From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022105.outbound.protection.outlook.com [52.101.66.105]) by lore.virtuozzo.com (Postfix) with ESMTPS id B5CC48017D for ; Mon, 26 Oct 2026 11:47:01 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=CH4i+2whr6J8CYuCnROl10pxFjS2fkMIzykBpYCotlSD+BuHOj4Ex6N35Dts3IDjnVg/Kuo68X4+yW1IChNU4kTZUzxGv7vXpNsB0gMWgxukmz+KdmF8smSWBekyclfkYBBTLxWooFL5Y8zL1X1OSq0U8V28MTc8+zDFvbZqaBWSWMIvO7V32LsvBqcsBBYa5H6Ik7a0YkEfCBSIP2XLBQdkTvpe3x6sERVW0D/3UmCvefL3SaAnojyV7ZzCU6fwrzU7s7dVYACWDDA0QkoP5q6urmOYxINDBAKS+6/aQh848keh1g9bH7uVjtcPhKIhNHy6xk4eWX/oz4mkRzfRqA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=VtuaBzftTdPiZpz84EtNbhxd98P33PYquRb4gSt7LoU=; b=aWXqBwjCWRW2IsDSZUuvKEwX2cT0xTO7Dl1r7jXmlewedCXeFFCK1o8rpvGyZw7kKaFR8Pe/j2ZHRIjV52BfQfuoOJBYfpTwK8XVvagmr/lPzcm7H91Kbf+Bxkt/6BmgP//I7egsk49gbwTH210ySc30VBaKiCrobNfrXWe+6wX6Wj2cQEEozyKN4YGHGQqiI5b8S2a3S++pRFPWDj/XHZbD1lGHO6UB+2C9OaCUF4Y4wocPL5rQhHDkM0NZL5H6LEXMFxzH4mzbVFbCJgQ/QZRX0A/WSNgKMo6FyTIeOWkuYe+c2Xmmn3SGUSgi7jFydzAGNEkNZtzJrD+wpuMuQQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 2a00:1450:4864:20::331) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=openvz.org; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=openvz.org; dkim=pass (signature was verified) header.d=openvz.org; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VtuaBzftTdPiZpz84EtNbhxd98P33PYquRb4gSt7LoU=; b=MbypSXZ/Kz0XfFIomTS9ZrIJY+tl+V6lcRAEgFhR2HrbL8cIzi4ClwdtDPM6JH5Kf1/GvwkBvuatqXtPGqK3KSHeHSd+fI/pMlYPjLTo1HoWGfJn6eWVopbABF9KQNj8vZZovrv2kQ+m+srBnZZxXLaSIOMGsiPBTlg+o6PloTE= Received: from MM0P280CA0006.SWEP280.PROD.OUTLOOK.COM (2603:10a6:190:a::12) by DB9PR08MB11380.eurprd08.prod.outlook.com (2603:10a6:10:60b::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 11:46:54 +0000 Received: from CPH1EPF00000526.eurprd05.prod.outlook.com (2603:10a6:190:a:cafe::2f) by MM0P280CA0006.outlook.office365.com (2603:10a6:190:a::12) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 11:46:54 +0000 Authentication-Results: spf=pass (sender IP is 2a00:1450:4864:20::331) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org; Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::331 as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::331; helo=mail-wm1-x331.google.com; pr=C Received: from mail-wm1-x331.google.com (2a00:1450:4864:20::331) by CPH1EPF00000526.mail.protection.outlook.com (2603:10a6:388::1e9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 11:46:53 +0000 Received: by mail-wm1-x331.google.com with SMTP id 5b1f17b1804b1-4a1fbd52ab6so18241115e9.0 for ; Mon, 26 Oct 2026 04:46:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793015212; x=1793620012; darn=virtuozzo.com; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=VtuaBzftTdPiZpz84EtNbhxd98P33PYquRb4gSt7LoU=; b=Z9147PVP4A4G/kP3fNVzLEtTww2DaYO2axujJqon7xPJstE07fI64b+0oDcXYm5DdL F21qPrxu/wYqmcADtVaveAns2qJChS3HPBVdzwsUBAZGb8VSx1QIAmb2/3VgftMeuVPc sfA4xe5cX105WzJkmvrG2o+oQokr2ZzQd3PDwkPyA9jCSgoBwLeKZ4msFmvcI59bmqUQ cDX/N2stdvMMy/Nw8s6+i2KyYECLkCQC1BdLWTY7qygL1+cq6UCMEqPB9D13UkeLWNvr ZQrnyd6j0AHU600uI9P9ZZLo3QP9mmeP4/IIVz0x8xkwAZgM5xrHs/tFDaI6QDE1W9pl hoAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793015212; x=1793620012; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=VtuaBzftTdPiZpz84EtNbhxd98P33PYquRb4gSt7LoU=; b=gtkXfCLZWbCC09Km9G+4L11A3S4hmoBTEYznjsfQkDxP8CTR8ElDvLmcHQhCbCNbFp hMODKN1UaYo6ZdSruRt/OFFXeHunsWAJOkanksQoWpNOisVkgHPSKYAkCH95vRRopPzu iFnayMDTgkS/JXCwGsC555JF9jqE6E4nnN6SLf2mobRdKlYtdyEhFpKP8Yfonq5eL8p4 2aJGj2rPfTz99z0ztYCjk0+6MmTL6e1OJzc3zapgbl1coeut6tZstH2zw01Lzt3bDT3v LA8SHnKwlFQNEyGJXbcVPez1Az3+bqb+Cc7AkQll7sIszbOP5pRoRMf7g9/WlcQ5pMc7 1kLg== X-Gm-Message-State: AFq9FYIG9o99K2KAh+3WAP/WzsCg8UNb0iyzrPQ8b519+WcYdT6ML+D7 SVq4xJOxGC7RdtwMzqW1i20XfIfgiHzy+CS0k7QCOBcCMbISDvKQxIOsKtF8C4RieQAKBQ== X-Gm-Gg: AYBFou0Da78/a23xTqH0HY9UEsSIVEe9ALCUmpDepgofwdwRdqVTKc5AgK3sw82DV5/ 6cS9CStLfEj3iGR2A4+Ly1dstG7RbOngkEs5UzPJ4cp/oZwF4WTpwUA1b8V3PqOyB2zy6rxmUow KRxvfU3Ooh1mLZHuV9GO0ipVVt9HuLWmiiY/9aJjIumqFuQsOlPhjrSs1cjJ7UlWidz6MwrBmLD NFYJc8XyDOtnB2xXnkn/JFU+kOjlx9S4g/x38wlUwWAf4BxzIwfJDKJcFUgtHJB45BizebklpXT pVeiblnS804VGsh3Qshim6GBcnzpRg5An+dFln/aEbG0YArFDZ9uzFcaupnNHvmRaVhKZ7M9xQU iLGKF6Y//BUaIHulnohz5S857ABLwFmQxSezDJa9b06tzePYdF+vrSNuG3ip4AkZ0VGNT7FhXKX Qxr6fR4L7T0AOJo+TVj6NR4M+YyfIJkv5fzc6eNNUCgcOx4/shypjA18i4WGqyV6lOJ5OActpCo 8dMZN2UwfJVCBaw/xEZPAT3xkP/rEMEQrBhd+M+yN1kcnztRt4= X-Received: by 2002:a05:600c:630c:b0:4a1:f9e6:f418 with SMTP id 5b1f17b1804b1-4a35acc216amr121622985e9.34.1793015212458; Mon, 26 Oct 2026 04:46:52 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:1a6:7f7f:f573:ba9e]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a35a04ad39sm504302105e9.1.2026.10.26.04.46.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 Oct 2026 04:46:51 -0700 (PDT) From: "Denis V. Lunev" To: andrey.drobyshev@virtuozzo.com Cc: svt-core@virtuozzo.com, den@openvz.org Subject: [PATCH hci-8.1 3/3] hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code #VSTOR-151666 Date: Mon, 26 Oct 2026 12:46:45 +0100 Message-ID: <20261026114645.187003-4-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261026114645.187003-1-den@openvz.org> References: <20261026114645.187003-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CPH1EPF00000526:EE_|DB9PR08MB11380:EE_ X-MS-Office365-Filtering-Correlation-Id: 729f2073-207f-4deb-c9c5-08df3356d45d X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 0 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|43022699015|61400799027|6059299003|9140799003|48200799018|376014|82310400026|5023799004|56012099006|5063699009|261009223027099003|261022105027099003|261021121427099003|10067099003|261022075727099003|22082099003|16102099003|55112099003|18002099003|6133799003|13003099007|3023799007; X-Microsoft-Antispam-Message-Info: ZdcoMmkgbIsu30BVXd/cVJjprMl7S1HIfrAoQuk9olbA7vTw+hg9MCCLqaqq+gIJqeKWh4p7So46BCQX2r3sI1O8QhYxuRkD7/+CmJBfuoRvqnxa1kt5SB2irhtStz3orC9QoxElsS0hOanaW6rgL2ItYaC5vRoV7gvp721IMiNHZPBAn7HxwyOsHgdp1TEpzY1nu2lkt76O6M5YkKfPFZjEiIyGZYjFJLtuA9l0PYlPRuRSZO9mXBefAICCIEm16YdmaXwLAReJExNvyil2mT7SklSUZqu0jADsyIK++ER+zsH+ZI6z3cxw6WG46gdxiZEwHI/jKHeP/87QJ1c7MO5Kyn4iF6I/RNF5qsCupIl2VlaOEuSfnmStxuvAyYED5fRdus33V5ePj+Jq506KoXLd1FQ2VDKLMBq9Wuuhj2TkJc+eeY1RIXoeQN19ZOm2MzXNWM5BUt1eQysErem7FG8PQaWPRkeqnzWD87L6UzJUljRT0yxaaQwjbwzIDMyZQknNCHy40t3Ofyd3za07Yr2Ej5NGlocNb19uFJUJY4hY2hW+zvg0dax6XmEtWvSwRH2OuURUA6Qh6NhBN/DiGgYK/CM4fUBOaWyGbbX0BxgYIN/HEab9gbpKMjOjnLJPu11FkvM4TaZ42bwg5RkVPRW0D3CYBpv+Zuk8WxgCRDaxWkN+vqDfJnyxMpo4sU0jQRTjyKFwTOkr9gBj0KkM7DjLhVBTzatrSbjgkBFX7/7Hei/wsdw4P0jTTAeL/sfVSKZYBIbQ6vOxPUSqqOb+b6P2QRFIwEjs4ipxEw8rJxT+bdb9VuvKGoAHpUGpBfsqC5X+2jlFlSnVSeQOQCYd+j0Td2WIr5X2mC6dR/Uunyn5t3JiYEbnOSP4iKz7rIZOVRR1THHVngGdvt+oLL/yJwlObk4irt3ptTzCe1EP+LMzElMM/DVqUq7gI0H1Zw1O