From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazon11021140.outbound.protection.outlook.com [52.101.65.140]) by lore.virtuozzo.com (Postfix) with ESMTPS id 4F0348017D for ; Mon, 26 Oct 2026 11:46:52 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=q3tl3w/ndK3w8WKzBa1wQQPIrv6h8RK6v26qqwrBapcngmc7QQfpQtvTXqKjrBszO7FwrXMvX9Lk1CuDX203ppLcZNxQ/1QfD+yAkbfa2uwOzEMlHMksgVJZo45TRhJhuhW3C0D2bTnUMd9Sh7z1J6P4E/CQqn8oYRBWvntKXwWdy2lZdtM9ERkhFsgh4FRUaCFbE4xigMKaMcf36nJiqStvdxgTYns/gLPGXD0BA64yCKAyKQnvP0SgoBV+hZtUfN6WLengT1Os8o1sGwazPlxXmL1B/m+2TjRAHXAn5G1CHY1KBzXVPMoILH0HjY5tDqN8uIg5YRgUbKBAVMORdg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=c6ZTssFH/PU4PqI0gLl2l7YxO1oWYsART1zA677nF/M=; b=vy74Azpr9Lsw8KCN6HJvSYdGqbGmlQOIqkb9Ozjgrxu9ForgCFrD9aaxGEPEffWD95eNR3EvakWWhHrtdt/1jIrT/+n9wcMMQ65YnjIXI4Ey509VrEvAMixN/yEdZhHc42iJXhexfiUU/FKqEa2LQdSeDEUvSJhNlf6HHgKPCez9yeOmzhS0hp6/l8R4u0HM9IcCMV6JCP4/U8JKhneVRvjz8JxChdMDhH2ziRGjXdBqFA07WVwG3NhZf4u0HJRPxT/igxHz+NAbcxZtY8gtW++CvE1o976B4v8R33UMK98ubmTsKbCXGPliXc47+BhBWS+3qLYMaiCxa0LkOxcTKw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 2a00:1450:4864:20::32e) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=openvz.org; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=openvz.org; dkim=pass (signature was verified) header.d=openvz.org; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=c6ZTssFH/PU4PqI0gLl2l7YxO1oWYsART1zA677nF/M=; b=bBI78a3S/Y+bkqVW/Uht57QLLQSBSRlX3SXywtcLBq6vhYg2Gmucv+kAp3rQ0tWFa5R9ijfp4k3T/CMlKmH11PpKRlPnihTd3Jro3LdvUhQlqOej11aJFAd1CMIoq6c3ZHWBHuiDwsztIkJ1wWhGd5sm7dmGh8Q6QrsXJaLBbjA= Received: from AS9PR06CA0726.eurprd06.prod.outlook.com (2603:10a6:20b:487::8) by AS8PR08MB8444.eurprd08.prod.outlook.com (2603:10a6:20b:566::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 11:46:50 +0000 Received: from AM1PEPF000C1AD6.eurprd02.prod.outlook.com (2603:10a6:20b:487:cafe::31) by AS9PR06CA0726.outlook.office365.com (2603:10a6:20b:487::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 11:46:50 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 2a00:1450:4864:20::32e) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org; Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::32e as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::32e; helo=mail-wm1-x32e.google.com; pr=C Received: from mail-wm1-x32e.google.com (2a00:1450:4864:20::32e) by AM1PEPF000C1AD6.mail.protection.outlook.com (2603:10a6:20f:fff8::255) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 11:46:50 +0000 Received: by mail-wm1-x32e.google.com with SMTP id 5b1f17b1804b1-4a20bde60a0so24021285e9.3 for ; Mon, 26 Oct 2026 