From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022138.outbound.protection.outlook.com [52.101.66.138]) by lore.virtuozzo.com (Postfix) with ESMTPS id 3E85080474 for ; Mon, 26 Oct 2026 11:47:05 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=rv/EeejLp3rfgv0OAA7B2x5xStp1lSSokX1EgaxkUBXBSSvVEwjL0RbVOk9sRXHzXvKcUdYcWPSSHl2SYYtUvqBdp+1F7krGsPC+2ZB6oBICm+OJOtO3yO/cgrigl5CMzmzE+eM1Eekp21tmq1pfH4dk4dyCW7kKzwF57OQ2jfaKUf+qRyHHHw/fu6+Goyr3UIWNAHE1H9boiLR/pEAIkCFN9Vx48JGWPSsZChdR008mAvh/k9naN3gC0mgQQdlDsoUbKpPaj81V21D122Y8xW9ZH0Bamxm+gjmgvKkeOyIaoq7ggZCdxqzu/+dc/f7fS2rK39zPA0Nx9EfwE2IHTA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=xfOJBUETLlva/NhLy6b6/mj4qrAs+YPLlMMIMath4es=; b=rx1rG0BBSFe396CGcT5stSBZl1zjNFgFxKD99xfzoq5swdnsrqQdG9SwepRUv23KLUCWrR6dQlTnr53b+O+/PUiwmYyv1gFEE3IMHjVtL4sybtbTZIgdnNIMmQZShJRCI6gB7VpGLqZ97VTO18VeiULMreJCgfRfVWU8woQVSZpceg0Q7SgdgKrzp0DmG7H/n/W1ubgsZvSnkESdeR35BT+5bMCoLWjDCNNEiqqm8tTM5RY6eQIN+kkHrTDFD54MFupTIwHux4K/hN6VJwE7uF6CdGYjgaCfqrJ89suuxACRQuIKn99G78em9kT4SuvhxWMpxn59Z/dFVNtFocQ6rA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 2a00:1450:4864:20::334) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=openvz.org; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=openvz.org; dkim=pass (signature was verified) header.d=openvz.org; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xfOJBUETLlva/NhLy6b6/mj4qrAs+YPLlMMIMath4es=; b=Okb5VB//yitM0lWYbD7SFsYx2aNMknIqBKrRjnDNlox2pC0hW8nc9inuFDOAgSl84dtemGiI9jEJ6LnGRXDzLXrbbMvG+srTlLUk59CgngG5ER6+Oau645BGpkv02Cal+INmgJ1ihZ33vNMRX4GlDu1aFin1GXu8YN5zxH/8Qag= Received: from AS9PR04CA0055.eurprd04.prod.outlook.com (2603:10a6:20b:46a::11) by VI0PR08MB10584.eurprd08.prod.outlook.com (2603:10a6:800:1b8::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 11:46:51 +0000 Received: from AM1PEPF000C1AD9.eurprd02.prod.outlook.com (2603:10a6:20b:46a:cafe::24) by AS9PR04CA0055.outlook.office365.com (2603:10a6:20b:46a::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 11:46:51 +0000 Authentication-Results: spf=pass (sender IP is 2a00:1450:4864:20::334) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org; Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::334 as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::334; helo=mail-wm1-x334.google.com; pr=C Received: from mail-wm1-x334.google.com (2a00:1450:4864:20::334) by AM1PEPF000C1AD9.mail.protection.outlook.com (2603:10a6:20f:fff8::258) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 11:46:50 +0000 Received: by mail-wm1-x334.google.com with SMTP id 5b1f17b1804b1-4a20a37703bso22017745e9.1 for ; Mon, 26 Oct 2026 04:46:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793015210; x=1793620010; darn=virtuozzo.com; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=xfOJBUETLlva/NhLy6b6/mj4qrAs+YPLlMMIMath4es=; b=sgjsVxFhsDNq3T4d+7hypD5r/1FrCBAtABtR5A8oiL9XNpprr7Rda05sklNhTQtiRj D8wxhZXMViQ8CYjKFpsaXICe8TPhuvU3Sa9djABfvfEaCNCSatcQmvyxxCGxzEKgN3BG 5YkUMq6tNBwTJaVK84Ro8L20+zFtEbTjG5v7HfPmXwIqFcKl1RMjA7tMumI40jANO/rL LJ+5h5G5KzCW0sR4cQJuGZ23CCHC9imteh8Lz0pY14vzJzFLC4qnU+1sjKJo6R/2m2QF 6Pm4Oq3hI6GAAK4l4FQPYVrEy5JEexCLhyN+JDp/jLfhhD1SVGla6PZo7InDy+aY0EHQ 2aSw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793015210; x=1793620010; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xfOJBUETLlva/NhLy6b6/mj4qrAs+YPLlMMIMath4es=; b=Q7/v09aUxJNcvAsmROaltUZoe+UX/Eiej1kRaZp9NAMjllFHIKwToMmkx0zDJpo+v5 