From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861498; cv=none; d=zohomail.com; s=zohoarc; b=UpY5FLbh8hJykeIAeQaClqAGwq6yXJ3HDtAW2orefICeGK6SpL8sATG8BqtGAxUI5Q4xw7iIRx1yRWDR+8gt4DoMJd73q3gYO6w4iXUM2MIC82BTp0dUSwQ4rctTVpEIn9GIDLRGzXqGrNDd/L4VDFdy73TzKtxbLQtNb+HVZXg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861498; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=TZmbH2/gqfx6THgqOZHwDcdXnhArTAtbTDCTFsdTcTc=; b=VN8chUdOo6ECxuN42PgKlgpvtcHWQBzmRvNgUVV87Y/LnFseLBxbxqxU0OdhIUMj2rZGU7gjy/JgGCeSVG8gLcPhuDuhDoesxrCcUXLsVH5uBZLtlGPfNH7FFf/WUUrt9fUrT6IuaDmvdI3Htam6zNTqJQwNaXX+fp4mY1nWJhw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861498195914.511190260259; Thu, 1 Oct 2026 06:31:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGrK-0007Qv-Bc; Thu, 01 Oct 2026 09:30:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrH-0007Q6-LS for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:29:59 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrE-00060i-1x for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:29:57 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-237-KxRaXhP3M_igJdh5lrJL_A-1; Thu, 01 Oct 2026 09:29:52 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id BB9D3190F9F5; Thu, 1 Oct 2026 13:29:51 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id E6503214; Thu, 1 Oct 2026 13:29:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861395; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=TZmbH2/gqfx6THgqOZHwDcdXnhArTAtbTDCTFsdTcTc=; b=c7M69yYWOcy7ZRqYAw2lXCTRJ1zFKAyjPLFY289jfWKXpuNsXLztyj9UWUHr+o1i9bA1eK mhWhyny3WtouJeLCj2a8IN50p6tuvJagvHOvPD2AskMvrEDJxKR53l1w8f6HOCvVvlUJaZ FD5eCzw7on2B4SdQNv8/qh1YVUJFPVo= X-MC-Unique: KxRaXhP3M_igJdh5lrJL_A-1 X-Mimecast-MFC-AGG-ID: KxRaXhP3M_igJdh5lrJL_A_1790861392 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:40 +0400 Subject: [GIT PULL 01/27] hw/usb/dev-smartcard-reader: validate interrupt transfer length MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-1-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=1629; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=gd9+exY4PBpz0mUvPkUrJQXW6HE9iDS2lLF+QiYhkko=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBHd4EJLQYu1qcXhvbakIhRY+34byVQPUdBu XJf+qkMZ/yJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gRwAKCRDa6OEJdZac 5c74D/95XmYyTCZ3nb59/cbyqU0LuejLHJSSKya0c268hx20M35iW0h/ybVRuf5hLLDvjUAzA4v dYTWBZBd6drFN/6bfOSahjzgXpSSXKFFlbwzo4sGg6x2s4beVnjhAuT8bkF9LvDT7tcsZ9caMSO keKfGDcei3TzTGONch4gg22OESRu/o9LGt7hJFRGOyrIPD0TqygOom8B0EQfT/HMevpcr3Zsc+I Y4FpP0lLs7A/r6ZJhbH9hz0q7AzcrTM3+K3ev9XaQQ9PgO6vQbvVVUS8HAg/krtkW+ZTWNbzFHw lkeAIlgL1Y0f79g5UCw/ZAwPxT6zGphcK3VATvT5IE+fypS4OeLR+bhtUKl2bH7OG3qcQInV81B F/wkF6yT7MoB4vFLh4O0gGth4zXePhoslCOPaBLvrV79ZJm5SLU20jwTh7UKLU+egTL07edIBvY T9TqXSdRCUN1LcsYnNAtLz7o0OxTNakXFJTLK/3YO/WxLL69QWaZNEV76RI+MPEZvWQv8JZTrr2 14uGlfXFV1UN3JByh8Qs3AnEh0sXhIDS8lXnF9Bjswm4LJ5j1yanE6upi7WJDn1yf1Y+5IAiUDa F/mM163O02KglsQi+r+7Nw++AgOxjOR/xZ+k8TBJ709A/QtVIVkJAc67C8mu7PmpYqSC/zaqV2M uUmGndXAxfm/Bbw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861500560158500 A guest can submit an interrupt IN transfer shorter than the 2-byte RDR_to_PC_NotifySlotChange message. usb_packet_copy() asserts that the packet has enough space, so a zero- or one-byte request triggers an assertion failure, crashing QEMU. Check the transfer length before copying and stall the endpoint when it is too short. The notification is preserved for a subsequent properly-sized transfer. Note: a later refactoring patch will switch to usb_packet_size(), but this patch open-code p->iov.size for consistency with the rest of the code. Fixes: CVE-2026-18609 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4128 Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 964c142d1066..bba97a2b19e6 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1122,6 +1122,10 @@ static void ccid_handle_data(USBDevice *dev, USBPack= et *p) break; case CCID_INT_IN_EP: if (s->notify_slot_change) { + if (p->iov.size < 2) { + p->status =3D USB_RET_STALL; + break; + } /* page 56, RDR_to_PC_NotifySlotChange */ buf[0] =3D CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange; buf[1] =3D s->bmSlotICCState; --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861527; cv=none; d=zohomail.com; s=zohoarc; b=SQB/RE2frC+8ah/3fDHV0qYNi4S4C6A1hiraKuDLOqt3avCHcvSkpoZ+NTihuK6LqcSY6K01AkoymM08hlyjbdVYadNc6YMUOpGfdClAs6zxH6/StK06NDBXpdwEwIPdHPxWCWIEYdsYfSMIvOpUXlCs+Y2ZNO01+UT9gJ94CQQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861527; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=1BXaeX1UwV3vIaqC+G5fHkdps2+vbYFs19Iq9Sgf7eo=; b=Bqo+4Gng0QtzTn/Gtzf4dAMAfT/QEGnsCdsnaVatpXif/sHh9qbMXTC1Co9KdpUCaj8cRdibFLEV2dPPWx/wkkdG3hphyP4EL8SIxRPbZBhucNlf6v1zsvot79f1rl9JF1SxkxWxizDzGVuc2NKKfhoQ0VxOXE+Ugt8v5Ion+Ns= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861527081646.204386213789; Thu, 1 Oct 2026 06:32:07 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGrT-0007WP-7H; Thu, 01 Oct 2026 09:30:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrM-0007RY-8r for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:05 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrK-00061i-D7 for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:03 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-257-87wt35VYPZCJPUw9RR21yw-1; Thu, 01 Oct 2026 09:29:57 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 66ADB1979075; Thu, 1 Oct 2026 13:29:55 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 9D8141956089; Thu, 1 Oct 2026 13:29:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861401; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=1BXaeX1UwV3vIaqC+G5fHkdps2+vbYFs19Iq9Sgf7eo=; b=A9XLn21UuEoxCf3XnoSHbTNR3T9CgW+vKV/gVAV7bqYF2wU0vtljrL65N3i1PoMr/NmFke 5Q6E39nfy8adleOEjLLGa+O1RbxFmoHx1jszZMJ11WEzSH4xjPwZ0GpSHoEOjNUFKzWoSY SzYm1OTD2owDuxZpXOvBlrSq+6SxZ2s= X-MC-Unique: 87wt35VYPZCJPUw9RR21yw-1 X-Mimecast-MFC-AGG-ID: 87wt35VYPZCJPUw9RR21yw_1790861395 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:41 +0400 Subject: [GIT PULL 02/27] hw/usb/dev-smartcard-reader: fix OOB read from pending bulk-in ring MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-2-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=2802; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=dX/G59RIuIisRnVjfAi3Y4LVmlF2qz9ETVujx8YjOXw=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBH5qYgXQWp5q8fPhk6qItrhJt8ZD5Xbw5S8 nqIZET045aJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gRwAKCRDa6OEJdZac 5QFBD/9TYUBfssmfzpNey41Ar5CdlGjVsylHndZHMg1xSPr/SXXy+/gBa8miZbylJzcLLwUEpoU W0+agHJG9L95L4ANAFRM2DZucEgB4OSTljBZrThKszsEVtd90NcGtCh3yMqfPEc7BxcO322/lo2 LT2WVUfTme2lzKVpy9M1FHqUz7LA/OngoXRQM8UPTEu9Oe21OxMuucC9u5sMOyr+PII2p2a3nIc rTOhwCTjXZcHFbY41j2juoUsXb/Y/JwkE0aqXne9vyJjgxaHmmon0kFo4XouBYmLlyTtI696fTg eGz5LAkO2PTkdzkHSYgTB3crz8on9uCIFGTZs3YbMEFFdbEV0CzsRWl+d0eAAjN88DTuNZUFVFA mC6h17KmTa9dGDmOhuFPp5FZTFWG8+WWnBWA18by7tKqO7h7NxRqyOYjLr0w5nR84I/zZ2WJF7N XpiBW842Dvk1RcMgRIoh0Wl39RbXfJ5EZW0BcrIgDKXmMzT2G4QF/4NknY1YPe4guN4VorupA/i VhvoAGSv3yx1wjEtqa8rs1toLITHz+wD8wC/QzrEeD1N6ZFJJQ8GwKPtWCXv6+1iHBYgMqYBCs/ aWt/6Q7xJ0vYMCByoiRzGgpv+G9+gV82D9moLiSA2unzZtxj/S01/GOPKAoYUHRqoB2ORIgReuY 1ND7W8iKn3G2/VA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861528775158500 ccid_bulk_in_get() decrements bulk_in_pending_num when a slot becomes active, but the slot is only truly free after ccid_bulk_in_release(). A guest can fill all 8 ring slots, partially read one (leaving pos non-zero), then send another command whose response reuses the active slot. The stale pos > new len makes the uint32_t subtraction in ccid_bulk_in_copy_to_guest() wrap, reading past data[]. Move the decrement to ccid_bulk_in_release() so the slot stays busy until then. Add an assert(pos <=3D len) before the subtraction. Resetting or removing the card must also discard the active slot so that its stale position and pointer cannot be reused. In practice, the device advertises bMaxCCIDBusySlots=3D1, so a conforming host never has more than one command in flight and the ring never fills. Fixes: CVE-2026-18204 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4086 Reported-by: Warisjeet Singh Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index bba97a2b19e6..aee966c0c92d 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -570,6 +570,10 @@ static void ccid_remove_pending_answer(USBCCIDState *s, =20 static void ccid_bulk_in_clear(USBCCIDState *s) { + if (s->current_bulk_in !=3D NULL) { + s->current_bulk_in->pos =3D 0; + s->current_bulk_in =3D NULL; + } s->bulk_in_pending_start =3D 0; s->bulk_in_pending_end =3D 0; s->bulk_in_pending_num =3D 0; @@ -580,6 +584,7 @@ static void ccid_bulk_in_release(USBCCIDState *s) assert(s->current_bulk_in !=3D NULL); s->current_bulk_in->pos =3D 0; s->current_bulk_in =3D NULL; + s->bulk_in_pending_num--; } =20 static void ccid_bulk_in_get(USBCCIDState *s) @@ -587,8 +592,6 @@ static void ccid_bulk_in_get(USBCCIDState *s) if (s->current_bulk_in !=3D NULL || s->bulk_in_pending_num =3D=3D 0) { return; } - assert(s->bulk_in_pending_num > 0); - s->bulk_in_pending_num--; s->current_bulk_in =3D &s->bulk_in_pending[(s->bulk_in_pending_start++) % BULK_IN_PENDING= _NUM]; } @@ -1078,6 +1081,7 @@ static void ccid_bulk_in_copy_to_guest(USBCCIDState *= s, USBPacket *p, =20 ccid_bulk_in_get(s); if (s->current_bulk_in !=3D NULL) { + assert(s->current_bulk_in->pos <=3D s->current_bulk_in->len); len =3D MIN(s->current_bulk_in->len - s->current_bulk_in->pos, p->iov.size); if (len) { --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861496; cv=none; d=zohomail.com; s=zohoarc; b=l0rlw8+kOK9xPVGly3cofqAxxjLlwFHGNt3yPYdKAf1mQt6byv6fgLLpgkR4znRM/QJi7KRZK7Xzj/6KWcUoGgWV1av5b/fh6cnXTDZnoXSCZRzuHyI5Ep0CUIP38rYRR7yGPPPcgv3e55HZrbGf+QvptGADpz72HVICchBoWo0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861496; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qL159fZtKp7u06YGG825uhx3tm+W5SLrbiiIFzQwURU=; b=UnA6gmS8njarDf5LxLjpmFXn/VHtAVRUpl7Wz7adeknycScBxYPvcPh4QvaNLeCMFja02B6+GOw4Ucm8hJR4PSZNoduftUWLEoAGcCU2m95scfLxcdJU1jWIT1pfTW/GWATTC+Gl05oRiSMYFJ5IcqSqdPZUHR73Idd5A4Lwpkw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861496928309.0325624136491; Thu, 1 Oct 2026 06:31:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGrT-0007Vh-6s; Thu, 01 Oct 2026 09:30:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrM-0007Rs-Sd for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:05 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrK-00061N-69 for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:04 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-664-3ah_9hiGN9OmPKlPl8V4og-1; Thu, 01 Oct 2026 09:29:59 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 831EE19772EA; Thu, 1 Oct 2026 13:29:58 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id B990146E; Thu, 1 Oct 2026 13:29:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861401; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qL159fZtKp7u06YGG825uhx3tm+W5SLrbiiIFzQwURU=; b=GrR6Ux+Z9xbBhMIDNrLFgCExriznDOMK7LBhvwp6zAslPp19FkKMb0nB1Kq5U8bedFw4Gu rMGU8Jri43xDk4JyOjeogGSapNDPvzY0Vd930C0xMLIQEWA+qn2RSaaXynPIJ/WqIL/DlX eXhph0gPn+xmgNvgBXM6Xg0/7SH7rlQ= X-MC-Unique: 3ah_9hiGN9OmPKlPl8V4og-1 X-Mimecast-MFC-AGG-ID: 3ah_9hiGN9OmPKlPl8V4og_1790861398 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:42 +0400 Subject: [GIT PULL 03/27] hw/usb/dev-smartcard-reader: fix assert on pending answers overflow MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-3-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=2030; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=oqfQZyWAvu53wFDKF++P6kpwZhpc4SiPNvpqAl1WC7s=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBHMw/uQxgMcnsHeVEpUn9vnVWh0RM/rkdmm BuDWL7/z9eJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gRwAKCRDa6OEJdZac 5QBCEAClA05WQdzXqb6osqMmF3gSEtm/kxo5AOj8yeK5dQMyHxgOq3PIE5sYl/3Khty34gIV9Im g5zpd9V8xv+CRNy0FCJSEsxkwD0ecNSvOIsE3hYfG1hXGybSVTIs839H59aLyhojI1evAG3geFo ig90V0jNiqv3YYJX3JC8TCm05Kn83wFrVo0ZKBDRXn8LCV26R3Lcw2SjpM66pZPTkNs1nsSZAL4 qvXqQA579eNzyUQAkyCOXZcjjU0nmu/gutOA7Hr2ddBsYECeWSYRtA7FhuEbIDFY8R+anzZprB+ bf1+9VQg4uOkXPJpI63gC1yynaeLCXSl8MZiJlV22U3QR4HT6t+EXsKLbh7mb2ekACUZg8A9h6z 578HjXbSFVXgP73cTyCgA9wmcy8C5Zez1web9/2Ns0Q3pmNUneob2wBDq7M9NyDU579RZOZcoSe vm5dZaQUGsXJe8m0w4lB+kxI184omhkV88VFmQ5n1R0wN/4mcLbZTxYyztm5JQj4IZQSrE2OvYA BHMg81B4sH8U6/sG2Hbs308ezAvEeCvUxsU49fIb9K6xPceqv3zq/2tG/aCmWuKWPYl9OBIsyxp 8nGdigRujw3cyC53uef1FLzJHzTF8nBUxnAW358FCR30fRpon+gJVXmvIrERdBFIMsc/dRXwIrX 6I8eirbb1lLMUFw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861498581158500 A guest can send PC_to_RDR_XfrBlock USB messages faster than the async card backend can process them. When the pending_answers ring buffer (128 entries) fills, ccid_add_pending_answer() hits an assert() and crashes QEMU. The CCID spec (section 4) states that a slot can only accept one command at a time. A second command to a busy slot must be rejected with CMD_SLOT_BUSY (section 6.2.6). Enforce this by checking pending_answers_num before queuing a new APDU. When the slot is already busy, report ERROR_CMD_SLOT_BUSY and send a DataBlock error response back to the guest. Fixes: CVE-2026-18410 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3997 Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index aee966c0c92d..9cbacf08e77d 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -166,6 +166,7 @@ enum { ERROR_XFR_PARITY_ERROR =3D -3, ERROR_XFR_OVERRUN =3D -4, ERROR_HW_ERROR =3D -5, + ERROR_CMD_SLOT_BUSY =3D -32, }; =20 /* 6.2.6 RDR_to_PC_SlotStatus definitions */ @@ -949,6 +950,13 @@ static void ccid_on_apdu_from_guest(USBCCIDState *s, C= CID_XferBlock *recv) ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); return; } + if (s->pending_answers_num > 0) { + DPRINTF(s, D_WARN, + "usb-ccid: slot already busy, rejecting apdu\n"); + ccid_report_error_failed(s, ERROR_CMD_SLOT_BUSY); + ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); + return; + } len =3D le32_to_cpu(recv->hdr.dwLength); DPRINTF(s, 1, "%s: seq %d, len %u\n", __func__, recv->hdr.bSeq, len); --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861440; cv=none; d=zohomail.com; s=zohoarc; b=RPUnpul6f0imYh+bMhmh8WBIrjH+r54oJHcdNAGBLKk1l+2Jac3VF739WW/NlG4RJWAROwH3kLvsCqqIxv4/LCOKrEqTYP+vSdaUAB5bRwFQKT4L+uU6b4JuxJU4omGfYMmBRJetlSOW3GBbe7lcOVRQrgKebbXAqAvyCEZW8Ps= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861440; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=oGb7bVxl71pK2JI9jeAzvy64NbfX5B2LGX/SdioEfnE=; b=oIfAEYE9nq7erI637r31fPUr1VeipyCQvI6rnDuDseNwfG9Q/j3uawLFahBNW0HXyb3QayHOeLokQM+JxgqMHag0Tp2shKcAUyUW3sgx4reeMYKlxrVDMkzB9Oe7dHAESKOlBherf/XaJJ2xpRDQtWS2yxXynWLI7sM9DZF7YDo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861440574259.4117054043435; Thu, 1 Oct 2026 06:30:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGrd-0007dM-6Z; Thu, 01 Oct 2026 09:30:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrT-0007b8-V8 for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:13 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrP-00063S-OY for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:11 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-172-WKqq3ouFNlK_NE-5HTw9dw-1; Thu, 01 Oct 2026 09:30:03 -0400 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 160841977019; Thu, 1 Oct 2026 13:30:02 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 3357D1800361; Thu, 1 Oct 2026 13:30:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861406; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=oGb7bVxl71pK2JI9jeAzvy64NbfX5B2LGX/SdioEfnE=; b=AWieXnroFbvZd5zSjUkdc3CAw6L1B0iDBxKRHJoq7FZnifAVG8WK++mi6BjMKvHBDiF4i9 r6xw7eBafWDck7oxNd2f6z4xUoGf4DjE9IZdVz3YYPQkJCnmKrAKg+bOcaWh9kfNyGd7xs I6QjZEUMW8jTKu6MZHe6UuHbkH841P8= X-MC-Unique: WKqq3ouFNlK_NE-5HTw9dw-1 X-Mimecast-MFC-AGG-ID: WKqq3ouFNlK_NE-5HTw9dw_1790861402 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:43 +0400 Subject: [GIT PULL 04/27] hw/usb/dev-smartcard-reader: decode bulk-out length as little-endian MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-4-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=2144; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=lvJc5DJaAPhL2Dub2eXYFx0OHUIFgKPZrlORX3sOSZI=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBHAFVJYpSew7vYXBVTrtav1O/L8yYYqRlLe t0f6PnO4duJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gRwAKCRDa6OEJdZac 5bRlEAC7MOLkDXLj5i6LpFNjvz9epr1sfXbEgVsxgzWCXdzJq8RDRXppNkMaXk3P/THWwB2JCjb IXcyq7fS8HR2bZmAGkQOuxzdNeKB83KWUCG6TJz81clZuQ2xajIHithumXwsFWR3dacvew7C54l SBaQ9Ei27ncrZkjl0q266vkF5cJ6pLZOoTT3zPUuMpMPWtCnoBdZUSbiowiPpBDpxSn6qjq48zw 83UG9yCZ8LetS2ZVUmmaHM0Cg1EwfUj3hfTv3+m9OiX93jLh23UBhtFxVDjK+q18yjXZSJWPk+X iOPNhi3K8M26R//uqcDC39/nFYfTwHRj1yjb18lUddTMJdZRbPCnHy/3hvO3rkvZPAm1NA5acVh VGbhf0Q+7lRce9kYrTiYED8xcLisFhW+l+4XfMzSRAv8djP9lRlwrl1/to6w3mJCgs7LwV7ThKB DCPbLtMkCw7qWrCp+XvzD2Q6gu3rV4Gh6LSeHF/cOHVDg6iSTY36h1NfyNLPe8QJoTscQsthibJ VQfQsp5mD0nhJGH3YsY/GU228hT/X8rVPHIaTPKowbiUJNql/IQq1S8MjbO8VTLb4XQVN9ZM+gD pqQITUZ0l05aly6uje/Vjmbu31xfmTxJTJbZau7zN9X+m59g2ohw8H7JrAxxKyyhEET+YEjnp9f NVhP9+0IvjQ8wTg== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861442548158501 The CCID Rev 1.1 specification states in section 1.3, Document Conventions, that fields larger than one byte are stored in little-endian format. The bulk message header's dwLength field is a four-byte field described in section 6, CCID Messages. Decode dwLength with le32_to_cpu() before using it to assemble and validate Bulk-OUT messages. This fixes message handling on big-endian hosts. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 9cbacf08e77d..4cb5f6e1a485 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -993,6 +993,7 @@ static const char *ccid_message_type_to_str(uint8_t typ= e) static void ccid_handle_bulk_out(USBCCIDState *s, USBPacket *p) { CCID_Header *ccid_header; + uint32_t payload_len; =20 if (p->iov.size + s->bulk_out_pos > BULK_OUT_DATA_SIZE) { goto err; @@ -1005,17 +1006,18 @@ static void ccid_handle_bulk_out(USBCCIDState *s, U= SBPacket *p) } =20 ccid_header =3D (CCID_Header *)s->bulk_out_data; - if ((s->bulk_out_pos - 10 < ccid_header->dwLength) && + payload_len =3D le32_to_cpu(ccid_header->dwLength); + if ((s->bulk_out_pos - 10 < payload_len) && (p->iov.size =3D=3D CCID_MAX_PACKET_SIZE)) { DPRINTF(s, D_VERBOSE, "usb-ccid: bulk_in: expecting more packets (%u/%u)\n", - s->bulk_out_pos - 10, ccid_header->dwLength); + s->bulk_out_pos - 10, payload_len); return; } - if (s->bulk_out_pos - 10 !=3D ccid_header->dwLength) { + if (s->bulk_out_pos - 10 !=3D payload_len) { DPRINTF(s, 1, "usb-ccid: bulk_in: message size mismatch (got %u, expecte= d %u)\n", - s->bulk_out_pos - 10, ccid_header->dwLength); + s->bulk_out_pos - 10, payload_len); goto err; } =20 --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861555; cv=none; d=zohomail.com; s=zohoarc; b=KL5t3TRYfSAUvrR0oRrFluDOLXoDm6gRcS7jREErCK4LATKVlnUOOF+CZINJBib1YRnv9WYG7FqesfjCXlowIkXuNDtuDY63tM2Fi0gOBgMIOX2HpUWMWXFv1AzIN7RroLE9QyxsIG5oBo6V5IuZLRggEanI9HOuEBK+fbMRfqk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861555; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0njDjE2smV1NBkl1OrGDuxIUXpqsDVRQBewzl0VZnzQ=; b=OzRn5NorzXEJWwalnJ+qzwxK/ZmgqvoOtXOywIflDLC6yq6xVHxVfkHqr+dRlPvHgxKiFApQRpIJY+rpaWi6mfsZfIsaAB2FRS0QLfZlcFNzDh3dw3UqiaIbtt1qEk1QFEp5zS38XyCgOhHZvhWmkoOHSh2XoT5fnGZFR9UdMSc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861555095650.9683076146167; Thu, 1 Oct 2026 06:32:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGrm-0007e7-10; Thu, 01 Oct 2026 09:30:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrU-0007bB-Qw for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:13 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrT-00064G-0H for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:12 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-70-0H0IE2ydPT6k-gsZ-T-lCg-1; Thu, 01 Oct 2026 09:30:07 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 813FD1809CA1; Thu, 1 Oct 2026 13:30:06 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 5619418002B6; Thu, 1 Oct 2026 13:30:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861410; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0njDjE2smV1NBkl1OrGDuxIUXpqsDVRQBewzl0VZnzQ=; b=V5VX6s9Ubyok0O9DpQIPlwyCmLF8VIKjLfue9Sqy2h9qhj9OMW2+vFtJxjFUpkBauF/Eh8 xhqHbuFWgOTbVfUYCYBGz0PynkpH4ST/1brnGuFPAQVf08vqQueAbaSXhky8cjnB3eAnQf XtElxII3Mmedn86XNc1hkvJS9f3jTSM= X-MC-Unique: 0H0IE2ydPT6k-gsZ-T-lCg-1 X-Mimecast-MFC-AGG-ID: 0H0IE2ydPT6k-gsZ-T-lCg_1790861406 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:44 +0400 Subject: [GIT PULL 05/27] hw/usb/dev-smartcard-reader: fix dwMaxCCIDMessageLength descriptor MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-5-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Zhao Liu X-Developer-Signature: v=1; a=openpgp-sha256; l=3474; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=/yt+O7FgKskLg67KH9wbm1hQRAAJVhwVUgrJWjmw9CY=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBHAHV+KOSGNgblDJg9rd6GKY3zjBUuRvtam KjwS6h0R4KJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gRwAKCRDa6OEJdZac 5binD/9ljatz6afBjMRjCVid0smdOr4CFFAbeQOF//LekJl6byIhfo56NARbqVxKMx0llu0/e3o +ZSF2Ar1fE0IQYYtznQbR+y2J+GMPoe6tUtuxCY2GIVnCTolMlqfrJky3lXVzs4AZ7ckHFygfky cVwi0qHtZsnM3ssPAkTK5GNCwVn0mbfOqy4+xDC8yP6+ErRoH8CSaqBa8jRnYvy0fIVSz9UUe7W cvry5AJ1msQmNfXi//dRyKRMf7WK/2mDrFYGHrMPd6lEh/zQ0UQmwBm0CLAnezEvPizM9Uxov9O WoY3oGyaXtNRIgrlqkIsmck1+jtbsI4LGOpgwWon7CXKQtd0XGQl2m7bMDKYk0gvZKjgXqYhvyh JDdtr39un9bCpx9KU/nsgMLeI3DLY74In70hIXP5RwOOC9Rfx1HFXJpHI63l5/XTWR7MXTObrec WwBBwtXhElu1ChRfHce5IMZwjc6O+2vq4N+aK8fklhpJ8QvJjNt30S8+I/fey4gbQknWxsrfUOA u18nGH0vryWTrmkAoHfhf+w6B4kaPIJ2AuTv8gubKxkYChsx255+VsnRuwdF7nvjKI0blq+4u2u ebM1TD24Ivsxn+MyALW7cwVI/tHVj0/rOmfXULu+SAJEcyvBseNPtXmLOZxHY1N4c/GcH2pHEui A9Cuuz2WQ9aWCBg== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861557032158500 The CCID class descriptor advertises dwMaxCCIDMessageLength =3D 65554 (the extended-APDU maximum), but bulk-IN storage is only 384 bytes. Since the device operates at TPDU level, the spec minimum is just wMaxPacketSize (64 bytes), and the actual limit is the bulk-IN buffer. Set dwMaxCCIDMessageLength to BULK_IN_BUF_SIZE (384) so the advertised capability matches the implementation. Guard the change behind a machine-compat property so older machine types preserve the original descriptor for guest reproducibility. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/core/machine.c | 1 + hw/usb/dev-smartcard-reader.c | 12 +++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/hw/core/machine.c b/hw/core/machine.c index 438624ece3d8..b30849d6f769 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -57,6 +57,7 @@ GlobalProperty hw_compat_11_0[] =3D { { TYPE_ARM_SMMUV3, "ssidsize", "0" }, { TYPE_ARM_SMMUV3, "oas", "44" }, { "migration", "switchover-ack-legacy", "on" }, + { "usb-ccid", "x-accurate-message-length", "off" }, }; const size_t hw_compat_11_0_len =3D G_N_ELEMENTS(hw_compat_11_0); =20 diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 4cb5f6e1a485..c200af41c83d 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -314,6 +314,7 @@ struct USBCCIDState { uint8_t powered; uint8_t notify_slot_change; uint8_t debug; + bool accurate_message_length; }; =20 /* @@ -326,7 +327,7 @@ struct USBCCIDState { * 0dc3:1004 Athena Smartcard Solutions, Inc. */ =20 -static const uint8_t qemu_ccid_descriptor[] =3D { +static uint8_t qemu_ccid_descriptor[] =3D { /* Smart Card Device Class Descriptor */ 0x36, /* u8 bLength; */ 0x21, /* u8 bDescriptorType; Functional */ @@ -387,7 +388,10 @@ static const uint8_t qemu_ccid_descriptor[] =3D { * u32 dwMaxCCIDMessageLength; For extended APDU in * [261 + 10 , 65544 + 10]. Otherwise the minimum is * wMaxPacketSize of the Bulk-OUT endpoint + * + * Corrected to BULK_IN_BUF_SIZE when x-accurate-messa= ge-length */ +#define CCID_DESC_OFFSET_DW_MAX_MSG_LEN 44 0x12, 0x00, 0x01, 0x00, 0xFF, /* * u8 bClassGetResponse; Significant only for CCID th= at @@ -1333,6 +1337,10 @@ static void ccid_realize(USBDevice *dev, Error **err= p) { USBCCIDState *s =3D USB_CCID_DEV(dev); =20 + if (s->accurate_message_length) { + stl_le_p(&qemu_ccid_descriptor[CCID_DESC_OFFSET_DW_MAX_MSG_LEN], + BULK_IN_BUF_SIZE); + } usb_desc_create_serial(dev); usb_desc_init(dev); qbus_init(&s->bus, sizeof(s->bus), TYPE_CCID_BUS, DEVICE(dev), NULL); @@ -1449,6 +1457,8 @@ static const VMStateDescription ccid_vmstate =3D { =20 static const Property ccid_properties[] =3D { DEFINE_PROP_UINT8("debug", USBCCIDState, debug, 0), + DEFINE_PROP_BOOL("x-accurate-message-length", USBCCIDState, + accurate_message_length, true), }; =20 static void ccid_class_initfn(ObjectClass *klass, const void *data) --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861485; cv=none; d=zohomail.com; s=zohoarc; b=kFuAgtXd+cN05bpKqUb3ImdwTIBcsspicgWyh810AKlFwNXK8kgYJiXxxTdCPxdjrI7hCc5ZgF+/+zZhTiIuR3i+dRrdEFg5JtH6PoPsKL27yX9t+Hyi8PAJiSz7Aw780KgDJLRJ97BEYSLaFgAl4vf6dmZD6GZUE6gqNItgIBg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861485; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=afFbDYOQZfArFQRaDE/FdfHqCf2G1EobRY/qHgBIMl0=; b=QOK0lxdOCagjOSjRPyYloQy+s1YHCLKwc9l6c8igwylCT/TAY3Lqyz7i/qzdr1DjqfMCYVRJ/Q10mkQKUPgvGL9BNbHkUHdlRo/l45GdSeVZldp66lFoTSb912Cn10I0lthdlxJ1nk1eolYK7tnNJCBPRvchf5N7H7GfonuQ7fI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861485549517.7802055950093; Thu, 1 Oct 2026 06:31:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGrx-0007sw-Re; Thu, 01 Oct 2026 09:30:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrY-0007dB-JQ for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:17 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrW-0006Gx-SC for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:16 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-320-W45b975PNuuWfpSnuCq77A-1; Thu, 01 Oct 2026 09:30:10 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id EEC30180136E; Thu, 1 Oct 2026 13:30:09 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 2F7D5180029C; Thu, 1 Oct 2026 13:30:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861414; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=afFbDYOQZfArFQRaDE/FdfHqCf2G1EobRY/qHgBIMl0=; b=AqwmrySn+u8tBTd+iwwITa6vc+mq1LQqsoTPZkyG8Ip8m2sDN4BFuba6dVG7Zuo/4ZbcWU 2dErR0a+KwW8gTEWMecxCIFm2FmpVubLjEhKkAmdAY6Tbc3NVz7JPDqnZVy1f0ozkxcQOt Lb2BeKERu8mBi16NeVsxZWFySEs7xsk= X-MC-Unique: W45b975PNuuWfpSnuCq77A-1 X-Mimecast-MFC-AGG-ID: W45b975PNuuWfpSnuCq77A_1790861410 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:45 +0400 Subject: [GIT PULL 06/27] hw/usb/dev-smartcard-reader: fix OOB read in atr_get_protocol_num() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-6-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=1100; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=5iowlDNhVdaQdg2jc1MaJUDefvrVlJpEui2BMNoySAo=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBHZQHDGvfZh0IipXzszfc5h2BqRV3BJTEha Fq13m65e0iJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gRwAKCRDa6OEJdZac 5V0kEACw/JzN1QFUoLZtw5DJ8236XBGs5DM+fkQSjHfYCiYtK/pRuv7wqBWHYbDDG6Bfb88eGFM E25Y6WsYUogDf8kSH6uSawTvpEyshZrEjga3jpmpwfkqALhtjOpTrcFR2snn+DcIV/txFS2Xhz3 xUyPiEVSsr2KJTQQcxZGQ/AqvtD+aaAlJkFcmsDnt9u2XnuOrn1X7rcWbyLwHoVi2kIjalawHjx bjN2WY7MRt7VXjvLEBvGBWWE54+VKPmW30mHucAUCYbcrzfyrBcQjaX0NG09xjs6lyNgepzp1uH rNrWABeScS0joM5SqR+FAQ0aZLtGCw62qs5r6NNNhPvd1f6IRduiCZx43VCa+zxc7Aw+xXy3wlr Ccmu8QHimLbiSPz0DtOEGlGokVQwzeg+HTuheV1GtW2oGg+wY2XeBD2daXp6FPkoDCIqMMewXKD pCDpXmxQ3xX8Uq8wKQZD7KA/j4a1j6+/BWahkk98Oul3Ddq2+qOlHy585wrXNutDdwkFdMA+Fot VJfj+MDhsRkD6/ViZd1ryPW18p/rt9fBxfvkZuBlQa+i+FUpM/Wb6mcKWxFybVC7Ls9evm3AoPm YQc/lwd9ICJR6A429fSsX2jXQYxn0iprsLrplNjYLN5zuwtCtrYc5GQEuWFJr69T4SSI25evPUn UMPXWvzVZVyqV2w== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861486445158502 atr_get_protocol_num() computes the TD1 offset from the T0 presence bits without checking that the byte exists in the ATR buffer. A truncated ATR causes an out-of-bounds read. Validate the offset before dereferencing and fall back to T=3D0. This is only triggerable by a buggy backend. Fixes: 2f8f916b6d44 ("dev-smartcard-reader: copy atr protocol to ccid param= eters") Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index c200af41c83d..b05f4a85666d 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -840,6 +840,9 @@ static uint8_t atr_get_protocol_num(const uint8_t *atr,= uint32_t len) } i =3D 1 + !!(atr[1] & 0x10) + !!(atr[1] & 0x20) + !!(atr[1] & 0x40); i +=3D !!(atr[1] & 0x80); + if (i >=3D len) { + return 0; + } return atr[i] & 0x0f; } =20 --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861486; cv=none; d=zohomail.com; s=zohoarc; b=MCR9gsZ8o44OoEFVzd+MYpbZ3fGjH/wEktMJ9Mv0g0LVrtIOT9e9sidI8bWWehsco9tjTkV0Yr5XmuxNY3VOMLoCHUysKhoeEBNTQDFX21TNGS+SAfHLJ2yIDFt1ZfKjQCQDm9HrjkKifRWGJMp5ZjW29k8P2xC2I2jX7YoApXA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861486; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=SWEzyTtziHOLEh9QjJ+cJOSJFGAj0GMSIb02VCXNztU=; b=Uk1v0XXndSkJFqFa7KZyE9orjH7PpzJm8cnqhBP789KWe2CGV/zNewomhrs2zsZrANV67UB57Xz1hzSxBbsTn2Hx++vQrKejqet85n6SOU0Dp6ZtGC/VJXCUdH5w14nDLXU52adjkl1DlAQ7Jl+d2WCCNgNFX12NI5ZzMhf4Hf4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861486620218.93128219254436; Thu, 1 Oct 2026 06:31:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsZ-0008QL-0h; Thu, 01 Oct 2026 09:31:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrc-0007e5-MP for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:26 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrb-0006IT-7W for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:20 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-635-08ifCF5RML2yNL0G5NWgbA-1; Thu, 01 Oct 2026 09:30:14 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 26D3B19056B3; Thu, 1 Oct 2026 13:30:13 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 5D92C754; Thu, 1 Oct 2026 13:30:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861418; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=SWEzyTtziHOLEh9QjJ+cJOSJFGAj0GMSIb02VCXNztU=; b=G34c5wyOeb6kPcsIglflbUJInGzBAbQoZmxHq+ny3XvjHvUaWtEezRLkOxRSZPapaC++X8 o740CDggETa516Ah/TwD5mmFEgoljHsixTgh+NgCc8GEDcik35fQBchpz1sLxjkk6a+H+N DnqS76UpKkm+nV8d+70sN2Bq8wcEY5I= X-MC-Unique: 08ifCF5RML2yNL0G5NWgbA-1 X-Mimecast-MFC-AGG-ID: 08ifCF5RML2yNL0G5NWgbA_1790861413 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:46 +0400 Subject: [GIT PULL 07/27] hw/usb/dev-smartcard-reader: block migration with pending queues MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-7-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=2243; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=EfS595qdVS9FMShSxwqJrIEBbIMzucm9U1uL91PHu/8=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBHI34vTMfpqF9JrAYzoLUyBG7/ZUDU/83Qs PyAFVgBzGKJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gRwAKCRDa6OEJdZac 5eCAEACVD3Putj8jMxUpCcQF4LYCGCqQTduLQd2CIibNDDOJC0e7jUloSBmSWfcm64PH5cB0xq8 wdj3POKj7ONcEwbqG5b6sPUs4tJzOpjcZGeoe2YxGScHq9WXYnsquCB0ieScPS/IaClXtxcrBKK 1eWWVZrGRECNHA08fAcpPjX94eu2D7iS25lKxpMCEekM+NyCmzhMwGhwsV0wayGE4GLeiQfsCdC cz836M1G6f6fO4uYJxUshTsUyzgsE4HswfhvGmDQSf1KAk4miXaWwoz0g03Sz9XeyPCLeGTuN7g uWy1ACc5QiObjPUtB9fzkmfd4vQ6FPHQyICslXejAdmkRgFLy1ESxdez4Ilu3AXecbFnsntDs9b NGkmutO2BsAJB7o2kYtQJBD3bZ7UKXRS6/x+j9rU1IHZa2FeN+sH1obKJpeFJtLTKUiTGeaEmrX AOL0Krv6v2qve7FGKaJ7xdKYaL5JUhWp0K5CHvvh59OH4cfqVvjw4rRueyb2nb/wb/TbG+KkJJd 2emW7Fn/Bt9YHpXtEo2hTIivsI841jDVyjzO+GN0rkapJ6isZNvw1Jf7bLepVWUuGoLhohQ+ifq i3DNX6DB6pbxqjoa1ZZTq7jCEWlxX6SAq65/RXp4KNb+wL4SJ2VXNr7hTeLvQTxmUSoN3MEOsNb NsJd4MnTEQCaYPA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861488606158500 Several queue state fields are not included in the vmstate: bulk_in_pending_num, pending_answers_start, and pending_answers_end. Also if current_bulk_in !=3D NULL (ongoing transfer). Migrating while any of these are non-zero produces inconsistent state on the destination. Rather than extending the vmstate (which would require a version bump and migration compat machinery), block migration when the queues are non-empty. In practice this window is very short since the CMD_SLOT_BUSY enforcement limits pending_answers to at most one entry. Convert pre_save to the pre_save_errp form so it can report the error cleanly. Follow up patches will add migration blocker and new migration version. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index b05f4a85666d..786d5217a95a 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1381,13 +1381,20 @@ static int ccid_post_load(void *opaque, int version= _id) return 0; } =20 -static int ccid_pre_save(void *opaque) +static bool ccid_pre_save(void *opaque, Error **errp) { USBCCIDState *s =3D opaque; =20 + if (s->pending_answers_num || s->bulk_in_pending_num || + s->current_bulk_in) { + error_setg(errp, "usb-ccid has pending queue state which cannot be= " + "migrated safely"); + return false; + } + s->state_vmstate =3D s->dev.state; =20 - return 0; + return true; } =20 static const VMStateDescription bulk_in_vmstate =3D { @@ -1430,7 +1437,7 @@ static const VMStateDescription ccid_vmstate =3D { .version_id =3D 1, .minimum_version_id =3D 1, .post_load =3D ccid_post_load, - .pre_save =3D ccid_pre_save, + .pre_save_errp =3D ccid_pre_save, .fields =3D (const VMStateField[]) { VMSTATE_STRUCT(dev, USBCCIDState, 1, usb_device_vmstate, USBDevice= ), VMSTATE_UINT8(debug, USBCCIDState), --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861498; cv=none; d=zohomail.com; s=zohoarc; b=AjjGgFvfd9e8vrkYCd5RYtML6QVIVM0tI+cS3xGtCilvBK1z1+INinypgh4T+QTBndsyyqE5hBhjSCFPgLsqe9NHYMWzhMHmi1M1rC3m/VYcEv+fcIv6xDLXBxMpzPG/3x4BUajIc5RzaJopGi4i42f8+A6ifbdetRYbJK0ElcU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861498; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=lWIBM2ZXglrUd23kFWRLvq7k6UftDx6q5rDXK/b5cnA=; b=PrOTIGi1CwdJDqbdHxnY9H6IK0PSxSBhA4SemPyEDcpTcScw6JWMHbMIq2EyHVAlkL4828+jTRPwuuDo6cNr8ZZaoJNIzh6QZ+6J/JM9ixkN7EhzjND707SvcaRR0GGTDbGwHq6Ng0OqPbGxYaOKg9pgsDgRB4a9jVfPViL51aI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861498797685.8780461985756; Thu, 1 Oct 2026 06:31:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsn-0000cu-7k; Thu, 01 Oct 2026 09:31:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrg-0007eF-9Q for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:29 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrc-0006JJ-Lf for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:23 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-661-kRzXFf1VOXqoQGORLR45kw-1; Thu, 01 Oct 2026 09:30:17 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 7FC3019056A4; Thu, 1 Oct 2026 13:30:16 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id B669C1956089; Thu, 1 Oct 2026 13:30:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861420; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=lWIBM2ZXglrUd23kFWRLvq7k6UftDx6q5rDXK/b5cnA=; b=jSEHuB923yf53WVu6txkoeZKIFXYC5O4l03NGL4fZjInZ/G3G+KfOKKIRtvlTgO2CjBg8W POb1eeXkgMRHSW3HjhGryI2FChe16VPYW1Tb/xF7Sgp2fVphEHY7GHY0ePGqqoicDoGX3d Ncz3GkOaFanyk5+R4fkq/Ec/8MlIrr8= X-MC-Unique: kRzXFf1VOXqoQGORLR45kw-1 X-Mimecast-MFC-AGG-ID: kRzXFf1VOXqoQGORLR45kw_1790861416 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:47 +0400 Subject: [GIT PULL 08/27] hw/usb/dev-smartcard-reader: drop needless state fields MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-8-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=1845; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=r7pycVW+de2Q6cGfmcDBWH+eQJ2goLJcJrX/ILjk4wQ=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBH3i8UFV6rhTCSD4NKaxWeFLkCq6h5pFRxp 3XNGmbhy5GJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gRwAKCRDa6OEJdZac 5W71D/4wZrmN2MryOChXeloL6t0fKhQtnTvpo6VMPVwiY4lnnmZsfhKvzAbow9G7oXcsXsuTqf9 8jMHENnZKgruJmky88Z1s0evIqB5fEdz5SWEPKjEHN8GjmL4ojSfganCPJZ2BxdI3ZYWfmbII5s NgbgR/O+xhy0R2B/w0/jEqm3geQuF5Lviu1gMaBxnPD8p4VYraVEmdg9R6dKWEOn89d1tTGY7NU Bq+6L30jE7z5ufp0bsgWOZ7XAhNsVaABUHwq0rnVSrx0UPgjEj/zxFW2beZtufObP0jHkATcfTy +uAtNYJLCaf/xF0qTshIhcSfsPCNyaUa3i0ivoLJdb38K9PoSmZtnutoZIhwfPMQZIeiySvtitU Yix40QPt/c1I2W+0Ib4Os1zhyvxjvBixKjHtVYedxNVaqUjpc/uTpnz2RasitkhWyMftso6fUfH m1ed6zpVVAyC8va3B0FaRVS61ESVu00xs6Q5vlRVwMku9GlrZnU+ZClWyfPsVdr2+rdjshECCcr 47Dhqvaxb549lj8a/JKSbAA9seU23DJFCQVk0mMMCaNh7zp4SwVxMCaRWadjiJQVuPs47OQWw1C JpcsQwX/0JznbcsLvmv3z87OSXGW9DYPE//ejD5+mcOgzhCRjIv6rQKc6v0SCe96fge/sDe6EDv hNZtKNlLA8In9Ug== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861500565158500 The field is never used, it could potentially do break on malicious migration stream. Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 786d5217a95a..0201b994f9c2 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -308,7 +308,6 @@ struct USBCCIDState { uint8_t bmCommandStatus; uint8_t bProtocolNum; CCID_ProtocolDataStructure abProtocolDataStructure; - uint32_t ulProtocolDataStructureSize; uint32_t state_vmstate; uint8_t bmSlotICCState; uint8_t powered; @@ -766,9 +765,8 @@ static void ccid_write_slot_status(USBCCIDState *s, CCI= D_Header *recv) static void ccid_write_parameters(USBCCIDState *s, CCID_Header *recv) { CCID_Parameter *h; - uint32_t len =3D s->ulProtocolDataStructureSize; =20 - h =3D ccid_reserve_recv_buf(s, sizeof(CCID_Parameter) + len); + h =3D ccid_reserve_recv_buf(s, sizeof(CCID_Parameter)); if (h =3D=3D NULL) { return; } @@ -1451,7 +1449,7 @@ static const VMStateDescription ccid_vmstate =3D { VMSTATE_UINT8(bmCommandStatus, USBCCIDState), VMSTATE_UINT8(bProtocolNum, USBCCIDState), VMSTATE_BUFFER(abProtocolDataStructure.data, USBCCIDState), - VMSTATE_UINT32(ulProtocolDataStructureSize, USBCCIDState), + VMSTATE_UNUSED(4), /* was ulProtocolDataStructureSize */ VMSTATE_STRUCT_ARRAY(bulk_in_pending, USBCCIDState, BULK_IN_PENDING_NUM, 1, bulk_in_vmstate, BulkIn), VMSTATE_UINT32(bulk_in_pending_start, USBCCIDState), --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861501; cv=none; d=zohomail.com; s=zohoarc; b=IwyA5DqaRowG/iAYWDpA2nm9SQnHDGLxQI09jRaaNgNj5A1UsMy/+3zJnbzliiNKmSVjUHb9W50HkRaJf9gVZSDmW6zAW0bf07X20dwTDegHV3RatS0RXUsNpXykME26XKBsOko5SmF7FJkbh6+jHWYN0H9mS1hIqS2RUDrrhLE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861501; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=pQkvoJscCc6aDW9GWSIoJ4FtHTQmqSYkVmc7PFwItO4=; b=b3BNBlh369Ty5RlKh8F7WpZB1wvD9K7P7i1vnDrEGTJ02PGyHm9bBlOozRfT8c9RG8j0TYprPrzwV/PNsWFtfthvzZti+6i7vRjk+y1+RlPIXywThKiDKi51Lk+Iy2lvIbrXk+Cha0hrqSpW5B2uaOj07wMBED20Wv+xHyXWj0I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861501720456.3416514679367; Thu, 1 Oct 2026 06:31:41 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGs7-0007va-EC; Thu, 01 Oct 2026 09:30:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrj-0007eT-Ao for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:29 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrh-0006KZ-Ut for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:27 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-111-VIdVdvYBOBSxH-H65MQrQg-1; Thu, 01 Oct 2026 09:30:21 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 978771977032; Thu, 1 Oct 2026 13:30:19 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id CEA5546E; Thu, 1 Oct 2026 13:30:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861424; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pQkvoJscCc6aDW9GWSIoJ4FtHTQmqSYkVmc7PFwItO4=; b=AxazRTsL1TBRtryY+RqceBJCjyPiyp4eIBxCriNOkpKlZktHJ5ueQZJnk6XiVBcEsW4IPd itiNOwKo2vMNeN07c34rl51a1zK40M8BRgFdyo6S6AxliXVNV1NVuFwTs6IwbOQBdHUBSr CiIdkO9Fo9qVfmzSPTGEUfGzzZEwvhM= X-MC-Unique: VIdVdvYBOBSxH-H65MQrQg-1 X-Mimecast-MFC-AGG-ID: VIdVdvYBOBSxH-H65MQrQg_1790861419 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:48 +0400 Subject: [GIT PULL 09/27] hw/usb/dev-smartcard-reader: validate migrated fields in post_load MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-9-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=1386; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=b8IBtxChvbvmJQ3hfxAOtHgud/sBAEaYO5UFt/xsmfk=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBH2k8XDBy/lG0XS8KMY4WwzGJJeSbiJqpqD AmpDbBk+JiJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gRwAKCRDa6OEJdZac 5byDD/9o3MGLvdcR+k0PLB/aS+PkyEVdXuvu3RBFliBZ5DL0ia2Ob511rlMmPXM9lhlF6FNM4WD 2KUDzfsQ/99LAZ3nSd3YlxVQYybkZeIF6TwHhuqAQs+wNSgcf9vvNvBDu5LyOQaCAF1aZ7DSMVa R+VT3qlsGMFsxXiOL6mlE+log8XzyZABQyWO30UXgRgUm9mbeoqS9ldOO1Ii7XbXQhDbOpvxBWe q+e1Cr1sNjamyLPyiThnxJGwM7/yL1EgYqb45YUZloXQohaNaOwpu9i8qEPOE2+bBh+mOPDu7hS y5A30hRiFtuDIrxazKfnPuO5IZL5sLc81yl6UC1UwHy54TEOE+HOvmpNKd6RxVmla/VWIPXjkEO UNTk0lflHMihAm/LA3rdKOtkuA7RUd4dyjn8dwRXZDT1t1G3FG6C5fh7ht6zVDy9QD46eKG6wLa LCeN/LQr/cL/eUePQkUaZWhFamoFkGCcizNdz0v6vlf53B1saGksLfcBBNmS8xenfgFETzrWqAt JFWCSU1DlJmGtgdByNVlH3E6m8cLgNqkK5IFhRGdlDkwRQNsDDFARzEF6lU6C8gllwBAB9m1R1G oi5rYfAg3nKVdwDzNPyrBKEu2Dn/xUgDmxMIB/8atbguySz+OONoLKgo7edv+dlm1glXGhaqhit Y9TKtSwSr6XIbvQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861502538158500 Validate fields loaded from the migration stream to reject crafted or corrupt data before it can cause harm. Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 0201b994f9c2..52d6f7e8d4de 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1368,6 +1368,26 @@ static void ccid_realize(USBDevice *dev, Error **err= p) static int ccid_post_load(void *opaque, int version_id) { USBCCIDState *s =3D opaque; + int i; + + if (s->bulk_in_pending_end - s->bulk_in_pending_start > BULK_IN_PENDIN= G_NUM) { + return -EINVAL; + } + + if (s->pending_answers_num > PENDING_ANSWERS_NUM) { + return -EINVAL; + } + + if (s->bulk_out_pos > BULK_OUT_DATA_SIZE) { + return -EINVAL; + } + + for (i =3D 0; i < BULK_IN_PENDING_NUM; i++) { + if (s->bulk_in_pending[i].len > BULK_IN_BUF_SIZE || + s->bulk_in_pending[i].pos > s->bulk_in_pending[i].len) { + return -EINVAL; + } + } =20 /* * This must be done after usb_device_attach, which sets state to ATTA= CHED, --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861485; cv=none; d=zohomail.com; s=zohoarc; b=LrdQPNvdDgFpmGHlXyvv1S6OOC4vPyh7QlX4+0R+RKv2S0Uxu3PBOGxmVHPIiEhMvplVYDGZXTSUNI5j9W1tl8rPpFxxMgjAVF1I5f6hHhE4hnVU3AuX+PCagVmilPPf4EDDAxzFHOhNoL9hLnklHIyxW63OE+vrjN9V/si23u4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861485; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=BzXfffnWSNHmW+TEOhH4ElaUYO0d3+YddCcBShim0Zk=; b=CqQTIeFpQPeLbvL/ounCEGk0P3bLDr6yCxkubOG3K1ZqlI75HaN6616OSCn6Armsx+myO5vXnsa2UjqPcYnOWW33Xl2sWlavXdsZ5fnjlGfPn2EVd3BxXwge1H7ThOyuxPkBBlJX5EL+BCKw189bPYRKHDGa9TooKKin/QnWlxY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17908614855761022.9006426470892; Thu, 1 Oct 2026 06:31:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsJ-0008A5-TV; Thu, 01 Oct 2026 09:31:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrn-0007fP-QR for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:33 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrl-0006Kx-Im for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:31 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-394-PkcWELfiNfKidfVWPXWG6A-1; Thu, 01 Oct 2026 09:30:25 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 2F7C01955F22; Thu, 1 Oct 2026 13:30:23 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 6508830000E6; Thu, 1 Oct 2026 13:30:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861427; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BzXfffnWSNHmW+TEOhH4ElaUYO0d3+YddCcBShim0Zk=; b=EfWl3N3eLEjPUp8fMx5BPnP/NJwe3DJ1Jxzs+QREMm/ryejS//EdpR327aZ6qvj00oSxch pxV6iq+CPATsf/2oj75POgWEaGps90A3f2ZuO4bvzSmyUVKb2SgSId8RlJEJdvEDXdKbVw GhdCJhuG0V0W7pqrVOALE/X+Y7ongoo= X-MC-Unique: PkcWELfiNfKidfVWPXWG6A-1 X-Mimecast-MFC-AGG-ID: PkcWELfiNfKidfVWPXWG6A_1790861423 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:49 +0400 Subject: [GIT PULL 10/27] hw/usb/dev-smartcard-reader: reset all I/O state on device reset MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-10-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=3473; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=hYFaAXo7E7kMCZjlWcmSX37LRvdqJFDVQU55mcJ2O0g=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBHVC6VUS579DfVd75i3iEMuBH1zVbf8jojo at+6dvZtIuJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gRwAKCRDa6OEJdZac 5c4xD/wIME1r/DxJBVO2V54YQCQ/7Odc+LwRtK4jfak8b1wFzK01OxiBYR5f1AvoAgHoSCrxEaA cFr4d1OlnrFEERt1eO9xYwDhspnJ93kWDpmWZveyGYMzfawW4oFr+LrKDh3W0sisgSO2zxf0DzR G6VnCfbxjz4rBDoAUAaSIoeZb75CXbXGDGPNMolG4YtvfNtFC09MQc0/dM5H89pfutlLQXh7DXM hlUa3nastQw71VXt0Lrrd2dHCqzUJvCkO0PLaxyCyVe5SlTvjxLYtC/Iccw0LujCnLGJ9GutS4M R0hkpjbyjepZSmC3p3MuRvxtegQU2YburCExbpbck4oQxAGoLkpqvRrLMQph8CFiY6TB3DqTFJ+ SiLDVUvB99SQMywFCGg01gWLOyznAxrP/49OCFV59jwpUCpc2tltLXjZTpEayRfCgwlcplbgtFM pjy/EZAmk6HSkEdjsYgQktPO3MwYQXDzm3neCA3g2xSp3uAl7oSk/dY2o5pt88MYfhtLb94ryjl UByPexJ/82cU2TK3/cgw42IVX7IYqAx07MzQ5OxSx9Djji3dCB2jRh+sJOEH1BLFlVdTiPQB6/t xewG420uEOwzvixUL1ACaWOvbkzZcXDOGWpsgfDmQlutKgQgs/u1wp2kNrOgjSWP6cdpliHnC/Q 5Lexug2pgI7boqQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861486488158500 Clear bulk-in entries (len/pos), current_bulk_in pointer, bulk-out position, error status, and protocol parameters during reset. Previously only the bulk-in ring buffer indices and pending answers were cleared, leaving stale state that could corrupt subsequent transfers. Move ccid_reset() after its callees to avoid forward declarations. Drop redundant initialization from realize() since it calls reset(). Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 62 +++++++++++++++++++++------------------= ---- 1 file changed, 31 insertions(+), 31 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 52d6f7e8d4de..12c82c8f6458 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -574,13 +574,16 @@ static void ccid_remove_pending_answer(USBCCIDState *= s, =20 static void ccid_bulk_in_clear(USBCCIDState *s) { - if (s->current_bulk_in !=3D NULL) { - s->current_bulk_in->pos =3D 0; - s->current_bulk_in =3D NULL; + int i; + + for (i =3D 0; i < BULK_IN_PENDING_NUM; i++) { + s->bulk_in_pending[i].len =3D 0; + s->bulk_in_pending[i].pos =3D 0; } s->bulk_in_pending_start =3D 0; s->bulk_in_pending_end =3D 0; s->bulk_in_pending_num =3D 0; + s->current_bulk_in =3D NULL; } =20 static void ccid_bulk_in_release(USBCCIDState *s) @@ -625,26 +628,6 @@ static void *ccid_reserve_recv_buf(USBCCIDState *s, ui= nt16_t len) return bulk_in->data; } =20 -static void ccid_reset(USBCCIDState *s) -{ - ccid_bulk_in_clear(s); - ccid_clear_pending_answers(s); -} - -static void ccid_detach(USBCCIDState *s) -{ - ccid_reset(s); -} - -static void ccid_handle_reset(USBDevice *dev) -{ - USBCCIDState *s =3D USB_CCID_DEV(dev); - - DPRINTF(s, 1, "Reset\n"); - - ccid_reset(s); -} - static const char *ccid_control_to_str(USBCCIDState *s, int request) { switch (request) { @@ -922,6 +905,31 @@ static void ccid_reset_parameters(USBCCIDState *s) s->abProtocolDataStructure =3D defaultProtocolDataStructure; } =20 +static void ccid_reset(USBCCIDState *s) +{ + ccid_bulk_in_clear(s); + ccid_clear_pending_answers(s); + s->bulk_out_pos =3D 0; + s->last_answer_error =3D 0; + s->notify_slot_change =3D false; + ccid_reset_error_status(s); + ccid_reset_parameters(s); +} + +static void ccid_detach(USBCCIDState *s) +{ + ccid_reset(s); +} + +static void ccid_handle_reset(USBDevice *dev) +{ + USBCCIDState *s =3D USB_CCID_DEV(dev); + + DPRINTF(s, 1, "Reset\n"); + + ccid_reset(s); +} + /* NOTE: only a single slot is supported (SLOT_0) */ static void ccid_on_slot_change(USBCCIDState *s, bool full) { @@ -1353,14 +1361,6 @@ static void ccid_realize(USBDevice *dev, Error **err= p) s->dev.speedmask =3D USB_SPEED_MASK_FULL; s->notify_slot_change =3D false; s->powered =3D true; - s->pending_answers_num =3D 0; - s->last_answer_error =3D 0; - s->bulk_in_pending_start =3D 0; - s->bulk_in_pending_end =3D 0; - s->current_bulk_in =3D NULL; - ccid_reset_error_status(s); - s->bulk_out_pos =3D 0; - ccid_reset_parameters(s); ccid_reset(s); s->debug =3D parse_debug_env("QEMU_CCID_DEBUG", D_VERBOSE, s->debug); } --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861666; cv=none; d=zohomail.com; s=zohoarc; b=J9nfkBwtGKBP5acpgf4n++ug684vqsQv7vBM5uuu8PRV91UXZCUTyu5NCkG/tSaOCipWWKoOFrVg17XJI4Xr+sgXyasyTRYHmIcyz6EUtUURjDOuhstONaj5RY9sUVIBXmk0CTzA+9aBmu5goTaMUtkemxksSGAX9vydP0tp6KY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861666; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mrZF6cdcnqviib3gja16Mvyqjbw8z+nCL3N0PjPyR7c=; b=KiXshidKUxx30V2NNQIi4JszbcJ8fX48EKk0W1LNK21FIP2q5/jKu5oaa6sKAreI2sB9kCr06LzX8UXI8SjKHxSh3Ykqp58F+NFcmRPdxzkoXN5p1RsGPabcTdiPakCx/BXZdvJumxpK1wjcyEXkhPRpfW4SBIcmuYPweKDmoU0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861666480132.20109705596064; Thu, 1 Oct 2026 06:34:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsO-0008Fj-Mi; Thu, 01 Oct 2026 09:31:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrs-0007m4-68 for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:37 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrp-0006LR-Iu for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:35 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-286-WW1jT4X3NS-FI21k1fa89A-1; Thu, 01 Oct 2026 09:30:30 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 63443193611C; Thu, 1 Oct 2026 13:30:26 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7F4C946E; Thu, 1 Oct 2026 13:30:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861431; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mrZF6cdcnqviib3gja16Mvyqjbw8z+nCL3N0PjPyR7c=; b=D9GVOuQqi6w899QoMb1jng1+/K4YkXZIy5odc+4jsYKSejlOxjjGrffvx/jQcAYbBmJMcL 91enIWXXmDLuqldzvFGfWCONWNau/xJQfpFUHaVWmYMSpWQWMRH0OZnj7zkSMurzrtm9lA HjYUdzlKOPzoq5KLGFIqEvenXOlJqeQ= X-MC-Unique: WW1jT4X3NS-FI21k1fa89A-1 X-Mimecast-MFC-AGG-ID: WW1jT4X3NS-FI21k1fa89A_1790861426 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:50 +0400 Subject: [GIT PULL 11/27] hw/usb/dev-smartcard-reader: apply backpressure to bulk-out MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-11-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=4392; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=j53eiN9DcSL9MXPj9EvF47pIBzJmmq/32PTbmZDAsvI=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBHckdTKmkdY9nKNKdhqwMxMQcVVUxuhCDbl slZCtjGk06JAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gRwAKCRDa6OEJdZac 5STpD/99xvFGbTcrwtjP0aTtM6GnupIvXgUFKqduiu/6mh5fPfc6ejjz7lq5BkxUGNZKQm3gW5x yjH2gv/2uQWEH/avusAFYMOmJsU/fBo4nd0h+Ai/pEzEMi+45WPfEqsyflBQCUMqUSuVy+J4t0U mOT7oN9NBiQkm4E0unaFxAF6cEaFmYUc3BlfZhIpxHeHrrMKfjx1jfbx+KCGHgWmD10A5m89ZLY GFo1KVmO5aiLcMHcPyuybsqCsoDoMZz0FFZnVPKl3SUP0rbe6q8vt9InSKkQP4TWqWxuoPRj8Gd GIF4WwaSa1EJaKIbttjDBMCyTtUNhGT92qumABU0CCtWbPrpzrG3WunuIqEumBL/2bGT15a3gpT rFeP0X1SfH8VQ1zhRiBNqVIhQFzSO9V8HdZM6EHXvNrMrzw5uJooEglsByyTN7T1mMPolG+QHw7 CRpTQdxbYskT5VPaOHjMlzq0xSof5eaHKtle8ECvh0zCQUvhGPyYKwv6NFTX727A+VpOYO7fCUk RugsSSV0meR6F8b8nD9NSv5L6qgUhX/ODocivVCtaKx/xdZ3M8iH1WBBTlRokWWNs9wzkw2O3X4 xCg/ySCDgtxddjZX5LuxuIpCIihBRtP1w+bJOv6sPlkooQV5YgY9m5CRTOkpI+uyflEyJq2VDjo sGv3sQHHVOGh+bQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861667878158500 A guest can send bulk-out commands faster than the card backend produces responses. Each XfrBlock adds a pending answer slot, and other commands immediately allocate a bulk_in_pending entry. Once all BULK_IN_PENDING_NUM slots are full, ccid_reserve_recv_buf() returns NULL and responses are silently dropped. NAK the bulk-out endpoint at message boundaries when bulk_in_pending_num + pending_answers_num >=3D BULK_IN_PENDING_NUM, so the guest retries later, giving the response pipeline time to drain. Change ccid_write_data_block_answer() to peek the next answer before attempting to write the data block: if the bulk-in ring is full, the pending answer is preserved for retry rather than being consumed and lost. Update ccid_flush_pending_answers() to break on failure so it does not loop forever when the ring is full. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 12c82c8f6458..279fef03652b 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -765,13 +765,13 @@ static void ccid_write_parameters(USBCCIDState *s, CC= ID_Header *recv) usb_wakeup(s->bulk, 0); } =20 -static void ccid_write_data_block(USBCCIDState *s, uint8_t slot, uint8_t s= eq, +static bool ccid_write_data_block(USBCCIDState *s, uint8_t slot, uint8_t s= eq, const uint8_t *data, uint32_t len) { CCID_DataBlock *p =3D ccid_reserve_recv_buf(s, sizeof(*p) + len); =20 if (p =3D=3D NULL) { - return; + return false; } p->b.hdr.bMessageType =3D CCID_MESSAGE_TYPE_RDR_to_PC_DataBlock; p->b.hdr.dwLength =3D cpu_to_le32(len); @@ -788,6 +788,7 @@ static void ccid_write_data_block(USBCCIDState *s, uint= 8_t slot, uint8_t seq, } ccid_reset_error_status(s); usb_wakeup(s->bulk, 0); + return true; } =20 static void ccid_report_error_failed(USBCCIDState *s, uint8_t error) @@ -796,19 +797,26 @@ static void ccid_report_error_failed(USBCCIDState *s,= uint8_t error) s->bError =3D error; } =20 -static void ccid_write_data_block_answer(USBCCIDState *s, - const uint8_t *data, uint32_t len) +static Answer *ccid_peek_next_answer(USBCCIDState *s); + +static bool ccid_write_data_block_answer(USBCCIDState *s, + const uint8_t *data, uint32_t len) { - uint8_t seq; uint8_t slot; + uint8_t seq; + Answer *answer; =20 if (!ccid_has_pending_answers(s)) { DPRINTF(s, D_WARN, "error: no pending answer to return to guest\n"= ); ccid_report_error_failed(s, ERROR_ICC_MUTE); - return; + return false; + } + answer =3D ccid_peek_next_answer(s); + if (!ccid_write_data_block(s, answer->slot, answer->seq, data, len)) { + return false; } ccid_remove_pending_answer(s, &slot, &seq); - ccid_write_data_block(s, slot, seq, data, len); + return true; } =20 static uint8_t atr_get_protocol_num(const uint8_t *atr, uint32_t len) @@ -1008,6 +1016,18 @@ static void ccid_handle_bulk_out(USBCCIDState *s, US= BPacket *p) CCID_Header *ccid_header; uint32_t payload_len; =20 + /* + * Every accepted command either queues a response immediately or comm= its a + * slot to a later APDU response. Apply backpressure before consuming = the + * first packet when all response slots are committed. + */ + if (s->bulk_out_pos =3D=3D 0 && /* start of message */ + s->bulk_in_pending_num + s->pending_answers_num >=3D + BULK_IN_PENDING_NUM) { + p->status =3D USB_RET_NAK; + return; + } + if (p->iov.size + s->bulk_out_pos > BULK_OUT_DATA_SIZE) { goto err; } @@ -1190,7 +1210,9 @@ static void ccid_unrealize(USBDevice *dev) static void ccid_flush_pending_answers(USBCCIDState *s) { while (ccid_has_pending_answers(s)) { - ccid_write_data_block_answer(s, NULL, 0); + if (!ccid_write_data_block_answer(s, NULL, 0)) { + break; + } } } =20 --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861685; cv=none; d=zohomail.com; s=zohoarc; b=ITbW9qkEaN7OZMOHU5lx18spzx5h5gFTO88zKYNVPps+mjxhFrqAxsBB2XEdwT6NxXYDmpjNJ/QBzNRFPGmpZw1+xv/TM+PxP14W+RFV3b79DZNf/EUXtZakygXza8SpDAwV2E433aJxrYloAbYDWkWbxFtPuiOc0xG/JbY3vz0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861685; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=WCbAGx8WjlZGv6Bg2nLZNpWSf10g/7d6frsVCktm5Q4=; b=L6mWhGu3VqlSBs7swwYwqp9r6kTfojO6+McKmGIzYJPYlrWMCzcOlpj0IsRfqPQj3XQDWDKtdEjUCwjGkw4PwD0FZBoOZwx8dT6SLVpRhaPrIWapbKC55xvzvhLjUqleveXUYTUcYx4o37O281fDe7iJx1q5tKpWEu7Y8c9aeXA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861685799650.5569572062554; Thu, 1 Oct 2026 06:34:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsq-0000pb-72; Thu, 01 Oct 2026 09:31:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGru-0007pk-0O for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:41 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrr-0006Lb-Rb for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:37 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-664-uwiTTwzPN4SvZWF1NPeyJA-1; Thu, 01 Oct 2026 09:30:31 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DCE3B188304E; Thu, 1 Oct 2026 13:30:29 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1ECF23000229; Thu, 1 Oct 2026 13:30:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861433; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WCbAGx8WjlZGv6Bg2nLZNpWSf10g/7d6frsVCktm5Q4=; b=HOY3NGGSGaBink9x/vA8mTXlyuBaqvQ70qJcgFiG3AgewoS3ih8v1ng0QDn7Ee451AWOEd ZdppWKrY6KU2zvYueesTjk4usUbRDNS/LTdrPVndxYQt+EbIKf+q1y/tAUfQoPkAwpWTkq WQKbex3/xpSaWUPm9yzOKtfujwE7FHQ= X-MC-Unique: uwiTTwzPN4SvZWF1NPeyJA-1 X-Mimecast-MFC-AGG-ID: uwiTTwzPN4SvZWF1NPeyJA_1790861430 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:51 +0400 Subject: [GIT PULL 12/27] hw/usb/dev-smartcard-reader: fix RDR_to_PC_Parameters dwLength MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-12-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=1928; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=WWP3k/LX8Esr33UDZLikH9XsKKdMbOQczyz8XhGffzY=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBIjNXwWHHNHaJFJYbef1OkCCfNTOzemoOEx 2Lpfv/gmgmJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5faeD/9Jx/XSGiam2gnXM7AfTvlW5EQrJDYrudKOVyj3kiouKZcnNBXebLwYJEnrnK1RAFgvoYV Uxlk5KOKEPkgRL94dGC6D9+XrdkUCO9KqtosvwIG6igCw0poc6JYgMpC7ly2eT8FsyGpBwyJuwN K+YNctuTcoPfQyZbBUwKq9GlDSoDBygQtNxxG/q8W4c53ptUeescDqHfWytQc9pS7acp5RtQO77 F8hZpsqIzpJ3sLu+HPsa6o8TVhxzm9NY4ZKpBOQJ2vAaHN2XwILO6/Mck1Z0XV5wh0wi+bZL/wK Ww0L2ektiaRtnqnC2DESdD2INheCgKzHXQm8IBqaGgKycYLLLS2zK6MVxBrjg1G1FZLBHhizAdQ JKnVGdmIH6fS6roOcfGe8l2eOcKO6Atl+mH1MHKB9xVStbDgsVAYH/lpUNQQxfL16ZDF32l/D51 Qw9PBpujrX5p4IuxoT5LBKRRO89PqP+IuHGwTGQzTVjwArkVP1Z5/Sgz/LNXktPFtOXRT3QaDB5 HsmDhYvMQL5TB/KVg/dh0XHs7TkA7aozbpPmPjhtQCzbft4rJ25kz+mOcFbNk9wXFgjI6Ok2EJp WsGwM2tewP5TilVMZAStKOz76vbxZ2YWBg/+gEBzd01f5zFKhqU/DBgKapOAp+Dmi/7eqO5LQJL ezpT2XgvTnREYJg== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861687964158500 dwLength in the RDR_to_PC_Parameters response was always set to 0 instead of the protocol-dependent size mandated by the CCID spec (5 for T=3D0, 7 for T=3D1). Since bulk_in->len is what determines how many bytes the guest actually reads, the reservation size must also match the wire message size. Set dwLength from bProtocolNum and compute the reservation size accordingly, so the guest receives a spec-compliant response. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 279fef03652b..16f248a0969f 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -748,19 +748,20 @@ static void ccid_write_slot_status(USBCCIDState *s, C= CID_Header *recv) static void ccid_write_parameters(USBCCIDState *s, CCID_Header *recv) { CCID_Parameter *h; + uint32_t dwLength =3D s->bProtocolNum =3D=3D 1 ? 7 : 5; =20 - h =3D ccid_reserve_recv_buf(s, sizeof(CCID_Parameter)); + h =3D ccid_reserve_recv_buf(s, sizeof(h->b) + sizeof(h->bProtocolNum) = + dwLength); if (h =3D=3D NULL) { return; } h->b.hdr.bMessageType =3D CCID_MESSAGE_TYPE_RDR_to_PC_Parameters; - h->b.hdr.dwLength =3D 0; + h->b.hdr.dwLength =3D cpu_to_le32(dwLength); h->b.hdr.bSlot =3D recv->bSlot; h->b.hdr.bSeq =3D recv->bSeq; h->b.bStatus =3D ccid_calc_status(s); h->b.bError =3D s->bError; h->bProtocolNum =3D s->bProtocolNum; - h->abProtocolDataStructure =3D s->abProtocolDataStructure; + memcpy(&h->abProtocolDataStructure, &s->abProtocolDataStructure, dwLen= gth); ccid_reset_error_status(s); usb_wakeup(s->bulk, 0); } --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861537; cv=none; d=zohomail.com; s=zohoarc; b=WPZJ7er1OrKUKFY7+d1Vahx2G0EqEIUXJglPdasDjFqoG4tk2w55wITNjMSd5LpIjac524TgkQVPdkQ7KQEwV0SaCzQ/KgQ3W8nAsM9cNssrfE0rNzrSZLAl4oKVIUTdRS6PYxS1NyG1WJ/anPvAqMqkK3dJTWUNpTovtrCcbS4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861537; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=44HJKj1mJ7KiXnS7tnBe4UNBUJE2H93VKcl32AM2Z94=; b=TlwyoZ3uRVeLrQeZ4MfJbPu8YDv8so/8aUNgyWCeNQqM9h9Cvl8A1mga99K3L7radMvO4W55G7u4O8fzGU90UlgjW2AO5ZrJ7OmyEi03aTl1n97G/8hHIPhRMjoTOr2K4642tVWYAfobhubYRxmBLypkmgkgTxksDoUQvCztkvA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861537328740.3073875562353; Thu, 1 Oct 2026 06:32:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsf-0000Fs-U6; Thu, 01 Oct 2026 09:31:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGs0-0007vm-EF for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:46 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGry-0006MG-5q for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:43 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-53-FEMQdYQkOpeSIAs-iNtNaA-1; Thu, 01 Oct 2026 09:30:34 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1A832189F8E6; Thu, 1 Oct 2026 13:30:33 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 4ECBD1956095; Thu, 1 Oct 2026 13:30:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861441; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=44HJKj1mJ7KiXnS7tnBe4UNBUJE2H93VKcl32AM2Z94=; b=fBDGh+oMHJ98MXqiXxbCFdXm+jMktGGX/pe/+BGvG6mWnII8vgqyMXBuqYmjJUE4UphPS+ L1KVnIYKlHJP4IlkJ5GNH+MAUY+WjZdTnQC3T5pNwf0wRaJ7vFje867ZkqaHIQ+Os2qMas 3h3Y9qrJ2dKnlJR7d76vQ2Pp6z34+gM= X-MC-Unique: FEMQdYQkOpeSIAs-iNtNaA-1 X-Mimecast-MFC-AGG-ID: FEMQdYQkOpeSIAs-iNtNaA_1790861433 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:52 +0400 Subject: [GIT PULL 13/27] hw/usb/dev-smartcard-reader: reject oversized responses safely MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-13-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=2470; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=53GOMWzaeNc92zmGKilDJvLKPMjcZbBHd7Lc58zXUDw=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBIMHNa/GCZYOTj1BICShg4fU/FTwJadZ2fx fJsyo6OUFyJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5YjPD/sHSiCqPGafyTWKMYKrBiadu8XmM0uqH4W1yWkT/1c4nUnVtoskJFgq75bif9uS7oOaUwr V5sLCqBeNaFLnwfTtJEG5cn7ilevKCZIxGEwNK1rPjDmTI+5AOd+X4MllMHnzj3EAgs+QOP9UWU 7rKYMivQWaOkE/6QhNIz4A8TzhxtCFWmH+rYfJMvvST7cPa263YdfptbULfeov+yd1t5PonrIRS nCFLj3Kb/1tno4+Y7msB402qWfodQ74P09AR7Ji4116OfcI3pz5N9/0iUYe52uRSbVunKAePlQA 9WA6UzqKKSQ6nOwUUUpuMzFvwDM0P5fefryfUuA37Kfgm/9u3yvh31D5XM3WasEUr/5SYFc4ZIP uKL8xIspn324AymcAgZ5xDP52yTL4wFufzRWNs88EZFfrlQxhxgc+c9UpTeTdow14lfWKjAlk3h R402CFtGb//yRHSzUXxHHhpJf+DZ3Btcs+hYmILcgGMiUojXNQHFuIWolRtXLE8Hc0Bt/KCZTM4 0/l/pK1LVailJme1VXxOdby5nOvDxL7xrZbQ0fp7eFQhtDhWrP4gjSde1qMa8iKQgHtDDJQmQVD O5hxli4Uom20vNSPhdDohGkjH7tMRc/64/XUtfLa34SdOoQ0ql6tL5t2jkcpffXj8nw1PagEriM dBx+XMg52Ls1Uxw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861538869158500 ccid_reserve_recv_buf() takes a uint16_t length, so the result of sizeof(CCID_DataBlock) + len silently truncates when the sum exceeds 65535. This could bypass the BULK_IN_BUF_SIZE check inside the function, leading to a buffer overrun on the fixed-size BulkIn.data array. The response length comes from the card backend (passthru chardev or libcacard), not from the guest, so this is not guest-exploitable but still worth hardening against a buggy or compromised backend. Fix this by adding explicit overflow-safe checks in both callers that add a header to the payload: ccid_write_data_block() returns false on oversized input, and ccid_write_data_block_answer() reports ERROR_HW_ERROR to the guest and sends a zero-length data block so the answer queue stays in sync. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 16f248a0969f..d91376826c5c 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -769,7 +769,13 @@ static void ccid_write_parameters(USBCCIDState *s, CCI= D_Header *recv) static bool ccid_write_data_block(USBCCIDState *s, uint8_t slot, uint8_t s= eq, const uint8_t *data, uint32_t len) { - CCID_DataBlock *p =3D ccid_reserve_recv_buf(s, sizeof(*p) + len); + CCID_DataBlock *p; + + if (len > BULK_IN_BUF_SIZE - sizeof(*p)) { + DPRINTF(s, D_WARN, "data block is too large (%u bytes)\n", len); + return false; + } + p =3D ccid_reserve_recv_buf(s, sizeof(*p) + len); =20 if (p =3D=3D NULL) { return false; @@ -813,6 +819,14 @@ static bool ccid_write_data_block_answer(USBCCIDState = *s, return false; } answer =3D ccid_peek_next_answer(s); + if (len > BULK_IN_BUF_SIZE - sizeof(CCID_DataBlock)) { + DPRINTF(s, D_WARN, + "APDU response is too large (%u bytes), returning an error= \n", + len); + ccid_report_error_failed(s, ERROR_HW_ERROR); + data =3D NULL; + len =3D 0; + } if (!ccid_write_data_block(s, answer->slot, answer->seq, data, len)) { return false; } --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861543; cv=none; d=zohomail.com; s=zohoarc; b=E/tu5XTX2cm5C5qvwLFUSGp54Sth8mWNk2aJ6P09pFekJZsbEJFjpghEzL8qd5ew2hva6OItWXKR9+k3SmU55HuxWo9xTPK1JUpihTG01SL7Gha59RqBbk6y8rM3zOBs6aHbHoLld//w8tMblCxJXJeuTlUTVhlaM/B/2V25ooM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861543; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=317T1cFJVRMQoMP1mUFEeD+HiVzQr8dmcp3IQMB+lOc=; b=MV9gUwreE+rZox/Z2xlx94CD3jxsyXpvwkOCXL51FH0vK8rDCusr7aB4FkoGpaoS0ocIc5v75c5Bf2QhMfOJ3bsh2KdbI5EBNqQtxgrDEKaAhhmOok3PTKG14JgciTKyNkSk8BWFvlDqkqhy46BUgUJNXYl9/xE1m+pbTvuIgZY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861543026313.6982575183191; Thu, 1 Oct 2026 06:32:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGt4-0001by-Hp; Thu, 01 Oct 2026 09:31:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGs0-0007vl-E9 for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:46 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGrx-0006MB-GK for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:42 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-643-iWonNNtVPuOvbkE3afG9xA-1; Thu, 01 Oct 2026 09:30:37 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 79F27195FCFB; Thu, 1 Oct 2026 13:30:36 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id B0DBC30000E6; Thu, 1 Oct 2026 13:30:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861440; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=317T1cFJVRMQoMP1mUFEeD+HiVzQr8dmcp3IQMB+lOc=; b=HN9sN3TWjEU1j5R5w/jtVZnKtOpETnf0GFx6S80qVqGhe5/UWlvqwJOAWr8sF7k+xgMLfV ewMccdb6MUeFP61NFDRnkPlsCtooyuheXmA/ONAbBJfjUvZUOJXWt6HXYjSfjGBYyDgqkK lKuYik9uYdFYxsuvz/Bse8jh3zCs+WY= X-MC-Unique: iWonNNtVPuOvbkE3afG9xA-1 X-Mimecast-MFC-AGG-ID: iWonNNtVPuOvbkE3afG9xA_1790861436 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:53 +0400 Subject: [GIT PULL 14/27] hw/usb/dev-smartcard-reader: release short bulk-in responses with xHCI MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-14-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=2580; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=y9ul0gfGocjW/EVhdL7tcA8uhUTpVBP2Qms30ZC/SOw=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBI8JXesfiE41AiniPSiY3MEvi55qS1HTw6o kzSQc22DP+JAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5bCtD/98r4KCK/12g6BOtEmCigGKlrFCAZvmIw3sN9hzwccK/Kbu51p31JQvNRbSAsj2c9z7K1J 99kkveoiPwsALApBhNE4/QCUr0+P/vUJ9hclLugG82W48s+kZaW2u9EDDs+lPaPwBS7uA2HWYLv TQYPMp4vuHSwFA9r8KGMkurQVFCPpcqeaj0V5UuAnmOkiOyEWSfiVOd+Ys2KDuQhhp8a2Jlz+/A SvuIgTlKZ+ra9tl7IEs7De70HUf+Vt4k5op1vSitIDpgAKseMcCyAEAFjDj64EYoOqIZhjHEtRh c+MDEMWmMtuIGOl5BF0PiixPyiI3HUKZRtDlicjckKGx5xIyDpPNGAHG/XWY8DmyeQS5YhinhOF knNmejzlCizZFjRsz3z3NniEgjgMoj44T1lc//3oPd8s+p+FvJzD6H8pUWJ0GVtf6tBDfRkvhYv p5LAVWjzH8QDRL9Vbis0GkRt3tp9+DTwiszCYHRZR/JCt9qcvQrkuZMnCI/52LSU4OqYXgFd5IV AV8FgCb/fmdHWMeoyWRBDi0E2oE87/osSsq14rmCGikHI2iy616Ci3ieNZXtYDAI5ppWKyU5idP nVTQaMgYAusy4BCzTCOAM6rS4WNTY1NpxXQhInXWXAv30C/1cqS4JEwbl9fgDkUPdlluPgy8fBD qVBU5916qTdHk0g== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861544881158500 USBPacket describes the host controller's complete transfer request, not necessarily one packet on the USB wire. xHCI maps the buffers from all TRBs in a transfer descriptor into a single USBPacket, so p->iov.size can be much larger than the CCID bulk endpoint's 64-byte wMaxPacketSize. The smartcard reader kept a completed bulk-in response queued whenever the last copied chunk was exactly 64 bytes. This is necessary when the guest requested exactly 64 bytes: the next IN request must receive a zero-length packet to mark the end of the response. It is wrong when xHCI supplied a larger buffer, however. In that case the 64-byte result is already short relative to the USBPacket and xHCI completes the TD. Keeping the response current leaves it waiting for a ZLP request which never arrives and prevents later smartcard responses from being delivered. Release an exact-64-byte response when it is shorter than the host controller request, while retaining it for a request of exactly one maximum-sized packet. This fixes smartcard reader with xHCI. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index d91376826c5c..699e236f624e 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1132,8 +1132,7 @@ err: s->bulk_out_pos =3D 0; } =20 -static void ccid_bulk_in_copy_to_guest(USBCCIDState *s, USBPacket *p, - unsigned int max_packet_size) +static void ccid_bulk_in_copy_to_guest(USBCCIDState *s, USBPacket *p) { int len =3D 0; =20 @@ -1148,7 +1147,7 @@ static void ccid_bulk_in_copy_to_guest(USBCCIDState *= s, USBPacket *p, } s->current_bulk_in->pos +=3D len; if (s->current_bulk_in->pos =3D=3D s->current_bulk_in->len - && len !=3D max_packet_size) { + && (len !=3D CCID_MAX_PACKET_SIZE || len < p->iov.size)) { ccid_bulk_in_release(s); } } else { @@ -1180,7 +1179,7 @@ static void ccid_handle_data(USBDevice *dev, USBPacke= t *p) case USB_TOKEN_IN: switch (p->ep->nr) { case CCID_BULK_IN_EP: - ccid_bulk_in_copy_to_guest(s, p, dev->ep_ctl.max_packet_size); + ccid_bulk_in_copy_to_guest(s, p); break; case CCID_INT_IN_EP: if (s->notify_slot_change) { --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861695; cv=none; d=zohomail.com; s=zohoarc; b=mey0gRlz2LMFmgFFV7aSrlbJRgHSpiHlBIPytdOwK/h4Ift8rjRcHKGixe5O4HFqIdEYNtEyBI0zF0PTkqEyZJSkoyx3IQgsly7AxpUmpbIKTFgZfSuzypCbXX1Q+itPR+8i1J71gt5w/Jvq1RGTCj1JkSgBA0dgQCAeNz9tfS0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861695; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=T/YBKrRAYzBzfTiYHtDwe4lXg+UiiNEnlFfnbIDDGss=; b=gpfGrRH/ZGX+TozfAWAPn0X5HXwAV4ZdsNOSu3aEr4cGiCT+naTVPbXpyKIwSJ2OUOWE6m2j9k5bCPvIK5DZ+1EsbLJdSy34eZrzFVrb1YwLkt+9S9s7pHFP9zbex2qfkzh2YX9vhEnBe5GaVXEUYsgq8ylhQwCc60r9rgyLtF4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861695358359.55692547711465; Thu, 1 Oct 2026 06:34:55 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGtI-0001wS-RX; Thu, 01 Oct 2026 09:32:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGs6-000813-KO for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:53 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGs4-0006OG-Hx for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:50 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-681-FnStZXhfO0GVfhei5_ir8g-1; Thu, 01 Oct 2026 09:30:40 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B15411936122; Thu, 1 Oct 2026 13:30:39 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id E50411956095; Thu, 1 Oct 2026 13:30:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861447; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=T/YBKrRAYzBzfTiYHtDwe4lXg+UiiNEnlFfnbIDDGss=; b=Wp8gz57WDAWSJFO9IEpsC7MjmwlNPp9yMBCNGKE0MaQwCsFlDazbgdT0oc6cvnuED6slic L0dVRy+VLgr4eG9+xx/arnBFbtY5OZwCmooLBNCgb9KtFVJ3Eo3IgNkSEcaYYDjdPn5mOV 8YlrZlgeu+gDnp7WkRhJ2Kop77914F0= X-MC-Unique: FnStZXhfO0GVfhei5_ir8g-1 X-Mimecast-MFC-AGG-ID: FnStZXhfO0GVfhei5_ir8g_1790861439 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:54 +0400 Subject: [GIT PULL 15/27] hw/usb/dev-smartcard-reader: drop current_bulk_in pointer MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-15-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=4172; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=Mz7FC7l6nRAjhl5MyuAWb9SEYek02WyouuK0jd/vk0g=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBI845S3cX6ZMwGsnyooSCBdsOPHjM+PL6pr hqkWoUp1PaJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5V2KEACNw2KtpFnBlAtzxqWeNK964Wmrm4hjLwPcHJxv8YiXB2bTGg8hsx4DHG++B00hYCVi/4S 3msoU4z+aKi8Ne7unkq317z1rLsa3xIOCMdDKljPz6HmU7isFVbXdGBpR44or0A09STJVu9mcNy gN6Jx+eX6Cmc2hSzz5V4cjN3RYXPKRLniMHwohB8xuCW9i144zdjdnZ/mAlY9GX+gdD2uAb/1ha qiyDq9VwtdnYqaBQPpgLtR8Pce52Fr6UwOpV5Z/Z72q6vUMsjQ6CXC0uMKHTe4Yd8x00PsnioNG hjTlgoYsnmjMAKabNSgMWBccXPh0+JBM1SAMjvNxvzRgZ/r2TfAZzvScaQVMak2Qh5kI47OdvLz uAkzB4+SkmBYwzpYFtav4SYvVuy+Vc7nSP9eXFOEBOk8zfveZa4VfJo9cenMvtOvWyxGTqm1Os6 SNdWzepsr/21Yva+7xsNAmVAvIYAIylR1nLgrO2OcNYMoNyT01qR8eDWDDidXImNAGD1kSdtk67 pQ6a+ydmoP6zRKhTQfSsITrUnHMqWufGtznRy0xhgxhBUFd7fsu4emp/qt5R60ihrkrOHV9y7Bh OyOi5IpK0swpM72mSF8gTeJy7NI2HwXyIKnBbA282CR/V8amxKsMxICNj8M4vxWEdrDflNn4Nec Zy2W/DwaE8qE2NA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861696208158500 Replace the eagerly-dequeued current_bulk_in pointer with a ccid_bulk_in_peek() that returns the head of the ring without advancing it. The element now stays at bulk_in_pending[start] while being partially consumed, and start is advanced together with the num decrement in ccid_bulk_in_release(). This removes a field from USBCCIDState and simplifies the bulk-in ring buffer lifecycle from three states (queued, grabbed, released) down to two (queued, released). Note that this changes the semantic of bulk_in_pending_start in the migration stream too. But since migration with pending current_bulk_in was broken, this doesn't make further damages. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 42 +++++++++++++++++++++------------------= --- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 699e236f624e..3f128791f3ef 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -296,7 +296,6 @@ struct USBCCIDState { uint32_t bulk_in_pending_start; uint32_t bulk_in_pending_end; /* first free */ uint32_t bulk_in_pending_num; - BulkIn *current_bulk_in; uint8_t bulk_out_data[BULK_OUT_DATA_SIZE]; uint32_t bulk_out_pos; uint64_t last_answer_error; @@ -583,24 +582,27 @@ static void ccid_bulk_in_clear(USBCCIDState *s) s->bulk_in_pending_start =3D 0; s->bulk_in_pending_end =3D 0; s->bulk_in_pending_num =3D 0; - s->current_bulk_in =3D NULL; } =20 static void ccid_bulk_in_release(USBCCIDState *s) { - assert(s->current_bulk_in !=3D NULL); - s->current_bulk_in->pos =3D 0; - s->current_bulk_in =3D NULL; + BulkIn *bulk_in; + + assert(s->bulk_in_pending_num > 0); + bulk_in =3D + &s->bulk_in_pending[s->bulk_in_pending_start % BULK_IN_PENDING_NUM= ]; + bulk_in->pos =3D 0; + s->bulk_in_pending_start++; s->bulk_in_pending_num--; } =20 -static void ccid_bulk_in_get(USBCCIDState *s) +static BulkIn *ccid_bulk_in_peek(USBCCIDState *s) { - if (s->current_bulk_in !=3D NULL || s->bulk_in_pending_num =3D=3D 0) { - return; + if (s->bulk_in_pending_num =3D=3D 0) { + return NULL; } - s->current_bulk_in =3D - &s->bulk_in_pending[(s->bulk_in_pending_start++) % BULK_IN_PENDING= _NUM]; + return &s->bulk_in_pending[ + s->bulk_in_pending_start % BULK_IN_PENDING_NUM]; } =20 static void *ccid_reserve_recv_buf(USBCCIDState *s, uint16_t len) @@ -1135,18 +1137,17 @@ err: static void ccid_bulk_in_copy_to_guest(USBCCIDState *s, USBPacket *p) { int len =3D 0; + BulkIn *bulk_in; =20 - ccid_bulk_in_get(s); - if (s->current_bulk_in !=3D NULL) { - assert(s->current_bulk_in->pos <=3D s->current_bulk_in->len); - len =3D MIN(s->current_bulk_in->len - s->current_bulk_in->pos, - p->iov.size); + bulk_in =3D ccid_bulk_in_peek(s); + if (bulk_in !=3D NULL) { + assert(bulk_in->pos <=3D bulk_in->len); + len =3D MIN(bulk_in->len - bulk_in->pos, p->iov.size); if (len) { - usb_packet_copy(p, s->current_bulk_in->data + - s->current_bulk_in->pos, len); + usb_packet_copy(p, bulk_in->data + bulk_in->pos, len); } - s->current_bulk_in->pos +=3D len; - if (s->current_bulk_in->pos =3D=3D s->current_bulk_in->len + bulk_in->pos +=3D len; + if (bulk_in->pos =3D=3D bulk_in->len && (len !=3D CCID_MAX_PACKET_SIZE || len < p->iov.size)) { ccid_bulk_in_release(s); } @@ -1439,8 +1440,7 @@ static bool ccid_pre_save(void *opaque, Error **errp) { USBCCIDState *s =3D opaque; =20 - if (s->pending_answers_num || s->bulk_in_pending_num || - s->current_bulk_in) { + if (s->pending_answers_num || s->bulk_in_pending_num) { error_setg(errp, "usb-ccid has pending queue state which cannot be= " "migrated safely"); return false; --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861542; cv=none; d=zohomail.com; s=zohoarc; b=AJM4jPdy+HPNmFzjHEVRFF3AU0TP0/ZYC0XRc8Tc9qesEAR9EXiwCDEAUhQFFh4NR4BnaqoRt5ODGOcnHKxxc4UYL5a85e21KCmXv36xmztsEM/xyfL2U9z/0d8shP85H/FeGBZpq07fIzAJ1ipQjwRpjqE03KQk7baWvEpk8Jg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861542; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=30hpSslFFzcSBLdVojcAzvw1uO5ssK+8fyDBtC18W6Q=; b=LhxSaSIA/aZHyLObRXF5RyEw8cw6R2RedqS9DdreWqPtZqLP13nugLI10FYi8oIWjTbULSleRy5Gz2hi9dZ3SZybO37RbFT/fLGj0eWTY6fwyVoqYFKwAiY35Qw4SyLR4DtGa3UklwSGU7NfdH2yfWNFF0foLC4cszkUxsX4tkg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861542526854.9192807444091; Thu, 1 Oct 2026 06:32:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsn-0000dQ-8V; Thu, 01 Oct 2026 09:31:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGs5-0007zb-1E for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:49 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGs3-0006No-70 for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:48 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-386-P3OEXonUMUmZkP5KAaC2gw-1; Thu, 01 Oct 2026 09:30:44 -0400 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 421061954B06; Thu, 1 Oct 2026 13:30:43 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 793901800361; Thu, 1 Oct 2026 13:30:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=30hpSslFFzcSBLdVojcAzvw1uO5ssK+8fyDBtC18W6Q=; b=UXjRC4RaROa74KWTvgpENrVa7+6JXrfbqZKOWN57QXmkTSM6mb8MdSvlCGmOzIZP2BEpR5 2nLCMY1dQjbb74WdSeEYljZdGh8U9O95WRg9a0+7v6N0bowV5Z1X5mfSMuICWa4/VgWntF KGOMWr3d5g97NvJLdEkM9D83ynXciYg= X-MC-Unique: P3OEXonUMUmZkP5KAaC2gw-1 X-Mimecast-MFC-AGG-ID: P3OEXonUMUmZkP5KAaC2gw_1790861443 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:55 +0400 Subject: [GIT PULL 16/27] hw/usb/dev-smartcard-reader: derive queue counts from start/end indices MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-16-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=7367; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=A//sG+y64UBaLwCBMeRAvSRJIYqLDbEjLttjc1SeoGY=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBIK8+kNE2S1+S+y3JOPTjXMGC9EQZfs1b8p JmlTyDk38+JAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5Tr8D/9UEbb40+Vfhkfzyr1x3uQIIgPhAzFFwwEadRrcubyCS+fBfOy2Pn9hBQXLUL0QPz+FRXE CjJHUGWiUSc16R7dniAycOAxJsGhAZFrCu2azSAtc6tulcHfxYbjhdMcgFf0oNruFqClj30EM9U Tl4F9FOgH8S8QsQ8s1+HZYUz2+thQdrBtbiKqESh+dnlRplEjTykxFEeLh0uXvitvMeh/wpZlDh 20l0Y2LHfwkX+AL7OSyMR3XWWi/TnHUZQ2MpUbOmdU7FV5UXd5C3L/Nw06m8uZV7z3LazOaCtB2 YU+zawTC573PqNJjW89Nu5J0nUusmbL9ho1OzDxUKjZGtWke5hALtxfMLcjFf4FHZhbmYiRT+bv HkIor9XmMOZ7U+N3oajVdt/yaUTHoz0AnvjxByhANbqNhb+gAw2oeOKX331w+NuoTmUpVlEpvQV 3J8Qgr1Hbkm2Ix4vQcaeW+dg/9Kk0gm9h7+6tZElGOlMUhDEpKeNUbqfsM+0HinHwdyuVKBFpvU eTdHBDGWbKQwAI39c+WbW1KXBZgVs7rG+NxiiCUmCxFIwbnq9HmfIKL2Mi1aS/QHwzol4VTprDA mNcastScaRDUB4NQls+jzUvHuVffNGeVVhjQPes3U+lQqlOOCOGR7q0h1IepoxjiNMYPQDD2RoQ sujln63+uMltGuA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861542865158500 Replace the redundant bulk_in_pending_num and pending_answers_num shadow counters with helper functions that compute the count from (end - start). This removes redundant bookkeeping and potential issues. pending_answers_num is kept for migration reasons, but since pending_answers_{start,end} are not migrated, we can just do a best effort for the following migration fix. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 47 +++++++++++++++++++++++++--------------= ---- 1 file changed, 27 insertions(+), 20 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 3f128791f3ef..e3c86cb90e6c 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -295,14 +295,13 @@ struct USBCCIDState { BulkIn bulk_in_pending[BULK_IN_PENDING_NUM]; /* circular */ uint32_t bulk_in_pending_start; uint32_t bulk_in_pending_end; /* first free */ - uint32_t bulk_in_pending_num; uint8_t bulk_out_data[BULK_OUT_DATA_SIZE]; uint32_t bulk_out_pos; uint64_t last_answer_error; Answer pending_answers[PENDING_ANSWERS_NUM]; uint32_t pending_answers_start; uint32_t pending_answers_end; - uint32_t pending_answers_num; + uint32_t pending_answers_num; /* for migration compatibility */ uint8_t bError; uint8_t bmCommandStatus; uint8_t bProtocolNum; @@ -315,6 +314,20 @@ struct USBCCIDState { bool accurate_message_length; }; =20 +static uint32_t ccid_bulk_in_pending_num(USBCCIDState *s) +{ + uint32_t n =3D s->bulk_in_pending_end - s->bulk_in_pending_start; + assert(n <=3D BULK_IN_PENDING_NUM); + return n; +} + +static uint32_t ccid_pending_answers_num(USBCCIDState *s) +{ + uint32_t n =3D s->pending_answers_end - s->pending_answers_start; + assert(n <=3D PENDING_ANSWERS_NUM); + return n; +} + /* * CCID Spec chapter 4: CCID uses a standard device descriptor per Chapter= 9, * "USB Device Framework", section 9.6.1, in the Universal Serial Bus @@ -513,12 +526,11 @@ static void ccid_card_apdu_from_guest(CCIDCardState *= card, =20 static bool ccid_has_pending_answers(USBCCIDState *s) { - return s->pending_answers_num > 0; + return ccid_pending_answers_num(s) > 0; } =20 static void ccid_clear_pending_answers(USBCCIDState *s) { - s->pending_answers_num =3D 0; s->pending_answers_start =3D 0; s->pending_answers_end =3D 0; } @@ -533,7 +545,7 @@ static void ccid_print_pending_answers(USBCCIDState *s) DPRINTF(s, D_VERBOSE, " empty\n"); return; } - for (i =3D s->pending_answers_start, count =3D s->pending_answers_num ; + for (i =3D s->pending_answers_start, count =3D ccid_pending_answers_nu= m(s) ; count > 0; count--, i++) { answer =3D &s->pending_answers[i % PENDING_ANSWERS_NUM]; if (count =3D=3D 1) { @@ -548,8 +560,7 @@ static void ccid_add_pending_answer(USBCCIDState *s, CC= ID_Header *hdr) { Answer *answer; =20 - assert(s->pending_answers_num < PENDING_ANSWERS_NUM); - s->pending_answers_num++; + assert(ccid_pending_answers_num(s) < PENDING_ANSWERS_NUM); answer =3D &s->pending_answers[(s->pending_answers_end++) % PENDING_ANSWERS_N= UM]; answer->slot =3D hdr->bSlot; @@ -562,8 +573,7 @@ static void ccid_remove_pending_answer(USBCCIDState *s, { Answer *answer; =20 - assert(s->pending_answers_num > 0); - s->pending_answers_num--; + assert(ccid_pending_answers_num(s) > 0); answer =3D &s->pending_answers[(s->pending_answers_start++) % PENDING_ANSWERS= _NUM]; *slot =3D answer->slot; @@ -581,24 +591,22 @@ static void ccid_bulk_in_clear(USBCCIDState *s) } s->bulk_in_pending_start =3D 0; s->bulk_in_pending_end =3D 0; - s->bulk_in_pending_num =3D 0; } =20 static void ccid_bulk_in_release(USBCCIDState *s) { BulkIn *bulk_in; =20 - assert(s->bulk_in_pending_num > 0); + assert(ccid_bulk_in_pending_num(s) > 0); bulk_in =3D &s->bulk_in_pending[s->bulk_in_pending_start % BULK_IN_PENDING_NUM= ]; bulk_in->pos =3D 0; s->bulk_in_pending_start++; - s->bulk_in_pending_num--; } =20 static BulkIn *ccid_bulk_in_peek(USBCCIDState *s) { - if (s->bulk_in_pending_num =3D=3D 0) { + if (ccid_bulk_in_pending_num(s) =3D=3D 0) { return NULL; } return &s->bulk_in_pending[ @@ -618,14 +626,13 @@ static void *ccid_reserve_recv_buf(USBCCIDState *s, u= int16_t len) __func__, len, BULK_IN_BUF_SIZE); return NULL; } - if (s->bulk_in_pending_num >=3D BULK_IN_PENDING_NUM) { + if (ccid_bulk_in_pending_num(s) >=3D BULK_IN_PENDING_NUM) { DPRINTF(s, D_WARN, "usb-ccid.c: %s: No free bulk_in buffers. " "discarding message.