X-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::331;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wm1-x331.google.com;PTR:mail-wm1-x331.google.com;CAT:NONE;SFS:(13230040)(43022699015)(61400799027)(6059299003)(9140799003)(48200799018)(376014)(82310400026)(5023799004)(56012099006)(5063699009)(261009223027099003)(261022105027099003)(261021121427099003)(10067099003)(261022075727099003)(22082099003)(16102099003)(55112099003)(18002099003)(6133799003)(13003099007)(3023799007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: bZcqvPxycRGGT9gA+tLNGXhTUG9ntle0/Iu5hx10xjO0QBgG7Avqc/pQ2jMU8nkq81w/cpBJskRAKqXPyvxbuRCtjh1rOpTS2UOh/SD6cjOijmAgyDzIN5hVzbFdJbQdRO6NpWiF1YMv5tIcairXNmoaZyNogE6iJeF8Ebdd3u5XoVyHHJFFpFHOBCah2zs4ZzuM4OvgWEroggAdly62oLt6GhJPdLGRAEP1j+CpIRwANcoRSQ8qwRk9ZzRbn5NHbWvpgGPLl1IygyX9N8zI8uPursc/1mHgnYtmAHAUu4zNmSIAZ3Lqtzo968wensVbbPJRvgEJ96d67v+DmZg+O9qMLGhUNzXPV0w4+Wx39ZS/NUUz+km+iZhsf74iKjkjSmWEaL6yjpPgec6sWzLS4BSni6iG/X6tciiFKP+OKmfp5DbupQXbgw9WvxoIfPvI X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 11:46:53.2182 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 729f2073-207f-4deb-c9c5-08df3356d45d X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: CPH1EPF00000526.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB11380 List-Id: From: Thomas Huth The XHCI controller's USB port and bus callbacks -- xhci_complete(), xhci_wakeup_endpoint(), xhci_attach(), xhci_detach(), and xhci_wakeup() -- can be invoked from outside any MMIO handler context. The device's mem_reentrancy_guard is therefore not engaged during this processing. A malicious guest can exploit this gap via MSI-X self-targeting: it programs the MSI-X vector's message address to point at the XHCI doorbell register array (both reside in the same BAR0 MemoryRegion). When any of these callbacks posts an event via xhci_event() -> xhci_intr_raise(), the resulting msix_notify() -> pci_msi_trigger() issues an address_space_stl_le() that writes doorbell 0, triggering xhci_process_commands() reentrantly. A CR_DISABLE_SLOT command planted on the command ring then frees XHCITransfer/XHCIEPContext objects that the outer call stack still references, causing a heap use-after-free. Fix this by setting engaged_in_io on the device's mem_reentrancy_guard around the processing in all five callbacks. The guard is set conditionally (only when not already engaged) because these callbacks may also be reached from within a guarded MMIO context. xhci_child_detach() is intentionally left unguarded: it only calls xhci_detach_slot() which passes report=0 to xhci_ep_nuke_xfers(), suppressing event generation, so it never reaches xhci_event(). Note: This is similar to the fixes done for CVE-2026-17588, see f91b0544fe ("Set reentrancy guard in timer functions"). CVE: CVE-2026-111819 Message-ID: <20261020114031.687929-1-thuth@redhat.com> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4625 Reported-by: Ken Hsu, Royce Lu, and Bo Qu of Palo Alto Networks Buglink: https://gitlab.com/qemu-project/qemu/-/work_items/4642 Reported-by: Nikhil Agrawal Signed-off-by: Thomas Huth (cherry picked from commit cfa70f3a82f581ad758586ecf408fe7f3602850f) --- hw/usb/hcd-xhci.