SDyXPkprlgu3GmSj/EpYn/sVIkH92TifiMP3F4hSbEAb60QvDvjdKKblrbpT4BUofYsl cYnGf3Cz14sAkR/VaCCbkPvQYcenT069ww+iggZhPyVfzcexkpGzkPS6W0vWrJM3g19N blmifqj1bR4Jl0bvrHcqZNVfZA7KNjhTZrCm+kAAvUKBN7wpgBPuy+8vu1Y9lYJG0oD/ Jy/Okc72Ru80rUnlGx7WSz/lmsUnbVH6dASqXh/4qNdonKbPZ943H5PFxGdtghx3tVRS KCSw== X-Gm-Message-State: AFq9FYI68NFcVV57znBX9ejL/7kdfwid1nOg8rgeEJ8H1a0LBqn26N5+ 9Qo0NZEcum0gLnGsswa/sXxQNEZpC07MiM+asEz22hq364J/rM0NBNBkHPha0y0ZYEvWGQ== X-Gm-Gg: AYBFou3X/aLsGuWBOVGnhF5v3QW8wsxQa3UOVPs3UkAdjQYtrWCbJdmaGIajJnWFvwP KnL22J+njA4+amW2ptN6HAmxb5bTzPSddrDAlnRFgTnjDvliOvbnD4/9VHJ10NRqvMlbRMwV4Xh Vnqao4P9tfJexmPPL/GLr3enLjjBkhJ1ewRupwqDxgIHE4bUI+PNX7LrgfnFy4icAzhaZPJ56bj zlPaNsUV+wVpRscfjBT0C1A0hqEdHhEc34PiBR94dHWN7KMlvCdLf0Dn2Djbw1oYzSh3iaga+fv S28XTPE4rWCZqMC2lRVDLYkD89dDnqKcB/QzD/ogc6HrdPGOzN+acsQX8EZKPX2Al8uc3pXPkJS pfHWuakFskzf2i3Nx+bWq0hXv9vgZEYfQK093MeTOGrdun8MZT/BgiV85Xtn3jLUwztDv0Pnp8x Nrd2ri7suS/slYs0syExSGFtWlcPNyxrJLlcBGQKpTVP9QjvZ7FuAkiSGyOTHWq4Qt0WyFXD/Js LTn3b/9kF4cgcWHrAVNBM5MQO/jItxv0RXQiuNW/UguXoDPIMM= X-Received: by 2002:a05:600c:a03:b0:4a1:d992:9476 with SMTP id 5b1f17b1804b1-4a35ac9f30dmr120407085e9.23.1793015208445; Mon, 26 Oct 2026 04:46:48 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:1a6:7f7f:f573:ba9e]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a35a04ad39sm504302105e9.1.2026.10.26.04.46.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 Oct 2026 04:46:47 -0700 (PDT) From: "Denis V. Lunev" To: andrey.drobyshev@virtuozzo.com Cc: svt-core@virtuozzo.com, den@openvz.org Subject: [PATCH hci-8.1 0/3] hw/usb/hcd-xhci: fix guest-triggerable use-after-free (CVE-2026-17588, CVE-2026-111819) #VSTOR-151666 Date: Mon, 26 Oct 2026 12:46:42 +0100 Message-ID: <20261026114645.187003-1-den@openvz.org> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM1PEPF000C1AD9:EE_|VI0PR08MB10584:EE_ X-MS-Office365-Filtering-Correlation-Id: e4ef7a24-0cc1-476f-0934-08df3356d28e X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 0 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|48200799018|6059299003|376014|61400799027|9140799003|43022699015|82310400026|5063699009|56012099006|261009223027099003|261022105027099003|261022075727099003|261021121427099003|261021123027099003|10067099003|55112099003|16102099003|18002099003|6133799003; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?81Dj/T7L22EiCiWTEzr20dddCzN224mOzqNNRl/ex67kKdE19gG2lFQRVp/i?= =?us-ascii?Q?HXg5/CRw0XPx5kTZqCQeBhZKImT8cDLavC87ztlz1jO54emLaAFEnuWgjktp?= =?us-ascii?Q?cAKBSzkyyWqZh8Mab2JWAoN8L1zcgyYEVMqvzytagIVonoBh7cmIuP5X/GKo?= =?us-ascii?Q?EhCISx3L4SV3PTdV9Zwiqs8ymvB5QbK3pqMLld/s2qUpqiO7s2hlr8IKacYj?= =?us-ascii?Q?lPviZP6B7AievnaJPecp8K4L5bLouGZuqak2NA6bTVoHyWHEHtXji42dzWFO?= =?us-ascii?Q?HtVq+O6xy3ihLcFFOR1QUswm3QylJWp4PMQ0IBgR4Opce9lHRGSY3kxVJFvc?= =?us-ascii?Q?J0kb2iUn4MF9fhFuzWe2JJSV+kkz0OueXqnSHaHBtKPA3Qa1xH7Gvp0etSOa?= =?us-ascii?Q?P/MtDnyOyUsAvRhKb0k1I+hT7T3EvLjfzWoHN8Xt5JBa4D8+f1jNKwLnSBoM?= =?us-ascii?Q?VQD+hMdGLvMR+16aPArKpDigcxqNLqFjAyCI/pSYnVcdnTReQmZdA2sjINZg?= =?us-ascii?Q?kB0FE8C0VCci3w4F61+Sk90S6UOen+ZcT+4ZixL33RIZdxW/ISmKL0E1TQj3?= =?us-ascii?Q?rgCjKhR10Uk1AvYtSHpYNnYRnsoIDbQpk6hkCKsUKPzus0Ra1d4My5Qfw/4c?= =?us-ascii?Q?9LBAeUvf/ZItqIwNoXRHdo4rLwbAN2GC4H96nrnk8SnlN3v0M9sNd395YTVT?= =?us-ascii?Q?eaDrv63pr7MyGcTRoQowh9t0eS0/Sx/Epk22VmLn9W0AVvCFN9VNy/emhe9V?= =?us-ascii?Q?ncgrBQqprYbUAdP9lCq0KVIAe7yUOh0r5Ak0Uo4rrUXQdMIoImNt3MmMOB0z?