\n", __func__); return NULL; } bulk_in =3D &s->bulk_in_pending[(s->bulk_in_pending_end++) % BULK_IN_PENDING_N= UM]; - s->bulk_in_pending_num++; bulk_in->len =3D len; return bulk_in->data; } @@ -988,7 +995,7 @@ static void ccid_on_apdu_from_guest(USBCCIDState *s, CC= ID_XferBlock *recv) ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); return; } - if (s->pending_answers_num > 0) { + if (ccid_pending_answers_num(s) > 0) { DPRINTF(s, D_WARN, "usb-ccid: slot already busy, rejecting apdu\n"); ccid_report_error_failed(s, ERROR_CMD_SLOT_BUSY); @@ -1039,7 +1046,7 @@ static void ccid_handle_bulk_out(USBCCIDState *s, USB= Packet *p) * first packet when all response slots are committed. */ if (s->bulk_out_pos =3D=3D 0 && /* start of message */ - s->bulk_in_pending_num + s->pending_answers_num >=3D + ccid_bulk_in_pending_num(s) + ccid_pending_answers_num(s) >=3D BULK_IN_PENDING_NUM) { p->status =3D USB_RET_NAK; return; @@ -1233,7 +1240,7 @@ static void ccid_flush_pending_answers(USBCCIDState *= s) =20 static Answer *ccid_peek_next_answer(USBCCIDState *s) { - return s->pending_answers_num =3D=3D 0 + return ccid_pending_answers_num(s) =3D=3D 0 ? NULL : &s->pending_answers[s->pending_answers_start % PENDING_ANSWERS_N= UM]; } @@ -1440,7 +1447,7 @@ static bool ccid_pre_save(void *opaque, Error **errp) { USBCCIDState *s =3D opaque; =20 - if (s->pending_answers_num || s->bulk_in_pending_num) { + if (ccid_pending_answers_num(s) || ccid_bulk_in_pending_num(s)) { error_setg(errp, "usb-ccid has pending queue state which cannot be= " "migrated safely"); return false; @@ -1512,7 +1519,7 @@ static const VMStateDescription ccid_vmstate =3D { VMSTATE_UINT32(bulk_in_pending_end, USBCCIDState), VMSTATE_STRUCT_ARRAY(pending_answers, USBCCIDState, PENDING_ANSWERS_NUM, 1, answer_vmstate, Answer), - VMSTATE_UINT32(pending_answers_num, USBCCIDState), + VMSTATE_UINT32(pending_answers_num, USBCCIDState), /* for compatib= ility */ VMSTATE_UNUSED(1), /* was migration_state */ VMSTATE_UINT32(state_vmstate, USBCCIDState), VMSTATE_END_OF_LIST() --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861666; cv=none; d=zohomail.com; s=zohoarc; b=NsgNOP4FXKiKaCYLkCALKZpJgn+JbeUCZAgMlapuH+bkvejEVHNe8RrQQbAgG1lMrY5wGNhR759mQ7FPpxlnuhKbfRdAr2qu2VZa1TkUTGhIFZLAJQhT8eemV/BBHvGHRkhtatyA1o38esEmWHCozPPvPagn3B8Ae+82yVbv4Y8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861666; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=3ZUO+N+iFLVdWfP5JZWA+I6Hf84H1L+rJV/aCMuk3dE=; b=LZY4XExSW/IsDhfFjaGsM14tyZRgJLv4SsULN/4JFK7Rl8BxdaOSwhaH01sUNtFRaQRqERjTsxYOx591gr8bRcUrxqrVGkigfUniF54usVZY1+Ilp0FUaeOUlfZQ9sH17w1cmB76L+UNuhcjnyE3MG6OaI9f2NUlPKyykRTtiFg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861666449634.4660943009983; Thu, 1 Oct 2026 06:34:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGtU-0002D2-7C; Thu, 01 Oct 2026 09:32:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsE-0008Ar-1e for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:00 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsA-0006P6-W4 for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:57 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-315-zNnFAf7JNNe-tfefAXSiqA-1; Thu, 01 Oct 2026 09:30:48 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 9E3F31954209; Thu, 1 Oct 2026 13:30:46 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id AC9A11956086; Thu, 1 Oct 2026 13:30:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861454; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3ZUO+N+iFLVdWfP5JZWA+I6Hf84H1L+rJV/aCMuk3dE=; b=baaul12HyDoylPuCo6lg3hAisVBf1fGK0RX/cOeUm/9LjKvfaU7sW4vh/L00060vhBbPoI AXDP5zIXsrIuV1T3uxCRqFBzWEQhS/+FC6ayZXdCbq9MevLgVuyC8Exwtv19Dui+wMdkCE SE0b20PLRzugTutxONfoY20QjY0Dpew= X-MC-Unique: zNnFAf7JNNe-tfefAXSiqA-1 X-Mimecast-MFC-AGG-ID: zNnFAf7JNNe-tfefAXSiqA_1790861446 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:56 +0400 Subject: [GIT PULL 17/27] hw/usb/dev-smartcard-reader: fix pending queue migration MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-17-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Zhao Liu X-Developer-Signature: v=1; a=openpgp-sha256; l=5970; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=MC4KdGeMrdRuJwsOCRfJidfJ/pgfrIwMkZf/D2hjl+o=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBI9X+v02ay5uJCCVFjgWiX1mOdwGmdgkP+F h56lk8rzlCJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5au7D/9Sjo7L3gDDvBTtZ+iZy3ZmFgiL5yZF9jHOUg1WPXUCk06DSpW1PbeFnSBBo8FsN4CKOkj uDos529nry9yquFhOlistLz4u7f08wxcBEkI72Kto4y1Cu6Vj1GwxQqLjaylWXDHNsmih1ZbFGB +opXL+j5De6Or7LitBlyZAEel3gF2MtmnP6jq3tBBCrqCP/QlHY9p90AJofA8yRMlHzTUPxaO// /fm5ViVQ5DLZ9iKKIR6RfAif0Rr+AcgRg46BKOwAfljipf5XQZM4tp6cj2PNX24B6ff0YsN7DHe /T1jN/O9EdKdKNSAE/0HryJMa9TgQ44NcAKS34hZ1dI+Yd+4cNpJagnnKMqmXEhteV0x1anuEyu 2KBBa/sbFVnA/IvijootAcyz81GqYad57qx5REeUa0q1d3HW0wmIj4InZ+xEgApD2qVG0V/b2AC +PWVDBsiyW06a1ArW7TV8Z23S42lJUWRg7ilJrvPlZ7m7eIFRNl9+RIlDI8PmegUp4UUEpiUNUI Ylq40lOOJ67Zexy7B2nSmpuhrDljhb8WO3e1qPTWMJBkVJ37Hu/ikuczGS/Lr28C8TJlpBPVzHi Fue3a1LBcrvfKt03n3HZqxmzxYo55bYld0yT4XCJ4VXWbdJopuXJqtnb9KO+Z7Tr43J5CGGocdO AhRmh3G/ATzALjg== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861667888158500 The original vmstate migrated the bulk_in_pending and pending_answers arrays but not the pending_answers queue indices (pending_answers_start, pending_answers_end). This made migration silently lose in-flight smartcard responses. Add a vmstate subsection "usb-ccid/pending-answers" that migrates the missing pending_answers indices. A compat property x-migrate-pending-answers (default on, off for <=3D 11.0) gates the subsection so older machine types keep the old behavior. Populate pending_answers_num in pre_save so post_load can reconstruct start/end when loading from an older source that lacks the subsection. When the subsection is absent, post_load derives pending_answers start/end from the legacy count. Validate all wire-sourced indices and bulk-in entry bounds on load. Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/core/machine.c | 1 + hw/usb/dev-smartcard-reader.c | 70 +++++++++++++++++++++++++++++++++++++++= +--- 2 files changed, 67 insertions(+), 4 deletions(-) diff --git a/hw/core/machine.c b/hw/core/machine.c index b30849d6f769..4aa5df13f386 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -58,6 +58,7 @@ GlobalProperty hw_compat_11_0[] =3D { { TYPE_ARM_SMMUV3, "oas", "44" }, { "migration", "switchover-ack-legacy", "on" }, { "usb-ccid", "x-accurate-message-length", "off" }, + { "usb-ccid", "x-migrate-pending-answers", "off" }, }; const size_t hw_compat_11_0_len =3D G_N_ELEMENTS(hw_compat_11_0); =20 diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index e3c86cb90e6c..5ca50c111217 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -312,6 +312,8 @@ struct USBCCIDState { uint8_t notify_slot_change; uint8_t debug; bool accurate_message_length; + bool migrate_pending_answers; + bool pending_answers_loaded; }; =20 static uint32_t ccid_bulk_in_pending_num(USBCCIDState *s) @@ -1409,16 +1411,35 @@ static void ccid_realize(USBDevice *dev, Error **er= rp) s->debug =3D parse_debug_env("QEMU_CCID_DEBUG", D_VERBOSE, s->debug); } =20 +static int ccid_pre_load(void *opaque) +{ + USBCCIDState *s =3D opaque; + + s->pending_answers_loaded =3D false; + return 0; +} + static int ccid_post_load(void *opaque, int version_id) { USBCCIDState *s =3D opaque; int i; =20 - if (s->bulk_in_pending_end - s->bulk_in_pending_start > BULK_IN_PENDIN= G_NUM) { + if (!s->pending_answers_loaded) { + /* + * Version 1 did not migrate the pending_answers[] queue indices. + * The historical interpretation of pending_answers[] as starting = at + * element zero. + */ + if (s->pending_answers_num > PENDING_ANSWERS_NUM) { + return -EINVAL; + } + s->pending_answers_start =3D 0; + s->pending_answers_end =3D s->pending_answers_num; + } else if (s->pending_answers_end - s->pending_answers_start > PENDING= _ANSWERS_NUM) { return -EINVAL; } =20 - if (s->pending_answers_num > PENDING_ANSWERS_NUM) { + if (s->bulk_in_pending_end - s->bulk_in_pending_start > BULK_IN_PENDIN= G_NUM) { return -EINVAL; } =20 @@ -1447,12 +1468,14 @@ static bool ccid_pre_save(void *opaque, Error **err= p) { USBCCIDState *s =3D opaque; =20 - if (ccid_pending_answers_num(s) || ccid_bulk_in_pending_num(s)) { + if (!s->migrate_pending_answers && + (ccid_pending_answers_num(s) || ccid_bulk_in_pending_num(s))) { error_setg(errp, "usb-ccid has pending queue state which cannot be= " "migrated safely"); return false; } =20 + s->pending_answers_num =3D ccid_pending_answers_num(s); s->state_vmstate =3D s->dev.state; =20 return true; @@ -1493,10 +1516,43 @@ static const VMStateDescription usb_device_vmstate = =3D { } }; =20 +static bool ccid_pending_answers_needed(void *opaque) +{ + USBCCIDState *s =3D opaque; + + if (!s->migrate_pending_answers) { + return false; + } + + return ccid_pending_answers_num(s) > 0; +} + +static int ccid_pending_answers_post_load(void *opaque, int version_id) +{ + USBCCIDState *s =3D opaque; + + s->pending_answers_loaded =3D true; + return 0; +} + +static const VMStateDescription ccid_pending_answers_vmstate =3D { + .name =3D "usb-ccid/pending-answers", + .version_id =3D 1, + .minimum_version_id =3D 1, + .needed =3D ccid_pending_answers_needed, + .post_load =3D ccid_pending_answers_post_load, + .fields =3D (const VMStateField[]) { + VMSTATE_UINT32(pending_answers_start, USBCCIDState), + VMSTATE_UINT32(pending_answers_end, USBCCIDState), + VMSTATE_END_OF_LIST() + } +}; + static const VMStateDescription ccid_vmstate =3D { .name =3D "usb-ccid", .version_id =3D 1, .minimum_version_id =3D 1, + .pre_load =3D ccid_pre_load, .post_load =3D ccid_post_load, .pre_save_errp =3D ccid_pre_save, .fields =3D (const VMStateField[]) { @@ -1523,13 +1579,19 @@ static const VMStateDescription ccid_vmstate =3D { VMSTATE_UNUSED(1), /* was migration_state */ VMSTATE_UINT32(state_vmstate, USBCCIDState), VMSTATE_END_OF_LIST() - } + }, + .subsections =3D (const VMStateDescription * const []) { + &ccid_pending_answers_vmstate, + NULL + }, }; =20 static const Property ccid_properties[] =3D { DEFINE_PROP_UINT8("debug", USBCCIDState, debug, 0), DEFINE_PROP_BOOL("x-accurate-message-length", USBCCIDState, accurate_message_length, true), + DEFINE_PROP_BOOL("x-migrate-pending-answers", USBCCIDState, + migrate_pending_answers, true), }; =20 static void ccid_class_initfn(ObjectClass *klass, const void *data) --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861685; cv=none; d=zohomail.com; s=zohoarc; b=BCjlE/3kO/9Zz58XOlzzKx73XdQ/F72ZrSAddvj8dZieot1M+mgMtvJ4TuXiyjIP1ENUqTg2DpA2xrgP4n503m7nP/Wk4/6lnpTwMtfQ5DRtCo5rYB59VdGpV9JBNKeKsCHFiL80qN2AmvYSxnwbsq2SszKG0WK9WlSKBZqHmbQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861685; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=GQvwlMR7WJGHwGPjvK3E/5mXHq9s02IHsayg4Uy5eZ8=; b=ZciA+fJvBZG2I5Tng5VU3Ixv+7pWVVadGFjUIghL/Bezhq9VZC6zlOCwReyewODUYI7H7wRqbZY0VEAeAF5faswiuh8ogyFrjT8tHpvpkFMRAARq1PyvH6Scm5nFkJQ+Aky1Hq64rzSXqkEduStFf+kDjnDLqzVCBlTZLpc9RIE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861685017170.36049538119073; Thu, 1 Oct 2026 06:34:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsi-0000SG-3a; Thu, 01 Oct 2026 09:31:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsD-0008AX-GQ for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:59 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsB-0006P8-3u for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:30:56 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-471-aKOExlNQOm2c8H8FWFgfDQ-1; Thu, 01 Oct 2026 09:30:51 -0400 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5179218015DE; Thu, 1 Oct 2026 13:30:50 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 884581800352; Thu, 1 Oct 2026 13:30:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861454; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GQvwlMR7WJGHwGPjvK3E/5mXHq9s02IHsayg4Uy5eZ8=; b=eq7E1QyH3WN2Xrse8RGp1Pdw2kjN+ds11D1LLgmxRR/7/bui6aIKWD3PDhONx7iLhPs0ru Jd4VHRDZz5lyHMlpS09de8ewa4tPnzc3eAqh2/tIVs7PZVH78OLasiMDxqnw5zZLx78jio giR3Bn/DPQ0ntfYlW72784y91mJLuWU= X-MC-Unique: aKOExlNQOm2c8H8FWFgfDQ-1 X-Mimecast-MFC-AGG-ID: aKOExlNQOm2c8H8FWFgfDQ_1790861450 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:57 +0400 Subject: [GIT PULL 18/27] hw/usb/dev-smartcard-reader: handle Secure, Escape and SetDataRate commands MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-18-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=4039; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=5/u0AEmDWetIReYHl2Pewzh7es7Js72pCwhpZwcyf+U=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBIePipT89ITHU/lRiAE9c43t9Mwy0XM2Jww GlqO3j4AjGJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5XYiEAChqFlqvnSbPZtNWvgCHIM0id+x73lsA9WRRIHeWp6OP/TXSoU3Ei29RzTqxAj6rX444gS xh7il/yZf+zCpFte66tiiGaS4ZcWqNqS8oNJ8aC/AUGC7oBZuuF79CIshMhJ3JLNvFTtVm9MR0d iPXSNP2EIAPcDqL62bbAvwmQZ0EMu1mkNvgV1M9xmcPmKmvJ0wYk4Fhar1EGHqEHrgE3sfTZL9C jdslpPGSLLUwDWGgABqNBbd/5Inzouzz7ToyhGV+bOXFmMideq7Ioh6p1XT2WfZ4vzt+mayREg7 9zX0ziBih4k7X+igurfVbKRixc7kaAAnOJ3Ho0ImRhWAO/x9WinFrfn343bST8OadMxMW4kqbMg cdqJymFSFfHHBus2yW2hb0oGkccMrELdsl3GHJWO+W2mfAZiCZqFMTF5YaUk+HkC2Kuw19+spRe Q4vxqkVmLJcq+DVO8Mv2OrPN7T1Ti2XTqi30bGZQsPJ1kt+T/F5eHb6wCoq37DF2gXaLKEhKLUg PbaKHIURlvnfn1RvTUz0cSeqj7g2nGcbYfLivZQjOvVi1l0nOn1V5l6ZoRv5UQObSdUfc7zljUC FO7I8N+YrRVYwhtSIkWS9SwkGRuJEXdaPjKHNbYggKVxapBpxfr1st69ilLPrASOpw7ML7cr81F 3JSMTprDUVO18tw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861686020158500 The CCID device defines message types for PC_to_RDR_Secure, Escape and SetDataRateAndClockFrequency but the bulk-out handler lets them fall through to the default case, which responds with RDR_to_PC_SlotStatus. The CCID spec requires each command to use its own response type: Secure must reply with RDR_to_PC_DataBlock, Escape with RDR_to_PC_Escape, and SetDataRateAndClockFrequency with RDR_to_PC_DataRateAndClockFrequency. Add explicit cases that report ERROR_CMD_NOT_SUPPORTED using the correct response message types, along with the corresponding structs and response writer functions. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 62 +++++++++++++++++++++++++++++++++++++++= ++++ 1 file changed, 62 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 5ca50c111217..e7bc5f6d4ae0 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -232,6 +232,19 @@ typedef struct QEMU_PACKED CCID_DataBlock { uint8_t abData[]; } CCID_DataBlock; =20 +typedef struct QEMU_PACKED CCID_Escape { + CCID_BULK_IN b; + uint8_t bRFU; + uint8_t abData[]; +} CCID_Escape; + +typedef struct QEMU_PACKED CCID_DataRateAndClockFrequency { + CCID_BULK_IN b; + uint8_t bRFU; + uint32_t dwClockFrequency; + uint32_t dwDataRate; +} CCID_DataRateAndClockFrequency; + /* 6.1.4 PC_to_RDR_XfrBlock */ typedef struct QEMU_PACKED CCID_XferBlock { CCID_Header hdr; @@ -739,6 +752,43 @@ static void ccid_reset_error_status(USBCCIDState *s) s->bmCommandStatus =3D COMMAND_STATUS_NO_ERROR; } =20 +static void ccid_write_escape(USBCCIDState *s, CCID_Header *recv) +{ + CCID_Escape *h =3D ccid_reserve_recv_buf(s, sizeof(*h)); + if (h =3D=3D NULL) { + return; + } + h->b.hdr.bMessageType =3D CCID_MESSAGE_TYPE_RDR_to_PC_Escape; + h->b.hdr.dwLength =3D 0; + h->b.hdr.bSlot =3D recv->bSlot; + h->b.hdr.bSeq =3D recv->bSeq; + h->b.bStatus =3D ccid_calc_status(s); + h->b.bError =3D s->bError; + h->bRFU =3D 0; + ccid_reset_error_status(s); + usb_wakeup(s->bulk, 0); +} + +static void ccid_write_data_rate_and_clock(USBCCIDState *s, CCID_Header *r= ecv) +{ + CCID_DataRateAndClockFrequency *h =3D ccid_reserve_recv_buf(s, sizeof(= *h)); + if (h =3D=3D NULL) { + return; + } + h->b.hdr.bMessageType =3D + CCID_MESSAGE_TYPE_RDR_to_PC_DataRateAndClockFrequency; + h->b.hdr.dwLength =3D cpu_to_le32(8); + h->b.hdr.bSlot =3D recv->bSlot; + h->b.hdr.bSeq =3D recv->bSeq; + h->b.bStatus =3D ccid_calc_status(s); + h->b.bError =3D s->bError; + h->bRFU =3D 0; + h->dwClockFrequency =3D 0; + h->dwDataRate =3D 0; + ccid_reset_error_status(s); + usb_wakeup(s->bulk, 0); +} + static void ccid_write_slot_status(USBCCIDState *s, CCID_Header *recv) { CCID_SlotStatus *h =3D ccid_reserve_recv_buf(s, sizeof(CCID_SlotStatus= )); @@ -1123,6 +1173,18 @@ static void ccid_handle_bulk_out(USBCCIDState *s, US= BPacket *p) ccid_report_error_failed(s, 0); ccid_write_slot_status(s, ccid_header); break; + case CCID_MESSAGE_TYPE_PC_to_RDR_Secure: + ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED); + ccid_write_data_block_error(s, ccid_header->bSlot, ccid_header->bS= eq); + break; + case CCID_MESSAGE_TYPE_PC_to_RDR_Escape: + ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED); + ccid_write_escape(s, ccid_header); + break; + case CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency: + ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED); + ccid_write_data_rate_and_clock(s, ccid_header); + break; default: DPRINTF(s, 1, "handle_data: ERROR: unhandled message type %Xh\n", --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861618; cv=none; d=zohomail.com; s=zohoarc; b=IquanYGxre5K+zQsunvnRObc8SIMoc/obOvNKwnlTywIaf5oMV8udxm4LL9QE11no/Hnn96Xsfr6o9wdcuCY9KuFPfyRoFMLqJzN5ioA3PtrvpiJpozL0DkdmcVxOvj+i99BjZv909hWaIEk18WCtKDP1xP1L1zDnHSaT3440SI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861618; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DN7Mxa0B8HRLcN4XqlhXmrWW0C5sZzFO8HSNl+zMm0I=; b=Z8oFcz8uLbOpkXSzijzBwi4xzlJKGYOUzHclhhXtFcqoqehHJwm07IY11vRfZNK6ZNj0X3SiRBFPWfoPFRO08w78NK/f9gbB2QYb2G3jbTRl966ZwAWWckrY9wC4eK803q1Zdv/2YH9PBxEDwUxMcMBxyu35Y/d/ZeYj81tJg6A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861618702143.7443968635498; Thu, 1 Oct 2026 06:33:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsh-0000OJ-OS; Thu, 01 Oct 2026 09:31:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsI-0008Du-LN for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:04 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsG-0006Pg-LG for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:02 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-627-1DosZFyWMU2RgAu_BiZuag-1; Thu, 01 Oct 2026 09:30:55 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 8067D19352FB; Thu, 1 Oct 2026 13:30:53 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id A11A230000E4; Thu, 1 Oct 2026 13:30:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861459; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=DN7Mxa0B8HRLcN4XqlhXmrWW0C5sZzFO8HSNl+zMm0I=; b=AEzY4lm03QhoH+tWvxGKHSRxEY8/cPdNEIUvFbBpiNhcfuPl9kzhAvUHuBIyDkylC9tKwX gzA8L32VMD0v+f+fvAgMKaWMUw5UzPtwZPLgpWHDBHyv7iBw13dqH3NBauhIl65FvgjEpX /SlKkDg0ZoAwbk8B+Ykequps/wpr25U= X-MC-Unique: 1DosZFyWMU2RgAu_BiZuag-1 X-Mimecast-MFC-AGG-ID: 1DosZFyWMU2RgAu_BiZuag_1790861453 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:58 +0400 Subject: [GIT PULL 19/27] hw/usb/dev-smartcard-reader: reject commands for invalid slots MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-19-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=2809; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=SM2yKYqDRqbJr7X/8a/vAfnwR98DbaY94wdf8nCxvnE=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBIjb80dAmcBdGoDC840+nG011Cl2x39k+On +SDBI+nJx+JAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5UsJD/4izFWuk6qSb+xcjueCSGe4+mmn956VWopayKZY8kBgkLur9TrlMLePTXfHPukvxM7OUOb ST6C35I/WOETmAQ3mTCVEwotl7tWr8H1xZJLrNKQLawHD/SwWRygWs9smF88vN4uvV12HYWl/MB /2GM22W4/vd6okGt3J81SakL3TxMysLZlAQrjPketdBsOXTgzl/909MvEB75LWQw0hI8Wo062Q/ jQa/Jcs6OdwLi00FXnXYADNsHf3Il9+UOC4INWt9KXCF0JXYmiXwEHEcN3hG29nzm9vzAwuPI+l n7K6ukQFYq2KH9T4drDWeKN0LY1iWT63MM7t50wwfBk/v4y0Cb/y9I3rBi9ih4ecYMbTYNQZLOm txFXLRsMEYXw6tTESuEag1mo5ST7lGM6yyOS3YOhLwU+/0aTVhfVKRro69ZBgON7W5Gc6BZxg+9 0f24+kyq3bwLa0tduHOAXRYY4fA9HFoc0dekWQiE/0PMT7c5t8ABaYRfA6VJ9ALKsMdf0Xn/2m/ DkzBboKtX2nSfcml6SshWVeGVh8xobWHA/cO3rTXq+m7ATkRqdebqgnncollo6N0Q9HIJSm4GvR MHtafLtuYES9HRg+v/De1f7chHcQGxGlHvxhnBnEe8cR5HfvRt/VVw900xVyXRYyjAkYXl8D6sN gkBFVsX8vY9mz0g== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861619599158500 The descriptor advertises bMaxSlotIndex =3D 0 (single slot), but ccid_handle_bulk_out() never validated bSlot. Commands addressed to non-existent slots were silently processed against slot 0 state. Reject them with bError =3D 5 (slot does not exist) per CCID Rev 1.1 section 6.2.7. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index e7bc5f6d4ae0..cc7356c77413 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -167,6 +167,7 @@ enum { ERROR_XFR_OVERRUN =3D -4, ERROR_HW_ERROR =3D -5, ERROR_CMD_SLOT_BUSY =3D -32, + ERROR_SLOT_NOT_EXIST =3D 5, }; =20 /* 6.2.6 RDR_to_PC_SlotStatus definitions */ @@ -1087,6 +1088,35 @@ static const char *ccid_message_type_to_str(uint8_t = type) return "unknown"; } =20 +/* + * Send the spec-mandated response type for the given command with the + * error already staged via ccid_report_error_failed(). + */ +static void ccid_write_error_response(USBCCIDState *s, CCID_Header *recv) +{ + switch (recv->bMessageType) { + case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn: + case CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock: + case CCID_MESSAGE_TYPE_PC_to_RDR_Secure: + ccid_write_data_block_error(s, recv->bSlot, recv->bSeq); + break; + case CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters: + case CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters: + case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters: + ccid_write_parameters(s, recv); + break; + case CCID_MESSAGE_TYPE_PC_to_RDR_Escape: + ccid_write_escape(s, recv); + break; + case CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency: + ccid_write_data_rate_and_clock(s, recv); + break; + default: + ccid_write_slot_status(s, recv); + break; + } +} + static void ccid_handle_bulk_out(USBCCIDState *s, USBPacket *p) { CCID_Header *ccid_header; @@ -1130,6 +1160,14 @@ static void ccid_handle_bulk_out(USBCCIDState *s, US= BPacket *p) goto err; } =20 + if (ccid_header->bSlot !=3D 0) { + DPRINTF(s, 1, "usb-ccid: bad slot %d\n", ccid_header->bSlot); + ccid_report_error_failed(s, ERROR_SLOT_NOT_EXIST); + ccid_write_error_response(s, ccid_header); + s->bulk_out_pos =3D 0; + return; + } + DPRINTF(s, D_MORE_INFO, "%s %x %s\n", __func__, ccid_header->bMessageType, ccid_message_type_to_str(ccid_header->bMessageType)); --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861673; cv=none; d=zohomail.com; s=zohoarc; b=I24GjS/YjrDd9CqKnOiugXQ6IuQbgizzVZdECqr74bHs9rptEh4fkSdNHP1auL0TbnfmycPUQ+zLhCOVTtFyTDSipkIj4IP2wZNCZfO6GBlKqURGnp2YxinJ2LlT3wvr+YnJkCiG4calarOxrVNtRDXgWGHZwRexdAhM7Pf8XUE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861673; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=GP0N80FMfdTeLjOQZMxys4fYS7GjXTkdh1zfBikzr5A=; b=UbftMw+ebtNtocSD909LdSZv1T7g25QgScop1dM9Ul4MyQ3HP6GcWECARAJFigTZHWiEopQDFvcrZhzCdZRrhy9X+ve65NYK+yLifUIvr8Mn24zSbL7qzCaIjJWITzChTZGY01QeJF068SIUpzud8EIX2slD2McAyFAY48th65U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861673213481.3402490855882; Thu, 1 Oct 2026 06:34:33 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsq-0000qa-M2; Thu, 01 Oct 2026 09:31:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsI-0008Eo-PO for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:04 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsG-0006Pk-Oy for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:02 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-80-G70bYXx6Om-gibXrzHmRRA-1; Thu, 01 Oct 2026 09:30:57 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D7CF71905689; Thu, 1 Oct 2026 13:30:56 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1BDCD180029C; Thu, 1 Oct 2026 13:30:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861460; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GP0N80FMfdTeLjOQZMxys4fYS7GjXTkdh1zfBikzr5A=; b=HnVT5DpVGGnaDOiPLg/Uhy3Cn7RXpwyaHAfx86q+kI7urgjwmgoA1z7GVW+TF5jrKUJRFH 70K/qs58NJAaOcutyGLV9NFQIbsdnr9xUYm58r/x0Ixxq8QeQGFgJBXKqlKtg8p0wQD6r9 EJvjkMv9nBgG66GFPTczLzBKcvLjUN4= X-MC-Unique: G70bYXx6Om-gibXrzHmRRA-1 X-Mimecast-MFC-AGG-ID: G70bYXx6Om-gibXrzHmRRA_1790861457 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:29:59 +0400 Subject: [GIT PULL 20/27] hw/usb/dev-smartcard-reader: zero bChainParameter in DataBlock responses MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-20-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=1135; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=EBwgarzTmp5yziTLazD7l+GBWBLKDmJY/xE6xM+3dGw=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBIKnOVs3vuXyn6lVnDCsL3wspuWft9QDwcS fhnXY2gqzKJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5bAwD/0Y0/aR9L9qP+xJRzNr6sQpjpz3npJiTdkvA+E2T5ta+I4m3ClYJUh6bktca9WRBP9ITqf D50mu49+0HwihIP51EF5mfkvmz212Wqu/8FvFg80L1CBbtvMwBm6Qp6RZVBkATitWweJkUGsbNb mulXJEpacjUjs30jY6pIDeXreRCQ7lf0vQR++pR23UuGnhzbUvH1Yk9aDqAr/aAEeE87SYKltf8 mxMqzsUI7df/wMlPvtpFb4ASn6bC5vSZaxAwSzBujJqm4AmqJAfcDc1l1+rm9gT1Kwy+ybJmTAN OER8Yvq1fMdye+wkcvXjdvQgKHnypCFTxOr539Sch70PXNwiAnXmEcpTRMMzGQOwUBL1S0J58RR 1QJVshC2NjIpDiLAwan2m2nzcxbQcNWDjNaso6qnda+GTNPOiCOTSXy6F7pPcQrzKEMXjPRXAFk xaL4/Z5n0NGH1CZm8e664iVall9DI5M8TLnZHygml96+lGHWEPfzoJzJPTphOvX+7HeM5XzXf3i WQF8IxVmajhsOHJrLVjmwQoqOG1v2ihebHv4QM6Haa+4RHeudco9oeFvRgY6S1f+K8Is53o6bxH 7zMF/z7s/OUniYJNB5vP2WYTf5SiugaZIZ6CS35xJ9krBkcUUInsPZukb0Z/scYu+/LJ4VRf98l BBQY+lRgFrSHemg== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861674088158500 ccid_write_data_block() initializes every CCID_DataBlock field except bChainParameter. Since bulk-in buffers are reused without zeroing, a stale non-zero value can make the guest CCID driver misinterpret a complete response as chained. This device never chains responses, so set bChainParameter to 00h as required by CCID Rev 1.1 section 6.2.1 for TPDU-level exchange. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index cc7356c77413..208a14dbd1b3 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -848,6 +848,7 @@ static bool ccid_write_data_block(USBCCIDState *s, uint= 8_t slot, uint8_t seq, p->b.hdr.bSeq =3D seq; p->b.bStatus =3D ccid_calc_status(s); p->b.bError =3D s->bError; + p->bChainParameter =3D 0; if (p->b.bError) { DPRINTF(s, D_VERBOSE, "error %d\n", p->b.bError); } --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861674; cv=none; d=zohomail.com; s=zohoarc; b=C4hcquXzKcDlOl+Bqh6M9n18p3kI2+VdQpqKTh1ssbWXjLBNbsUyoF6FdiO8RFhoIDs7yCatmYW5QymMrsGocbJtSRwZc0wBUxlxX+t5F77yzEt3rBG5unfQfqbxJDNsDcRyYF/PxH0DRzQAeNwMaG4iIvnHeJsu6tZoAWd0RTQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861674; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=yYHNvJpFLSZFL7ouF7hNfIkVHpQ4xl/jm8rXxvtAA6A=; b=YJxC6HDdy/Dt58ikoFVSU0PX1FUqU2gWudT+zykXTJn2ySnoYSn3cmf1Y7lA3aM2mRwheEHO08sUtZ5tbKXiVoyQyIzyH0iMfRdQKyFQSZ/UF3Z995sU3dAtPVkwmYMJhTSANxdv2gp2CkJFT++NfARHWW418OyV050ChNMnxQg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179086167471625.38575180646035; Thu, 1 Oct 2026 06:34:34 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGuL-0002hf-I7; Thu, 01 Oct 2026 09:33:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsL-0008GU-85 for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:08 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsI-0006Px-UR for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:04 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-681-j3L0RfReMQ-msMEWOshdfg-1; Thu, 01 Oct 2026 09:31:00 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 011D018011F3; Thu, 1 Oct 2026 13:31:00 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 36A9B30000E4; Thu, 1 Oct 2026 13:30:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861462; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yYHNvJpFLSZFL7ouF7hNfIkVHpQ4xl/jm8rXxvtAA6A=; b=OVmN5SwXVKOiEIUHy8+9hzidpiX3h5Rxi0a8iLaOcYyJ7XerEDk8u02UsGko0RNHPV3xW1 /4gIYcLzL5oSoqLPuneSCF22ALWy/VjzIUhkgOBKF8j1dKi50cMOrDyd+joHd2bluB7lI3 lS4dNbyCY2bCuPuaAmqW/gVgRZm3PRQ= X-MC-Unique: j3L0RfReMQ-msMEWOshdfg-1 X-Mimecast-MFC-AGG-ID: j3L0RfReMQ-msMEWOshdfg_1790861460 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:30:00 +0400 Subject: [GIT PULL 21/27] hw/usb/dev-smartcard-reader: report error on XfrBlock with no card MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-21-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=1267; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=L3ECr7grYuToT7blHOBeTWg+GgZ4M8ndBx33X1qV31Q=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBIu60d1Nh6qNBBlByNuui9Uc0p7WDG9iOal yxqjucX5bSJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5aNUD/99r6ZvqwNbbgIA/6cXs52Yw3INBU93vcgo7rdudyKnl97Poc9r+Fs1iGVchCzTGr9Zsio 8EZNDU8/lPoWFB0QR1VfxyzwK2JT3xK576ziRRER2Zl1ZCXMnevSQ1mq5GuQRwe3iymbLZdkbMJ NgIWsTGd/khS9MheFje/0MXQXXPRzd6SdbIRAt30NB34fijn1VMY80fN8QElhaS/ci2iH/0HVMM 27qY7x43b/dJ71vehFCyvChY2+J+/Zf8Rn7fWmHjKevqkfM1QJdMMmTr0srjcs7w7Qzq093JNlT O8S8xd38lJnkuy51sZFDIz4cTGlJUoGmOcyqhHunB5fcclHLfJV94iqG+7poKdWBAe/JSfgeEvm /85ENJcizj6xDC4QJATCSYEk9opxvqJnx1Qi+cZPfhXRjoIYmFGpO4dY+kVsrSmbvxuTNGNibVV uMXNi5J/jvWbrf3aG81Xvn0stXfOw2veQDUBZclARPGX2pf4VbsyXDzG/1bESQT6hnzwktjbv/o mxgZbkeFsfveHj+XxOaAHJSsH7qkLdDpZIQHC7/9yZNCjasMbifjjxnw1vLTrNR5xS+N5kfrfo0 XBTRUPC8tur87ZPZVdq4tsi2l3hkffRFp5rr6uhAv5eu0CGQUZJGdqJFggFrR0l9a0Pg+8KCvol xbf5Y4OEaF/3kMQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861675920158500 ccid_on_apdu_from_guest() returns an empty DataBlock when no card is active, but without first setting failed command status. This makes bStatus report success and leaves bError unset, violating CCID Rev 1.1 section 6.1.4 which requires failed status with ICC_MUTE. Call ccid_report_error_failed() with ERROR_ICC_MUTE before queuing the response, matching the existing pattern in the slot-busy error path. Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 208a14dbd1b3..65ceed57541a 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1046,6 +1046,7 @@ static void ccid_on_apdu_from_guest(USBCCIDState *s, = CCID_XferBlock *recv) if (ccid_card_status(s) !=3D ICC_STATUS_PRESENT_ACTIVE) { DPRINTF(s, 1, "usb-ccid: not sending apdu to client, no card connected\n= "); + ccid_report_error_failed(s, ERROR_ICC_MUTE); ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); return; } --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861700; cv=none; d=zohomail.com; s=zohoarc; b=ZxioxphCJ41sNrTKWo/8UoyoejeAtrg7X5KlQARDvbV8gMImJRfiayM1mueEXlsrLo59slZjth5RKVH5ob4EY/Ms24jWsfBLLvosicsU9yjzOZ39k1lRwrEkiFArWsEAS6GqOWKmddPwSt/HtQb7Wz9jjbcVUp/n5q0NP9Grij0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861700; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bKw6fkq7NI7n/7XJwVwBUUecKUqBRGB1AOlajcKyMQ8=; b=PTx1Wfx7ZjIYSHBEjz7AbrW/2A6iZUMAT07+t+OnemMQ5n2GxJwRsr6VlfSIxyAYXAKB7gZ7AiK+K9T8OsFT2o5KPscjBcAFkROWVLznbd9kMyRk3erXW2zFMn+40p7n3fviUhaUUlDy7zjJkKhIKvx2S5NEbgSU+WwPNf8yvy4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861699994714.7639738520965; Thu, 1 Oct 2026 06:34:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGv2-00034M-88; Thu, 01 Oct 2026 09:33:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsS-0008QQ-TP for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:16 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsP-0006Qk-Oj for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:12 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-634-FGGwCB7_OpWTnBx-G9i5WA-1; Thu, 01 Oct 2026 09:31:04 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 67C9E185588D; Thu, 1 Oct 2026 13:31:03 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 9BD0C30000E6; Thu, 1 Oct 2026 13:31:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861469; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bKw6fkq7NI7n/7XJwVwBUUecKUqBRGB1AOlajcKyMQ8=; b=JjyFXnvgQVJJBMapORqJi5Rquo846XxBaI9RMtd3GXhpbH9qEP8CYa+Jqxs9i7s1fd50R3 48o7Xq9XAdfKOoQGgQexwUgRsrtsFaYTjKyW30/wnLsSS92i7l4I12/1Gf7wftWmqa4X+Q DHMDhwy8DJPtHBZzg3TKeaFslRdCngg= X-MC-Unique: FGGwCB7_OpWTnBx-G9i5WA-1 X-Mimecast-MFC-AGG-ID: FGGwCB7_OpWTnBx-G9i5WA_1790861463 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:30:01 +0400 Subject: [GIT PULL 22/27] hw/usb/dev-smartcard-reader: stop advertising PIN support MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-22-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Zhao Liu X-Developer-Signature: v=1; a=openpgp-sha256; l=3148; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=wjdQd/MOl1N5vuQvFluSxxpU2EXe4n1TUXXXwQA5c9Q=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBIzTHur2g/HmCzGFYPvcfwFNL/0em2s6WSE WNBIxfeTBuJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5S0RD/sGJZMqqHL3WHNVFDtwmy8XRobHt/FBtkysYaWsRjWMHt5VPvIeMpEciSABsM5++/8mbmg a4OfemJ/LSqU681xFjRVqWIGPYkUiIWIQd+c6O+CBkzeNhPOi+0hiBDmcNngF+oKVvDtsLFrHC1 PoaPBt/fiaIl9Zmrzx1rIFGlLSs0UCQ6FUmSnsMlS2NinfqPnYWlsYKaACpipZjoYUcX5KMlO23 0+fbGRgtmF6ElCaoyLN6GdAtHgkcW8WKacoVBjQ4kX6U7BjlIqRfBlTdpQ/5URo14IUDNwuQ5L8 Zq4Fsxu9USRL8QOs4JM/7Q0awRl1RP9bAKFtXNijXAXJpEvYlDey+6GC+ZZ6ZoOd2QjU4HlXuGM VGlwg6uRCKz2tEjyWOJ3dSLwRxvY2nhaTy6idB0Z7WQ9EJuh8HgoGI0s7qhYNSs68cmRwiasn8q 0pKB5ocaB7v9Mfq1LV3S+iWguuW9Zwpdu3C+pwGpe0za0El7qyoUj0LeUPhng/UBIM1YKfzQ5NS zt7bR4iS/ohO6eXCMOz6fmNStm3XlxiQ15JepEPMOwEIAWpBFOQzZuIElICbcxKUt2RGYDQH9/1 F+RrKKt1ETgHIxlMdtaShSA0TT/adIl4wFu4oR7+tT5LIpVMB9Ilwb8mv6ZLNySyp+rYu55ueO+ bYG8EeRP6pQUOlQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861702112158500 The CCID descriptor claims bPINSupport=3D1 (PIN Verification) but the device does not implement it, returning CMD_NOT_SUPPORTED for Secure commands. Stop advertising the capability by default, gated behind an x-pin-support property for backward compatibility. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/core/machine.c | 1 + hw/usb/dev-smartcard-reader.c | 12 +++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/hw/core/machine.c b/hw/core/machine.c index 4aa5df13f386..a5a168d72521 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -58,6 +58,7 @@ GlobalProperty hw_compat_11_0[] =3D { { TYPE_ARM_SMMUV3, "oas", "44" }, { "migration", "switchover-ack-legacy", "on" }, { "usb-ccid", "x-accurate-message-length", "off" }, + { "usb-ccid", "x-pin-support", "on" }, { "usb-ccid", "x-migrate-pending-answers", "off" }, }; const size_t hw_compat_11_0_len =3D G_N_ELEMENTS(hw_compat_11_0); diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 65ceed57541a..a973a0396bb3 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -328,6 +328,7 @@ struct USBCCIDState { bool accurate_message_length; bool migrate_pending_answers; bool pending_answers_loaded; + bool pin_support; }; =20 static uint32_t ccid_bulk_in_pending_num(USBCCIDState *s) @@ -436,10 +437,14 @@ static uint8_t qemu_ccid_descriptor[] =3D { * u16 wLcdLayout; XXYY Number of lines (XX) and chars= per * line for LCD display used for PIN entry. 