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index 80d2687fb19..8017ddcebd0 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -3243,49 +3243,73 @@ static const MemoryRegionOps xhci_doorbell_ops = { .endianness = DEVICE_LITTLE_ENDIAN, }; +static bool xhci_engage_reentrancy_guard(XHCIState *xhci) +{ + bool prev_engaged = xhci->parent.mem_reentrancy_guard.engaged_in_io; + + xhci->parent.mem_reentrancy_guard.engaged_in_io = true; + return prev_engaged; +} + +static void xhci_restore_reentrancy_guard(XHCIState *xhci, bool engaged) +{ + xhci->parent.mem_reentrancy_guard.engaged_in_io = engaged; +} + static void xhci_attach(USBPort *usbport) { XHCIState *xhci = usbport->opaque; XHCIPort *port = xhci_lookup_port(xhci, usbport); + bool prev_engaged = xhci_engage_reentrancy_guard(xhci); xhci_port_update(port, 0); + xhci_restore_reentrancy_guard(xhci, prev_engaged); } static void xhci_detach(USBPort *usbport) { XHCIState *xhci = usbport->opaque; XHCIPort *port = xhci_lookup_port(xhci, usbport); + bool prev_engaged = xhci_engage_reentrancy_guard(xhci); xhci_detach_slot(xhci, usbport); xhci_port_update(port, 1); + xhci_restore_reentrancy_guard(xhci, prev_engaged); } static void xhci_wakeup(USBPort *usbport) { XHCIState *xhci = usbport->opaque; XHCIPort *port = xhci_lookup_port(xhci, usbport); + bool prev_engaged; assert(port); if (get_field(port->portsc, PORTSC_PLS) != PLS_U3) { return; } + prev_engaged = xhci_engage_reentrancy_guard(xhci); set_field(&port->portsc, PLS_RESUME, PORTSC_PLS); xhci_port_notify(port, PORTSC_PLC); + xhci_restore_reentrancy_guard(xhci, prev_engaged); } static void xhci_complete(USBPort *port, USBPacket *packet) { XHCITransfer *xfer = container_of(packet, XHCITransfer, packet); + XHCIState *xhci = xfer->epctx->xhci; + bool prev_engaged; if (packet->status == USB_RET_REMOVE_FROM_QUEUE) { xhci_ep_nuke_one_xfer(xfer, 0); return; } + prev_engaged = xhci_engage_reentrancy_guard(xhci); xhci_try_complete_packet(xfer); xhci_kick_epctx(xfer->epctx, xfer->streamid); if (xfer->complete) { xhci_ep_free_xfer(xfer); } + xhci_restore_reentrancy_guard(xhci, prev_engaged); } static void xhci_child_detach(USBPort *uport, USBDevice *child) @@ -3337,6 +3361,7 @@ static void xhci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep, { XHCIState *xhci = container_of(bus, XHCIState, bus); int slotid; + bool prev_engaged; DPRINTF("%s\n", __func__); slotid = ep->dev->addr; @@ -3345,7 +3370,9 @@ static void xhci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep, DPRINTF("%s: oops, no slot for dev %d\n", __func__, ep->dev->addr); return; } + prev_engaged = xhci_engage_reentrancy_guard(xhci); xhci_kick_ep(xhci, slotid, xhci_find_epid(ep), stream); + xhci_restore_reentrancy_guard(xhci, prev_engaged); } static USBBusOps xhci_bus_ops = { -- 2.53.0