From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930745; cv=none; d=zohomail.com; s=zohoarc; b=dMl1yTggV8XdWnPAYEyKko0duBG1wP8DCO73Nit/XbE0adybioMigalRrYGzgwfzqCbc+MhkWQ/zA6US+hZQoAG7/dqLarJdAnF1RTLBVypPWe9B+AHii9gJJ8WH12M/w6TvfCFgGJI7cne0c5f+bpkTj746pxMlWq5WQtrrsXw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930745; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=6BnZeIw3V0BAAz5LtSf1O+FSYGZT0ypBXRhLo46zAyU=; b=kY3b3KG4mXRM+EU3xD59+/6F/ShBoJ/ejU7PFwX7VDVHNQ0OpxMErpe9Hd0v5iMQMPIs98Q9gyFDVBm6Sfqc6xuTU5Nzw+Dd3dqyB7GccJUx+1JHIYmvxD9H7P+gMnKxc2ul3auJFPZyrCd0g+iHy1/VG+gyjdJimEAT6/CmL00= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930745740851.3171700606296; Wed, 5 Aug 2026 04:52:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraA4-0004fZ-2y; Wed, 05 Aug 2026 07:51:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraA3-0004fO-IZ for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:51:51 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraA2-0006jR-06 for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:51:51 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-53-C2m8xCafNseqB0B0IWh9RA-1; Wed, 05 Aug 2026 07:51:30 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id C05731800846 for ; Wed, 5 Aug 2026 11:51:29 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id CB449180049F; Wed, 5 Aug 2026 11:51:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930709; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6BnZeIw3V0BAAz5LtSf1O+FSYGZT0ypBXRhLo46zAyU=; b=AA7suFxQhrL1U3AXCjDKAnez+M8x95w5AOvo2hdrlqpx6m3eXvj6aUbzkYpyzwHKz8uHU9 GXknv1uLVB++4uZ71DtJCJrKTfcdHYayguv0kNsjVl/elZ/iuljPqlueiSbISWSdvEmY45 SEJsxUR6e222AHRf7NLXz5NwGmlNP1M= X-MC-Unique: C2m8xCafNseqB0B0IWh9RA-1 X-Mimecast-MFC-AGG-ID: C2m8xCafNseqB0B0IWh9RA_1785930690 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:50:51 +0400 Subject: [PATCH 01/27] hw/usb/dev-smartcard-reader: validate interrupt transfer length MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-1-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=1547; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=9lcrDRYO8GrZ8aSFNQ+D47jbFfVunNetUQ8wln6BisI=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOrXPiAoimCuvz2mzvaadpKLgCCIkFsvz0Yz +JWrA2td82JAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjqwAKCRDa6OEJdZac 5VR+EAChAipm9j9Col+IY9bWcr4kfdLu8eT6gnqyrcSM2s+YHAmRWyvYIo9m9Yb7M/vK63qcAHC 3ZKlk+Mgp18/0uGqRIeS5FUiejhfl9iFCmfRB2Q/B9HlSgBPFVwBoeerKQOvkOhGhP908nGc/YM bMbc33bVpMs6ap4QYsA8xn7I0TzmTWQD5eMleFOJMf8UDRWhnSAnSEJlYgYe3hRyMkK85R+/tY+ eIe6Xxva+O3ggZeMderwbZ4kh1uviZYPS9Etzmi9n/TqUdYTBquZkWgtb7aS/8eJMUYQFsFs5ml tC6uktxpTQe2Qw4V9JpQTmH2Wl74kJDRhJU/vFo01bc9/Hp6PE0xC7j1Dbwn9DT2ARIcMm0Ku8C f+zZGHFYCZGn98m8wBhynU9RdBtW0yPeRu2tVW9LRQFGVygmKokVz0MGP87O8qhT77S6W4U5ebS KtfnS5p64nF1fKsFSlS/JPUmGR6+D3uZecP12+NEZ3iV0f5q+PrXeu8AM7M2Lyzowno+xOGLJTK onCQGsXyB3cbnUA4sHFKspuk/X7vvAolT54Dz4USCao/u4douC3zymbunvtrMjjOmSavYuxOMg6 H+DDeaOupjbkZEWHs9ZkIgCBUcXMT7dSziVK+w5X9XsS40zLZlWdW/yD0bI9wIDTXNfDDiadhCM es+1jRDrSVpCS/Q== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930747133158500 A guest can submit an interrupt IN transfer shorter than the 2-byte RDR_to_PC_NotifySlotChange message. usb_packet_copy() asserts that the packet has enough space, so a zero- or one-byte request triggers an assertion failure, crashing QEMU. Check the transfer length before copying and stall the endpoint when it is too short. The notification is preserved for a subsequent properly-sized transfer. Note: a later refactoring patch will switch to usb_packet_size(), but this patch open-code p->iov.size for consistency with the rest of the code. Fixes: CVE-2026-18609 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4128 Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 964c142d1066..bba97a2b19e6 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1122,6 +1122,10 @@ static void ccid_handle_data(USBDevice *dev, USBPack= et *p) break; case CCID_INT_IN_EP: if (s->notify_slot_change) { + if (p->iov.size < 2) { + p->status =3D USB_RET_STALL; + break; + } /* page 56, RDR_to_PC_NotifySlotChange */ buf[0] =3D CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange; buf[1] =3D s->bmSlotICCState; --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930745; cv=none; d=zohomail.com; s=zohoarc; b=WPbQy061ApnTwHQh27e16pbpsrFCHg7kivIK9zyKMfI7xA5VDdVLcNOLwRrcuKkqybfnfB5T40w2Bz3IkY0yBBNzuXZCOax6QeL2EtqIrL0wQO00VU5MqHtm+Jj6vjuQELBaqb/bHZoFNSiKUmleDLjTmC/0TTRKPHtO7dvSUHE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930745; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=32hlOoxGcOHc+TuHMabHzUMn9fLw1XdnOt4vvPs+mgc=; b=lID7tWEuYMJkjlnBfrlW9rgDmNubkhDSsPmvdgeaKJrQXE5kCbvi30ns2sQFVJeqmvbMRsGRzbsQThjRjJZ9RXBL5SlGGqIccXFLzVGQYv6pFtanNv9iUwqAp8TNY3wC1LxWfXkzaq9Gl4mpClkaPMZ6prhY/QwBuExD+qRmLfA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930745146395.4294260375216; Wed, 5 Aug 2026 04:52:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraA3-0004fN-CQ; Wed, 05 Aug 2026 07:51:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraA1-0004eo-1U for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:51:49 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wra9z-0006j9-FN for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:51:48 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-171-V5sGPF6xPRaSKfF0rpQNng-1; Wed, 05 Aug 2026 07:51:39 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6F06A1955F2D; Wed, 5 Aug 2026 11:51:38 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 98CE41956094; Wed, 5 Aug 2026 11:51:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930706; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=32hlOoxGcOHc+TuHMabHzUMn9fLw1XdnOt4vvPs+mgc=; b=GCNkcsFsmJJ2jwc12hamaJUYNw/vttT2kmc5s7ipiBOM36BB+XtD4rVY7xVwBFtZVvv4ng i9ypcq9Zy2WYxJheXLvCEKK2AzL2TPLMWFzyFXciEXnuYsXEYHh88N6Ig9+Sfehxr+w99b U7MVzqjXj9o4qEQA3/Np9tvsqAkQW1o= X-MC-Unique: V5sGPF6xPRaSKfF0rpQNng-1 X-Mimecast-MFC-AGG-ID: V5sGPF6xPRaSKfF0rpQNng_1785930698 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:50:52 +0400 Subject: [PATCH 02/27] hw/usb/dev-smartcard-reader: fix OOB read from pending bulk-in ring MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-2-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Warisjeet Singh X-Developer-Signature: v=1; a=openpgp-sha256; l=2224; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=g51vDtQSsX4MUh7GbI6yZjnSsCXHFNXZm1WmNeBdFT4=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOrxtC07a9LGJRB2lYReVpDllIPRMeRTA0fA 35TDWIk+EuJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjqwAKCRDa6OEJdZac 5fswD/oDXdxLo6gvuIhvFRnY7vqAO9IUzoMepLXE/cev6ziMkdp6J7fiz8i6v0nw6Dv2dHWGMlF MwUFE/E6xfuqnrS/ORtyjsqTCR6LlFbD9M0fujlK93XvG0PF+ynuE/ijl6vp2H2B14RUQuF6T8P 3vkdAoGB5ziwynjoYQeGE2Bz9u4fIjZ41Av+SJxBP7RjIgeke9rcjrW+r3gQf/42FHFNj6qpplH nBMqLLO+Qm9jvWuhq0yoUut/wCVb1AyzXcVYCdNrZ3mHTAaT2geBPuFDzZ6WEUzL5cd9Bi0UvQ5 ywrPgLYjRbrbBYW41UnIzOBmshJGVpK/61CJG//tm4OkUKVt2cZDk8IdHtnt14khqxRfx6kTX9b m1LiS6mSrX83hTgaaN7RYgWuz7tmxCHSdItxtamNIeetHehtnQpTnafMPDfArn5bi/Lil71j5S5 nOi3dVbFjPrsvtU2yqFxepDGbye77ebonOp9k9/zg0sq6J8oSh7XKpRCx3ONIqdBNC1QX8s1Wk2 dxyVoha1dHIIpvqQR81Q8HzWiEHox9JnuJdexHYGv+32hYqCVbmaIAo8Ko5AE9Tfwa4uqwSvqL9 uAwMhWgaWqYhTR8afECbPy2DKuUbYIPaOy8ubE+ThSKuTfHGur/yZqf1nsmyieEWcBcVdQ4k7FK Ud5RrdUoZovKeEA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930747139158500 ccid_bulk_in_get() decrements bulk_in_pending_num when a slot becomes active, but the slot is only truly free after ccid_bulk_in_release(). A guest can fill all 8 ring slots, partially read one (leaving pos non-zero), then send another command whose response reuses the active slot. The stale pos > new len makes the uint32_t subtraction in ccid_bulk_in_copy_to_guest() wrap, reading past data[]. Move the decrement to ccid_bulk_in_release() so the slot stays busy until then. Add an assert(pos <=3D len) before the subtraction. In practice, the device advertises bMaxCCIDBusySlots=3D1, so a conforming host never has more than one command in flight and the ring never fills. Fixes: CVE-2026-18204 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4086 Reported-by: Warisjeet Singh Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index bba97a2b19e6..8241cd07648d 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -580,6 +580,7 @@ static void ccid_bulk_in_release(USBCCIDState *s) assert(s->current_bulk_in !=3D NULL); s->current_bulk_in->pos =3D 0; s->current_bulk_in =3D NULL; + s->bulk_in_pending_num--; } =20 static void ccid_bulk_in_get(USBCCIDState *s) @@ -587,8 +588,6 @@ static void ccid_bulk_in_get(USBCCIDState *s) if (s->current_bulk_in !=3D NULL || s->bulk_in_pending_num =3D=3D 0) { return; } - assert(s->bulk_in_pending_num > 0); - s->bulk_in_pending_num--; s->current_bulk_in =3D &s->bulk_in_pending[(s->bulk_in_pending_start++) % BULK_IN_PENDING= _NUM]; } @@ -1078,6 +1077,7 @@ static void ccid_bulk_in_copy_to_guest(USBCCIDState *= s, USBPacket *p, =20 ccid_bulk_in_get(s); if (s->current_bulk_in !=3D NULL) { + assert(s->current_bulk_in->pos <=3D s->current_bulk_in->len); len =3D MIN(s->current_bulk_in->len - s->current_bulk_in->pos, p->iov.size); if (len) { --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930725; cv=none; d=zohomail.com; s=zohoarc; b=CWh3cy9n4qDFtKJDd8APTF5tcdPG9DFpYW5BwWovi3l6cFP37XFMtL9YcYDF4YlJoIBxqnWYlkT+vBGtFrUi3XZyqMW3uJybgG8w95pbMZ28YOluFUR52neUmEmHvmKRidukoOsIXc5MC/rne5BL9oV3FpvO3meONKJONlzyLIc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930725; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=hCRmnSWXK6YF43RdUv6ID/tYdpsLJqbm/2L6HherxKo=; b=WubIKyoRw9X1F0lKVScH0NUvUcfjsjjFOh0agxlJpzsKtLoTYI1al8KMOOHxBJYeoWpgIMX5rJuybPh4f6AFbr1j4QbKspR0taSSVq41otupST4B1W3WfOMn+iKfHUXnSzB4j/V+VI2TPXP8olVF8lyzZGzw+VSHRDexZnK+Jpk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930725892353.4188760107743; Wed, 5 Aug 2026 04:52:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraA5-0004gC-Qz; Wed, 05 Aug 2026 07:51:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraA3-0004fY-VK for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:51:51 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraA2-0006jT-7G for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:51:51 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-638-wwD4HWDiPymAFZBnJn_ofg-1; Wed, 05 Aug 2026 07:51:48 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 7AD141800614 for ; Wed, 5 Aug 2026 11:51:47 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 94138434; Wed, 5 Aug 2026 11:51:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930709; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hCRmnSWXK6YF43RdUv6ID/tYdpsLJqbm/2L6HherxKo=; b=iwyxaCSiUFVSYqWLjv+gP3e8pwETmflYca2UaBGdAqD9IDFEHwi9L+lmOKG35fXZMckUY5 P5NukPKNb77Zg5yr4y7kdXsFEdL+k8Gkw/N7bqtEOplN2KVV4gb0v3VN1YbTq/bjGlklXO YQoQ+vDfjy9elDGaHVR0IVTuDzmXk0Q= X-MC-Unique: wwD4HWDiPymAFZBnJn_ofg-1 X-Mimecast-MFC-AGG-ID: wwD4HWDiPymAFZBnJn_ofg_1785930707 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:50:53 +0400 Subject: [PATCH 03/27] hw/usb/dev-smartcard-reader: fix assert on pending answers overflow MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-3-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=1948; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=8r1WrMY8qvKHYq+sLpf/U+GdQK/1XkWNkVF/NDHIznQ=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOrW6lTCHcKxj571Xaq3/3c0uLdUT6C9Onoc OX5Q6ELouCJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjqwAKCRDa6OEJdZac 5fcoEACWByCum7kJvBFX/QeQ20/SleprKetoGWyUOpJwR3d7YCdUwK/YXbeUhQhjOajgbtztfdl t3hp0TU8dY4q5z6fDZLJMtZq2ZfDt6kVerhaNkErHDVEn0rDIWmJSLuzYjl0q1MxCSi5Y9fM1ZF /Ccqu8Nt9aM42QLRigUfTARGKfYFowtRPhXy8BUTVpGzVzf8O72nvtMkTMr8m+u4X1+4gr3b97n xbpzciO0X4h1d7tWLadB0+3nZ7/VrkpXiKiVO/CmKly4R75/6G8KYICJCpX+49TyvxO3nlpzVMb auHmz2CHhenLeFKgeav/KXaopOvYZD1yISfayoLkdJB3wjqSU3IX2TO3lWcETGm3ZKoQdwU1JtO 576/iRgl8yuqIi2htcGCsKdwayGIltVYpsOPcwrBnjk0QGgMf8az9Qyj/p5UCjthuHRKxUUrLg6 QgWkFHWH8aKR6rVz6R5VOrOUJgsBTZKOHW8nyrLcEdYuce1mRlna8og6HOOFiQPrR2R3OtHjAFh 0M0dchlRLQFfbugLl/3dxFyk7xLwLLUtDYHPravGaG+M9WOk/IWOOuCF7/EU8dZK9jXnG9c+nw/ CcZT7BbyJnQW4ncB/y7vXS+rTqPmyTXdDJm+MP+O1/w8JBMWcpZgTy9CjiDMrtWpqIOSDVGiypK dUEKW9Xk2QbB3vQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930727100158500 A guest can send PC_to_RDR_XfrBlock USB messages faster than the async card backend can process them. When the pending_answers ring buffer (128 entries) fills, ccid_add_pending_answer() hits an assert() and crashes QEMU. The CCID spec (section 4) states that a slot can only accept one command at a time. A second command to a busy slot must be rejected with CMD_SLOT_BUSY (section 6.2.6). Enforce this by checking pending_answers_num before queuing a new APDU. When the slot is already busy, report ERROR_CMD_SLOT_BUSY and send a DataBlock error response back to the guest. Fixes: CVE-2026-18410 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3997 Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 8241cd07648d..9fc6bbca0f2d 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -166,6 +166,7 @@ enum { ERROR_XFR_PARITY_ERROR =3D -3, ERROR_XFR_OVERRUN =3D -4, ERROR_HW_ERROR =3D -5, + ERROR_CMD_SLOT_BUSY =3D -32, }; =20 /* 6.2.6 RDR_to_PC_SlotStatus definitions */ @@ -945,6 +946,13 @@ static void ccid_on_apdu_from_guest(USBCCIDState *s, C= CID_XferBlock *recv) ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); return; } + if (s->pending_answers_num > 0) { + DPRINTF(s, D_WARN, + "usb-ccid: slot already busy, rejecting apdu\n"); + ccid_report_error_failed(s, ERROR_CMD_SLOT_BUSY); + ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); + return; + } len =3D le32_to_cpu(recv->hdr.dwLength); DPRINTF(s, 1, "%s: seq %d, len %u\n", __func__, recv->hdr.bSeq, len); --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930778; cv=none; d=zohomail.com; s=zohoarc; b=PotcYjPsn2dmjtPEegDaYdJY+wiQ8zLulPGsLXjxyjvMKJ1NvZGC06iGRlCto1bsDag9dAz5fuGFmYoU6ATjtiOcptuuOtnDGMIuMQvZBnng1CVe+NQMyEgcvI6om2Lf/nVceboJGdQj8Q1h4x6dAbkMmybfSgKqy1tsIbTGyU4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930778; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qoRToi6De8b+7zMk0CxW4wYsMhcGUvA7Ejv3EsBE6sQ=; b=FCkUEfKceII7rho3b854up++V/CNfwY8vcpjzbPLlLOBJlbocP9iUB2qZKZUK+tpNsDYSx6nAYitlj0rDLVR22UWJBhAFydBOMNtHcuOJKQQ2lJO9JVE6R/1OSgQTWBfjbe0nQul+m7fdW/smPRAm6Wx8c/P8GPfThIhGc1VPgQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930778361744.5885127178044; Wed, 5 Aug 2026 04:52:58 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraAR-0004vV-C2; Wed, 05 Aug 2026 07:52:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraAN-0004up-PV for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:52:11 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraAJ-0006lW-Jo for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:52:11 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-311-90fqFw8WO32U-YwFz1DY4g-1; Wed, 05 Aug 2026 07:52:00 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5251318004A9 for ; Wed, 5 Aug 2026 11:51:59 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 9514130001A2; Wed, 5 Aug 2026 11:51:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930726; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qoRToi6De8b+7zMk0CxW4wYsMhcGUvA7Ejv3EsBE6sQ=; b=GcVOFQ4rmPN5uzMACirSu56I9BgMucKiRqCo5LKrhSeCF9TCKbG+MzsPw25Kg5vnTK7oJu IhZ/lwqEtTPJQPzMnsj5A6P/3xwZ19ho7ramw2WK2ygDR6voJC2KvArGmd0z0gDaO1HI3f dVOcBPR6+Eks6r1+RDPj3dniQA7gAIU= X-MC-Unique: 90fqFw8WO32U-YwFz1DY4g-1 X-Mimecast-MFC-AGG-ID: 90fqFw8WO32U-YwFz1DY4g_1785930719 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:50:54 +0400 Subject: [PATCH 04/27] hw/usb/dev-smartcard-reader: decode bulk-out length as little-endian MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-4-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=2059; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=uf4mSWY4qqASiRvsnqXRiU1XB++MZ6NGlJsVLANpeDY=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOsfiKHkrwzPonYHtLVq0rDbH5PM4qI2h8u+ R25Wc8ZOtmJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrAAKCRDa6OEJdZac 5ZNgD/9TP6zN0k5NJRiTPkd+YO/1PCGi19/c0xiNrcNg7OoMj8wtFSXJ/JVc7uaAYcaN9HVHrEq yii0EZRx9T8HvB8QlbLQR8TeMDcRkOLsG/AVaNeqppUpY8rZVcAQz8fNbnTwpH6Fsgx67Z0DRSb YRXHT1bL72YkSAQKodNABEibmLgPDUo7btAbWp4ve+yQGMGGY+UpRcnAZYGmuzUfNAKOFtBY8QQ Acle1ey1lhTYxYgYDhq1BzovXzE3oUg9+n88WdldFvUdXo09NbjTZYfgRIjZ4lbKfVPcHIqhkxM I8dK7nE4CE9IjME9XNNsP+JYZJwdLIwtukQgQlX1u9Ymo/8GaGMcz9/g61fOKUD1RcSm9gCQ1l5 G99TmQqgt3I1ju8VNP90g2fa0Jq2/hWkdAqRs8xNl84tS2GDnGcLrKejb1xxJLRlfAaQ6gsOW/6 tti9sdsIb0Fk1aZGY51S0DpTb0KA1UAd9iS575FaXGvg5kDTMmVRmAiB/9moVUdLr0AgJI4wANR kLFNf8AnOSpkqwd3s5wUTSyAJzulaEI2gG7qtiEkD6O9Od+dK5dfKkrMj3LcOM7MNs1OwDOF+al a2QU0ccaXIr4Bv9fjFvD+8sXwt0sEJ6mikAIguBHAPwhJokeTCxIvrYr3Cfc38Jge4urjgiZubn cvJwry+xETlUpvA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930779223158500 The CCID Rev 1.1 specification states in section 1.3, Document Conventions, that fields larger than one byte are stored in little-endian format. The bulk message header's dwLength field is a four-byte field described in section 6, CCID Messages. Decode dwLength with le32_to_cpu() before using it to assemble and validate Bulk-OUT messages. This fixes message handling on big-endian hosts. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 9fc6bbca0f2d..3580465df368 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -989,6 +989,7 @@ static const char *ccid_message_type_to_str(uint8_t typ= e) static void ccid_handle_bulk_out(USBCCIDState *s, USBPacket *p) { CCID_Header *ccid_header; + uint32_t payload_len; =20 if (p->iov.size + s->bulk_out_pos > BULK_OUT_DATA_SIZE) { goto err; @@ -1001,17 +1002,18 @@ static void ccid_handle_bulk_out(USBCCIDState *s, U= SBPacket *p) } =20 ccid_header =3D (CCID_Header *)s->bulk_out_data; - if ((s->bulk_out_pos - 10 < ccid_header->dwLength) && + payload_len =3D le32_to_cpu(ccid_header->dwLength); + if ((s->bulk_out_pos - 10 < payload_len) && (p->iov.size =3D=3D CCID_MAX_PACKET_SIZE)) { DPRINTF(s, D_VERBOSE, "usb-ccid: bulk_in: expecting more packets (%u/%u)\n", - s->bulk_out_pos - 10, ccid_header->dwLength); + s->bulk_out_pos - 10, payload_len); return; } - if (s->bulk_out_pos - 10 !=3D ccid_header->dwLength) { + if (s->bulk_out_pos - 10 !