04:46:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793015209; x=1793620009; darn=virtuozzo.com; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=c6ZTssFH/PU4PqI0gLl2l7YxO1oWYsART1zA677nF/M=; b=iSM3kdPohk6OHw3KuUD+prraAXVdTRt3NKgKloLweJPRNc/PWn1DcEQPMJhWMjB/yk IXKGOYn1ZIapuzZBfYYJNwvyOV4l6WeD6ciqcDoTuYMNQaqLDGULkqMgC9OIKmh90Vg4 BxW4xlcJ3tqTjQpUzkUm8xwXCQ8fFRU+U2FSbD3Vm0PYXUBYXwzvTzKTsi2odboF5NJ5 smG3kcFgkn7fLPuHjVITuhsWs3BeyTMr6/i58QrnVa2Y3/A4+2aeSkCD57d1wnlcx02H 1NQ9LLeGdVGI7O8WJIuCuJCuR6E9lULc8cAOrVk4/ujcXn4PniWiVB6r16zVsRrZaV5K yV8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793015209; x=1793620009; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=c6ZTssFH/PU4PqI0gLl2l7YxO1oWYsART1zA677nF/M=; b=r1DeJKmBFWRYeZAfeEBc4DK48yBmHfUHv9K3IDxV1NUS4UIgPB1H4wtwwMv72lgmFb AcaHtSdZAJJ4Vc1P8FAC5lujfN7dgcRjdL33I9fqOlRS1AP+TPupFFn58+ohC8HnU4CZ Ncpm7PwrSyg7cGdmhXpaN68ESGZ7vtP4DPj5d9LlXOLcdZDv394Vu8XrnhCETKN5YjFU kuDdXCkBdH0Nr3UKWTwAO+ssZwzd0wnZGipDy0RbL1oyIhVkSO16nxkQMCxyh22htAjt iBF42qgbZ45YpxDufWp4l4hdtVfn18+g9foB1Sqd51e5Vl7iTTt4M9iLkixDlOhuOC9C 0kug== X-Gm-Message-State: AFq9FYJcib5mcNcOAO01cRpdArT4tHYmSHxJLeLVl7bvuioZS96YrUPK IDFmJUH+vTr8rZ6NttsLxSgK9lbIlvyQjv04meoE/stlGtq9vEWkSvgefzDgUK6snKnAfA== X-Gm-Gg: AYBFou2DknFTin6T0jo+DFLiRjsnd+rQhXcj2VearcHR1UANGPJ0ySJPAAk39R9CKqs snHc8vnnTNHdfHrDCgoKPIHq+zVKCqPG2gQinnTHvQ7Ez4YO5uSkIgziYsMROXVwAICCBeoPZmn QCnJQ6ZOEWpZ/o8lI9xRY7gDj2nQT2BHsZ7dz1clBNOCWN9VdSIs7znO1KqH0ASF9s4R0kugkyn ySYt+rvKv5QBcKIhFme6rZfoSdkMy1fAI5siqtsA6cBmde794oKz0XVRy2Wf+p64SCPqixmOzPY 8BzNsD9cfdsV9uNkZI+oyn1QCXUptHX7Y+vtI8vJNAc2GkHb6BECa1lIEuQpZPq/yqUnANTtEJ3 jl+JP9YWysjYLaRBHCgS+yrs5OXfhgMcII997/6GzTX+j3ifk8H1OLk4TKP0MR68A9stDoUdSkV S2lR6UxSUjW/XNcPBh2EirRyA14GKi7OwybuJNM/pGvMtqEOG05wJe3dVtlXweBwYWQeW429W0+ xASLdK0dBzKaDfyG5HxvUX6hxskHZl/IcrF5Nljy53veq4qF9Y= X-Received: by 2002:a05:600c:6289:b0:49e:7c8c:361d with SMTP id 5b1f17b1804b1-4a35ac9f52cmr114291175e9.22.1793015209513; Mon, 26 Oct 2026 04:46:49 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:1a6:7f7f:f573:ba9e]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a35a04ad39sm504302105e9.1.2026.10.26.04.46.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 Oct 2026 04:46:49 -0700 (PDT) From: "Denis V. Lunev" To: andrey.drobyshev@virtuozzo.com Cc: svt-core@virtuozzo.com, den@openvz.org Subject: [PATCH hci-8.1 1/3] hw/usb/hcd-xhci: Set reentrancy guard in timer functions (CVE-2026-17588) #VSTOR-151666 Date: Mon, 26 Oct 2026 12:46:43 +0100 Message-ID: <20261026114645.187003-2-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261026114645.187003-1-den@openvz.org> References: <20261026114645.187003-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM1PEPF000C1AD6:EE_|AS8PR08MB8444:EE_ X-MS-Office365-Filtering-Correlation-Id: caabcc46-75fb-4b7f-582b-08df3356d26f X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 0 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|704162011799003|43022699015|6059299003|61400799027|376014|48200799018|9140799003|82310400026|261021123027099003|56012099006|5063699009|261009223027099003|261022105027099003|261022075727099003|261021121427099003|55112099003|16102099003|18002099003|6133799003|22082099003|3023799007|10067099003; X-Microsoft-Antispam-Message-Info: QsDZNoBDfOmEm/axIx2vAzQNxA03AwHEyI7qUGrc6w3Rtfpx+0f1vsF+8pE1xvPO3M2JE27pGN77r44kqOtkmN6f7MrzH7RlrzEd3lh8MoIXziyq0V5QQqHDO2Xjk1RsGWNfdnRKwZPSmFQ66j0nHKLpM8+8F4P181h6xI0A+72iWk1We6VXCxMmG9B8ZWEVPHbKeLOwbsydzx7FZ0ivftEVnpIVPqGAgTLDS2Jk+Bvh3nKb1lEjKjRd/xsexeN6K251yDJ5/yPVaMpgP5daQ8KRySsG+xEowliAL7Nz5NTXjTjb8ao0e5kGTHJWVcFnkg/gSl68MiD+RfAKmhGdqpR+oHWZr1fNbj0IC/2YumDQ3zPy7VsZxcQ/4x8rLA0bGgrU9Ha8GtZ7dcfowgjZP+vzgX65YZC/n4x8E5/wYD1V3eCVV575cytgjD6DtZFMBuo87GX0Djm7b4Hxvz8Ox+PtUjrUG4rDq0y6Hb9ROJeY0/PBd0kg94OGkZPrOQhOpSk98TA8r9oZtQ786bJ62klAcEjQgaluxuAZYEC6RgZMDYiSufzoz0LiOZKnWJkGl3f61d5RM0NHBvd440DCSLdmEFXb+0ucWE7XkFM/vGYbLXyrwSYMu7yFQ4l5x0v+cHU1CvwIYlUXEz0j/wmEIAwsyebfw4NY8v3X+t6DorJCmI343xSRch8iqjprffvjeeFINmcPg1uHb52m3WhGyMk9bSxeJzwa9fD2roMbz7ctNBGVvSKjzH7GJ6jxCd0s07msEKITu7s58tW+ATg1I6kqvKWLBV8yjEt1fQi+i3KmiTz7YGPv3tu7Pdp+/RSY5275kAkG9JOxwy6NDzGITLFjQThCC5KfXngc4UgVlZkQtoQzjrs+ezYeiyYXLHr1l7owdz0KH+pWTiM1xO/mjJ1hXa8lcZbOpIttXH1TFNs= X-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::32e;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wm1-x32e.google.com;PTR:mail-wm1-x32e.google.com;CAT:NONE;SFS:(13230040)(704162011799003)(43022699015)(6059299003)(61400799027)(376014)(48200799018)(9140799003)(82310400026)(261021123027099003)(56012099006)(5063699009)(261009223027099003)(261022105027099003)(261022075727099003)(261021121427099003)(55112099003)(16102099003)(18002099003)(6133799003)(22082099003)(3023799007)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: sO5EItF8C4nuE2Pi63Dt5HdlIJQO7fMuZb2N7djGeTP9kqGb1g0pJ3e5HhYER7v7HY4Rkuqn3aZ/AV1JJZnIWI/LLRIgw3vm1fUvNS3sc4ojj7O3hMd2rRv181iwW5HRpbFRDJKA+Wd6SzlLKUVuIagV2DNbtGTglYQQO7nFkVZWs4GKzy1pAB7UqNJFpMMqglsB3jOmbCzUMoAhM7tra1zSS6nSopDloI7gQCaSjXm1oOTFuzKIPI9o8CJBrtUcaKyJtGmMyDHdrc6yX0KtPPE6DKHKkyUfjQVq/ESPXkBU0Or6XsS8sfeMe49R89ya2Rt/VLtgBz0XdzOUPF2IsUk/HCb5Qubmog3LSC6K77A6OEyn4isVWBg6ErnosCLl3aYQOCMTMySSsvYR0HeVbUALT8tCsz8v3k/Qbm3k28pKxGaejvbGOgbG4jPPRRpB X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 11:46:50.0315 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: caabcc46-75fb-4b7f-582b-08df3356d26f X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AM1PEPF000C1AD6.