= =?us-ascii?Q?xE2ybrthUu4N70G27iLTl2P4iWGuPIT4j0WTDyPLw9NU/i8w+PN8ykzHlAUo?= =?us-ascii?Q?NSJNbZ492PP1/2rmNAoCMVuh+b9D9YnVqmHG/vEQ7lvUFiQIOyRdHHiFdrgt?= =?us-ascii?Q?PhDZVLzMG6BedI1ZAQzENw=3D=3D?= X-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::334;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wm1-x334.google.com;PTR:mail-wm1-x334.google.com;CAT:NONE;SFS:(13230040)(48200799018)(6059299003)(376014)(61400799027)(9140799003)(43022699015)(82310400026)(5063699009)(56012099006)(261009223027099003)(261022105027099003)(261022075727099003)(261021121427099003)(261021123027099003)(10067099003)(55112099003)(16102099003)(18002099003)(6133799003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: iLkvbqCogyB9maDR7HPBXGYPXA5UXnqivKQ0cuYDS40NVTipodiGBrRhW15PiFOINWmAUUKjOuffq5NbNreXKV5sFB9kVTPlD2pRXl0tusn5JoYHVQsLiZzkBTLf3CfleHyyobaTFTd6Ac4ubnkJqmm6fo+zoO2gSWLZ8AOrWmcVJkD1E/+NYdgCNzcqVgO+bIHZlaMHySJToDlkHSB/eLtehliMz7yd47dwewFGFa9Ik4CzMCZdYc7UG/lOCP5BDsPs/+gVXHvOuYFwd9SEx5FkhkBdI+KWPhBGq3Oh6wYwwQXkVd3Bt2wSMGIJe8qkAWsIXnrScRtxT3mKaX5EwjiexwcWqlGhazACJ1TGzvmc74+gUebzxbBoHo75chXiP6FZ3uoRd3yE9r8btLMdR3Qdh93zkCIqdKvME7W2vt1B1IZwPGVXVneXxwLqqS15 X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 11:46:50.2478 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e4ef7a24-0cc1-476f-0934-08df3356d28e X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AM1PEPF000C1AD9.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR08MB10584 List-Id: A guest can crash QEMU through the emulated xHCI controller by pointing the event ring, or an MSI-X vector, at the controller's own doorbell register. An event posted outside MMIO context, such as a USB transfer completion from the main loop, is then written by DMA into doorbell 0 and runs the command ring re-entrantly. A Disable Slot command planted there frees the transfer and endpoint the caller still holds. VSTOR-151666 is this crash on a production node: qemu-kvm SIGSEGV in xhci_ep_free_xfer() <- xhci_complete() <- usb_msd_command_complete(). In the core, intr[0].er_start equals BAR0 + 0x2000, which is doorbell 0, and most crashes of that VM follow the "Blocked re-entrant IO on MemoryRegion: doorbell at addr: 0x0" warning by a second or two. Upstream fixed it with these three commits from Thomas Huth: f91b0544fe engage the re-entrancy guard in the xHCI timer callbacks (CVE-2026-17588) 89e653b773 restrict xHCI DMA writes to RAM, so events cannot reach MMIO at all cfa70f3a82 engage the guard in xhci_complete() and the other port callbacks (CVE-2026-111819); this is the path that crashed All three cherry-pick cleanly onto hci-dev with no changes. The only local edit is the #VSTOR-151666 tag in the subjects. Upstream has no test for either CVE. hw/usb/hcd-xhci.c builds, and the existing usb-hcd-xhci-test qtest passes. The attack itself has not been reproduced. The same series is needed on hci-8.0, hci-7.4 and hci-7.3 and will be sent separately. Signed-off-by: Denis V. Lunev Thomas Huth (3): hw/usb/hcd-xhci: Set reentrancy guard in timer functions (CVE-2026-17588) #VSTOR-151666 hw/usb/hcd-xhci: Limit DMA transfers to plain memory #VSTOR-151666 hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code #VSTOR-151666 hw/usb/hcd-xhci.c | 52 ++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 47 insertions(+), 5 deletions(-) base-commit: f3c1d9ef263edfab8d2a273078493bb766dcf8f8 -- 2.53.0