=3D payload_len) { DPRINTF(s, 1, "usb-ccid: bulk_in: message size mismatch (got %u, expecte= d %u)\n", - s->bulk_out_pos - 10, ccid_header->dwLength); + s->bulk_out_pos - 10, payload_len); goto err; } =20 --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930750; cv=none; d=zohomail.com; s=zohoarc; b=m0G0sQBUfX5oM6j7p/wrQxvWXQQW0xdyBphK6VbBMKJhbSWLbKjFmUB7b+VZApuCC1cVWvztqAAv2XNE5quxUNsrU88BFzZ4FTQI3NGX2f1SzkJgsZo2qavEiNrEVkZ0/ASor2uSEuYXf4N5tF874UiBhXEofF0XcuGC2h7Z97A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930750; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=RUiHw1X97TyqX/bI7AoZTQft5uT6WiNqmfbMb9Gk9HI=; b=M9h+5gVwj4Y6k4vpitYba6WdOQBwk2k+vy55361d3xLWat7Egcu22HeErG1CN+e0iRcw82Y39st9VkuLtS9YQWNN6XLbWT0IwwuhCjVkxPTzXaKAX3U4ilT7wTgQNebxP4XpA23Y8uzTPwlxFusLD93E8dvhHR7qnS1EO4mbMWY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178593075079659.744695631953846; Wed, 5 Aug 2026 04:52:30 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraAT-0004wD-Ap; Wed, 05 Aug 2026 07:52:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraAQ-0004vJ-6I for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:52:15 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraAO-0006rv-MB for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:52:13 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-270-H2gyfpgUNfWGVefdIGlVnQ-1; Wed, 05 Aug 2026 07:52:10 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 97ACB1956095; Wed, 5 Aug 2026 11:52:09 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id F1C5F180049F; Wed, 5 Aug 2026 11:52:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930731; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RUiHw1X97TyqX/bI7AoZTQft5uT6WiNqmfbMb9Gk9HI=; b=cR8loqd7YEnnHnU3dNwoGXR8wi6nUcXzl4sCaa7b5Q7XLo3W595bCyVEJ+UuuvHiFWdviw yY5kAQkwSYlTWiLCHbufl6ZSWPOaYwHFhAEas9c9PGIxcw7YhOTZWJG7ZzChrHP9rlJx4q jrdvu/uAne9FCpc0crcmx65Qvh1+kzI= X-MC-Unique: H2gyfpgUNfWGVefdIGlVnQ-1 X-Mimecast-MFC-AGG-ID: H2gyfpgUNfWGVefdIGlVnQ_1785930729 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:50:55 +0400 Subject: [PATCH 05/27] hw/usb/dev-smartcard-reader: fix dwMaxCCIDMessageLength descriptor MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-5-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Zhao Liu X-Developer-Signature: v=1; a=openpgp-sha256; l=3392; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=VJfRZ/vlWPkPw50oUk6mI2+mxcxOC1M0HQBUSmgUKNM=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOsgVcrdgwmGf+hKXMpk/V/Gd8djv+IPVCnY 6d4c/M2yOCJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrAAKCRDa6OEJdZac 5TtcD/4txlfQkNsLUDEa/lckBez4FFio1+QNlhz/5pkyoOE0+sHZONzR5Y5EJsXhpnEyGIj1PDs rIZnvhuqw/DsxAwWWSNNmiKQ0hwbKWY6itboAGCAAaXUMWoNrdym+fWyXNUuMABAidX16ujfy2C 0mDEpSBWwXX0aEZ7v4uvLv1VnXymwEFCMZOdlATuXuctcEdlo3c3ongwV2Yp1bI1GutGWHSxgQa t/yK9YkWs9I6aBSLqKlowg5bsio1P9xXk13FBYPvyp8oCZxvSANxMfJBuFqVTeuGeiUp1PRrvVV +D/1WCCXpUzh4x1ecYTRciHqIgmNGUBdjndg6/FvWMWTV055n9wfyMvvhVsZ5h3a/pR6GE8NI3w fiz2l962WluNE+f8h21EkXHlPu6r1VQh+t3xcFbW1g3j04xzwbPxlTh76dLA7/9rDHS7H/3//xl btK1mh71h6nrTSh6n1XroDGWad/TBq68XkRB+lUCyHXgCb2FexM5xQnUqW/NCQtc5axtXtPMazZ rbHxSlcGaW6ZINUsK7pVcRDBz7WTItLpywR3deHwOPfwNadq2FzpydEyKdDQMGBu0wM5KFPIDwo zHkc/MsTuiYMBQ5A9eK7EFrzOEMMJBSqBZMFrmRrG9RC3P80y6sJLd5x1RcBri9qg9ceo10F7do 63U0NY7SXW64S7A== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930751290158500 The CCID class descriptor advertises dwMaxCCIDMessageLength =3D 65554 (the extended-APDU maximum), but bulk-IN storage is only 384 bytes. Since the device operates at TPDU level, the spec minimum is just wMaxPacketSize (64 bytes), and the actual limit is the bulk-IN buffer. Set dwMaxCCIDMessageLength to BULK_IN_BUF_SIZE (384) so the advertised capability matches the implementation. Guard the change behind a machine-compat property so older machine types preserve the original descriptor for guest reproducibility. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/core/machine.c | 1 + hw/usb/dev-smartcard-reader.c | 12 +++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/hw/core/machine.c b/hw/core/machine.c index 73b4d82b4a1d..01e50ebe05e0 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -51,6 +51,7 @@ GlobalProperty hw_compat_11_0[] =3D { { TYPE_ARM_SMMUV3, "ssidsize", "0" }, { TYPE_ARM_SMMUV3, "oas", "44" }, { "migration", "switchover-ack-legacy", "on" }, + { "usb-ccid", "x-accurate-message-length", "off" }, }; const size_t hw_compat_11_0_len =3D G_N_ELEMENTS(hw_compat_11_0); =20 diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 3580465df368..a14062948071 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -314,6 +314,7 @@ struct USBCCIDState { uint8_t powered; uint8_t notify_slot_change; uint8_t debug; + bool accurate_message_length; }; =20 /* @@ -326,7 +327,7 @@ struct USBCCIDState { * 0dc3:1004 Athena Smartcard Solutions, Inc. */ =20 -static const uint8_t qemu_ccid_descriptor[] =3D { +static uint8_t qemu_ccid_descriptor[] =3D { /* Smart Card Device Class Descriptor */ 0x36, /* u8 bLength; */ 0x21, /* u8 bDescriptorType; Functional */ @@ -387,7 +388,10 @@ static const uint8_t qemu_ccid_descriptor[] =3D { * u32 dwMaxCCIDMessageLength; For extended APDU in * [261 + 10 , 65544 + 10]. Otherwise the minimum is * wMaxPacketSize of the Bulk-OUT endpoint + * + * Corrected to BULK_IN_BUF_SIZE when x-accurate-messa= ge-length */ +#define CCID_DESC_OFFSET_DW_MAX_MSG_LEN 44 0x12, 0x00, 0x01, 0x00, 0xFF, /* * u8 bClassGetResponse; Significant only for CCID th= at @@ -1329,6 +1333,10 @@ static void ccid_realize(USBDevice *dev, Error **err= p) { USBCCIDState *s =3D USB_CCID_DEV(dev); =20 + if (s->accurate_message_length) { + stl_le_p(&qemu_ccid_descriptor[CCID_DESC_OFFSET_DW_MAX_MSG_LEN], + BULK_IN_BUF_SIZE); + } usb_desc_create_serial(dev); usb_desc_init(dev); qbus_init(&s->bus, sizeof(s->bus), TYPE_CCID_BUS, DEVICE(dev), NULL); @@ -1445,6 +1453,8 @@ static const VMStateDescription ccid_vmstate =3D { =20 static const Property ccid_properties[] =3D { DEFINE_PROP_UINT8("debug", USBCCIDState, debug, 0), + DEFINE_PROP_BOOL("x-accurate-message-length", USBCCIDState, + accurate_message_length, true), }; =20 static void ccid_class_initfn(ObjectClass *klass, const void *data) --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930781; cv=none; d=zohomail.com; s=zohoarc; b=hDlA+XC1uf4Pr7vHq76o+1uxmgfsPr3oFbDFLMezPLhFj0lcefMhYMbjO7Wz+8gNC7C9+NTzl9THOVOcJ76FQaIr2qjqrsTnB61z0c7WZ5OlJDPz9M5hVx4btA37nuaGG8kUlvq4MX+OQCZObSg9r0WToL2Ae/eOlhBiBO7CbmM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930781; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=3cKC1Q443HkKmBCPK6f7y7gcM49z2DQPieEv1+CLUjM=; b=PUzK4tZ7eauo6QeWIWK30yGMwRJ5eRRCheaV+d0N1VYTO1+DKZcqGbfUOuOiqAhURkQ79D35XluJT3oSe7IDOddlCJAD56gKv2fDWflQbcIoTPAU4TrYvZnqHa5I18G+9mtRJtYW+rhRQQee/QbdiTuKuOpJTB0wdpmOxGOccfk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930781137484.8054611498069; Wed, 5 Aug 2026 04:53:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraAg-0005fT-Kw; Wed, 05 Aug 2026 07:52:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraAe-0005Vs-EA for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:52:28 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraAc-0006u1-Iz for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:52:28 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-637-QEfGZ37aOBGWu5afr_wqFQ-1; Wed, 05 Aug 2026 07:52:19 -0400 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id F09EF19560B5 for ; Wed, 5 Aug 2026 11:52:18 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 6B08F180034C; Wed, 5 Aug 2026 11:52:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930745; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3cKC1Q443HkKmBCPK6f7y7gcM49z2DQPieEv1+CLUjM=; b=KYU79/yL2OBOaWIm1eY8rAQ+BKMmANuaEwi7dKJZ25gplsu3oU/GKbllhnyQ+yY+ZZnE43 TnJhKENqIL5LutmXt1R1avjA7UzXxmSU0xleylNV25yrOegmdmsSTjFnf5+zeAT06vn42G bFQ7mLmlTUQ6yfiYtFKu50lmE9bEn/A= X-MC-Unique: QEfGZ37aOBGWu5afr_wqFQ-1 X-Mimecast-MFC-AGG-ID: QEfGZ37aOBGWu5afr_wqFQ_1785930739 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:50:56 +0400 Subject: [PATCH 06/27] hw/usb/dev-smartcard-reader: fix OOB read in atr_get_protocol_num() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-6-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=1018; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=cVmgGekfR/ZikK6JZqR1e4rXKDxXKSJXVIK7Fe/G53Y=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOsCUFhx+zKw2vsNZV98dACxp3uRUeXp8py1 wqwJRvQhWyJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrAAKCRDa6OEJdZac 5QlgD/0RoJqNnAKyAghvGR/i1ixiAqGDeYC3RTLDdYyl4z0rKSQgo7C1GcELfkGuEtym1m75fn8 nNTNy1V2qaQEmEekslCns83GbfAwMH9DeljyNmjnOCfAx1NsPuwIg7dqUrj0qh9pjV4Sclvhb6E eq4/vPjRdGmtJ/oQm/xDDF0DVBpciKt5CqMHZOZbfRL0HWFiN1QBwiZ8mCnlmlj1v+gr2IqcnXj HUQCLyN80Uy42rH0Ij8dJh04Frl0pDR5cMUbJER9pEWEc0fDIj0V/KGVUMWX+wo0ZOhu5TQPciK o3fULeKDc0H3bN5PMrv5BHzHlKSKdfDeDAVgTkCRw1YLjjJhpJfkp4B7vRMQgQFOVxebY5wnSwY nQ3OuS2lI2/8G/gVwbQ/8hmAX/PyC7HkIDu+Nwi8PpAUino1WsYnIEJEDvSwsu8uZ9zsWra4BRG SeTTh7eSHSfxS7bULL+ua4KNQN+lMiPSjx30d8JIwTR40QVafkIgxUqIfibZJohp/VShI4YZ7bY xOPi0Ev5UXsD8aBVtVy51gufteIGtNxMCvqOXAmTwrNr/cfTaT9OwuudyPQnX2vmAowRqdaT2X2 0zdWHVZgWAYqj6cac0AENM/oqdiFOrACtuB3eyT582vd1hFVEU5VStNEjqT3WAsONcC5QATJ9xZ fcAocM6y4Or3yvg== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930783237158500 atr_get_protocol_num() computes the TD1 offset from the T0 presence bits without checking that the byte exists in the ATR buffer. A truncated ATR causes an out-of-bounds read. Validate the offset before dereferencing and fall back to T=3D0. This is only triggerable by a buggy backend. Fixes: 2f8f916b6d44 ("dev-smartcard-reader: copy atr protocol to ccid param= eters") Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index a14062948071..a147cd19f388 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -836,6 +836,9 @@ static uint8_t atr_get_protocol_num(const uint8_t *atr,= uint32_t len) } i =3D 1 + !!(atr[1] & 0x10) + !!(atr[1] & 0x20) + !!(atr[1] & 0x40); i +=3D !!(atr[1] & 0x80); + if (i >=3D len) { + return 0; + } return atr[i] & 0x0f; } =20 --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930781; cv=none; d=zohomail.com; s=zohoarc; b=jiped+6f28hO6j/TR6IubacSYyBMqg11X7C0o5JzXd73KQA2n+FTHTcPwCCMEeOSaWF0k8lMvY1bLtVY3haEi6/QEw3gt1oB6DVC2ms/xiZmZu2fZc3agyunRh+aqRyJeZPkeged2Fhp6khnElOrtM3F9lrpIHmm2THKKV/DqgQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930781; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Osfx8gZJrB7dh/sUZUFu7wXoAjXOKWpsoAdI1+KIrJ4=; b=REg+leSxS6csNpdWdmo592gCTtXGo/IgFG8jP6Hk1nszjRenFWALt6fuQXNXI6dIwat9iFSxR4GO7ubQp4ICpakgMGEUrJq4a8stWOHO0bWo4T+aq4Jq3gXTe1J+iTkPwdjd4bmMcz8QeIAfr6VUVYjOjZ6aEo2TwAcAwAIypAk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930781117669.4817268031098; Wed, 5 Aug 2026 04:53:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraAn-0005lO-BF; Wed, 05 Aug 2026 07:52:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraAm-0005l5-0T for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:52:36 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraAk-0006uW-DJ for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:52:35 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-170-eHNH-eN9Pe6CPG8v2WK9tg-1; Wed, 05 Aug 2026 07:52:27 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 8811A1955DBE for ; Wed, 5 Aug 2026 11:52:26 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id DC5C6422; Wed, 5 Aug 2026 11:52:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930753; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Osfx8gZJrB7dh/sUZUFu7wXoAjXOKWpsoAdI1+KIrJ4=; b=hfkQQAVe3W9SBSYKN2G8q0I7WNFS1LUIp2AmsYq4SJ+LkjGMcvEKohqw1cqE6CesdmS7Y4 DKEBY44nheQCKdsChjxpzU5RWZFOEYhT+qqbCyoYV83zI+Mh1w+GDsbtdnUHggYJLKQqgB fFR+8wW17P7v7cZanXiBu64yRqBnJfE= X-MC-Unique: eHNH-eN9Pe6CPG8v2WK9tg-1 X-Mimecast-MFC-AGG-ID: eHNH-eN9Pe6CPG8v2WK9tg_1785930746 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:50:57 +0400 Subject: [PATCH 07/27] hw/usb/dev-smartcard-reader: block migration with pending queues MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-7-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=2161; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=xzskyDLi6FbuDSwTo5I/zb0dvLyg/dAAIh1/km1p3Xo=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOs4IDy37k+DXBdi2iKm1NJxCZ/4f38m7avz euH/rcoaVGJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrAAKCRDa6OEJdZac 5aWoD/0c75VSrVEZNCourY5CMQbXlBtUuj+nXf82Nnrj28MhNvl++st3cDZn3CG3oP80J9SQps6 M40vRmHHflhaotIb9qAAOTZV0NDqxZqOXyjtPDIrK/O39r/gGVjAGFd9Y96bjKjCGaNoITtbLoB aSBrYZatHb6TMK2eroHqi2Mpsc4I5umx0HJAbveZXNobvf7xAOP6I68J1LFP3SYgSw6QcLmpgea hsAmTPSgtXuz7G/rpmBWP3RKeBwR5WTRE728ODmVbw2wtEpKbUnMBzpQis+njTZFksKGyhZQ1bO mlkNxnhKWhwRSK0BMGO6xMORM4SrO6SEIjfTk4zuFiNCtjHnA4mEZFqba7D9XwW0KNUd8YcxHYP ZOYNkNIQ8uDkUMWe35Ws1laMO5+Nw+Kxm4W5s/6QEXo/kfYZWzcn63kb/JO8pimBlr2auq4rr0W SAJ7JAkg6kbuzt/FoFy0iHDVkA9h1K/MO0UvM9cIzmVJURzbrHt0RU30PwlFRBIYkg9uhvE7Ewp oq6BS/cb68Nq2BZvr1nPw1dnY25hYsOrkHj8SQLfDeKtDjaGrZuysiPGUhdpWRWyvIpkG+/fUP+ RuVncv6zJZ9SvGGCcRqkwC5SBKcAIxkp9W3U/qfLfzj6y0WOLsZFGydZ4QK7ykzjz6RrP1qnJXp bAqxXLRyLFkwS6g== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930781272158500 Several queue state fields are not included in the vmstate: bulk_in_pending_num, pending_answers_start, and pending_answers_end. Also if current_bulk_in !=3D NULL (ongoing transfer). Migrating while any of these are non-zero produces inconsistent state on the destination. Rather than extending the vmstate (which would require a version bump and migration compat machinery), block migration when the queues are non-empty. In practice this window is very short since the CMD_SLOT_BUSY enforcement limits pending_answers to at most one entry. Convert pre_save to the pre_save_errp form so it can report the error cleanly. Follow up patches will add migration blocker and new migration version. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index a147cd19f388..1b8f0e10e172 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1377,13 +1377,20 @@ static int ccid_post_load(void *opaque, int version= _id) return 0; } =20 -static int ccid_pre_save(void *opaque) +static bool ccid_pre_save(void *opaque, Error **errp) { USBCCIDState *s =3D opaque; =20 + if (s->pending_answers_num || s->bulk_in_pending_num || + s->current_bulk_in) { + error_setg(errp, "usb-ccid has pending queue state which cannot be= " + "migrated safely"); + return false; + } + s->state_vmstate =3D s->dev.state; =20 - return 0; + return true; } =20 static const VMStateDescription bulk_in_vmstate =3D { @@ -1426,7 +1433,7 @@ static const VMStateDescription ccid_vmstate =3D { .version_id =3D 1, .minimum_version_id =3D 1, .post_load =3D ccid_post_load, - .pre_save =3D ccid_pre_save, + .pre_save_errp =3D ccid_pre_save, .fields =3D (const VMStateField[]) { VMSTATE_STRUCT(dev, USBCCIDState, 1, usb_device_vmstate, USBDevice= ), VMSTATE_UINT8(debug, USBCCIDState), --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930780; cv=none; d=zohomail.com; s=zohoarc; b=IY5Ey1KjuT3W7lknQbAARpHUNkSU3VFWzevjVIBFjB17vK2AI5GVU9K5VojY/YmHqWtX3Dik/iCpmiOjExLWtUnr2L+0OVIfAtM8Hm+EHIAflyjtyGcpVQwAsq0EkWh0viHfIUvmbRBLfNTRWdUJHajyb8heb0+i54kkP3hdJjg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930780; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=3EaL3oGsmyoo9Mb8QtTF8RHLY3nHU3zHQv1/Tjv69qQ=; b=VJBu4EptTnzLUw+xSKOo9fH+G1LzxfcHOBeRNgyWQEwSndAw4s9DXfOSVg2zRPZeTL1SttJFwIrbSPd0R6IvFIL1EMVB0v2jlonGMz5aFzwwHKhKSjMC9Gx9fH/Ae0ok9Gfr6ES7/Axsu8B7O4owSjUrnv6nW7M9RjjRd6u/uWU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930780817324.08716251817407; Wed, 5 Aug 2026 04:53:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraB6-0006zc-VS; Wed, 05 Aug 2026 07:52:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraB4-0006xF-2v for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:52:54 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraB2-0006z7-K7 for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:52:53 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-154-cMp1aclYNSCeSZqwWM5i6w-1; Wed, 05 Aug 2026 07:52:45 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E0AD119560BC for ; Wed, 5 Aug 2026 11:52:44 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 18BA3434; Wed, 5 Aug 2026 11:52:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930771; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3EaL3oGsmyoo9Mb8QtTF8RHLY3nHU3zHQv1/Tjv69qQ=; b=fiP07LfEN45kWbJGhXzPCWfxpp1u0XsmQmMD/eTJvndC/9hRuXyFjPZZ2fAOJyaOYSwblQ B3G3ZonRusGga5PBp8h819TZtKDfDw4LpK8xVa/WRBzkSAtVJ/yZ8jEOmZ7ZMBNl0Nqyc3 66EHAG+cLr1Hb+qIAjyImCV6nQI2Adk= X-MC-Unique: cMp1aclYNSCeSZqwWM5i6w-1 X-Mimecast-MFC-AGG-ID: cMp1aclYNSCeSZqwWM5i6w_1785930765 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:50:58 +0400 Subject: [PATCH 08/27] hw/usb/dev-smartcard-reader: drop needless state fields MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-8-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=1763; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=mOnLqynUX3ypyc0K+pzAWTylprbsShk6E+l9SbJpIc4=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOsx8Wi/X9E0EcgqsLFS7FLOcp9xWYz251+R +YcwzCAPxKJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrAAKCRDa6OEJdZac 5ffrD/9r5rGia/ajazxK2GAkKdOas9vYWiGiTN4GFIoJfgw7qZ9MPAuaR1zapJUOjRSZEGNq1wH NhCRxSzXXmyMnZ59A0RtZ5XBfQkeBVTKOj+HZhzuF+Zk2Jo56Cq+ltyMRXK4+OErqzmJ/ngeanV xozwnfE77/2XAkda3+W6KpMfHAHfXKLHmZy0gB0ELwd4Uf82GX+zuy614GSy42JpdUNlXsIdj4T HLUzowjQv208yraQMIjYml3386hvYBdtnar9a5DqdctIi4Tvun5aYO4BTwedpfth+WMlA0H6EYK um25UMlY/qh/qeHAOo4/FUbqimlBp6yx/J/a3z/NcbVOPtalgqyAF6gcKrDfLRAwhsVR5u9zeeJ iaLUaeVZt5ZR75zAzvwahN3GrUK2PuAXM/XqDN4/0jFBxOG3x2OGxGzMWMuGaqLpnm5zK8egsA+ 1msAfB5k6V8TeP6oObTF18SEnGJzy3l/8Nsac+PYngMEc8ykcS8wn+qnZA9pqqmt7PZYczw8VKH C5OrLoO99RYsL4izP7NbzKIukgggXVvpk40V+9izn4GrXojEbZNPT6HsPCLZkJryUzkJ/kH03SO ROZbYBFLh51CL9wXomyn9f717JgbpPxSEoyNUewIRsXOn0pGahqtqsK2P+I0XvAjTHr9LeQWzrD 6rb+NMRcJLiv36g== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930781240158500 The field is never used, it could potentially do break on malicious migration stream. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 1b8f0e10e172..c6a9faf00d6f 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -308,7 +308,6 @@ struct USBCCIDState { uint8_t bmCommandStatus; uint8_t bProtocolNum; CCID_ProtocolDataStructure abProtocolDataStructure; - uint32_t ulProtocolDataStructureSize; uint32_t state_vmstate; uint8_t bmSlotICCState; uint8_t powered; @@ -762,9 +761,8 @@ static void ccid_write_slot_status(USBCCIDState *s, CCI= D_Header *recv) static void ccid_write_parameters(USBCCIDState *s, CCID_Header *recv) { CCID_Parameter *h; - uint32_t len =3D s->ulProtocolDataStructureSize; =20 - h =3D ccid_reserve_recv_buf(s, sizeof(CCID_Parameter) + len); + h =3D ccid_reserve_recv_buf(s, sizeof(CCID_Parameter)); if (h =3D=3D NULL) { return; } @@ -1447,7 +1445,7 @@ static const VMStateDescription ccid_vmstate =3D { VMSTATE_UINT8(bmCommandStatus, USBCCIDState), VMSTATE_UINT8(bProtocolNum, USBCCIDState), VMSTATE_BUFFER(abProtocolDataStructure.data, USBCCIDState), - VMSTATE_UINT32(ulProtocolDataStructureSize, USBCCIDState), + VMSTATE_UNUSED(4), /* was ulProtocolDataStructureSize */ VMSTATE_STRUCT_ARRAY(bulk_in_pending, USBCCIDState, BULK_IN_PENDING_NUM, 1, bulk_in_vmstate, BulkIn), VMSTATE_UINT32(bulk_in_pending_start, USBCCIDState), --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930788; cv=none; d=zohomail.com; s=zohoarc; b=i4wknGJ1MKrocWBQxQqbjZqi9K62OmEc1RE7VRqrJtNdVKYBFyyBW3wy0CBZvCvRYkGEGbEt/yOFb5WGqZwCpfArpj22sSSbP1TrXofL4VG+UiEC1zRs7IzK1HUVCtL9go7zWJBKxU1yZ6Xvz2aXyD0iZlOAcHICcOmkgtjpb9U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930788; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=EMibH8iba3oSpJwO21+PI+MpXq9PANZk1NviI0MLeWA=; b=HFAZOttGs15AIbn6ToGrGPUoySR4E069ix+8LwOuyQd8rOeWo6jtZJy3fpT7zL9tthlBH8VAxWiTpfjcB4YrxbTuGxCtMvmhY+Lwyw4smtshDILLIVaNGQHtcNEnbY4kqG0/N1+G2DkcVMKN1RiraHJuEcgbzt/BOnXLkWMB3GY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930788819737.4082178172637; Wed, 5 Aug 2026 04:53:08 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraBC-0007UK-Tm; Wed, 05 Aug 2026 07:53:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraBB-0007Me-Eo for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:53:01 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraB9-0007EG-VA for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:53:01 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-633-EoirwjjVMkWgyhvHmnVxQA-1; Wed, 05 Aug 2026 07:52:53 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 44A2A19560A2 for ; Wed, 5 Aug 2026 11:52:52 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 72B9C180049F; Wed, 5 Aug 2026 11:52:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930779; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=EMibH8iba3oSpJwO21+PI+MpXq9PANZk1NviI0MLeWA=; b=YN1K818cKVdcHoFZGewuiWan5VEE4BxBb2vOH95zGzouh/SzAJJ7n3BbXQGLc+EVFW7eDb +hdtLEby6vhCmd4pQZyh2ScF0sAMJq/a6Oef4U40hrpo851YeUrpWqLUD3dhggIoN9NGhM V8pnj0n5nbiqDKkzCca38yGr084Av/o= X-MC-Unique: EoirwjjVMkWgyhvHmnVxQA-1 X-Mimecast-MFC-AGG-ID: EoirwjjVMkWgyhvHmnVxQA_1785930772 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:50:59 +0400 Subject: [PATCH 09/27] hw/usb/dev-smartcard-reader: validate migrated fields in post_load MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-9-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=1304; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=vf6q3ker/6skkfLofV3IYMweVoha2qg+51FmyI3g6NE=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOs2Fhl/j6IJoOofsW2hKw5OgMNnituTOvlc gIS+QeyawSJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrAAKCRDa6OEJdZac 5RsaD/97AaM+S452u3iRaTaImX8PikeJNedRl7gW4LoRjRgzGE+gzjddnzivsb1eLY7ODmO28dN 6c7e0+Zx7DPud/PSoPoaFWq0WfM3bMz2z6Pw4+cLdQLC+OwfONmXcv5MKP0k80soB8xQPyWndmT 7wC/D8ct1+GS3VIxee5SE6+M0TqGvbN1uKgHKiDTKLlmV02Y0KbP9y+vA83gcvqKbsFyrXzmeXd 8vDlZMMWQ9R7EAHMsBK+7o/ymqPhx1AseEXYWCJLp/D4yoWKhxuBvlUvm9f2xh83NssUb2uWpba SqMPug5QweTZOBmd8iytVNRKFd/LJSalEHpsSmCKzmvCRg89vqnQxU6RahxHSk9keHRlWJ10mFO DIzW0S3Ikyu3+K8j+Rnhhpi+0uW/L2yKhj9e/jN3INMxw5i1tyWJ+DsCJMKsJo52/iXnun3biKj SQCnjaVMBkj49VP3UkB5JaZ4Oqpl+KNBW7g8MR7fpqCzxrZXDLv53hpFkx93eStZJRYKhBgGc6n S7z2hjqcjangH1Re76Kjej5Voz5u2N52tv3eQkqHnptyNnonmiMhj9bQKBOUGdDE40m/351AOb4 R+YCRANyMOKXwAJEmUhRlV/G3in7DJLGiMYJzZ/T4cC4v1gWk0yoqIaFreSq3YmIhGtfiIyT6tt jAvyRDpGUt5VUgA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930791823158500 Validate fields loaded from the migration stream to reject crafted or corrupt data before it can cause harm. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index c6a9faf00d6f..bed641be4512 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1364,6 +1364,26 @@ static void ccid_realize(USBDevice *dev, Error **err= p) static int ccid_post_load(void *opaque, int version_id) { USBCCIDState *s =3D opaque; + int i; + + if (s->bulk_in_pending_end - s->bulk_in_pending_start > BULK_IN_PENDIN= G_NUM) { + return -EINVAL; + } + + if (s->pending_answers_num > PENDING_ANSWERS_NUM) { + return -EINVAL; + } + + if (s->bulk_out_pos > BULK_OUT_DATA_SIZE) { + return -EINVAL; + } + + for (i =3D 0; i < BULK_IN_PENDING_NUM; i++) { + if (s->bulk_in_pending[i].len > BULK_IN_BUF_SIZE || + s->bulk_in_pending[i].pos > s->bulk_in_pending[i].len) { + return -EINVAL; + } + } =20 /* * This must be done after usb_device_attach, which sets state to ATTA= CHED, --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930797; cv=none; d=zohomail.com; s=zohoarc; b=TXTaVnYS/0ACauPyXRrep8KK8kooXNGwEv+KcBJRIYwwYwJ9ABLtuk3NFqfZ4E+Yx1IXeAsKy/FqYHeOvBwsalpBQdB8P9Xjj7p5OhEGJZ6Zveiph3PrXuZiUEe6ddLuYJJFU0wbhSJN5y4XiyhbdpjRPyw8rLVW5YjBq5s1YlY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930797; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=7PMTkvaIVO4jhh0ZLegntqLtMpH+bSV5zE9b/jru5SI=; b=gcH06lBg3IUziS6UxW9JnTnKlljJuzV6ASQPgEAp4CuCkXqSvxbwpRqU+vPAuiFWzr9TmC9cZSIT5Vs4mS/9j/TtHpTzD4RtycuEtzjdIbdwSITGT/9acTP/wieaSQrloNlLM4SrmmmLYX0Fztg9BQnBJcRUqUNKIf4JpQQC2oM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930797440637.236310528809; Wed, 5 Aug 2026 04:53:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraBM-0007ud-OV; Wed, 05 Aug 2026 07:53:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraBL-0007uN-WC for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:53:12 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraBK-0007JR-I9 for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:53:11 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-66-v9HxG4iZNoO8CIW_g-9Flg-1; Wed, 05 Aug 2026 07:53:08 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 079C519560AA for ; Wed, 5 Aug 2026 11:53:08 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id C6CD3180049F; Wed, 5 Aug 2026 11:53:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930790; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=7PMTkvaIVO4jhh0ZLegntqLtMpH+bSV5zE9b/jru5SI=; b=ecV6u7lk2h3GgvEh2lpdMUkWd/BiHULAIOb3h8v9QpF6IC88TqaaSkFFzJZzQ1mkjGKiJ5 jaP4SXzqDR1bKKJtACTIOwGXPeqOn25gG3n0vEwscK2OtT07VVkn5ZOMENdFVsSs7yIp65 uA8CJ3C6zRR3YSi+StYG64CGaJUL4lo= X-MC-Unique: v9HxG4iZNoO8CIW_g-9Flg-1 X-Mimecast-MFC-AGG-ID: v9HxG4iZNoO8CIW_g-9Flg_1785930788 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:00 +0400 Subject: [PATCH 10/27] hw/usb/dev-smartcard-reader: reset all I/O state on device reset MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-10-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=3274; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=PUVI70oyctTz1sag9yfTLK9ruJyZ7AFi1cPL+bm/MWE=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOtQjv4bSKqQGnitCXc1gOq+O4OcFALNHb3g 17FIU9PZfGJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrQAKCRDa6OEJdZac 5YeyD/9Pd903+XcETamlodI78G5D9tJxOEjCsE1yblGkIT4sAxXJehPZ4iBShWDgAvNxCtW8Wbv 4beADbBdH27vJ9ZUNB8DMqZnyNriJs924zPOXHoOFB+AM6BF43XVTaamK5XgWPfDcFFb+SSyJ2Y NjIy559EBSd3R2kmN7hUdP4RBmGxAwFkMHbSkI6GvgPdnSkDQGSOKcvHtqRWkcKu9Hf9T6db/FH P7AxF2haKB7ixaQY3IGNeYEpKybEbKG0Q7JLUVLD9bz6QyxBc/w4lzn1yNGGiDukhc1qkIDflO9 +y7ypjESTylUT6WoZt80RGe5uxxVIn2r+n22i1a/ciOvhTyUd3MmZG17D/8iTkzQN+nx4SBBHyB 56XyejvNOjAbymeeoo5MmzvyC3rEotPcTThRWD491wP5jq60oNBv0iwbyPPSjczIKsgccy7nZm7 AMzCjUI3WXYI6gVPhgNKLmhfMHwGTpw01dgGX6+P+9G6oPoQ5YFzf73S1Cto6SZsa42voKOuPwk mZ3c0zRX0FqUrgXSya7R1OOQvy8CZQ54gFnkTew5brWGA2pf/0gpbESCsKHVEl8XOks0ieP1QJg R3cEDVIHEoDViKrquPphxdanv6nU0gkZD+0QkA7PAzWe1+NRru9CHqoZw8GwqzCN9E5d7Gl9ORj lZbLgEpOOVTJtBA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930799431158500 Clear bulk-in entries (len/pos), current_bulk_in pointer, bulk-out position, error status, and protocol parameters during reset. Previously only the bulk-in ring buffer indices and pending answers were cleared, leaving stale state that could corrupt subsequent transfers. Move ccid_reset() after its callees to avoid forward declarations. Drop redundant initialization from realize() since it calls reset(). Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 60 +++++++++++++++++++++++----------------= ---- 1 file changed, 32 insertions(+), 28 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index bed641be4512..12c82c8f6458 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -574,9 +574,16 @@ static void ccid_remove_pending_answer(USBCCIDState *s, =20 static void ccid_bulk_in_clear(USBCCIDState *s) { + int i; + + for (i =3D 0; i < BULK_IN_PENDING_NUM; i++) { + s->bulk_in_pending[i].len =3D 0; + s->bulk_in_pending[i].pos =3D 0; + } s->bulk_in_pending_start =3D 0; s->bulk_in_pending_end =3D 0; s->bulk_in_pending_num =3D 0; + s->current_bulk_in =3D NULL; } =20 static void ccid_bulk_in_release(USBCCIDState *s) @@ -621,26 +628,6 @@ static void *ccid_reserve_recv_buf(USBCCIDState *s, ui= nt16_t len) return bulk_in->data; } =20 -static void ccid_reset(USBCCIDState *s) -{ - ccid_bulk_in_clear(s); - ccid_clear_pending_answers(s); -} - -static void ccid_detach(USBCCIDState *s) -{ - ccid_reset(s); -} - -static void ccid_handle_reset(USBDevice *dev) -{ - USBCCIDState *s =3D USB_CCID_DEV(dev); - - DPRINTF(s, 1, "Reset\n"); - - ccid_reset(s); -} - static const char *ccid_control_to_str(USBCCIDState *s, int request) { switch (request) { @@ -918,6 +905,31 @@ static void ccid_reset_parameters(USBCCIDState *s) s->abProtocolDataStructure =3D defaultProtocolDataStructure; } =20 +static void ccid_reset(USBCCIDState *s) +{ + ccid_bulk_in_clear(s); + ccid_clear_pending_answers(s); + s->bulk_out_pos =3D 0; + s->last_answer_error =3D 0; + s->notify_slot_change =3D false; + ccid_reset_error_status(s); + ccid_reset_parameters(s); +} + +static void ccid_detach(USBCCIDState *s) +{ + ccid_reset(s); +} + +static void ccid_handle_reset(USBDevice *dev) +{ + USBCCIDState *s =3D USB_CCID_DEV(dev); + + DPRINTF(s, 1, "Reset\n"); + + ccid_reset(s); +} + /* NOTE: only a single slot is supported (SLOT_0) */ static void ccid_on_slot_change(USBCCIDState *s, bool full) { @@ -1349,14 +1361,6 @@ static void ccid_realize(USBDevice *dev, Error **err= p) s->dev.speedmask =3D USB_SPEED_MASK_FULL; s->notify_slot_change =3D false; s->powered =3D true; - s->pending_answers_num =3D 0; - s->last_answer_error =3D 0; - s->bulk_in_pending_start =3D 0; - s->bulk_in_pending_end =3D 0; - s->current_bulk_in =3D NULL; - ccid_reset_error_status(s); - s->bulk_out_pos =3D 0; - ccid_reset_parameters(s); ccid_reset(s); s->debug =3D parse_debug_env("QEMU_CCID_DEBUG", D_VERBOSE, s->debug); } --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930835; cv=none; d=zohomail.com; s=zohoarc; b=igMyGmZZ0Dc2bzExhtsvNPTXYVNdjd4GkpobOiALZp1xpkR9zSeEKPVR61IVHYrllA1aBnWASp+Bl5tgJEyExrp7kUHej9ytRjoUo0zGQZN2Ges+zqdYEycQw55Wt+FrSXl1Jq+JOUL7xa2UN2PXlABFWtarz+yfja8TmUCtObY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930835; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=9wAdE8mr2uX8uSw90JvEGg/kSqNlIlm9Tunja/FKeME=; b=QwMCKI1Qr0HBBHJ6EpaQZozE35qmi2fps/W1NnoGsT5455xNxev7TLVMj4up4JRVW+xTZM0p/EaLArSwF/o7cvpgfUzrBvdMnMzSDWYRDY1Is/XHhhVCPFyNwnFl6OvOwcOB/J/b9x80m80tVlGnBlo0L2Bo+YjMBWqrh861Fd8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930835914643.8697838842211; Wed, 5 Aug 2026 04:53:55 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraBp-0008VZ-4A; Wed, 05 Aug 2026 07:53:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraBi-0008UN-On for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:53:35 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraBh-0007LX-AD for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:53:34 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-564-mz0zlP3VMS25EJMjdoXRUg-1; Wed, 05 Aug 2026 07:53:19 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6A1611955F2C for ; Wed, 5 Aug 2026 11:53:18 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 5C871422; Wed, 5 Aug 2026 11:53:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930812; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9wAdE8mr2uX8uSw90JvEGg/kSqNlIlm9Tunja/FKeME=; b=bCymij6Y1E7tm3oWW8QkLnPZoY2TezXn/tTptAfixclTaDbp1ojn5G6Ps8ibDIYLQA+vue IvUp3tRli746MTbxflSAGjGm40GvuiKF7v6FiR+7rVU/q1zRn6Q/zUQFUpBPNNhH+65L7O IWPZktDZLYwIqv4oI12t+fyj7pASwXs= X-MC-Unique: mz0zlP3VMS25EJMjdoXRUg-1 X-Mimecast-MFC-AGG-ID: mz0zlP3VMS25EJMjdoXRUg_1785930798 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:01 +0400 Subject: [PATCH 11/27] hw/usb/dev-smartcard-reader: apply backpressure to bulk-out MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-11-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=4307; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=Q7YR25/KA+jsIIkKs7kge1uoqYzd+HF+D6BFaDNCJ6I=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOtPFQpI28iSr62gUaQvbhu2QSpUffWXK6FG D6zS0b7eVqJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrQAKCRDa6OEJdZac 5ZTBD/93flWdfxbUD8ROC6oQtE5kB2e12gx19+dVy1uJ1EkruHLLrOHnPrT2sOrHDKiZaq5luF+ ehPeHdRQQhf0+EbcP8AVcmH8AxMXlOdjKYt90JJqEqHy79K3AZiSy5jw3RDUj3Ugw6nODw2vEB5 Q+VtgCd5tPsLglqHGX1XExVy8caOYQAbTJKXeW40mGbYQWqX0EmVqmLkwiheE2uZs0PLyvLT42W w+V4q4MjyuYKRGPnRKlQ8Rohd+w+WtbvSMdhYnKRmoRQx1MIWrcBjWrejXGOdxZDsRLKnksphRV KukfGaBRlwI16FOkuf5+zlwasc00pIZOUI3mXWsAF3koMj33VDGMtSc1DKsXVI+C343rTG2qBYB R0tWdPaHY/yEuMyWXItPsJ7ezHWS0W/h8TBwEC56HD8whgj9fSeBfu9Lz15koZFwcnAO9/Rux4r 7AnPd8cdomq0ElejcIQjY/bp1LnoGQWLVtKrDAAWpp4+5cQu7yaXXyvAI6Dr0OUwpHxmqVathrt fn3uxuBhGLYTYp8LuEJ3VkOJrZhCUshF6XozaaSvCPrX1K8A7XqBoPd+6NIJGIx3YpuuV+nyBH1 fuUlYux40C+fbiSBMbpXNH1PDgp66alFyuJS3owUwaDu6jvETs+Uein3+EATuXrpAx60uYItJak T8ORmVvW2cQBUkA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930837619158500 A guest can send bulk-out commands faster than the card backend produces responses. Each XfrBlock adds a pending answer slot, and other commands immediately allocate a bulk_in_pending entry. Once all BULK_IN_PENDING_NUM slots are full, ccid_reserve_recv_buf() returns NULL and responses are silently dropped. NAK the bulk-out endpoint at message boundaries when bulk_in_pending_num + pending_answers_num >=3D BULK_IN_PENDING_NUM, so the guest retries later, giving the response pipeline time to drain. Change ccid_write_data_block_answer() to peek the next answer before attempting to write the data block: if the bulk-in ring is full, the pending answer is preserved for retry rather than being consumed and lost. Update ccid_flush_pending_answers() to break on failure so it does not loop forever when the ring is full. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 12c82c8f6458..279fef03652b 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -765,13 +765,13 @@ static void ccid_write_parameters(USBCCIDState *s, CC= ID_Header *recv) usb_wakeup(s->bulk, 0); } =20 -static void ccid_write_data_block(USBCCIDState *s, uint8_t slot, uint8_t s= eq, +static bool ccid_write_data_block(USBCCIDState *s, uint8_t slot, uint8_t s= eq, const uint8_t *data, uint32_t len) { CCID_DataBlock *p =3D ccid_reserve_recv_buf(s, sizeof(*p) + len); =20 if (p =3D=3D NULL) { - return; + return false; } p->b.hdr.bMessageType =3D CCID_MESSAGE_TYPE_RDR_to_PC_DataBlock; p->b.hdr.dwLength =3D cpu_to_le32(len); @@ -788,6 +788,7 @@ static void ccid_write_data_block(USBCCIDState *s, uint= 8_t slot, uint8_t seq, } ccid_reset_error_status(s); usb_wakeup(s->bulk, 0); + return true; } =20 static void ccid_report_error_failed(USBCCIDState *s, uint8_t error) @@ -796,19 +797,26 @@ static void ccid_report_error_failed(USBCCIDState *s,= uint8_t error) s->bError =3D error; } =20 -static void ccid_write_data_block_answer(USBCCIDState *s, - const uint8_t *data, uint32_t len) +static Answer *ccid_peek_next_answer(USBCCIDState *s); + +static bool ccid_write_data_block_answer(USBCCIDState *s, + const uint8_t *data, uint32_t len) { - uint8_t seq; uint8_t slot; + uint8_t seq; + Answer *answer; =20 if (!ccid_has_pending_answers(s)) { DPRINTF(s, D_WARN, "error: no pending answer to return to guest\n"= ); ccid_report_error_failed(s, ERROR_ICC_MUTE); - return; + return false; + } + answer =3D ccid_peek_next_answer(s); + if (!ccid_write_data_block(s, answer->slot, answer->seq, data, len)) { + return false; } ccid_remove_pending_answer(s, &slot, &seq); - ccid_write_data_block(s, slot, seq, data, len); + return true; } =20 static uint8_t atr_get_protocol_num(const uint8_t *atr, uint32_t len) @@ -1008,6 +1016,18 @@ static void ccid_handle_bulk_out(USBCCIDState *s, US= BPacket *p) CCID_Header *ccid_header; uint32_t payload_len; =20 + /* + * Every accepted command either queues a response immediately or comm= its a + * slot to a later APDU response. Apply backpressure before consuming = the + * first packet when all response slots are committed. + */ + if (s->bulk_out_pos =3D=3D 0 && /* start of message */ + s->bulk_in_pending_num + s->pending_answers_num >=3D + BULK_IN_PENDING_NUM) { + p->status =3D USB_RET_NAK; + return; + } + if (p->iov.size + s->bulk_out_pos > BULK_OUT_DATA_SIZE) { goto err; } @@ -1190,7 +1210,9 @@ static void ccid_unrealize(USBDevice *dev) static void ccid_flush_pending_answers(USBCCIDState *s) { while (ccid_has_pending_answers(s)) { - ccid_write_data_block_answer(s, NULL, 0); + if (!ccid_write_data_block_answer(s, NULL, 0)) { + break; + } } } =20 --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930842; cv=none; d=zohomail.com; s=zohoarc; b=TGkdsBe8ibTr/8sPLc6QobF1b6udXNhgedQfhagzMolR+uGdkLqgEgDuuNzvEiGAriPo5XyHa90o4SH5o48u+DivhDgLwINKzaWGrYyz2GYNL9xPSZeE3VOWoA3Vi5eTs0VJ9hy/b1whgDbY5Ir7p27gBkYrNN/SV4Bu7TxaCzg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930842; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=3A4GS1vpubnF8dlvXdHjd6RI2rRgkvNQkvZB1xfjVwU=; b=Wae8KKwmUhj3BRRoW50fuB3bdN27Zh902hQB6uzgM1954PuV90VrVL+qkKd2peUwucVbPMG0DS3SpCJ5gWc5TK+XxqsgMmhDBWaI939QR/10Twu/yPgO1McSuXQAKKLrM3Kn70vnYlXcDEcR5d9KjdKhiSmMLCtDQn9FhB/aJtw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930842211843.8036661469225; Wed, 