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB8444 List-Id: From: Thomas Huth The xHCI controller processes USB events from timer callbacks (xhci_mfwrap_timer and xhci_ep_kick_timer) outside of any MMIO handler context. The device's mem_reentrancy_guard is therefore not engaged during this processing. A malicious guest can exploit this by pointing the event ring base address (er_start) at the xHCI doorbell MMIO region. When xhci_write_event() performs a DMA write to deliver a transfer completion event, the write lands on doorbell register 0. If the written value is 0, this triggers xhci_process_commands() reentrantly. A CR_DISABLE_SLOT command prepared on the command ring then frees endpoint and transfer objects via xhci_disable_ep() / g_free() while the outer call stack still holds references to them, causing a heap use-after-free. Fix this by setting engaged_in_io on the device's mem_reentrancy_guard around the processing in these non-MMIO entry points. This mirrors the protection that EHCI, DWC2, and UHCI already have via qemu_bh_new_guarded(). With the guard active, the memory subsystem's automatic reentrancy check (system/memory.c) blocks DMA writes that would dispatch into the device's own MMIO handlers. CVE: CVE-2026-17588 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3926 Reported-by: XlabAI Team of Tencent Xuanwu Lab , Guannan Wang , Zhanpeng Liu , Jiashuo Liang <761232680@qq.com>, Guancheng Li Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4195 Reported By: Ken Hsu and Royce Lu of Palo Alto Networks Message-ID: <20260915112213.525283-1-thuth@redhat.com> Signed-off-by: Thomas Huth (cherry picked from commit f91b0544fe1f9fbabf582ccaaecc08877b7e19e1) --- hw/usb/hcd-xhci.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index 292c378bfc9..1d7c0363e95 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -458,9 +458,15 @@ static void xhci_mfwrap_timer(void *opaque) { XHCIState *xhci = opaque; XHCIEvent wrap = { ER_MFINDEX_WRAP, CC_SUCCESS }; + MemReentrancyGuard *guard = &xhci->parent.mem_reentrancy_guard; + + assert(!guard->engaged_in_io); + guard->engaged_in_io = true; xhci_event(xhci, &wrap, 0); xhci_mfwrap_update(xhci); + + guard->engaged_in_io = false; } static void xhci_die(XHCIState *xhci) @@ -1080,7 +1086,14 @@ static void xhci_set_ep_state(XHCIState *xhci, XHCIEPContext *epctx, static void xhci_ep_kick_timer(void *opaque) { XHCIEPContext *epctx = opaque; + MemReentrancyGuard *guard = &epctx->xhci->parent.mem_reentrancy_guard; + + assert(!guard->engaged_in_io); + guard->engaged_in_io = true; + xhci_kick_epctx(epctx, 0); + + guard->engaged_in_io = false; } static XHCIEPContext *xhci_alloc_epctx(XHCIState *xhci, -- 2.53.0