5 Aug 2026 04:54:02 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraBn-0008Uj-34; Wed, 05 Aug 2026 07:53:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraBh-0008U4-HT for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:53:34 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraBf-0007KS-0T for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:53:32 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-152-2XPe-kDBM5KDYoV6vqsXag-1; Wed, 05 Aug 2026 07:53:29 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 26276195609E for ; Wed, 5 Aug 2026 11:53:28 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 15AC2434; Wed, 5 Aug 2026 11:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930810; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3A4GS1vpubnF8dlvXdHjd6RI2rRgkvNQkvZB1xfjVwU=; b=Cd+/PcY1+5x/s61EXIKatcP9eh1m3tghCgweNT6g+lVmUN4VlhJ0/MXaxeb+k6LX5MKdKw KQmJOiLpWcIDYrghuY2qEBb8uVsDECz+xfgOw2im/+9vGWoBqhTpqsqj/UAhg35ZO5QGm9 7qaozlXq7RPhG0Qn98xnPbL7xIczSD0= X-MC-Unique: 2XPe-kDBM5KDYoV6vqsXag-1 X-Mimecast-MFC-AGG-ID: 2XPe-kDBM5KDYoV6vqsXag_1785930808 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:02 +0400 Subject: [PATCH 12/27] hw/usb/dev-smartcard-reader: fix RDR_to_PC_Parameters dwLength MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-12-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=1846; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=l9YNs4XrELkSPSF5rfSgGqqOZRudYj/BBNDj5rHbBdg=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOtOLlSrZcYYrYccK7b2wjHALrud7F44dsoI a6ArL63OwiJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrQAKCRDa6OEJdZac 5RilD/9lhf1g2e+UW3enTq56FHR3EXtgaKqViL+qkkF62yaKJPg5HNs6CtVfEdiZdGcKn/4t3p9 Alva7aD+0GCSfCGs1Q4T7J7l+ia8SY9cRdH+5ZHQSyuQ0oBMxqvu7gqJCTCHboyCXABRm5mQSlI rwsiwWTsZqaOja4PlhtbcbR7NHgN9bu2uS2YhmCsVZtE1UHdXpZB3I54Ux2xGl04abuHbxmfi8f QUEx91f5Czc0suf9ZGaggJLYrWAIe38yBrXZia1wmK7z9+XDUT+G9dh5nTYIgeibrbVZmFn7pEe JJPW71Dx6JviKx6/xP7NRngQ4K6DqakQy/VIpcXK9l6RSAsgVPH36AD5NrBGT38DrW4Eco1gzLA vuBZpPxQsMLiLIVHh6B0tbUgM8ELH/jcSzWzR8v0NBY+a9KEuohakknelDV76q6FdNeHaHDrSLh 02hAs4YZOAoo4oALBu2pK2483Yq2zBcVH2R4vo5lEWjeIZRozLjC3dIqrOOatDcLIbFfH0q+l9u 8wPHtyIwmJRIWTtwUEemJo5pGe4gst+Pu1A2W3/NUssjuB54jLuUQY2xH0xt/E41pZBtAizSB7Y /iHLv/cUn4ogCShX4B/KSIQZiZetYrzdkfNQRjKlKESw5adgZPh7R9HviGVPkbN0a56y+jq7mFm 3L/XChzyDeEMl5A== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930843596158500 dwLength in the RDR_to_PC_Parameters response was always set to 0 instead of the protocol-dependent size mandated by the CCID spec (5 for T=3D0, 7 for T=3D1). Since bulk_in->len is what determines how many bytes the guest actually reads, the reservation size must also match the wire message size. Set dwLength from bProtocolNum and compute the reservation size accordingly, so the guest receives a spec-compliant response. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 279fef03652b..16f248a0969f 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -748,19 +748,20 @@ static void ccid_write_slot_status(USBCCIDState *s, C= CID_Header *recv) static void ccid_write_parameters(USBCCIDState *s, CCID_Header *recv) { CCID_Parameter *h; + uint32_t dwLength =3D s->bProtocolNum =3D=3D 1 ? 7 : 5; =20 - h =3D ccid_reserve_recv_buf(s, sizeof(CCID_Parameter)); + h =3D ccid_reserve_recv_buf(s, sizeof(h->b) + sizeof(h->bProtocolNum) = + dwLength); if (h =3D=3D NULL) { return; } h->b.hdr.bMessageType =3D CCID_MESSAGE_TYPE_RDR_to_PC_Parameters; - h->b.hdr.dwLength =3D 0; + h->b.hdr.dwLength =3D cpu_to_le32(dwLength); h->b.hdr.bSlot =3D recv->bSlot; h->b.hdr.bSeq =3D recv->bSeq; h->b.bStatus =3D ccid_calc_status(s); h->b.bError =3D s->bError; h->bProtocolNum =3D s->bProtocolNum; - h->abProtocolDataStructure =3D s->abProtocolDataStructure; + memcpy(&h->abProtocolDataStructure, &s->abProtocolDataStructure, dwLen= gth); ccid_reset_error_status(s); usb_wakeup(s->bulk, 0); } --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930851; cv=none; d=zohomail.com; s=zohoarc; b=ECLEGASHDFTnT4fXoLziTQ3ozZLFQyB+tOM1XRfXFrc4ia2r96K13LvvmV7PKeNH3JdK8pctm+28spHCemUdwwqNwD6D3ZKkSssDY/V+JRsFGoJXXQZ1Sdo4jnVyGKQRMv0GGqvJ76K6tXNLRaPFr2upkDGv3owTsyuTUtOQong= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930851; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=6vCMv5OovUEb7vaiFSGmLJ0V5SFUkB5yVKJWL8zrwqk=; b=RXGhKAfU5kBrNHCOOk8hvoDSqFP/2WwVkT5gPL+3MAaqInQ5nA4RaTLTulhwFkZ5oMonPoqyUPLxuHkYwzaS2S9+xuIE2GI2t6SC3HO+aqXdMS6cjuKzZSabvrgGgbrT7kZoIRiEZ/JZDLMoAF45YZDmAfj10eXeG9+ltTKvNlU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930851028337.1869513747024; Wed, 5 Aug 2026 04:54:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraBq-0008Vs-Gc; Wed, 05 Aug 2026 07:53:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraBp-0008Vj-JE for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:53:41 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraBo-0007M6-2I for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:53:41 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-661-QYdQ5m_LOwiRVRZSOLUO-Q-1; Wed, 05 Aug 2026 07:53:38 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1D45C195608D for ; Wed, 5 Aug 2026 11:53:36 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 8D7DE5BC; Wed, 5 Aug 2026 11:53:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930819; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6vCMv5OovUEb7vaiFSGmLJ0V5SFUkB5yVKJWL8zrwqk=; b=VeS47VXhikJP76GaIb/zcReHThCsuYK+L92ErD1qDNj5gQUoR0uMAuKE+kl3s8bhYzy26k 0P9PT06X4vRJ/oMfCgPncj07b8WvOTNt+diSWVGGaTcHPhnIzhsTTAnaM+EuEqoe3J96aN ctEqBp5/BJ/2ffFZ0NZFTG+G+1n27ZQ= X-MC-Unique: QYdQ5m_LOwiRVRZSOLUO-Q-1 X-Mimecast-MFC-AGG-ID: QYdQ5m_LOwiRVRZSOLUO-Q_1785930816 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:03 +0400 Subject: [PATCH 13/27] hw/usb/dev-smartcard-reader: reject oversized responses safely MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-13-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=2388; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=51tZEZWvmdqvOJzg4RDlKTdtEHLsJlHYExzuAp1XPao=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOtFDhQwUbWs+l9xTjmirMS5eF1TwbHPp6LM RgTOfRU0lmJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrQAKCRDa6OEJdZac 5Y7sEACoZ9MXM2Ln6UUoPhma9obuhPGQ503YiYiEFw6dhHfU7GV3iHL3D/b6pARoC2amVXn1w0d 8A/xC5ia2Dk2YhS3T/9kVRypp0yVaCt5Eea8Bz73cDYrslsTV2RAeWOVC2mEjPSJbwKVB2bCfXC WHPaSzzFG4USXjharxjm0P+PVPuVAAfvzo1YPk3LP2Tp8vVeGNeJUNC2I6FuSwNr5BenU0KIyXh NTRJb2DujQ9ZmrbzVt1vNV7bEWvdhPAoReOUt4UDCmTA9zrdfoxMePtUD3N+0YQzWQc5AA4gs7a c27LXFfINXvUtngWY7woEDXyWGLY9rOJIX7h994GJXBlNhOJuWYN5SE34d1X+c1UBEvBnvw0LFq yHgnBZc66pvWrtuOxocQ3mWkcAmbGlp/XcQRcraf+KHQY/jtEUXF9Cf66asWLj3exuJBkotS41y CAjXL3iNHaoS/EtGn7aQWZ0VNz/sZN/ugHhzYb5oUgXxqENR2Xsk2QSDzKxabp0zdpGsXqgs0ge 1szi5apKF/XFqvwTsKHjFcT/8x1al5TxRaxfpMs2/pwhZQXC/5Iw0xG1Rpkd1GHW5e2H3y8BGcw UWRPSPS/Hen9W7XvvxmA91vihSIjYRX3Kp2nAU6Es37JyVENOWqUjv3DcSinnNXXkceBJq5TZpz CXegXnnRhtwxQfA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930852092158501 ccid_reserve_recv_buf() takes a uint16_t length, so the result of sizeof(CCID_DataBlock) + len silently truncates when the sum exceeds 65535. This could bypass the BULK_IN_BUF_SIZE check inside the function, leading to a buffer overrun on the fixed-size BulkIn.data array. The response length comes from the card backend (passthru chardev or libcacard), not from the guest, so this is not guest-exploitable but still worth hardening against a buggy or compromised backend. Fix this by adding explicit overflow-safe checks in both callers that add a header to the payload: ccid_write_data_block() returns false on oversized input, and ccid_write_data_block_answer() reports ERROR_HW_ERROR to the guest and sends a zero-length data block so the answer queue stays in sync. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 16f248a0969f..d91376826c5c 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -769,7 +769,13 @@ static void ccid_write_parameters(USBCCIDState *s, CCI= D_Header *recv) static bool ccid_write_data_block(USBCCIDState *s, uint8_t slot, uint8_t s= eq, const uint8_t *data, uint32_t len) { - CCID_DataBlock *p =3D ccid_reserve_recv_buf(s, sizeof(*p) + len); + CCID_DataBlock *p; + + if (len > BULK_IN_BUF_SIZE - sizeof(*p)) { + DPRINTF(s, D_WARN, "data block is too large (%u bytes)\n", len); + return false; + } + p =3D ccid_reserve_recv_buf(s, sizeof(*p) + len); =20 if (p =3D=3D NULL) { return false; @@ -813,6 +819,14 @@ static bool ccid_write_data_block_answer(USBCCIDState = *s, return false; } answer =3D ccid_peek_next_answer(s); + if (len > BULK_IN_BUF_SIZE - sizeof(CCID_DataBlock)) { + DPRINTF(s, D_WARN, + "APDU response is too large (%u bytes), returning an error= \n", + len); + ccid_report_error_failed(s, ERROR_HW_ERROR); + data =3D NULL; + len =3D 0; + } if (!ccid_write_data_block(s, answer->slot, answer->seq, data, len)) { return false; } --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930871; cv=none; d=zohomail.com; s=zohoarc; b=hn2i4KoKGufT2p1fH+xazE0ILytNnbCvxI1bU58AiVM3wh9w3CuzdynhZWPWERDbdJid0WcYEVNO8KQFrJuzFiC/H+Rrjk+MXm2Mh2chhjmyqXmVUB0IobwGWm85FCDsL62if3VevxObyyTyv5AOTMwWhrCrkT/sL6j9h371LnE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930871; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=x2LvSbpEtJbg0iXFtoQWnSmsjH8S4wATFWNebm0al14=; b=S/EbH4kJUOixkqliYpU9547fEQCJjl2Xdip+QsYQs4RoQ8R3rqvDWVJa9o88oq0ZGaojZhbVrgkgBlFvzxMSnyEqHsB6MgfjLMtqzqVM7CBLf2ekb72IPnXRy1axJz7tssOzDp3LIk1SN7tkoVAyqn3A1yZzldGnHK+Vgjl8juk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178593087111336.85868227912363; Wed, 5 Aug 2026 04:54:31 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraCF-0000Xu-Ey; Wed, 05 Aug 2026 07:54:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCD-0000Kz-Au for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:05 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCB-0007N8-NL for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:05 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-121-l9WurMXWPQmYNEJmFqomCA-1; Wed, 05 Aug 2026 07:53:51 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 8DE0618005B3 for ; Wed, 5 Aug 2026 11:53:44 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 88B5A30001A2; Wed, 5 Aug 2026 11:53:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930836; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=x2LvSbpEtJbg0iXFtoQWnSmsjH8S4wATFWNebm0al14=; b=Y7bWVcUx8N8fPSOICDlNfLFO7JQUch/ccKuFoDF+BYzhAas3DbqxxFzVYbQP5M9ZZtOSa/ SFz9j2nQ9/nqYIBGxoCRPWXx6GtluTy6IMw+2jUV7E73+nFiTj3/W4Km+/VX92bk0Mp16m SuGOU8bXCJ2T7mfF/Vczk00fh9OTJqo= X-MC-Unique: l9WurMXWPQmYNEJmFqomCA-1 X-Mimecast-MFC-AGG-ID: l9WurMXWPQmYNEJmFqomCA_1785930824 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:04 +0400 Subject: [PATCH 14/27] hw/usb/dev-smartcard-reader: release short bulk-in responses with xHCI MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-14-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=2495; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=SXyXnV8aFURBX1WRd2SUK2xEo9JlBeWQEIYyVupgC9g=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOtMcUQa1JVGIds+v3A7CB6xZqnMGAc3WBT0 LVYQ4PYMmeJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrQAKCRDa6OEJdZac 5aVSEACBN3MYN5om4/YOAsLhPbdoB2rt8ENordKLEhIhaknsauv9yZunCyTjGBTVONNnHvEZkHJ POzWV5ords2X3k+/KtLp4JxQTXfiWPuSzLz9BOO/R+jGHeoWzWoVapGHMtcmIuyQ0Ij1rCrUcIJ HbTXHb0kLNb2L43q9/7V7SlkfSDjo+JHNvtvoG2DSq/nKkJkv3gq6byIl9gL1ypKzwDr5617zbK WBY0eZtknm5sHIfbFAMJ2bloOLssePsb+3YfnxCypld48UvnlN5Q/FQ6yJbD+5f+l/GhszmuKEE /QQqlaisyStDENqf/Vzfnmbv4qsXTYv2hPm0sB13albR9TjgvJ5oLcT0hYFDd27F0HChd+191SM AFZ8nB2I4qYy04emGoF3XGNVVZsu4V1pMOO2ll3j5SIt7Sq10c46bJhupP+NAWKjqOB7gqpPlV4 vjNCF/zkPQS1Unh9tiVzcw/kh0kVcUriJR9ZsN8dKBvq8YeUgcqGH1jJSOuntb216MRy4F/o39h bxixJznGXbNRYyfzS6y149axyIhFaqWBgWwPD3uNdzAH2ziLgIi+RC2+DBFAHNMXZhFvK4GWPYj IVJ1ZrcuDs/3bul8hQuo6qpOWQER/CGVmZ3svsCyRaIl/jB6JNBhKgqm1EvmVqIsKf3/+Cc+ak4 91jHGXYvuDsRMhw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930872140158500 USBPacket describes the host controller's complete transfer request, not necessarily one packet on the USB wire. xHCI maps the buffers from all TRBs in a transfer descriptor into a single USBPacket, so p->iov.size can be much larger than the CCID bulk endpoint's 64-byte wMaxPacketSize. The smartcard reader kept a completed bulk-in response queued whenever the last copied chunk was exactly 64 bytes. This is necessary when the guest requested exactly 64 bytes: the next IN request must receive a zero-length packet to mark the end of the response. It is wrong when xHCI supplied a larger buffer, however. In that case the 64-byte result is already short relative to the USBPacket and xHCI completes the TD. Keeping the response current leaves it waiting for a ZLP request which never arrives and prevents later smartcard responses from being delivered. Release an exact-64-byte response when it is shorter than the host controller request, while retaining it for a request of exactly one maximum-sized packet. This fixes smartcard reader with xHCI. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index d91376826c5c..699e236f624e 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1132,8 +1132,7 @@ err: s->bulk_out_pos =3D 0; } =20 -static void ccid_bulk_in_copy_to_guest(USBCCIDState *s, USBPacket *p, - unsigned int max_packet_size) +static void ccid_bulk_in_copy_to_guest(USBCCIDState *s, USBPacket *p) { int len =3D 0; =20 @@ -1148,7 +1147,7 @@ static void ccid_bulk_in_copy_to_guest(USBCCIDState *= s, USBPacket *p, } s->current_bulk_in->pos +=3D len; if (s->current_bulk_in->pos =3D=3D s->current_bulk_in->len - && len !=3D max_packet_size) { + && (len !=3D CCID_MAX_PACKET_SIZE || len < p->iov.size)) { ccid_bulk_in_release(s); } } else { @@ -1180,7 +1179,7 @@ static void ccid_handle_data(USBDevice *dev, USBPacke= t *p) case USB_TOKEN_IN: switch (p->ep->nr) { case CCID_BULK_IN_EP: - ccid_bulk_in_copy_to_guest(s, p, dev->ep_ctl.max_packet_size); + ccid_bulk_in_copy_to_guest(s, p); break; case CCID_INT_IN_EP: if (s->notify_slot_change) { --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930862; cv=none; d=zohomail.com; s=zohoarc; b=K+mBnpx3YfkodNdFwp8c6cySd/vRfIhI6jnV0+wjJ9LRjUeHy1fVsIBUGaIreQY6+IsAirmNcaHCJ8Zo5dCt2ahNttzOYeuv/h7H5xqOXRdxAtqEMYI3f9/mxnRD56FyfbRrxFQhmjuNkR+65GF2pzt+gG3AQNDeoYy0Eek/ynA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930862; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=5jDhb2tARuSf+YKnlUfn3SUaBnFFNuXdl0nurjHO2es=; b=nB2Fr48tsySbDaMCvsSDOaLeutWJdNGmGk/jmQKpC6BG+F0r8Yl49m2lfgEjONVVt81t7BQAESfk98kF57Kj7IVncKl+P1xeEY5JYYb8gAbPVetyv1B3sODMd8IFV20Df89mJbI+7e618bMMyv0hPV0LrsjoHtICvfieX1djd/Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930862866923.6763806165178; Wed, 5 Aug 2026 04:54:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraCH-0000k7-JV; Wed, 05 Aug 2026 07:54:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCF-0000aJ-O7 for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:07 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCD-0007PK-Ts for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:07 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-338-KZ0bwLT9NBeJ8nXM54CwdQ-1; Wed, 05 Aug 2026 07:53:57 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 55FD018001E3 for ; Wed, 5 Aug 2026 11:53:56 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id A75181956041; Wed, 5 Aug 2026 11:53:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930845; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5jDhb2tARuSf+YKnlUfn3SUaBnFFNuXdl0nurjHO2es=; b=IMQK+B8NG896ZgE+Rn65IwQNST9Omknrg99pggITwvJUBmUV9Tcbqz7T5+6blzgKQTxe5M kE/W+Ip2BqICMJFYuJ+KQQm2FfKLecNx1Uh6zyGWRzy1sPVx2+Nsxp9e0WZJH+aUqQtAy5 G+KaMBFdtEkHtqi075xI5W0mSgQG4Uk= X-MC-Unique: KZ0bwLT9NBeJ8nXM54CwdQ-1 X-Mimecast-MFC-AGG-ID: KZ0bwLT9NBeJ8nXM54CwdQ_1785930836 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:05 +0400 Subject: [PATCH 15/27] hw/usb/dev-smartcard-reader: drop current_bulk_in pointer MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-15-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=4087; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=6DXD21OlPSmolUfb9FpDK83hcl7TtJL+zhY9NAez3qc=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOtpYhXDuEwnHeaT671r47apxRl5xmLUK8Q0 6DeqYsKwjCJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrQAKCRDa6OEJdZac 5d8eD/0SjL9NQ0/kDbJAHl0AqVd7fmiVog+L6cWxYEQDfbDyw61BZmLdEbzkzVCqxB3QMVhG6BR Lue5e5iQL/hPKP38N3tStEwfIpcYgLseNHLgIAQvweNtvbru4m86C0mAIDTkqQtmagEXzYMFoCo YWb3c6tg7vss5zJGMzDArCT6xSetcogiqZEIh+cAK43sRHIZq3U9iL+TRfrtbYihkkTF9tiiLTw R32bZFvY3cyTlPnPr3ZH7meQIvLDxgSxBufn9gEy5ZAsuVhNO3vaiRd2w2e+srn7jPRM/uQMWte gk0sKIzzKAVRzDkl0KTKG7NW+UCGObkdVUbVO1Cjl7cpgHCTWmmMiV/6SoO0mlWpd+ZOrS6+oUn y4CFWQ70YahdfuYza06rdrvrddw0FImoxlZYvRG+PoNnzvQcEeya6YHsmgkssWIYCogDoAVAFEh IyYsfFm27HxlSPO3jLV5gCh2zoBedcjudUsnHMjnhYM1hcLjJYJT2IsYz3AsKYJVwjY5U+q1Trf 7oMZkRjrrWYkmxHnx/AOa8LmWeNNgJs1qoGJjAUnSOVagcBLczqtk7ssamxbf0AerXslckeAzqs 6pfZJw101NnwhZ2XqtLFcVZpsq4DwTCSWH6yd45Ez21ufZjC2KVLI0q9w/VCeLxupl+VQLpCOOB A63BGUsNhi0i8mg== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930864195158500 Replace the eagerly-dequeued current_bulk_in pointer with a ccid_bulk_in_peek() that returns the head of the ring without advancing it. The element now stays at bulk_in_pending[start] while being partially consumed, and start is advanced together with the num decrement in ccid_bulk_in_release(). This removes a field from USBCCIDState and simplifies the bulk-in ring buffer lifecycle from three states (queued, grabbed, released) down to two (queued, released). Note that this changes the semantic of bulk_in_pending_start in the migration stream too. But since migration with pending current_bulk_in was broken, this doesn't make further damages. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 42 +++++++++++++++++++++------------------= --- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 699e236f624e..3f128791f3ef 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -296,7 +296,6 @@ struct USBCCIDState { uint32_t bulk_in_pending_start; uint32_t bulk_in_pending_end; /* first free */ uint32_t bulk_in_pending_num; - BulkIn *current_bulk_in; uint8_t bulk_out_data[BULK_OUT_DATA_SIZE]; uint32_t bulk_out_pos; uint64_t last_answer_error; @@ -583,24 +582,27 @@ static void ccid_bulk_in_clear(USBCCIDState *s) s->bulk_in_pending_start =3D 0; s->bulk_in_pending_end =3D 0; s->bulk_in_pending_num =3D 0; - s->current_bulk_in =3D NULL; } =20 static void ccid_bulk_in_release(USBCCIDState *s) { - assert(s->current_bulk_in !=3D NULL); - s->current_bulk_in->pos =3D 0; - s->current_bulk_in =3D NULL; + BulkIn *bulk_in; + + assert(s->bulk_in_pending_num > 0); + bulk_in =3D + &s->bulk_in_pending[s->bulk_in_pending_start % BULK_IN_PENDING_NUM= ]; + bulk_in->pos =3D 0; + s->bulk_in_pending_start++; s->bulk_in_pending_num--; } =20 -static void ccid_bulk_in_get(USBCCIDState *s) +static BulkIn *ccid_bulk_in_peek(USBCCIDState *s) { - if (s->current_bulk_in !=3D NULL || s->bulk_in_pending_num =3D=3D 0) { - return; + if (s->bulk_in_pending_num =3D=3D 0) { + return NULL; } - s->current_bulk_in =3D - &s->bulk_in_pending[(s->bulk_in_pending_start++) % BULK_IN_PENDING= _NUM]; + return &s->bulk_in_pending[ + s->bulk_in_pending_start % BULK_IN_PENDING_NUM]; } =20 static void *ccid_reserve_recv_buf(USBCCIDState *s, uint16_t len) @@ -1135,18 +1137,17 @@ err: static void ccid_bulk_in_copy_to_guest(USBCCIDState *s, USBPacket *p) { int len =3D 0; + BulkIn *bulk_in; =20 - ccid_bulk_in_get(s); - if (s->current_bulk_in !=3D NULL) { - assert(s->current_bulk_in->pos <=3D s->current_bulk_in->len); - len =3D MIN(s->current_bulk_in->len - s->current_bulk_in->pos, - p->iov.size); + bulk_in =3D ccid_bulk_in_peek(s); + if (bulk_in !=3D NULL) { + assert(bulk_in->pos <=3D bulk_in->len); + len =3D MIN(bulk_in->len - bulk_in->pos, p->iov.size); if (len) { - usb_packet_copy(p, s->current_bulk_in->data + - s->current_bulk_in->pos, len); + usb_packet_copy(p, bulk_in->data + bulk_in->pos, len); } - s->current_bulk_in->pos +=3D len; - if (s->current_bulk_in->pos =3D=3D s->current_bulk_in->len + bulk_in->pos +=3D len; + if (bulk_in->pos =3D=3D bulk_in->len && (len !=3D CCID_MAX_PACKET_SIZE || len < p->iov.size)) { ccid_bulk_in_release(s); } @@ -1439,8 +1440,7 @@ static bool ccid_pre_save(void *opaque, Error **errp) { USBCCIDState *s =3D opaque; =20 - if (s->pending_answers_num || s->bulk_in_pending_num || - s->current_bulk_in) { + if (s->pending_answers_num || s->bulk_in_pending_num) { error_setg(errp, "usb-ccid has pending queue state which cannot be= " "migrated safely"); return false; --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930871; cv=none; d=zohomail.com; s=zohoarc; b=DNlR80O/lTaB3AoGeBFtlGwWtbAmzTo7gV5fdw7iu2pE9uTVR/rFgY4SCqp4GtVwSQN0B30NPsVuxQA6IgCzG2akA5fw7mUDdagBWv8buC+mllL92hmD8IDa+sf9Xa1D+EH1sBUD8fIr2apF615CMxHfkOFMEbAVU+on5ccaa4k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930871; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bNF4m7ci2HpS4FLloHT0Tdnt7xTANURrOcHGQaUioKA=; b=KlOn/mahOq1mt/njc/PrDrF8d+uEwaot1/7rMiD/2e6fuheFvIQW+5vxu8ZC8aatReMcJWAxrckAgZtFo0ZfqZshcbZ5lzNG+PwSNRAR/lQlPEFVX+xqs62aBqAusQguPd4s/el/v1ebA+cMm2u0VKt9kvY24AqvMz3+2b75pNo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930871815691.2635900624442; Wed, 5 Aug 2026 04:54:31 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraCI-0000nM-09; Wed, 05 Aug 2026 07:54:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCF-0000ah-Pt for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:07 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCD-0007PH-Rx for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:07 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-556-XqSnDyqhPliJ_7APD2Tg6w-1; Wed, 05 Aug 2026 07:54:04 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 45D7B180035C for ; Wed, 5 Aug 2026 11:54:03 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id CB4CC1956041; Wed, 5 Aug 2026 11:54:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930845; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bNF4m7ci2HpS4FLloHT0Tdnt7xTANURrOcHGQaUioKA=; b=erb9SSFcy/PUuhcIe5cgKXXS+uk01RZ5ntQqttcfS6aqvBwUiUaI63GaQMYTw/2VAnz6Ra E9EyyollM0LA7P83vpt+ur06b7Zar63tCXL/xmzmJQ/P3yGdHkqWUJxC8EsbDiuPoWmIUk 9C3XXrBJURI1dRq7DjfbxXd4lEX5dcs= X-MC-Unique: XqSnDyqhPliJ_7APD2Tg6w-1 X-Mimecast-MFC-AGG-ID: XqSnDyqhPliJ_7APD2Tg6w_1785930843 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:06 +0400 Subject: [PATCH 16/27] hw/usb/dev-smartcard-reader: derive queue counts from start/end indices MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-16-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=7282; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=1eY9L4oL2U9UI9yiBIqtLr7IOpTEn1kS0NTCXyCacf0=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOuIVgqzSwje6deBGO0n71oFACC0BKKg7Uvp JSSq9/YXU+JAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrgAKCRDa6OEJdZac 5SUrD/9ry6/tzKa0EDycUWC1SZGAliuNsUurlhXrfF7cxK/Qr3q9439T0u54ahlYy3VbW086N6l 5wOqtB82H2Wjc4KG3f81yQaFuIH9+raqIMRCpMeSNbhYS/AYp2aTsMqvBHzZybWMxVT/eyvKrZj B/Uh52QznoTtQLrth1EBOLuyJvgyOTsj5L/wR3ePXTpjuzzphYh58LlXP2sZmuWaFIMpmkCCBxx y1R/XnWMFtcQ0L5PuE3/iJicMLzbsJJZvM/ji+IxTf6Ga27nORZk1ZKRIBljXti3i7jX0Cx/hv4 apHTvlBez2mItplw3cboMGW+9RDcEZjtaCv7Gi4oU+glNkqzzVIAd/597OUTGLCrDfZRY1/sKRD h/NjCGGxgItuZl+a/9y+W/FOHnjyjpabHJ3DHVajdOOr6LbvDVmVVpQQ9L9/8nsCKM/DdEE8idP r+1r+qz/EvsdJcOP2umiVyR+Qqe4h/xKXr/e9ta17mWBx71aRcJGAib+ObfEWtF4dQsuVqHrq8n qMLPAWs0zCvIq0+XpNMeh++CDnO60LzCN2gfsfhQFCoZFO1Ejdp9s6v3fyvP4LAwqLrDn3X/Th9 H3D23tyQncopMxBoUAoT9IaT2/GywyNa4wqgaRl/t4Qa3v99R+lAS/0uU1QGk0Kpt3eQpFzDwSW 6CS1b+5DdX9m9iw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -28 X-Spam_score: -2.9 X-Spam_bar: -- X-Spam_report: (-2.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930872198158500 Replace the redundant bulk_in_pending_num and pending_answers_num shadow counters with helper functions that compute the count from (end - start). This removes redundant bookkeeping and potential issues. pending_answers_num is kept for migration reasons, but since pending_answers_{start,end} are not migrated, we can just do a best effort for the following migration fix. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 47 +++++++++++++++++++++++++--------------= ---- 1 file changed, 27 insertions(+), 20 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 3f128791f3ef..e3c86cb90e6c 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -295,14 +295,13 @@ struct USBCCIDState { BulkIn bulk_in_pending[BULK_IN_PENDING_NUM]; /* circular */ uint32_t bulk_in_pending_start; uint32_t bulk_in_pending_end; /* first free */ - uint32_t bulk_in_pending_num; uint8_t bulk_out_data[BULK_OUT_DATA_SIZE]; uint32_t bulk_out_pos; uint64_t last_answer_error; Answer pending_answers[PENDING_ANSWERS_NUM]; uint32_t pending_answers_start; uint32_t pending_answers_end; - uint32_t pending_answers_num; + uint32_t pending_answers_num; /* for migration compatibility */ uint8_t bError; uint8_t bmCommandStatus; uint8_t bProtocolNum; @@ -315,6 +314,20 @@ struct USBCCIDState { bool accurate_message_length; }; =20 +static uint32_t ccid_bulk_in_pending_num(USBCCIDState *s) +{ + uint32_t n =3D s->bulk_in_pending_end - s->bulk_in_pending_start; + assert(n <=3D BULK_IN_PENDING_NUM); + return n; +} + +static uint32_t ccid_pending_answers_num(USBCCIDState *s) +{ + uint32_t n =3D s->pending_answers_end - s->pending_answers_start; + assert(n <=3D PENDING_ANSWERS_NUM); + return n; +} + /* * CCID Spec chapter 4: CCID uses a standard device descriptor per Chapter= 9, * "USB Device Framework", section 9.6.1, in the Universal Serial Bus @@ -513,12 +526,11 @@ static void ccid_card_apdu_from_guest(CCIDCardState *= card, =20 static bool ccid_has_pending_answers(USBCCIDState *s) { - return s->pending_answers_num > 0; + return ccid_pending_answers_num(s) > 0; } =20 static void ccid_clear_pending_answers(USBCCIDState *s) { - s->pending_answers_num =3D 0; s->pending_answers_start =3D 0; s->pending_answers_end =3D 0; } @@ -533,7 +545,7 @@ static void ccid_print_pending_answers(USBCCIDState *s) DPRINTF(s, D_VERBOSE, " empty\n"); return; } - for (i =3D s->pending_answers_start, count =3D s->pending_answers_num ; + for (i =3D s->pending_answers_start, count =3D ccid_pending_answers_nu= m(s) ; count > 0; count--, i++) { answer =3D &s->pending_answers[i % PENDING_ANSWERS_NUM]; if (count =3D=3D 1) { @@ -548,8 +560,7 @@ static void ccid_add_pending_answer(USBCCIDState *s, CC= ID_Header *hdr) { Answer *answer; =20 - assert(s->pending_answers_num < PENDING_ANSWERS_NUM); - s->pending_answers_num++; + assert(ccid_pending_answers_num(s) < PENDING_ANSWERS_NUM); answer =3D &s->pending_answers[(s->pending_answers_end++) % PENDING_ANSWERS_N= UM]; answer->slot =3D hdr->bSlot; @@ -562,8 +573,7 @@ static void ccid_remove_pending_answer(USBCCIDState *s, { Answer *answer; =20 - assert(s->pending_answers_num > 0); - s->pending_answers_num--; + assert(ccid_pending_answers_num(s) > 0); answer =3D &s->pending_answers[(s->pending_answers_start++) % PENDING_ANSWERS= _NUM]; *slot =3D answer->slot; @@ -581,24 +591,22 @@ static void ccid_bulk_in_clear(USBCCIDState *s) } s->bulk_in_pending_start =3D 0; s->bulk_in_pending_end =3D 0; - s->bulk_in_pending_num =3D 0; } =20 static void ccid_bulk_in_release(USBCCIDState *s) { BulkIn *bulk_in; =20 - assert(s->bulk_in_pending_num > 0); + assert(ccid_bulk_in_pending_num(s) > 0); bulk_in =3D &s->bulk_in_pending[s->bulk_in_pending_start % BULK_IN_PENDING_NUM= ]; bulk_in->pos =3D 0; s->bulk_in_pending_start++; - s->bulk_in_pending_num--; } =20 static BulkIn *ccid_bulk_in_peek(USBCCIDState *s) { - if (s->bulk_in_pending_num =3D=3D 0) { + if (ccid_bulk_in_pending_num(s) =3D=3D 0) { return NULL; } return &s->bulk_in_pending[ @@ -618,14 +626,13 @@ static void *ccid_reserve_recv_buf(USBCCIDState *s, u= int16_t len) __func__, len, BULK_IN_BUF_SIZE); return NULL; } - if (s->bulk_in_pending_num >=3D BULK_IN_PENDING_NUM) { + if (ccid_bulk_in_pending_num(s) >=3D BULK_IN_PENDING_NUM) { DPRINTF(s, D_WARN, "usb-ccid.c: %s: No free bulk_in buffers. " "discarding message.\n", __func__); return NULL; } bulk_in =3D &s->bulk_in_pending[(s->bulk_in_pending_end++) % BULK_IN_PENDING_N= UM]; - s->bulk_in_pending_num++; bulk_in->len =3D len; return bulk_in->data; } @@ -988,7 +995,7 @@ static void ccid_on_apdu_from_guest(USBCCIDState *s, CC= ID_XferBlock *recv) ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); return; } - if (s->pending_answers_num > 0) { + if (ccid_pending_answers_num(s) > 0) { DPRINTF(s, D_WARN, "usb-ccid: slot already busy, rejecting apdu\n"); ccid_report_error_failed(s, ERROR_CMD_SLOT_BUSY); @@ -1039,7 +1046,7 @@ static void ccid_handle_bulk_out(USBCCIDState *s, USB= Packet *p) * first packet when all response slots are committed. */ if (s->bulk_out_pos =3D=3D 0 && /* start of message */ - s->bulk_in_pending_num + s->pending_answers_num >=3D + ccid_bulk_in_pending_num(s) + ccid_pending_answers_num(s) >=3D BULK_IN_PENDING_NUM) { p->status =3D USB_RET_NAK; return; @@ -1233,7 +1240,7 @@ static void ccid_flush_pending_answers(USBCCIDState *= s) =20 static Answer *ccid_peek_next_answer(USBCCIDState *s) { - return s->pending_answers_num =3D=3D 0 + return ccid_pending_answers_num(s) =3D=3D 0 ? NULL : &s->pending_answers[s->pending_answers_start % PENDING_ANSWERS_N= UM]; } @@ -1440,7 +1447,7 @@ static bool ccid_pre_save(void *opaque, Error **errp) { USBCCIDState *s =3D opaque; =20 - if (s->pending_answers_num || s->bulk_in_pending_num) { + if (ccid_pending_answers_num(s) || ccid_bulk_in_pending_num(s)) { error_setg(errp, "usb-ccid has pending queue state which cannot be= " "migrated safely"); return false; @@ -1512,7 +1519,7 @@ static const VMStateDescription ccid_vmstate =3D { VMSTATE_UINT32(bulk_in_pending_end, USBCCIDState), VMSTATE_STRUCT_ARRAY(pending_answers, USBCCIDState, PENDING_ANSWERS_NUM, 1, answer_vmstate, Answer), - VMSTATE_UINT32(pending_answers_num, USBCCIDState), + VMSTATE_UINT32(pending_answers_num, USBCCIDState), /* for compatib= ility */ VMSTATE_UNUSED(1), /* was migration_state */ VMSTATE_UINT32(state_vmstate, USBCCIDState), VMSTATE_END_OF_LIST() --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930877; cv=none; d=zohomail.com; s=zohoarc; b=i+HhA5ioSuY3abBk1iEBtJkxq20yVJUHS68iV0IPht/dl4rHM47BWxDk3yvORhh8yEW2CtuXx2dpHL+/EcJDVHcksO2x10D84WB5kWy/fAl2K5DtjO6aT9LTcpJJwctzx3C0nMUIwBVRGeUZtw3CotaB+RCD4ktLoJ7hcaiqx3Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930877; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=AHSJYHAh8P51d2wOrkpD/aaXu8nPUjIU+7SM2v0XY2o=; b=R8sM+4BDZv2NyeW/nKsFv+iYI64/CogDghd7mT/gyTb6ibgOaV5oZ+2so6ZLDIxPt/LGv2Fc3lHQXO0XiIYOF1kdu0k+mpdGkZaKwKwhvi1LE6uycPjvB3Ewz/rafc8KKWHWrA+K6b3l6Q8d/F1d/29z3AyjHpjzP8IloizGqao= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930877755222.4099764329634; Wed, 5 Aug 2026 04:54:37 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraCX-0001Nw-Ev; Wed, 05 Aug 2026 07:54:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCR-0001Js-92 for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:20 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCP-0007Q6-G9 for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:19 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-623-APumHMs-N6e1J9zdrTbzgQ-1; Wed, 05 Aug 2026 07:54:13 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A902618001D7; Wed, 5 Aug 2026 11:54:12 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 105CB422; Wed, 5 Aug 2026 11:54:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930856; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AHSJYHAh8P51d2wOrkpD/aaXu8nPUjIU+7SM2v0XY2o=; b=i6T58KwI8tfWkkUhuHh0lKmLbz7Y/AJS9wiBtNjhr8uQFrOxNKDFnFGezNyUzKXLEA4N6y k6JXiOTmTv17f1bPS+3XApZOQ82uxGtHrKypxQ299kApONsIh7PanvJMY5mRcCA13TwQY0 SmgH43uEJyMCRfYEx9+AiPMNzUm88w0= X-MC-Unique: APumHMs-N6e1J9zdrTbzgQ-1 X-Mimecast-MFC-AGG-ID: APumHMs-N6e1J9zdrTbzgQ_1785930852 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:07 +0400 Subject: [PATCH 17/27] hw/usb/dev-smartcard-reader: fix pending queue migration MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-17-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Zhao Liu X-Developer-Signature: v=1; a=openpgp-sha256; l=5888; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=SAviAdY4YXb4F2wTQFY6tqn5wKJuu3AagelCrnSXmKI=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOuGeeHSPj2J1ujiZvJj34QtLAQEICiT04ce yEuSId90cGJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrgAKCRDa6OEJdZac 5dyZEACPr1AELHe9knVSGYhxYrZ+xw33dMuzVFf5IHPrNziFvRnejU/XirO+rndEzulPF/N91OA G7yUC+PsEuTnODsc0uFwzXkWDx4Dks0lrQqGWfKkO8Ow6a1qI1HsnAYsit86v0Ght0uD2OVsBXx pSiuYqm/m64Vq7v7IA9XV60aQy41XnorOIJug9kxSyws5XazvFCwvTWCY9Jpm3n+bQbkyt7SGti 9AAsRKM7nIWQdhyRA6/UL8k50d/UmdshNplJyFHzqrQc9TNEt4mTlZVR0lPk9aIYD/O5msOKKoQ 582PngQW0ZsE3IBeTxjUQQPSLlfSdrGSS0YWiPZx+BzWIBAxv29c681omQyeI+2QQg89mbeAVW0 e6nU4w9M1vgQWoNh2RheuE6DnylkGfje3/HN3SZ488jCItfudHhXWfCFPIuXQY6LHaHCrnJiaCA kqbcMiCIqHUW/5yJ7xpG/ply6RoMs3OEsxOiIeCWqYxs3Damwo3PMhRGmAAHynuKevWHOTeEf7K 9vkFFm0EfR23VUBOxpbClPgnOJ35TXh+S2yjcCUvf1hCSTZOR0aItorOpeqlDH4Yr9N4GgcvQlt hYgbBxOxCjVlfidU37WZ0yMyMuo51z04PnmQyj3wb8fvihyt6pAALp9EENyGULPAiw1pliE9V6w jFyCmw2cBmhZWfA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930878291158501 The original vmstate migrated the bulk_in_pending and pending_answers arrays but not the pending_answers queue indices (pending_answers_start, pending_answers_end). This made migration silently lose in-flight smartcard responses. Add a vmstate subsection "usb-ccid/pending-answers" that migrates the missing pending_answers indices. A compat property x-migrate-pending-answers (default on, off for <=3D 11.0) gates the subsection so older machine types keep the old behavior. Populate pending_answers_num in pre_save so post_load can reconstruct start/end when loading from an older source that lacks the subsection. When the subsection is absent, post_load derives pending_answers start/end from the legacy count. Validate all wire-sourced indices and bulk-in entry bounds on load. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/core/machine.c | 1 + hw/usb/dev-smartcard-reader.c | 70 +++++++++++++++++++++++++++++++++++++++= +--- 2 files changed, 67 insertions(+), 4 deletions(-) diff --git a/hw/core/machine.c b/hw/core/machine.c index 01e50ebe05e0..28842f53ae4f 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -52,6 +52,7 @@ GlobalProperty hw_compat_11_0[] =3D { { TYPE_ARM_SMMUV3, "oas", "44" }, { "migration", "switchover-ack-legacy", "on" }, { "usb-ccid", "x-accurate-message-length", "off" }, + { "usb-ccid", "x-migrate-pending-answers", "off" }, }; const size_t hw_compat_11_0_len =3D G_N_ELEMENTS(hw_compat_11_0); =20 diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index e3c86cb90e6c..5ca50c111217 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -312,6 +312,8 @@ struct USBCCIDState { uint8_t notify_slot_change; uint8_t debug; bool accurate_message_length; + bool migrate_pending_answers; + bool pending_answers_loaded; }; =20 static uint32_t ccid_bulk_in_pending_num(USBCCIDState *s) @@ -1409,16 +1411,35 @@ static void ccid_realize(USBDevice *dev, Error **er= rp) s->debug =3D parse_debug_env("QEMU_CCID_DEBUG", D_VERBOSE, s->debug); } =20 +static int ccid_pre_load(void *opaque) +{ + USBCCIDState *s =3D opaque; + + s->pending_answers_loaded =3D false; + return 0; +} + static int ccid_post_load(void *opaque, int version_id) { USBCCIDState *s =3D opaque; int i; =20 - if (s->bulk_in_pending_end - s->bulk_in_pending_start > BULK_IN_PENDIN= G_NUM) { + if (!s->pending_answers_loaded) { + /* + * Version 1 did not migrate the pending_answers[] queue indices. + * The historical interpretation of pending_answers[] as starting = at + * element zero. + */ + if (s->pending_answers_num > PENDING_ANSWERS_NUM) { + return -EINVAL; + } + s->pending_answers_start =3D 0; + s->pending_answers_end =3D s->pending_answers_num; + } else if (s->pending_answers_end - s->pending_answers_start > PENDING= _ANSWERS_NUM) { return -EINVAL; } =20 - if (s->pending_answers_num > PENDING_ANSWERS_NUM) { + if (s->bulk_in_pending_end - s->bulk_in_pending_start > BULK_IN_PENDIN= G_NUM) { return -EINVAL; } =20 @@ -1447,12 +1468,14 @@ static bool ccid_pre_save(void *opaque, Error **err= p) { USBCCIDState *s =3D opaque; =20 - if (ccid_pending_answers_num(s) || ccid_bulk_in_pending_num(s)) { + if (!s->migrate_pending_answers && + (ccid_pending_answers_num(s) || ccid_bulk_in_pending_num(s))) { error_setg(errp, "usb-ccid has pending queue state which cannot be= " "migrated safely"); return false; } =20 + s->pending_answers_num =3D ccid_pending_answers_num(s); s->state_vmstate =3D s->dev.state; =20 return true; @@ -1493,10 +1516,43 @@ static const VMStateDescription usb_device_vmstate = =3D { } }; =20 +static bool ccid_pending_answers_needed(void *opaque) +{ + USBCCIDState *s =3D opaque; + + if (!s->migrate_pending_answers) { + return false; + } + + return ccid_pending_answers_num(s) > 0; +} + +static int ccid_pending_answers_post_load(void *opaque, int version_id) +{ + USBCCIDState *s =3D opaque; + + s->pending_answers_loaded =3D true; + return 0; +} + +static const VMStateDescription ccid_pending_answers_vmstate =3D { + .name =3D "usb-ccid/pending-answers", + .version_id =3D 1, + .minimum_version_id =3D 1, + .needed =3D ccid_pending_answers_needed, + .post_load =3D ccid_pending_answers_post_load, + .fields =3D (const VMStateField[]) { + VMSTATE_UINT32(pending_answers_start, USBCCIDState), + VMSTATE_UINT32(pending_answers_end, USBCCIDState), + VMSTATE_END_OF_LIST() + } +}; + static const VMStateDescription ccid_vmstate =3D { .name =3D "usb-ccid", .version_id =3D 1, .minimum_version_id =3D 1, + .pre_load =3D ccid_pre_load, .post_load =3D ccid_post_load, .pre_save_errp =3D ccid_pre_save, .fields =3D (const VMStateField[]) { @@ -1523,13 +1579,19 @@ static const VMStateDescription ccid_vmstate =3D { VMSTATE_UNUSED(1), /* was migration_state */ VMSTATE_UINT32(state_vmstate, USBCCIDState), VMSTATE_END_OF_LIST() - } + }, + .subsections =3D (const VMStateDescription * const []) { + &ccid_pending_answers_vmstate, + NULL + }, }; =20 static const Property ccid_properties[] =3D { DEFINE_PROP_UINT8("debug", USBCCIDState, debug, 0), DEFINE_PROP_BOOL("x-accurate-message-length", USBCCIDState, accurate_message_length, true), + DEFINE_PROP_BOOL("x-migrate-pending-answers", USBCCIDState, + migrate_pending_answers, true), }; =20 static void ccid_class_initfn(ObjectClass *klass, const void *data) --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930894; cv=none; d=zohomail.com; s=zohoarc; b=LEeZv+Y9OUZcrOVTgvDZzBfVFRp8BysM6nAzEuaI0oVOxWM02sAjA5SOecVxaLREIKVg3lSwhH8PIO7WHMt+hQTDsk1TU15wskH/6YpLIncPNzkE/gEEKoJHvv9Dq2B+kbC/AFQvoSZ/QpuxwKYTEJIoWXuX8Cp62nZG9KHgJLk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930894; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=QuuOQE1Tid/CLQqbvoiHs+GixDUg4AnBCGRpP4sQ6/E=; b=eF33+7VK/aBUsfKVluY0Jcr1UzI3PWKZhcH27ThtQ/1Qzs/nm6xTFgZdH04g/WioTvdQDFewTzDnkJbfp8NcALa8yRFO+kh1gXlgcowwnburTPh+yl86N5Kn/G7eThKYOMmHwtkOIQroy0epqvANkKZxYFSo7nuan8GEy999CYM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17859308946679.38667887731026; Wed, 5 Aug 2026 04:54:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraCe-0001ac-Q5; Wed, 05 Aug 2026 07:54:32 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCZ-0001Os-CT for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:28 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCX-0007Qc-Rd for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:27 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-475-HHiAAiULNPuYs8BMBR8pJA-1; Wed, 05 Aug 2026 07:54:23 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D8EEC18001E1 for ; Wed, 5 Aug 2026 11:54:22 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 5FB3C434; Wed, 5 Aug 2026 11:54:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930865; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=QuuOQE1Tid/CLQqbvoiHs+GixDUg4AnBCGRpP4sQ6/E=; b=B04E0oLy+jpTgS8ipLntMg4ojvGgySttCT11LaQQ26bipEdLTh0Lo/ywfcdjz76X1GKgBf q+Y1cuZIbmKzMyfnvi9PgGPAWm1jOoJBYHBXc3WaoxYrq4eAO5wN4W38VvNTgTG+mtZ7i6 0GmMPyieH5YNNbhiGf76u0ZSF3St15I= X-MC-Unique: HHiAAiULNPuYs8BMBR8pJA-1 X-Mimecast-MFC-AGG-ID: HHiAAiULNPuYs8BMBR8pJA_1785930863 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:08 +0400 Subject: [PATCH 18/27] hw/usb/dev-smartcard-reader: handle Secure, Escape and SetDataRate commands MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-18-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=3957; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=+GeLYkQ66ayZBib1mFWIYosAh6K2QOV573zIujfNcEw=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOujLmJmIvoMJdvkvkKR/aRUQdpBBOpAqGej NuDSiAzFG2JAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrgAKCRDa6OEJdZac 5e7kD/9BYBfNcHmxbeT/1Oh+wewEtPGLMYhs9IVwCDcJe+k5+UGTpr/ge2gn49ji6H7dDCbVwb+ mVBtsGXKUPgRhcA7bpT1iMeemXxzru5KRRNFpkz7tQefXBICSGx6SHyGReO60/5rOGwRo/m9/LG RYpC3eqX3Qvz4zd8Ytw9bnk/pGTYHsz8aTfDUARi096gCn4tQC7E9FEAF1vfg+efHygch9MGCQR zEG6ZJ2emnuTaOGKbR7Mq7ykR5QbiwDdQEdeufoYoTW2L14HsdIKUAq0e9evzlbSreCSEGXJED8 gofYx4B4lTmGexG9gm53Yem8dy3umxC31nvF3dYYTGeCU7i5sWKc+pI/ItMsIl4QvScVrtP758x QhvZk7tuqF8DGXOUiU+Rj0s2NIUNJtGBGIlY0eAflJ/CCVGeGEvxKBj6MT0uxHv1fH5GUsyiEJN qKsS7tfEt0MYlRMDCb2iRu0nz6UNiXLvU/9bmn+HQxjiWe7/c+bxnMN1DOk5UwaFcRqmDvLhvSF rGYcY4LZm2j+gaUjTeNyxrGWnbxegaO/nXipGzgMbBM8MAcxK/kMJizrNBIEjAXuM0++hAwvU7e RWQaJbCNjy7DXgU+1rN+3E0KKylx/iBD6Ui6S4ngzKZYLqn6U53laq+P/BmR6sa8ggonzPVfiwO bf3YFihD9wKWfwQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930896283158500 The CCID device defines message types for PC_to_RDR_Secure, Escape and SetDataRateAndClockFrequency but the bulk-out handler lets them fall through to the default case, which responds with RDR_to_PC_SlotStatus. The CCID spec requires each command to use its own response type: Secure must reply with RDR_to_PC_DataBlock, Escape with RDR_to_PC_Escape, and SetDataRateAndClockFrequency with RDR_to_PC_DataRateAndClockFrequency. Add explicit cases that report ERROR_CMD_NOT_SUPPORTED using the correct response message types, along with the corresponding structs and response writer functions. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 62 +++++++++++++++++++++++++++++++++++++++= ++++ 1 file changed, 62 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 5ca50c111217..e7bc5f6d4ae0 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -232,6 +232,19 @@ typedef struct QEMU_PACKED CCID_DataBlock { uint8_t abData[]; } CCID_DataBlock; =20 +typedef struct QEMU_PACKED CCID_Escape { + CCID_BULK_IN b; + uint8_t bRFU; + uint8_t abData[]; +} CCID_Escape; + +typedef struct QEMU_PACKED CCID_DataRateAndClockFrequency { + CCID_BULK_IN b; + uint8_t bRFU; + uint32_t dwClockFrequency; + uint32_t dwDataRate; +} CCID_DataRateAndClockFrequency; + /* 6.1.4 PC_to_RDR_XfrBlock */ typedef struct QEMU_PACKED CCID_XferBlock { CCID_Header hdr; @@ -739,6 +752,43 @@ static void ccid_reset_error_status(USBCCIDState *s) s->bmCommandStatus =3D COMMAND_STATUS_NO_ERROR; } =20 +static void ccid_write_escape(USBCCIDState *s, CCID_Header *recv) +{ + CCID_Escape *h =3D ccid_reserve_recv_buf(s, sizeof(*h)); + if (h =3D=3D NULL) { + return; + } + h->b.hdr.bMessageType =3D CCID_MESSAGE_TYPE_RDR_to_PC_Escape; + h->b.hdr.dwLength =3D 0; + h->b.hdr.bSlot =3D recv->bSlot; + h->b.hdr.bSeq =3D recv->bSeq; + h->b.bStatus =3D ccid_calc_status(s); + h->b.bError =3D s->bError; + h->bRFU =3D 0; + ccid_reset_error_status(s); + usb_wakeup(s->bulk, 0); +} + +static void ccid_write_data_rate_and_clock(USBCCIDState *s, CCID_Header *r= ecv) +{ + CCID_DataRateAndClockFrequency *h =3D ccid_reserve_recv_buf(s, sizeof(= *h)); + if (h =3D=3D NULL) { + return; + } + h->b.hdr.bMessageType =3D + CCID_MESSAGE_TYPE_RDR_to_PC_DataRateAndClockFrequency; + h->b.hdr.dwLength =3D cpu_to_le32(8); + h->b.hdr.bSlot =3D recv->bSlot; + h->b.hdr.bSeq =3D recv->bSeq; + h->b.bStatus =3D ccid_calc_status(s); + h->b.bError =3D s->bError; + h->bRFU =3D 0; + h->dwClockFrequency =3D 0; + h->dwDataRate =3D 0; + ccid_reset_error_status(s); + usb_wakeup(s->bulk, 0); +} + static void ccid_write_slot_status(USBCCIDState *s, CCID_Header *recv) { CCID_SlotStatus *h =3D ccid_reserve_recv_buf(s, sizeof(CCID_SlotStatus= )); @@ -1123,6 +1173,18 @@ static void ccid_handle_bulk_out(USBCCIDState *s, US= BPacket *p) ccid_report_error_failed(s, 0); ccid_write_slot_status(s, ccid_header); break; + case CCID_MESSAGE_TYPE_PC_to_RDR_Secure: + ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED); + ccid_write_data_block_error(s, ccid_header->bSlot, ccid_header->bS= eq); + break; + case CCID_MESSAGE_TYPE_PC_to_RDR_Escape: + ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED); + ccid_write_escape(s, ccid_header); + break; + case CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency: + ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED); + ccid_write_data_rate_and_clock(s, ccid_header); + break; default: DPRINTF(s, 1, "handle_data: ERROR: unhandled message type %Xh\n", --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930911; cv=none; d=zohomail.com; s=zohoarc; b=gNTLmW1g5KsWKoAUmSAq1cjK95kpdvvWSZSxdHR8JoAc/l7RR05t8figDqEO0tXhXCNPW2bSEKNTCF0bDN1FvQm449hGZkg/8GES3BzELXiSu0svUW99BkDV/wMF4KzMXZlBLhWCXWaJfc1jackZO8sIjmlGzAkWyvK/pAzrdFQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930911; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2ZBhjxoc9FDfKhS6e23d1epvZEMzL+UHcqW72/TxVs8=; b=LVWrZk0DI2FNzWzjim2MYg9Nj6x8ldNm3b9Ty0DyQ/C8s+6Gg5u7iOnwZiYk1F2Kt5VWZMKovEJPDEG3jy2qgvVSKhhRxOMXKpx0at+tqMpoDLrvrN/p1jeLVd+yj24Id6uqatTK2zCJTrtteebhl7bYrHZfFLbyDoW8jtCcDnQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17859309111847.502218406297402; Wed, 5 Aug 2026 04:55:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraCq-00023f-DO; Wed, 05 Aug 2026 07:54:48 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCi-0001wE-Hy for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:36 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCg-0007RI-Sb for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:36 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-126-PChGU9wZM8SDxtBYDX_LMw-1; Wed, 05 Aug 2026 07:54:32 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 18B57180034F for ; Wed, 5 Aug 2026 11:54:32 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 050861956041; Wed, 5 Aug 2026 11:54:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930874; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2ZBhjxoc9FDfKhS6e23d1epvZEMzL+UHcqW72/TxVs8=; b=fXH7vEBtCnPh1N64SOUCXdZ+cJrHKRY9DluKpi9x8kDYMfyyjLXysdWZsIYvR5vKzn2opA u7FTvUHUHqm2+jYQ8xWlYNbCuIQ5WI9/ynYFeqsjLP6u3SdKs+AKSvWmQ9UlbzfihS+fd0 7x8SqBane/ZgV81NScdsfYGkTINJJOs= X-MC-Unique: PChGU9wZM8SDxtBYDX_LMw-1 X-Mimecast-MFC-AGG-ID: PChGU9wZM8SDxtBYDX_LMw_1785930872 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:09 +0400 Subject: [PATCH 19/27] hw/usb/dev-smartcard-reader: reject commands for invalid slots MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-19-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=2724; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=oHi+ugEI+1CrxuDbJP2mregTFzCdGRz1gev+6CPEJM4=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOuGhJH7Eqm4bluUHVfPlHpD43D2/P9gJbsE qSi9Kp8KKKJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrgAKCRDa6OEJdZac 5bcwD/9NjLyKwmtEZnR4kFIbArTIktS6oTo/5wX6odTSJ3IPKkoDcG68+DN8l9quFX3yBn5s2k5 H65jqAzfCwdiiwaZt/Au7WdsjXuhYupRKqcksLGjAYjsfkDWuurLPd9AiOhRJ8vX8GYu55L0Bx3 HswVLi8uX18L0UKowLvrZX79bt2VA7W1ujCM0aD2O9x3amuEsnyVI/uFJnIQ79f7XJtYC2apH0D soJicFqeMen9plDKAbyOlCUAzk8L2DYsuhM+hYQgE/XiEZYEajpdblDCypHId2hrJqigW2kP8v5 BFifTH7Vq1M1/smIHIpgWmopDfve+UVkPiSPwKeulQMt8OtAaSFO7si3ogKrONZLmNqd1ErY/d7 AubThbo6Yet9zIl1OmGGjngT7rHK8tTp8wYiemb+3wCzFtSDUY6o24LzWTZaDxehRr5SQ9Ub7l4 grTQS+how82WvMtz5oHFMs5DJ9KS31KuPD6LcZkT6AUENkCPkf9WEbyq+GyK1liDqBuFCV6MXSS TzkemeISY7WEqOvlWtkm4oyqhSEhZCGMkTxCuotulX6bp+fyjgveIUJrw6mrk5gqDvQPeg479eg oumHiPWJx7QJbqwnIzW/LwDCOno+pCQie7LGYlpZ2FNvkWhEdgC6eN/+/L/UJelamnVja7txNO+ p341yev1YVgNXuw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930912389158500 The descriptor advertises bMaxSlotIndex =3D 0 (single slot), but ccid_handle_bulk_out() never validated bSlot. Commands addressed to non-existent slots were silently processed against slot 0 state. Reject them with bError =3D 5 (slot does not exist) per CCID Rev 1.1 section 6.2.7. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index e7bc5f6d4ae0..cc7356c77413 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -167,6 +167,7 @@ enum { ERROR_XFR_OVERRUN =3D -4, ERROR_HW_ERROR =3D -5, ERROR_CMD_SLOT_BUSY =3D -32, + ERROR_SLOT_NOT_EXIST =3D 5, }; =20 /* 6.2.6 RDR_to_PC_SlotStatus definitions */ @@ -1087,6 +1088,35 @@ static const char *ccid_message_type_to_str(uint8_t = type) return "unknown"; } =20 +/* + * Send the spec-mandated response type for the given command with the + * error already staged via ccid_report_error_failed(). + */ +static void ccid_write_error_response(USBCCIDState *s, CCID_Header *recv) +{ + switch (recv->bMessageType) { + case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn: + case CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock: + case CCID_MESSAGE_TYPE_PC_to_RDR_Secure: + ccid_write_data_block_error(s, recv->bSlot, recv->bSeq); + break; + case CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters: + case CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters: + case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters: + ccid_write_parameters(s, recv); + break; + case CCID_MESSAGE_TYPE_PC_to_RDR_Escape: + ccid_write_escape(s, recv); + break; + case CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency: + ccid_write_data_rate_and_clock(s, recv); + break; + default: + ccid_write_slot_status(s, recv); + break; + } +} + static void ccid_handle_bulk_out(USBCCIDState *s, USBPacket *p) { CCID_Header *ccid_header; @@ -1130,6 +1160,14 @@ static void ccid_handle_bulk_out(USBCCIDState *s, US= BPacket *p) goto err; } =20 + if (ccid_header->bSlot !=3D 0) { + DPRINTF(s, 1, "usb-ccid: bad slot %d\n", ccid_header->bSlot); + ccid_report_error_failed(s, ERROR_SLOT_NOT_EXIST); + ccid_write_error_response(s, ccid_header); + s->bulk_out_pos =3D 0; + return; + } + DPRINTF(s, D_MORE_INFO, "%s %x %s\n", __func__, ccid_header->bMessageType, ccid_message_type_to_str(ccid_header->bMessageType)); --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930912; cv=none; d=zohomail.com; s=zohoarc; b=Wdd7gA/MH/XJWmLT30fe08QWJIvz5buwOOqRlhDPDkrvAd2Wm4ykRxvxwWci05LWfAKIeK9/j/MVNxvAxMYErurYBY/ZS19awzOj52MS+fvO7zwIEvKR+eakp9JmHDhwnRfECYC69kLpSj7LuH0lqWOPj+z5i6feDXavLewl+Ik= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930912; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=csQbvDWovjTTK7V5KSKTy5ckSfE5Aq7wN/bhPs2KCKM=; b=DDE99KAr1zxagbdEDcAGIKZpoloMI0At6U4IvKZodipC8E1wn58VXAvSrpgfObIsImhMopaAyZHVXKyW2i3iwb9k/yJXEg6f2Gey3mYOdLyKCzb8dSlKUydyL2wIuKC5yQt2BnT82doukchEpt/sa1Zs5o5u8cm7s7u0CyT+Blk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930912482178.86862466103355; Wed, 5 Aug 2026 04:55:12 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraDB-0002HM-Nt; Wed, 05 Aug 2026 07:55:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCr-00024z-Lv for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:51 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCq-0007S5-9m for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:45 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-7-sMMd5s_zMA6VQQlGSwowLw-1; Wed, 05 Aug 2026 07:54:42 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 8EA05180064B for ; Wed, 5 Aug 2026 11:54:41 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 76B5A1956042; Wed, 5 Aug 2026 11:54:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930883; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=csQbvDWovjTTK7V5KSKTy5ckSfE5Aq7wN/bhPs2KCKM=; b=TwaqoZ7X0NYffnz3GqWR4/SpB+VLuGLZQfrbZETvVig2c/LQFEgWLM2K2lpTxwst/KLwBk DifP2uyiZqryACgJRFS+NJzm+LeUA0eV0hW+E3oklHPUVWM/H22xsD3DoltqQyo+GJxlJ1 PKn3QgjUvFIYWM3s1/NgzQuWuX/Hiug= X-MC-Unique: sMMd5s_zMA6VQQlGSwowLw-1 X-Mimecast-MFC-AGG-ID: sMMd5s_zMA6VQQlGSwowLw_1785930881 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:10 +0400 Subject: [PATCH 20/27] hw/usb/dev-smartcard-reader: zero bChainParameter in DataBlock responses MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-20-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=1050; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=Brf+Qn514iwgk3BKpGRkMlkg3KxjrfrFKTxgit2/WZs=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOumJGPGKv/ybXc+Ni01pjX9ul5W02CLqLKH 0ecG4mK1wuJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrgAKCRDa6OEJdZac 5ZvjEACsGC1fEMyu4ZHeneIUeVEQU39D/T0gOcU1jsIobcYYPhsx35mgy+1xKXAscZdjMIBP82T qaCkoS2KSL6X+WWup4a468TZfAHuwWrWcvPhRyYmAgFBHFVQHqKmi1cWBG2ma8Z1sZNvPWOU7W/ /z8cVyyow1yVNj3EQZ17N5Ne/7Y1KsrXDG8pmJrixRH9Qf4/I/mqlpW7UCMpHbyPhocrSVttlEB 1ISd1cpEYTzqn5d3NZVBe3Ae6Etc3ghm6gy56PsJfXV9f/2kICNDuLpPahAfROLti06drgrdrlU TamQ5x3Znl+v08tjHzXxSxEcuY98RV5iAeKGAvehc3NQnaqnh/WhrzNRAeU2+fyBR88qhwU+7/H KuvPgF03YCpqfOsJAq9GM8Lqr1zHZCL/Ag/wtx2L07FGqRc0cERN4iBaS1I0MtwQi3NEUmO8cUm iaBva6rmSjGVn0aFcvbL5YjolcQTmGRPKuRtKpumvxIzbjIiEbFtkp0SrBJT96X28Pk4C0YNCKS 4vq8jWI6s+IlqQl1pp7GphWqXpyIpLPjvXPkZJ6YcVwOX3C4hgxKfCr25W/G7YgbzjcCs2jlNiW A7KD5ImGs0uSUNMCk0enp/ahNHI4t7PP+5N1OQiwyNehNBlx6TgMhyIXcZQm+E5AOM5TnUU8MqX h6yAMEpVOWJHSDQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930914362158500 ccid_write_data_block() initializes every CCID_DataBlock field except bChainParameter. Since bulk-in buffers are reused without zeroing, a stale non-zero value can make the guest CCID driver misinterpret a complete response as chained. This device never chains responses, so set bChainParameter to 00h as required by CCID Rev 1.1 section 6.2.1 for TPDU-level exchange. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index cc7356c77413..208a14dbd1b3 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -848,6 +848,7 @@ static bool ccid_write_data_block(USBCCIDState *s, uint= 8_t slot, uint8_t seq, p->b.hdr.bSeq =3D seq; p->b.bStatus =3D ccid_calc_status(s); p->b.bError =3D s->bError; + p->bChainParameter =3D 0; if (p->b.bError) { DPRINTF(s, D_VERBOSE, "error %d\n", p->b.bError); } --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930916; cv=none; d=zohomail.com; s=zohoarc; b=c/JolxpyW7DDSP0crKQa5UZQiArugiz24+mMJvOccXckeX5o0RCtkMMpXW9qoiG01ApK5rlOVal0RPPYaJ2qi/GGi3v6yyHDu83WMyKTvZtn5bsUnAnA816UFgOa827nToT2LHrDZuCge44WHR6QCvOGpoChHWZJs5UiBeZJdp4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930916; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=IPLRNUH3dnEf5lNfRacEvCQIA+98SFfajwR+vJmGBo8=; b=Lxyn5+AqVpb/JSMydpvLVuythKU7OXBnXkV03QB4WZmLO/Ey9SvuNvV9Q54O6/ZcmUDteqa4+t5BTTydtpYCnJqimO7ycgK2PIx4cVadN4mkSdxXJ6I5UX2BmihDfpwTfjFcY1Ou+UrnErBRU9fE0X7ABQFxgcf8GlIKdrJs3nQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930916461805.1194208352439; Wed, 5 Aug 2026 04:55:16 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraDG-0002Py-QL; Wed, 05 Aug 2026 07:55:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraD2-0002BJ-9g for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:57 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraCz-0007TE-Ex for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:54:55 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-650-sWFNEG8HPoOQyRUN2k7HMQ-1; Wed, 05 Aug 2026 07:54:51 -0400 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E454619560B4 for ; Wed, 5 Aug 2026 11:54:50 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 86D3718005A7; Wed, 5 Aug 2026 11:54:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930892; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=IPLRNUH3dnEf5lNfRacEvCQIA+98SFfajwR+vJmGBo8=; b=bVANjffwZvhPiRnFTfju4YW2k9l2UuWK/rvq/Af0LSweIztKrZ9qC26c7byQEQFJi5rkj3 rMjrrsginggclBowYZfBSc96ZerzmhF2oTlSTbxYZGzf5CiDD7qdGVkr6YxkR4T+5n0Qg4 62aw0JEeuT2oIECmJ4yXpfB5UQpws4s= X-MC-Unique: sWFNEG8HPoOQyRUN2k7HMQ-1 X-Mimecast-MFC-AGG-ID: sWFNEG8HPoOQyRUN2k7HMQ_1785930891 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:11 +0400 Subject: [PATCH 21/27] hw/usb/dev-smartcard-reader: report error on XfrBlock with no card MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-21-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=1185; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=P3Zq+m9aEcCUmGiVB/yrql1wtSwwsWyAhXTfhnoK90U=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOuaDZKNmDX6WeupqPbGV+90AwJetBsFU/Uh E53NS48x8CJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrgAKCRDa6OEJdZac 5WPXD/9um1Ru1DjXBWFgjOYRXFqQOpdA73EFBBT91SF0n/QlyvhuRHixOzLBeI1XCxlmd5Ztptx MQ04NYTu5RyKz2eKlDi3jUIGQ9CNtTSROIgTUzeiTGglBK4ha+zvpeJIHjikrw9jqzFFIl91dvn 5rR6K+8PNi0cv3dJCf+JGuvryeDcjx9xdfkcpj++qApPAdaj/aOmaQF8gJYH45NZ8M8ADqZelvF 4L7/+UYXk2b+V40hf/IHtqgcEUIxRoZhWIC9qgDqF7pY/tyzNyN9fI2Pf6V6FETguXyhMpf79yT 4vEbIoz/PEMSixzqwbwzh3rpN+Lfj8ST7I107+QFltfzViFcPu/a1UlXkgXu+B8iTETuT2e/y7t xQZV8iE13j92XgBPHuI/JspwpbUq7HAdzFrC4lsKVpTYzhhoQksTibfKAjaYvkwP6/2QrdfU8zI TbBJ5IyhmLs3Vklr4sPzy65Do3dOgXc7P8BCdy5lHHRZjKs9FEDzd8wY/I+UtFYRRZj7QwsnQzw JK+bGufB6XM50IzHyjxH7FszWQ4uwkgqflx9etIDFvjvZyduBhI1eqfsi/aDtNbYCaTkThMK9l4 6gNaGBggiFqK3DS/LhLYvDlRY7C9hiyuxrKoKkItJOfl6PbdkBygQOYDXHrB2amZ992hAvpAQfK kGfSQApsHkCFkrw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930918402158500 ccid_on_apdu_from_guest() returns an empty DataBlock when no card is active, but without first setting failed command status. This makes bStatus report success and leaves bError unset, violating CCID Rev 1.1 section 6.1.4 which requires failed status with ICC_MUTE. Call ccid_report_error_failed() with ERROR_ICC_MUTE before queuing the response, matching the existing pattern in the slot-busy error path. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 208a14dbd1b3..65ceed57541a 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1046,6 +1046,7 @@ static void ccid_on_apdu_from_guest(USBCCIDState *s, = CCID_XferBlock *recv) if (ccid_card_status(s) !=3D ICC_STATUS_PRESENT_ACTIVE) { DPRINTF(s, 1, "usb-ccid: not sending apdu to client, no card connected\n= "); + ccid_report_error_failed(s, ERROR_ICC_MUTE); ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); return; } --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930928; cv=none; d=zohomail.com; s=zohoarc; b=Ar4CjGZatioxw7YBCkL0VPNCMNiQKYK/f6e8xpzS7pWA0mW7WRBN+og4LAi7Cybp3fPTit6v23bzrsjiD78JX99RxoEv80XVws2DW1X+HhlT3Nn/cA5rp9t1s2me0XTno+UP1x+8s4sUeQEakh1qDxQxBDbb7XXmXkR2a48QNLw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930928; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=FVjmh4ZPE1CWjcfJbVY4ylfKXEB4Jlz+y9MOk8aUsqc=; b=IP4IknKhp5Wcv0pbCaVkeO9u3X5r0T3tZzZHgM9RLMNFWDpjGqx3lnHkIuWMJN8AK6GO9+sPyGmW7p8TJ/YQGm/Kd22WIDit7m1CZenrYsfQZeEz3nAABXgw1RnXRW39ddCsY1TEeFC64bt0MHlgrlIm/O8uW6KcKt5KGNzCW1s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930928920489.4871212469652; Wed, 5 Aug 2026 04:55:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraDV-0003KT-Az; Wed, 05 Aug 2026 07:55:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraDN-0003Am-Hl for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:19 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraDM-0007Up-3H for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:17 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-481-fZ_4vwseMHGNl1i2s-LpOg-1; Wed, 05 Aug 2026 07:55:09 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 391301956049; Wed, 5 Aug 2026 11:55:08 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 862761800348; Wed, 5 Aug 2026 11:54:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930915; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FVjmh4ZPE1CWjcfJbVY4ylfKXEB4Jlz+y9MOk8aUsqc=; b=gMThZG4Gksbk2yitQca030/BTj+4AjWiVBErGEqGpgVtHBIbz4DFk3YdQy6SLTdXWGPEHy X+A0bHrmUIsZeZD2vY8gSfy9sZUKwXuzqSzT66Mm9pxhyyGJyjo0w5pHJqlb/0DFp+K9Iy aSzi+EhymFFa93TYVpyFY866wTg8jcE= X-MC-Unique: fZ_4vwseMHGNl1i2s-LpOg-1 X-Mimecast-MFC-AGG-ID: fZ_4vwseMHGNl1i2s-LpOg_1785930908 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:12 +0400 Subject: [PATCH 22/27] hw/usb/dev-smartcard-reader: stop advertising PIN support MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-22-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Zhao Liu X-Developer-Signature: v=1; a=openpgp-sha256; l=3066; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=srx5Y+nSZKFJAop3xtcxoY4v0msOUn8egihFkdC4xfs=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOv5kGsUlvnW1Y7yJlPu+prhPHZXfCGmNUj+ zE8PirdLtCJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrwAKCRDa6OEJdZac 5SjCD/9vsSW70AWyQnXB+GxPLyTQvb85+6uoFtDU12FgMJkzehx2w7NkJ06b+jHbWQTIjGUYOzJ DZ7o1r2yH4y9Tq+l3nHhgM2ExLQFWFMv+5Da2jJGStRuKetvxVvEtHlaSWxvjvcL08bnCrM79XE JudcVVx6/CPmS+7dYCimPEtHbJQJyZGjq4n0y9ISzuBMSdvWhfvgQzgoL2VKnDV3BE8Q4kUlLlk LS53ffxmc9PeJa9mNMKCNHGizl58V15OVjlmgAX3eF5VMF9kSYq/qB6JKYjUrrGslU9ezUpdazk tiTYXQ58ExdJPTxOWqvRRZk42b4XMSj/mMuTQISaLaYq43SRFB831jtrKyDyrVxf3Qk0+iFc5od h1ZTPSPFkE9sS9ebMxxqbAMqm6UNDffX3+pUXDb6pZUFBa36zs1wpXQaVGDeFpW4mmfYlm99VLt dH1cGzs1/ETxptDXHg1Z35KUD6l8zlvS35gNSZ7A4TGEV9FNXxTlT0f+1TCMIRfCVQvc9+6+JeX 6VNf2FlUFIRV/jZG9Cj/CXpsDqPL9i0xdkFG1o6g/8WmNpECFGKn1PGXZ7Drem/j3OfOwSmgJJy kisj7igy5M5+wuW88cICAfH3fjzyxulNVD+l/oKbCh/BFKakHbIiI75rqOXnCddXcMJdDjpVrFO t3A9dW3t49vLYZA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930930435158500 The CCID descriptor claims bPINSupport=3D1 (PIN Verification) but the device does not implement it, returning CMD_NOT_SUPPORTED for Secure commands. Stop advertising the capability by default, gated behind an x-pin-support property for backward compatibility. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/core/machine.c | 1 + hw/usb/dev-smartcard-reader.c | 12 +++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/hw/core/machine.c b/hw/core/machine.c index 28842f53ae4f..790d947e28d1 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -52,6 +52,7 @@ GlobalProperty hw_compat_11_0[] =3D { { TYPE_ARM_SMMUV3, "oas", "44" }, { "migration", "switchover-ack-legacy", "on" }, { "usb-ccid", "x-accurate-message-length", "off" }, + { "usb-ccid", "x-pin-support", "on" }, { "usb-ccid", "x-migrate-pending-answers", "off" }, }; const size_t hw_compat_11_0_len =3D G_N_ELEMENTS(hw_compat_11_0); diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 65ceed57541a..a973a0396bb3 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -328,6 +328,7 @@ struct USBCCIDState { bool accurate_message_length; bool migrate_pending_answers; bool pending_answers_loaded; + bool pin_support; }; =20 static uint32_t ccid_bulk_in_pending_num(USBCCIDState *s) @@ -436,10 +437,14 @@ static uint8_t qemu_ccid_descriptor[] =3D { * u16 wLcdLayout; XXYY Number of lines (XX) and chars= per * line for LCD display used for PIN entry. 0000 - no = LCD */ - 0x01, /* + /* * u8 bPINSupport; 01h PIN Verification, * 02h PIN Modification + * + * Corrected to 0 when !x-pin-support */ +#define CCID_DESC_OFFSET_B_PIN_SUPPORT 52 + 0x01, 0x01, /* u8 bMaxCCIDBusySlots; */ }; =20 @@ -1498,6 +1503,9 @@ static void ccid_realize(USBDevice *dev, Error **errp) stl_le_p(&qemu_ccid_descriptor[CCID_DESC_OFFSET_DW_MAX_MSG_LEN], BULK_IN_BUF_SIZE); } + if (!s->pin_support) { + qemu_ccid_descriptor[CCID_DESC_OFFSET_B_PIN_SUPPORT] =3D 0; + } usb_desc_create_serial(dev); usb_desc_init(dev); qbus_init(&s->bus, sizeof(s->bus), TYPE_CCID_BUS, DEVICE(dev), NULL); @@ -1692,6 +1700,8 @@ static const Property ccid_properties[] =3D { DEFINE_PROP_UINT8("debug", USBCCIDState, debug, 0), DEFINE_PROP_BOOL("x-accurate-message-length", USBCCIDState, accurate_message_length, true), + DEFINE_PROP_BOOL("x-pin-support", USBCCIDState, + pin_support, false), DEFINE_PROP_BOOL("x-migrate-pending-answers", USBCCIDState, migrate_pending_answers, true), }; --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930935; cv=none; d=zohomail.com; s=zohoarc; b=VK9uyS1MwFu9CFsaM48R8FG91QCOb16ComlFIKd0vi9MkOdjKzuVs5Ge4MabfR/eJeM1ezvMmo5ZcOB0D7q/cvEuHFGXeWhxEa20Yy09yXWTd9ZuhfR7pJBDRmbmcMQjbVNXO68C9frJHU83TpFea308pYwM2OE/SD1DVr7GGvE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930935; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=w+mn8Fo4wRhA3/jQoXvREfwdebgX2hlAP3FIOa8NaHI=; b=PDs0UAUKwu0MYPl9kq9WgE54cgB5fzKizdqvXj/4qEq0KLNTndMk1LV9ZQvnUYU4EElfyZW5JWWaG0r3Y7kveSEPCW+cPk+jIlzpHySw10oeMg6vCrNndKAC2JhqbZ/8sT2myvPZGcD5ydLFsKEWASpb7EWNPlYxpgCDi3449Mc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930935883216.86766434563629; Wed, 5 Aug 2026 04:55:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraDZ-0003b4-Gt; Wed, 05 Aug 2026 07:55:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraDQ-0003F9-OI for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:20 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraDO-0007VI-OE for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:20 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-369-_txZ32U7P36FGa2I13lCqg-1; Wed, 05 Aug 2026 07:55:16 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A6C291956096 for ; Wed, 5 Aug 2026 11:55:15 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id BE98D180049F; Wed, 5 Aug 2026 11:55:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930918; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=w+mn8Fo4wRhA3/jQoXvREfwdebgX2hlAP3FIOa8NaHI=; b=eTgSNxyzSkhMi4ek0xwFnlGBD4+nNA1R470FyPfG5Ak40saV0FFLIhCWc1nKlj5qyuS0vO lI13Sgpbr5NnY8b9nb7OG/uET1rjTGpnsPKhU3Wb7fF9HvUBAVML08ddoREDhpt3w6qHb1 3scL7ji2x8vhel8fl2yQJSqqzfO/8og= X-MC-Unique: _txZ32U7P36FGa2I13lCqg-1 X-Mimecast-MFC-AGG-ID: _txZ32U7P36FGa2I13lCqg_1785930915 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:13 +0400 Subject: [PATCH 23/27] hw/usb/dev-smartcard-reader: validate per-command dwLength MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-23-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=5043; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=WXD5bjOCbmvtoyIanJkHCKNFdnCHhPyegVWy81kKbKw=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOvwStEkUaNO5ugHbc1K4MKEk3rRwregzMh+ AJGA5P0FyuJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrwAKCRDa6OEJdZac 5YIuEACNdXq3rFVzuIyTILCqcDj2360nHiKqfwEO6QakpN5e8kkG2P94Yur5czTgZDAGhLANkhP do6kVfxIxXw298zbvHwRfctaO8Ct8oExYdaDQ1KZ6A00oiiHTsNg1x69zCgjR5VbsENu8y58Ehn NFWzvcpnbnR9U5LeeDrZvoukjCI8KHjDNBPG7KEjkDKTkUYgfrNHUiYZuqp66wAQm98hvwtzo+r aYtAAEAaToBwKgOXk2q/uU2KL1dMEbbqs/zh2+zBKaMLQb34g6s3A3OTDq+vaG0VPiA7lE9nV72 6ZSzT/1fXAjBWYBWI8MBcolF7SfTtAXUhibkYsaNk0ruxj49uQl1flqIduyLdNOZK2wKa6JdHQ5 WOjHXkdNvWH8JcALT0KGLM9Q3AweekuWGkWhsH6DA9I2fx2b04axASLU9udeM2rJcyEEvZSVIXj IHzZZvj1a/YozZmkdTrM5wOMWXxIaj0ZNIdPxHyF+Y3fN396qxAFL7ZcgltwrJ69eK266adeTbm JiilcavHXJIvPXByjM3nkK3usqxsFxqbKPRPuOBuY94yIFON+grC8r24Si/O1bYTRykcBJVhhmi qskE1POCqYb2HA0ujaJCZpU+US7bgHHCCe/PiyKnd2WcLFfNNvOzsx9cRJJGuSoqpQ3os7LaH04 mT3ZSOai6D5S0CQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930936520158500 The bulk-out parser validates that dwLength matches the received byte count, but does not check whether dwLength is correct for each command type before dispatch. For example, SetParameters copies protocol bytes from the payload even when dwLength is zero, reading stale data left in the fixed bulk_out_data buffer from earlier commands. Add per-command dwLength checks before dispatching: - Commands with no payload (GetSlotStatus, IccPowerOn/Off, Get/ResetParameters, Mechanical): require dwLength =3D=3D 0 - SetParameters: require exactly 5 bytes for T=3D0 or 7 for T=3D1 - SetDataRateAndClockFrequency: require exactly 8 bytes - XfrBlock: variable length, already bounded by the buffer - Secure, Escape: variable length, unsupported and no payload access Malformed messages are rejected with ERROR_BAD_DWLENGTH. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 42 +++++++++++++++++++++++++++++++++++++++= ++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index a973a0396bb3..bee118cb4ff9 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -167,6 +167,7 @@ enum { ERROR_XFR_OVERRUN =3D -4, ERROR_HW_ERROR =3D -5, ERROR_CMD_SLOT_BUSY =3D -32, + ERROR_BAD_DWLENGTH =3D 1, ERROR_SLOT_NOT_EXIST =3D 5, }; =20 @@ -1180,9 +1181,15 @@ static void ccid_handle_bulk_out(USBCCIDState *s, US= BPacket *p) ccid_message_type_to_str(ccid_header->bMessageType)); switch (ccid_header->bMessageType) { case CCID_MESSAGE_TYPE_PC_to_RDR_GetSlotStatus: + if (payload_len !=3D 0) { + goto bad_length; + } ccid_write_slot_status(s, ccid_header); break; case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn: + if (payload_len !=3D 0) { + goto bad_length; + } DPRINTF(s, 1, "%s: PowerOn: %d\n", __func__, ((CCID_IccPowerOn *)(ccid_header))->bPowerSelect); s->powered =3D true; @@ -1193,6 +1200,9 @@ static void ccid_handle_bulk_out(USBCCIDState *s, USB= Packet *p) ccid_write_data_block_atr(s, ccid_header); break; case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOff: + if (payload_len !=3D 0) { + goto bad_length; + } ccid_reset_error_status(s); s->powered =3D false; ccid_write_slot_status(s, ccid_header); @@ -1200,21 +1210,38 @@ static void ccid_handle_bulk_out(USBCCIDState *s, U= SBPacket *p) case CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock: ccid_on_apdu_from_guest(s, (CCID_XferBlock *)s->bulk_out_data); break; - case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters: + case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters: { + CCID_SetParameters *ph =3D (CCID_SetParameters *)s->bulk_out_data; + uint32_t protocol_num =3D ph->bProtocolNum & 3; + uint32_t expected =3D (protocol_num =3D=3D 1) ? 7 : 5; + + if (protocol_num <=3D 1 && payload_len !=3D expected) { + goto bad_length; + } ccid_reset_error_status(s); ccid_set_parameters(s, ccid_header); ccid_write_parameters(s, ccid_header); break; + } case CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters: + if (payload_len !=3D 0) { + goto bad_length; + } ccid_reset_error_status(s); ccid_reset_parameters(s); ccid_write_parameters(s, ccid_header); break; case CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters: + if (payload_len !=3D 0) { + goto bad_length; + } ccid_reset_error_status(s); ccid_write_parameters(s, ccid_header); break; case CCID_MESSAGE_TYPE_PC_to_RDR_Mechanical: + if (payload_len !=3D 0) { + goto bad_length; + } ccid_report_error_failed(s, 0); ccid_write_slot_status(s, ccid_header); break; @@ -1227,6 +1254,9 @@ static void ccid_handle_bulk_out(USBCCIDState *s, USB= Packet *p) ccid_write_escape(s, ccid_header); break; case CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency: + if (payload_len !=3D 8) { + goto bad_length; + } ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED); ccid_write_data_rate_and_clock(s, ccid_header); break; @@ -1245,6 +1275,16 @@ static void ccid_handle_bulk_out(USBCCIDState *s, US= BPacket *p) s->bulk_out_pos =3D 0; return; =20 +bad_length: + DPRINTF(s, 1, + "usb-ccid: bad dwLength %u for %s\n", + payload_len, + ccid_message_type_to_str(ccid_header->bMessageType)); + ccid_report_error_failed(s, ERROR_BAD_DWLENGTH); + ccid_write_error_response(s, ccid_header); + s->bulk_out_pos =3D 0; + return; + err: p->status =3D USB_RET_STALL; s->bulk_out_pos =3D 0; --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930945; cv=none; d=zohomail.com; s=zohoarc; b=A0Ubv8Ii1XlmMFEeoBwChv3Mmyq/rOd//dQUoLr/YByFaPJzC9z0CKHhbrRElCHVIJtiRnWJGe20SKc7E/XwT3H5RrYHg+WLi9QsWlDh/wdXKZ2wPffejusBpPqAfGYAxxxfFjemjw4MqpEvTyjBTDFvWmqJpgwYXiOf40Dr75U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930945; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Ttk74vB5a13FGZBeP2t5AzMqh/E4OV0LHnpApA8Rukg=; b=JRsvLK28RDE8P/BiuKd/8I8TkX06eHJEhhNVBgmqMTUQSgYd1m1pIRAVV93pQCqjR0DjXBgy71APeKY+XerMttnZYcr4cC+OE66wvJottWX913Itfu8/2bU0N/cUf9ZqGlxAdO0fPt/SVA9uHojgMoj8UHOPbqtpiXikMwxpa7E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930945806179.64593836174367; Wed, 5 Aug 2026 04:55:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraDb-0003f5-H5; Wed, 05 Aug 2026 07:55:32 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraDW-0003Uc-Pi for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:27 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraDV-0007W9-8X for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:26 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-625-vzyE6PguOIGjPzxPgciIiQ-1; Wed, 05 Aug 2026 07:55:23 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 7EEA11956080 for ; Wed, 5 Aug 2026 11:55:22 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 58EEC1800348; Wed, 5 Aug 2026 11:55:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930924; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Ttk74vB5a13FGZBeP2t5AzMqh/E4OV0LHnpApA8Rukg=; b=Z8cxPB53WGThtVMFn9wuZI/QJV+xolUrYBtEOETrdT273OXzmpvdsp78i5pC832oxndv+r 63g5Q8U0ADDfj0i4oogq+1C+r4i2CTtCzssErpexAPKwDSpm0+GFjepbRAhmnMmnc3Rfu9 zIrSMmoQMxpp3+XOTDzZh5UWeav5ahA= X-MC-Unique: vzyE6PguOIGjPzxPgciIiQ-1 X-Mimecast-MFC-AGG-ID: vzyE6PguOIGjPzxPgciIiQ_1785930922 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:14 +0400 Subject: [PATCH 24/27] hw/usb/dev-smartcard-reader: use usb_packet_size() accessor MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-24-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=3488; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=oKj3znzcWH9h2NBqI7QwuC+RA4aQIgVkNCe/GI2lqSA=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOvH+ONxbFtzKeTc7eXYHHmHcBcC7Y2vvxUS B66vp50j7KJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrwAKCRDa6OEJdZac 5cqnD/479A/cVtMrqfYh04WcokY6W86JwiW1VZkhWWQx9E6rqK3vcosPFtakKNwqh6GunYI8Cqi hEGMGTA0OIpTAt7puHtDweF+kO4RJELIPFqQmlPxSn0Al5reB/uSQ2aeiiWUTY5g9F0ClxJgghx UKObliqBHbwshFHzidFsHq78+yYYnYRpVpOPenqrjyKeVQXr5cMoV4PriJt+4e/BgqbDk5gQYk/ 7prYOP47KBqZPQ1LMIDUZygLk0t2UA6oMc1HaRjI1spM9y3/F1r1oT0RycmBJ4zMzQPDo0xAVIh zTh5NTQwmO7flZcF9APiSKrXUGpUKNg99flguj8Diy1uj4IjHAVftBrZk1AI9kzydrf//TXEN2q RYimVlRGx2KtoOCyO+ujUcEKTkWF6Eu6gWzGMI5nt8r3b0icNGAbCQhkTOYmNJWIgpZYLqagbYg JhaO4QHChj9ERfyoz5aTnE6TNBRVjiDMzyiVvkxf5Xoy5PFv5Ox7lrTUhoBvMn+dzxMjlBjUyT6 6YvtQpx12j+z4xUWOzPBFqy2Jj4Ez8xxHhdG5kP4iage3bUJD2w1w22s+ngooSoGSEmlcyEqJTW JYPyTqkVFwaRX4zQlb6xtTHcECsPq4Sm6u5mtwGyBiLQ9LhyJ1pQcEYUfnpxGNYyygLTR7XYiBN qg5CiVVrQJrqKsw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930946543158500 Replace direct p->iov.size accesses with usb_packet_size(), which correctly handles combined packets. Signed-off-by: Marc-Andre Lureau --- hw/usb/dev-smartcard-reader.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index bee118cb4ff9..8520a2dab216 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1142,11 +1142,11 @@ static void ccid_handle_bulk_out(USBCCIDState *s, U= SBPacket *p) return; } =20 - if (p->iov.size + s->bulk_out_pos > BULK_OUT_DATA_SIZE) { + if (usb_packet_size(p) + s->bulk_out_pos > BULK_OUT_DATA_SIZE) { goto err; } - usb_packet_copy(p, s->bulk_out_data + s->bulk_out_pos, p->iov.size); - s->bulk_out_pos +=3D p->iov.size; + usb_packet_copy(p, s->bulk_out_data + s->bulk_out_pos, usb_packet_size= (p)); + s->bulk_out_pos +=3D usb_packet_size(p); if (s->bulk_out_pos < 10) { DPRINTF(s, 1, "%s: header incomplete\n", __func__); goto err; @@ -1155,7 +1155,7 @@ static void ccid_handle_bulk_out(USBCCIDState *s, USB= Packet *p) ccid_header =3D (CCID_Header *)s->bulk_out_data; payload_len =3D le32_to_cpu(ccid_header->dwLength); if ((s->bulk_out_pos - 10 < payload_len) && - (p->iov.size =3D=3D CCID_MAX_PACKET_SIZE)) { + (usb_packet_size(p) =3D=3D CCID_MAX_PACKET_SIZE)) { DPRINTF(s, D_VERBOSE, "usb-ccid: bulk_in: expecting more packets (%u/%u)\n", s->bulk_out_pos - 10, payload_len); @@ -1298,7 +1298,7 @@ static void ccid_bulk_in_copy_to_guest(USBCCIDState *= s, USBPacket *p) bulk_in =3D ccid_bulk_in_peek(s); if (bulk_in !=3D NULL) { assert(bulk_in->pos <=3D bulk_in->len); - len =3D MIN(bulk_in->len - bulk_in->pos, p->iov.size); + len =3D MIN(bulk_in->len - bulk_in->pos, usb_packet_size(p)); if (len) { usb_packet_copy(p, bulk_in->data + bulk_in->pos, len); } @@ -1314,12 +1314,12 @@ static void ccid_bulk_in_copy_to_guest(USBCCIDState= *s, USBPacket *p) if (len) { DPRINTF(s, D_MORE_INFO, "%s: %zd/%d req/act to guest (BULK_IN)\n", - __func__, p->iov.size, len); + __func__, usb_packet_size(p), len); } - if (len < p->iov.size) { + if (len < usb_packet_size(p)) { DPRINTF(s, 1, "%s: returning short (EREMOTEIO) %d < %zd\n", - __func__, len, p->iov.size); + __func__, len, usb_packet_size(p)); } } =20 @@ -1340,7 +1340,7 @@ static void ccid_handle_data(USBDevice *dev, USBPacke= t *p) break; case CCID_INT_IN_EP: if (s->notify_slot_change) { - if (p->iov.size < 2) { + if (usb_packet_size(p) < 2) { p->status =3D USB_RET_STALL; break; } @@ -1353,7 +1353,7 @@ static void ccid_handle_data(USBDevice *dev, USBPacke= t *p) DPRINTF(s, D_INFO, "handle_data: int_in: notify_slot_change %X, " "requested len %zd\n", - s->bmSlotICCState, p->iov.size); + s->bmSlotICCState, usb_packet_size(p)); } else { p->status =3D USB_RET_NAK; } --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930942; cv=none; d=zohomail.com; s=zohoarc; b=nISw5SCzZ1LV+G2mxrIJgCOHJXAqDP6JDWcp6K6070Efl5gqD2dqHErnSMzQwsEk8ocmpkwLUXsfB+2x/6Qf2UJYAnSkyNpr82dsOF7E+NBm0mi7l4CSPc+pQmnDcWo7JyUnpnPdnqs98BqSi/XUtxwf4XQjB8KAzIIONIroHho= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930942; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JJYSed4bMpJL/q0dbriaVvyhdgepiiOHGbaEnAQQr7g=; b=G/RrmG5NcbNxEkvUvwq6j4eMqDIIdKnYBiU6eYiFbTsjE7a2k/SDqh5+PDmf6Kx/fPgyb/Q/ChNAfeuU4MigaleFTpxgRhYP+SOZVhVKhGCSICpEQbKJn+/WSNDd7gSTMtNiPwRXm3Wc9lD3Qndzosi3uSumwTehOeAjl/pNLjA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930942773793.4746635244544; Wed, 5 Aug 2026 04:55:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraDi-00045y-Mu; Wed, 05 Aug 2026 07:55:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraDg-0003pw-NX for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:36 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraDe-0007Wx-Oa for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:36 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-602-ITYTV0q3OYqNF9I9hWgtrQ-1; Wed, 05 Aug 2026 07:55:32 -0400 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 59AD818004A9; Wed, 5 Aug 2026 11:55:31 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D5301180034C; Wed, 5 Aug 2026 11:55:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930933; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JJYSed4bMpJL/q0dbriaVvyhdgepiiOHGbaEnAQQr7g=; b=eoe01yEcK/L7kv3Odc1PNBMWJdk9oGEC54OVtUbxiBpAGZUSRxVhInEfQBiwcj9bnhmElq pGRzHMwtSp10bdzSR8N+D34ZHS6RiRYrJ7cFdhnNMyjNYwm6RwMZDJ+pgarqmdi1JK+Q29 FdlngbpF/E0cHodMw0RLMaDixpHyNyk= X-MC-Unique: ITYTV0q3OYqNF9I9hWgtrQ-1 X-Mimecast-MFC-AGG-ID: ITYTV0q3OYqNF9I9hWgtrQ_1785930931 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:15 +0400 Subject: [PATCH 25/27] hw/usb/dev-smartcard-reader: advertise T=1 protocol support MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-25-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Zhao Liu X-Developer-Signature: v=1; a=openpgp-sha256; l=3619; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=BsrL+0MBSMaMusNeetvdAGYiszIG6+E8WKFChzY874I=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOvcb23HUT6JZsyVXSbwEIoyGPdOpSIYQFZo nwQ96ouETOJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrwAKCRDa6OEJdZac 5VIcD/wIGK5zaslJXmWVyQ6Gdv5yc99MW/27aOw5Nv7y4NKcXehckgJAdpovIfskORQeforNl8E wuLM41ce7o+kqQN3fLcthZydiq5pzcvOCjBRJJCBckEHYYx3FKkdzhJf++pE8TRMRRdXt83EmRv w4CMA4Ztr/CwNfDFo33pnj1aLa3RMScjT5ExZNPHe65uLgTAr1GiMGmsVBloZwoqAxzPU/jzzxZ ikXkjtC2PcXOgO2JqUdP/SxkX6eMJh2JMWfgwDi1RZTMtfpSABZZV9YRFCjOD8lxhtIfG4h5otn tasIuwnpSvP9TefoKaz9semk45S3fISh+5BTGhTrFFiPzNU2M6kAAR9mVQC6/Qws56UiWCtkJqf wr+JSIm1IIapjjs6r8aIFfpVKnlnRcygv/s0hWgugmBm1bOi75GzBMOVgh3L6Da43h+AadzrQod QrL1mLadjbZbsye6XIuYGE+P1L1MnncdOYAiVdS659necfOH9T5CASBzP2Wa/KERt3Q0GF/81kq CcuQIPfoQo2ccxpGWO8kA96oqmGSBeeeU0qKc93r2lFpudJTBq2/E1k92Agt6LcAgie7pVenbKi RIyxGIYGbuuk48MW3CAEWitrof2L/VSmCh9e0yOIMM4xjUriyqTeFe+yOg1Tk1x0JRa67obiyCH eabQIq6uQv5N25g== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930944737158500 The CCID descriptor only advertised T=3D0, but it actually handles t=3D1 since it shuttles framed blocks to the backend. libcacard advertized T=3D0 in the ATR, so it works fine. This allows passthrough cards to work at t=3D1 if they need to. Add a configurable property to also advertise T=3D1 in the dwProtocols field, enabled by default. Use the correct error code (7, ICC protocol not supported) instead of CMD_NOT_SUPPORTED when SetParameters receives an invalid protocol. Note: I only tested with libcacard emulation. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/core/machine.c | 1 + hw/usb/dev-smartcard-reader.c | 10 +++++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/hw/core/machine.c b/hw/core/machine.c index 790d947e28d1..e9fecdec18df 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -53,6 +53,7 @@ GlobalProperty hw_compat_11_0[] =3D { { "migration", "switchover-ack-legacy", "on" }, { "usb-ccid", "x-accurate-message-length", "off" }, { "usb-ccid", "x-pin-support", "on" }, + { "usb-ccid", "x-t1-support", "off" }, { "usb-ccid", "x-migrate-pending-answers", "off" }, }; const size_t hw_compat_11_0_len =3D G_N_ELEMENTS(hw_compat_11_0); diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 8520a2dab216..99086befe0b8 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -169,6 +169,7 @@ enum { ERROR_CMD_SLOT_BUSY =3D -32, ERROR_BAD_DWLENGTH =3D 1, ERROR_SLOT_NOT_EXIST =3D 5, + ERROR_PROTOCOL_INVALID =3D 7, }; =20 /* 6.2.6 RDR_to_PC_SlotStatus definitions */ @@ -330,6 +331,7 @@ struct USBCCIDState { bool migrate_pending_answers; bool pending_answers_loaded; bool pin_support; + bool t1_support; }; =20 static uint32_t ccid_bulk_in_pending_num(USBCCIDState *s) @@ -368,6 +370,7 @@ static uint8_t qemu_ccid_descriptor[] =3D { */ 0x07, /* u8 bVoltageSupport; 01h - 5.0v, 02h - 3.0, 03 - 1.= 8 */ =20 +#define CCID_DESC_OFFSET_DW_PROTOCOLS 0x06 0x01, 0x00, /* u32 dwProtocols; RRRR PPPP. RRRR =3D 0000h.*/ 0x00, 0x00, /* PPPP: 0001h =3D Protocol T=3D0, 0002h =3D Protocol = T=3D1 */ /* u32 dwDefaultClock; in kHZ (0x0fa0 is 4 MHz) */ @@ -968,7 +971,7 @@ static void ccid_set_parameters(USBCCIDState *s, CCID_H= eader *recv) uint32_t protocol_num =3D ph->bProtocolNum & 3; =20 if (protocol_num !=3D 0 && protocol_num !=3D 1) { - ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED); + ccid_report_error_failed(s, ERROR_PROTOCOL_INVALID); return; } s->bProtocolNum =3D protocol_num; @@ -1546,6 +1549,9 @@ static void ccid_realize(USBDevice *dev, Error **errp) if (!s->pin_support) { qemu_ccid_descriptor[CCID_DESC_OFFSET_B_PIN_SUPPORT] =3D 0; } + if (s->t1_support) { + qemu_ccid_descriptor[CCID_DESC_OFFSET_DW_PROTOCOLS] |=3D 0x2; + } usb_desc_create_serial(dev); usb_desc_init(dev); qbus_init(&s->bus, sizeof(s->bus), TYPE_CCID_BUS, DEVICE(dev), NULL); @@ -1742,6 +1748,8 @@ static const Property ccid_properties[] =3D { accurate_message_length, true), DEFINE_PROP_BOOL("x-pin-support", USBCCIDState, pin_support, false), + DEFINE_PROP_BOOL("x-t1-support", USBCCIDState, + t1_support, true), DEFINE_PROP_BOOL("x-migrate-pending-answers", USBCCIDState, migrate_pending_answers, true), }; --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930964; cv=none; d=zohomail.com; s=zohoarc; b=BZQPzJSZel1iGZvwdb36hN0Ph2KZijGPdPsKbd4ZdzMHvMGuJYPeHDCKUJU3vEjUh4MaFcXMcpXlUHGxpxNjX3AMqEKrZjs92dc7M51gFs6r3hV2gvT8aAZTr+2RxyNjKmVEclVSyiEMGpAYbWw7sYJ69ie7vJYlZqMvV/Qo7+U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930964; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qQpDyNbU/tG46EiuRbnYkqx7KUBqvimmPNcTnvK0MRE=; b=BnPpiHK9XWWhAU6DvuYUjnWYhyCQJxe+Ipfa6UUU7iS+ORD5MsNma0rXLgA5xx0H6vLt4GcNfdKSw9U0he/NSBl6A3UPvOTzb21RsqmJ6jDeFMyovh1daatOLfO6O3TWhYVa9L9QtIUDswGB0/KWfXSeUxnrGtl0VYw01uOxivU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930964280847.91958142957; Wed, 5 Aug 2026 04:56:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraE3-00050k-GM; Wed, 05 Aug 2026 07:55:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraE1-0004up-Cr for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:57 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraDz-0007io-Tv for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:57 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-630-jJh9S8KVMOi4xwYtHzRZHQ-1; Wed, 05 Aug 2026 07:55:39 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 665B118002C4 for ; Wed, 5 Aug 2026 11:55:38 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 51BC01956041; Wed, 5 Aug 2026 11:55:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930955; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qQpDyNbU/tG46EiuRbnYkqx7KUBqvimmPNcTnvK0MRE=; b=NfwfvckUYJiiZk5ga63s9kM8rNHixNp7GFqfYDWb+46Jb9ePeXO3g0RaYANNchgvNUfH2i eltUOyzTdKqiIWLcmpgof0j1XQYMc+RU8JfYQK/mahcy5QnpXxajeiIpFwPSXjoTspuIYl GU1aBYHLkD3amLa+CeCvmS0cHOdzn7s= X-MC-Unique: jJh9S8KVMOi4xwYtHzRZHQ-1 X-Mimecast-MFC-AGG-ID: jJh9S8KVMOi4xwYtHzRZHQ_1785930938 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:16 +0400 Subject: [PATCH 26/27] hw/usb/dev-smartcard-reader: correct CCID_IccPowerOff MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-26-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=720; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=zuU7sGv4XRn83fvDoUSbqUQUBz6wo6doi5L28VfpSJ8=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOvHOUZp6RniE5Gqwmnk7RZj2siGg6YMt+Yl S83dxcLc/iJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjrwAKCRDa6OEJdZac 5ZWuD/9QiP3W3Dx2udLZTMwyK5a29P/46Erx9QgYyfZs1HXgIhxhqkHXUs3tVzQXnzLzKPdJn4S EhMUIwV463v+JIHnsYkSjekByLEPCnvqrJ30/zrkQODvNrN5Z5QIZbye1gsIE8catunsOxrxRMw RBTuNZcbf6QsOXdX9TfeTYB3tYCTqsQId5+iZ5sgGeXOI6Q6h7H+fAmBthFUliqABuQEUNjtmyd cWCMWCZPUa8SLidY0Kt8O/pKtm/MsKdwYt5SxY24pv1Cam00YeQivqpzP7xTzoNq9taebX5ZEHe xxzB4BxgxvEKwRRQ5fSyY5FQhGRME8073A83VEGdVF9KPHvZybYv2AFbwhz++kkqDqqrfg7dRaE 3VeHsD2nsEskPRU54PLjvufV87IejAHNBgUb/oCyZEtHunpSHeuJiA73fLhQnqhfkKLpwI27XUy AM1d1YBEZNAFC4APGl0+dw+GpYNIV3wMujTM6gOzXn/XlH2+7Lpe0KZBXi4iLsvDvCKE8AQvL8y o2aTlh1IAxOEzDHnb0dHvWPkB/yY3BE21TX497zQbUq4PmQNG4C0wSLhK2jAliGhn5bR8/W2nyJ /e802/cN/mSS2KKlFPrLnKidu7e5MjRluinYFs3qt6I6EDuR4JdFsfR2ySnWxDe3KPkPMrbj/eB HBNGYso+rqU4Qlg== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930964678158500 The struct has 3 bytes reserved according to spec. Fortunately, it's not used yet. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 99086befe0b8..752571043ee6 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -264,7 +264,7 @@ typedef struct QEMU_PACKED CCID_IccPowerOn { =20 typedef struct QEMU_PACKED CCID_IccPowerOff { CCID_Header hdr; - uint16_t abRFU; + uint8_t abRFU[3]; } CCID_IccPowerOff; =20 typedef struct QEMU_PACKED CCID_SetParameters { --=20 2.55.0 From nobody Wed Aug 26 13:54:16 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785930961; cv=none; d=zohomail.com; s=zohoarc; b=UobJ1JCUvEnAdAhRKvGdTDJLwWdsKJFhG7GavKxyVToXbGLhCG0SaYFkXIMTwNkiXITjyg5hxExDEuz+ZRMz8x1k7h4J8yk04S1OYFX5h5Sv2h9h64DJXrcUh8mH6J3YuoDAMZIBzWcdUYaYKI7BtdHXc8ccu6T9p0HztWdik4w= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785930961; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=D0JOWpxgYHVraQyk7JyYhUXwt3gc/+3Ds3TfPwVGKtY=; b=Ztk+7hNedyLCZWmpqX+hGKuilfnTarNQhH5Q4zSTE5gZKFPNw8dXz89yvOrYtD0UF1vkZkTeENEoklTYPVHZ4w9tlN078yf2AODVWS5HI6/CW4/Sh8JyDFbr08+VY4vPuz77xG3mXcrQydyvSdN4v9ANdBWEVSlfdMMiymvQQd4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785930961437150.75172017105263; Wed, 5 Aug 2026 04:56:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wraDz-0004tO-59; Wed, 05 Aug 2026 07:55:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraDx-0004qO-Ok for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:53 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wraDw-0007id-Ak for qemu-devel@nongnu.org; Wed, 05 Aug 2026 07:55:53 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-531-kA3r6nWBMRyvnLTvTcg7_A-1; Wed, 05 Aug 2026 07:55:50 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 93BD21800471 for ; Wed, 5 Aug 2026 11:55:49 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 65E36195DF92; Wed, 5 Aug 2026 11:55:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785930951; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=D0JOWpxgYHVraQyk7JyYhUXwt3gc/+3Ds3TfPwVGKtY=; b=XNWHhSCmEJX2Tmqfia+UHs4l2v8UP92jTyHlt65c/wsf8hsoYEjTXss30ExUvYMvMPoq5f DXAErnNu6beB/A30Dy+s0j6nEJAGzUBSs0n6qcMWfVOt1Jvn/QbDqo9tobNzHVBhqmVkLv LhRj1w1WCV3p2n9MCJ7wD7Q+3vv4Mi8= X-MC-Unique: kA3r6nWBMRyvnLTvTcg7_A-1 X-Mimecast-MFC-AGG-ID: kA3r6nWBMRyvnLTvTcg7_A_1785930949 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Wed, 05 Aug 2026 15:51:17 +0400 Subject: [PATCH 27/27] hw/usb/ccid-card-emulated: free libcacard context MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-smartcard-fixes-v1-27-187ee9122441@redhat.com> References: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> In-Reply-To: <20260805-smartcard-fixes-v1-0-187ee9122441@redhat.com> To: qemu-devel@nongnu.org Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=857; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=0u/9EGX/TshoNoHcdDiBVT0hKpwYKdo8Nl67CxZjKuY=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcyOwVJ2mMrF5uaWhgyNISQ00j3Nme4cpbRp1g hAUdiWSUtCJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanMjsAAKCRDa6OEJdZac 5SMJD/98UxtuDZhzm+EIb83okk+oIJuf/7Kcr2kueInmBZFkHxattA+j4QL0EDoKYy5Opj5KHQP stLzIbf2v/tySbpIoZpwRiOxZYI082gpbmIebihchnYWFiv++cFGHtWtHQwkd0hOkyyIYtKhPyh Y21I/nhzgy6Uy1n1J7wzkdBHxvepy40MzTRBLFgJf2VDC0FQUZjz078jus2LiZZSUAgafFi8BF7 UFQ9ZE1abAW9XYM+srcnYIFKWPxcZJNege18tTDeAkB2IAk0tbK/RT+1wXdLsaoxKaNgcteXzTc pJ5ljaO72pdvgFELwLbFedo6hqR9fvQHL+q4vJS2Se6SaqwvUfW0IeJ/NqkI+L0Ln//Q1Yuj/MT tJ6SdmvjkoSWTE/2p+WI9paHFUPuxL2wo5MdXGPjyaCdYfnCPoA/ikZdlkaOs6ryW6LNuPBDuSP M4dE+VmqdWPGu+KjYoyLbMcuLfg6ljv6WgP95lQwLB88umSSehKOIqS6m6sS0vaPUU1qUzsX/Ho x2I/UXLVKu8fBMBDG1QD8Dl6gDceMBYwGoVkflQfmEgmlmLVBDZPhcPcu1ge/t5m7pz1n6mNRm+ x/RP80Pgth4abD7pkLJNStdM+YWEu8v2Txu3Iq5uUTN5ndTV05yd0+mvsB6VuEs9P6vywF7Et46 tVKoMN3gKCe7L5w== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.852, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785930962678158500 libcacard uses a global context, but we can call finalize since vcard_emul_init() would have failed earlier if a second card context was used. This fixes libtss2-fapi leaks spotted by ASAN. Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/ccid-card-emulated.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c index 985f21997aa8..6c8eec39faa9 100644 --- a/hw/usb/ccid-card-emulated.c +++ b/hw/usb/ccid-card-emulated.c @@ -580,6 +580,8 @@ static void emulated_unrealize(CCIDCardState *base) qemu_mutex_destroy(&card->handle_apdu_mutex); qemu_mutex_destroy(&card->vreader_mutex); qemu_mutex_destroy(&card->event_list_mutex); + + vcard_emul_finalize(); } =20 static const Property emulated_card_properties[] =3D { --=20 2.55.0