0000 - no = LCD */ - 0x01, /* + /* * u8 bPINSupport; 01h PIN Verification, * 02h PIN Modification + * + * Corrected to 0 when !x-pin-support */ +#define CCID_DESC_OFFSET_B_PIN_SUPPORT 52 + 0x01, 0x01, /* u8 bMaxCCIDBusySlots; */ }; =20 @@ -1498,6 +1503,9 @@ static void ccid_realize(USBDevice *dev, Error **errp) stl_le_p(&qemu_ccid_descriptor[CCID_DESC_OFFSET_DW_MAX_MSG_LEN], BULK_IN_BUF_SIZE); } + if (!s->pin_support) { + qemu_ccid_descriptor[CCID_DESC_OFFSET_B_PIN_SUPPORT] =3D 0; + } usb_desc_create_serial(dev); usb_desc_init(dev); qbus_init(&s->bus, sizeof(s->bus), TYPE_CCID_BUS, DEVICE(dev), NULL); @@ -1692,6 +1700,8 @@ static const Property ccid_properties[] =3D { DEFINE_PROP_UINT8("debug", USBCCIDState, debug, 0), DEFINE_PROP_BOOL("x-accurate-message-length", USBCCIDState, accurate_message_length, true), + DEFINE_PROP_BOOL("x-pin-support", USBCCIDState, + pin_support, false), DEFINE_PROP_BOOL("x-migrate-pending-answers", USBCCIDState, migrate_pending_answers, true), }; --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861619; cv=none; d=zohomail.com; s=zohoarc; b=eOOOiQNWPri4a5gOjdypC7oBV4OrxAtZAj7Bt0qYWU1g/qA9HAUhKcv4x6HPjh6K+EdbX3oDMkhf21ZwWrXWtn/XNiBT8jezExk18NiAxzNHHBK8+iXRkhBkGnNRJbmnOy+DFOmRy4kFZlVO/yAD2CIcSyG+hQ9WQFNEKJjrDjA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861619; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=SgAjoKlWlgFbatzBUOK+3OCXUu7lHVO9JxwVqYlR4o0=; b=j+XwKdGZUyAJ2hbcnp64pywbkZQdfm5uyINL5M8XHcrnbkfrbu9Z1cXD098KdClFN4xbOk4WimDaH1Gb/oo/G5zHaBotclAZV/aYto9S85oPttjG0k0ijjjsASubAE77LxZmQdUHdpl/H5htc4bEibOdzNVmJ9P8X2Gv39EA1Qc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861618969279.2059070229691; Thu, 1 Oct 2026 06:33:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsq-0000r2-Mt; Thu, 01 Oct 2026 09:31:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsS-0008QP-Sm for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:16 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsP-0006Qg-DH for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:12 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-454-IgYKrUROPqeC3XYZi3eM-w-1; Thu, 01 Oct 2026 09:31:07 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6F7C6193610C; Thu, 1 Oct 2026 13:31:06 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id A4CA41956086; Thu, 1 Oct 2026 13:31:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861468; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=SgAjoKlWlgFbatzBUOK+3OCXUu7lHVO9JxwVqYlR4o0=; b=S1FK6EJamVHohIyHlBsFPPe3pbgp02b5YNqS+tWoT07mUF/u3gRbzXh9LKUeD7sjju0mGK szZnw2KG1vDKnGg1hn3xzZJCkAdSdh6sM8Di6hIHufELBaJdJSX0RVqnpKRAOwsqJvmtin CgEBbS3LX+UG1GVXYZJo20EVu2jl8NI= X-MC-Unique: IgYKrUROPqeC3XYZi3eM-w-1 X-Mimecast-MFC-AGG-ID: IgYKrUROPqeC3XYZi3eM-w_1790861466 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:30:02 +0400 Subject: [GIT PULL 23/27] hw/usb/dev-smartcard-reader: validate per-command dwLength MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-23-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=5125; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=P1dRbwb8aB7dEsE7NIbX9x/0VcMM5uk/QA38FYSRtDc=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBISdxkpUop+S1bCRy0rfhosEwsaMf6iA7s8 kYCWu/COf6JAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5e1rEAC0ZPUBbpIksvPE09uF+iIM1DbNMVtiFc/KwMLRxMd1wGKXsTXL4Vt0XFhB1IuC7GBcwHf rGRdNrLWFyWN1RU1vfQ5AaU4lFAbetOxBtVvkKp3gMd2s8Fiy9I3M9nqRoYVFrYlgFI5GLbJGGO KgbpSht311RXyQ5qoZpdbc1TeW1elf4pe6x+yNoMA1bz6W/n2BunpFa3YtqOzOWc5VsjhHLJF0y CeKFA7QU/ta6/smdv/4vsU9wPll9sSsTgBQ5aFcTk7UESrgmpD0s3rKec38FN4f9llER+diuKo6 tky2RHXVLXxjTnmQ59ljXLaD1HTdMdUMT3zM5LWHacupAhakuOltYj9ebLMowK9LpeAkTdChCnT Oj/WGfBE0hARf75vqArSKtJKLLkzVbiSzp61AcFZb1GzSaXrkP8dY/4YWYAP1prr6cYVCxzPHn9 z3Jp7kzXFBu8h/1WO1f5r/l3o0g63Rw2QVQpKHXjAU7VkQwcErOeg44PNalSt2Iqp76d/J6geuR snCU3J/cncpswtlxanPneeF/uOT5jIdfd/N45XQ4T/fqersU0K3ZpTTwXC/knEanoZ7SQagdcIf yGu0u+vEJNmbs5A7fb6PTntnoiz73w08BChCQyGNnlblhKKPhy5jKe6RfPQG/k/Sr+LroKg7332 j4qjZnfyFzSvT+g== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861621458158500 The bulk-out parser validates that dwLength matches the received byte count, but does not check whether dwLength is correct for each command type before dispatch. For example, SetParameters copies protocol bytes from the payload even when dwLength is zero, reading stale data left in the fixed bulk_out_data buffer from earlier commands. Add per-command dwLength checks before dispatching: - Commands with no payload (GetSlotStatus, IccPowerOn/Off, Get/ResetParameters, Mechanical): require dwLength =3D=3D 0 - SetParameters: require exactly 5 bytes for T=3D0 or 7 for T=3D1 - SetDataRateAndClockFrequency: require exactly 8 bytes - XfrBlock: variable length, already bounded by the buffer - Secure, Escape: variable length, unsupported and no payload access Malformed messages are rejected with ERROR_BAD_DWLENGTH. Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 42 +++++++++++++++++++++++++++++++++++++++= ++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index a973a0396bb3..bee118cb4ff9 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -167,6 +167,7 @@ enum { ERROR_XFR_OVERRUN =3D -4, ERROR_HW_ERROR =3D -5, ERROR_CMD_SLOT_BUSY =3D -32, + ERROR_BAD_DWLENGTH =3D 1, ERROR_SLOT_NOT_EXIST =3D 5, }; =20 @@ -1180,9 +1181,15 @@ static void ccid_handle_bulk_out(USBCCIDState *s, US= BPacket *p) ccid_message_type_to_str(ccid_header->bMessageType)); switch (ccid_header->bMessageType) { case CCID_MESSAGE_TYPE_PC_to_RDR_GetSlotStatus: + if (payload_len !=3D 0) { + goto bad_length; + } ccid_write_slot_status(s, ccid_header); break; case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn: + if (payload_len !=3D 0) { + goto bad_length; + } DPRINTF(s, 1, "%s: PowerOn: %d\n", __func__, ((CCID_IccPowerOn *)(ccid_header))->bPowerSelect); s->powered =3D true; @@ -1193,6 +1200,9 @@ static void ccid_handle_bulk_out(USBCCIDState *s, USB= Packet *p) ccid_write_data_block_atr(s, ccid_header); break; case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOff: + if (payload_len !=3D 0) { + goto bad_length; + } ccid_reset_error_status(s); s->powered =3D false; ccid_write_slot_status(s, ccid_header); @@ -1200,21 +1210,38 @@ static void ccid_handle_bulk_out(USBCCIDState *s, U= SBPacket *p) case CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock: ccid_on_apdu_from_guest(s, (CCID_XferBlock *)s->bulk_out_data); break; - case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters: + case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters: { + CCID_SetParameters *ph =3D (CCID_SetParameters *)s->bulk_out_data; + uint32_t protocol_num =3D ph->bProtocolNum & 3; + uint32_t expected =3D (protocol_num =3D=3D 1) ? 7 : 5; + + if (protocol_num <=3D 1 && payload_len !=3D expected) { + goto bad_length; + } ccid_reset_error_status(s); ccid_set_parameters(s, ccid_header); ccid_write_parameters(s, ccid_header); break; + } case CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters: + if (payload_len !=3D 0) { + goto bad_length; + } ccid_reset_error_status(s); ccid_reset_parameters(s); ccid_write_parameters(s, ccid_header); break; case CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters: + if (payload_len !=3D 0) { + goto bad_length; + } ccid_reset_error_status(s); ccid_write_parameters(s, ccid_header); break; case CCID_MESSAGE_TYPE_PC_to_RDR_Mechanical: + if (payload_len !=3D 0) { + goto bad_length; + } ccid_report_error_failed(s, 0); ccid_write_slot_status(s, ccid_header); break; @@ -1227,6 +1254,9 @@ static void ccid_handle_bulk_out(USBCCIDState *s, USB= Packet *p) ccid_write_escape(s, ccid_header); break; case CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency: + if (payload_len !=3D 8) { + goto bad_length; + } ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED); ccid_write_data_rate_and_clock(s, ccid_header); break; @@ -1245,6 +1275,16 @@ static void ccid_handle_bulk_out(USBCCIDState *s, US= BPacket *p) s->bulk_out_pos =3D 0; return; =20 +bad_length: + DPRINTF(s, 1, + "usb-ccid: bad dwLength %u for %s\n", + payload_len, + ccid_message_type_to_str(ccid_header->bMessageType)); + ccid_report_error_failed(s, ERROR_BAD_DWLENGTH); + ccid_write_error_response(s, ccid_header); + s->bulk_out_pos =3D 0; + return; + err: p->status =3D USB_RET_STALL; s->bulk_out_pos =3D 0; --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861517; cv=none; d=zohomail.com; s=zohoarc; b=fL2/VHFa82xxxRlCKo7VfHH0JZcnvUKKz0LurWqNqzzg7WKTttHBfl2S0SKXV6pcoxUtXDA1Mwabg1S72RBJ3uumF664WhdHwnAbTe1gqcyhOLXBxyP4MqEsYlN/2vZ5G6LuSvXQlVAO9wlAhvojH37c9wfp3hGxZutxOyUqp5k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861517; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zFNUv8RjeNsH9jAUIjQp8KNl9pB7eLaPjsoWErgPNfU=; b=dzujxhaWVLGDekefu14HCFbL5BOFqUjlttJjZBew1gP/fMxMpO+RPoqXtbxqItxS6/6A5+Bhna2z+nxuVMmWVKyRxJxpjQSW/3fZQOveJHx4CC0BAAKkuoKjwikcHFTsRF8f+SsPw76fUz0H7/VHG0T4ektDZM4rT7uB3VtKjpA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861517273868.4517637781762; Thu, 1 Oct 2026 06:31:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGsu-0001Er-4S; Thu, 01 Oct 2026 09:31:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsb-0008Vx-Cj for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:23 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsY-0006RQ-GK for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:21 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-636-hS_YHhlLNh-vNnHQpZXb-g-1; Thu, 01 Oct 2026 09:31:11 -0400 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id C1F101809CB2; Thu, 1 Oct 2026 13:31:09 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 0688118005B3; Thu, 1 Oct 2026 13:31:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861477; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=zFNUv8RjeNsH9jAUIjQp8KNl9pB7eLaPjsoWErgPNfU=; b=UE/K7kQ92vkKyfQN5bRg5bFWPwY2dlsy2bL8uR8snkYo4HU7/sc4/bprO98LkEmilyyN6a pfWXbEyjRvuVo5JNrqj7rvpOktV8YGdJamloc7qhWwNwmzFlx0P1Rp19PxVq16hluQSLQ1 skZJkmicmJ1UNY02J+QyfrTUUCMLRzs= X-MC-Unique: hS_YHhlLNh-vNnHQpZXb-g-1 X-Mimecast-MFC-AGG-ID: hS_YHhlLNh-vNnHQpZXb-g_1790861469 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:30:03 +0400 Subject: [GIT PULL 24/27] hw/usb/dev-smartcard-reader: use usb_packet_size() accessor MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-24-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=3573; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=dm40QCDQhaUf0+8KvvG9NEurnfi+Acexw9HoRYzOVFY=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBIRKSFKmsyTCoddc4R7Hml3OEb7/ZkgKSBH WkZVxzVKJGJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5YTND/0Yq9jYCLbFOY9+jCBqmEuO2gHNKkGQ/0skEFFZQ3Gu2p9HNgN2TzPv3S3ijK8h/g+asbu +CozPzj+EGPAMOqXy14z903ccYZOiNtqsryoTNxMaEL/Dr0LTKJPN9DbEdwWIyBkTtLOIYDtTay 4wlZbz0ed1ztRaAzQYck12tOmHfr/9rdkdN7nvmHWtHl4FolvBr6MfXX4Vf+X2B8Ftmw//uZ1qA wl0WvswJNAWjtc2PECZVabQsm962TBIED/NTNRvp61lZ6QEatqTnmAw+b9NAkegG6W3vQwK0L+L iTk8oO0lAKAouP2JfVLdlfqAb+ebIMqVf7lcLew79qbhV2xlDBMuTD/eEzzk0kCKLTNrApokvAa Ujd4huDj8fPeqnov20oTtmUMmV8Db2Q22LYYO4YkcPG4MqJteiGYUxJYmhLIRyoTG9EoooEybIG LY/zaq7wW5v7bqzXODA7Ro98kWpqtAnnPtWkOOJjvn9P9GBnp9UAyoL7T4zMRUEYRLCxgNZ/ldu d5e7GZykW9h/hjd8aHTGFSm+sQ8vwVXhqjvRKoKIQ4BNvHD7XetkVRidOrlVz0Op38Yk3tCvJDv pIUBpUM0icuA81YH/qpglbL2BAe33GRmloMbYWzjirjMw4WyJ9HZK4ZcjeCltvgkrkU7/38b/au GIGX6jY0skLMn4Q== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861518690158500 Replace direct p->iov.size accesses with usb_packet_size(), which correctly handles combined packets. Signed-off-by: Marc-Andre Lureau Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/dev-smartcard-reader.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index bee118cb4ff9..8520a2dab216 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1142,11 +1142,11 @@ static void ccid_handle_bulk_out(USBCCIDState *s, U= SBPacket *p) return; } =20 - if (p->iov.size + s->bulk_out_pos > BULK_OUT_DATA_SIZE) { + if (usb_packet_size(p) + s->bulk_out_pos > BULK_OUT_DATA_SIZE) { goto err; } - usb_packet_copy(p, s->bulk_out_data + s->bulk_out_pos, p->iov.size); - s->bulk_out_pos +=3D p->iov.size; + usb_packet_copy(p, s->bulk_out_data + s->bulk_out_pos, usb_packet_size= (p)); + s->bulk_out_pos +=3D usb_packet_size(p); if (s->bulk_out_pos < 10) { DPRINTF(s, 1, "%s: header incomplete\n", __func__); goto err; @@ -1155,7 +1155,7 @@ static void ccid_handle_bulk_out(USBCCIDState *s, USB= Packet *p) ccid_header =3D (CCID_Header *)s->bulk_out_data; payload_len =3D le32_to_cpu(ccid_header->dwLength); if ((s->bulk_out_pos - 10 < payload_len) && - (p->iov.size =3D=3D CCID_MAX_PACKET_SIZE)) { + (usb_packet_size(p) =3D=3D CCID_MAX_PACKET_SIZE)) { DPRINTF(s, D_VERBOSE, "usb-ccid: bulk_in: expecting more packets (%u/%u)\n", s->bulk_out_pos - 10, payload_len); @@ -1298,7 +1298,7 @@ static void ccid_bulk_in_copy_to_guest(USBCCIDState *= s, USBPacket *p) bulk_in =3D ccid_bulk_in_peek(s); if (bulk_in !=3D NULL) { assert(bulk_in->pos <=3D bulk_in->len); - len =3D MIN(bulk_in->len - bulk_in->pos, p->iov.size); + len =3D MIN(bulk_in->len - bulk_in->pos, usb_packet_size(p)); if (len) { usb_packet_copy(p, bulk_in->data + bulk_in->pos, len); } @@ -1314,12 +1314,12 @@ static void ccid_bulk_in_copy_to_guest(USBCCIDState= *s, USBPacket *p) if (len) { DPRINTF(s, D_MORE_INFO, "%s: %zd/%d req/act to guest (BULK_IN)\n", - __func__, p->iov.size, len); + __func__, usb_packet_size(p), len); } - if (len < p->iov.size) { + if (len < usb_packet_size(p)) { DPRINTF(s, 1, "%s: returning short (EREMOTEIO) %d < %zd\n", - __func__, len, p->iov.size); + __func__, len, usb_packet_size(p)); } } =20 @@ -1340,7 +1340,7 @@ static void ccid_handle_data(USBDevice *dev, USBPacke= t *p) break; case CCID_INT_IN_EP: if (s->notify_slot_change) { - if (p->iov.size < 2) { + if (usb_packet_size(p) < 2) { p->status =3D USB_RET_STALL; break; } @@ -1353,7 +1353,7 @@ static void ccid_handle_data(USBDevice *dev, USBPacke= t *p) DPRINTF(s, D_INFO, "handle_data: int_in: notify_slot_change %X, " "requested len %zd\n", - s->bmSlotICCState, p->iov.size); + s->bmSlotICCState, usb_packet_size(p)); } else { p->status =3D USB_RET_NAK; } --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861665; cv=none; d=zohomail.com; s=zohoarc; b=OtlFX3R9CrtsMvU3syGcm2KTsHCKHH0H0cYleDb+LK8xqOq/7cp5ddONo/SWbDX96Ab0RRcAMci2Uzb6fpLVs3ZFxhRGLHdBMyXSzb79ato1PjKeVDv0pldiku7vqqJ/V6HxEjhKpxblI9cZZRg9sG5EJEjmKhcp1lW7LfNWRWQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861665; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Y/oPf45UcMrdKaDQ6+RGXf9f/PrLAkuUHjEXeWLkNjs=; b=OpXqQaXadVFjOh8L1bdOUUU51bo836BgKtM3RkrWtmiOUZA+fo864hdOGZgOhX19T3UpPoS5wqLPoXKGE45NmxBT05nsqrqIKsCQf59VkWfSN+slTJ0ymv/q5gL+d2fTwAG5marvdt1bZfoxrB8oodqIzlh/Qhgx8lAFtMyfNRA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861665808964.3179858207803; Thu, 1 Oct 2026 06:34:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGst-0001BM-Sr; Thu, 01 Oct 2026 09:31:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGse-0000Ft-SD for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:25 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsc-0006S6-Kp for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:24 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-527-amKVIMC9N26wxdM_Ln-WOA-1; Thu, 01 Oct 2026 09:31:17 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E1F311828A86; Thu, 1 Oct 2026 13:31:12 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 238141956086; Thu, 1 Oct 2026 13:31:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861481; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Y/oPf45UcMrdKaDQ6+RGXf9f/PrLAkuUHjEXeWLkNjs=; b=Ohot6sV2RQI0FqkX/1wAMDaOxt6D1rOpbEvSZVfvaf1Jq/P+lKss18I9fzk29u2pTUst1c 11xXRUml5IcAcraasJrSjxQgH79QXMg96J8Pr+S8twcf94QcIynJLAby9uXPMlDacrotz6 cTAtzfZjE6T5BF2a8pnI+vI4vxvUJJY= X-MC-Unique: amKVIMC9N26wxdM_Ln-WOA-1 X-Mimecast-MFC-AGG-ID: amKVIMC9N26wxdM_Ln-WOA_1790861473 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:30:04 +0400 Subject: [GIT PULL 25/27] hw/usb/dev-smartcard-reader: advertise T=1 protocol support MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-25-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Zhao Liu X-Developer-Signature: v=1; a=openpgp-sha256; l=3701; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=uX9Ip/8PgNR6QRXszgmYx0rl0AfR271pYolhO3lO9y0=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBI3eiiogU4Xgdnpzsc4x9kjTGqcMi5b7Tgy A/rYrM3/xOJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSAAKCRDa6OEJdZac 5eegD/9udg4HpD4CuXYUNKDAB+WLTaBEkU+QrKHhHfT2uykoWaohlvaVqdbwEKJGpEQ9zDeLE0c 8Ndwjw+yT9Q1X1XG6GmKbo9t9v2rj5xlhZ2KuYgIilY3+k6W2NdMQm3uphzbhXrtFBAZytBF2eg /fZ1YIct8fNgjMdCS7wKKo/trEzycBp465tjXBOowjwxQqLNZWMejw/JOS5D+7Mu3Nk73ZNuCd/ SGjjnLCwmBAjRBCwqolNHAiuFZx8EdJBJWHsvT8KOhtZVNTbvIeoDizEA5f3CjvMTz43EoEUwEU cFDEJ9bjYWijA6GEv2kmhXHEGdjWGnF3xDoET5vdILQ3ATxBaDeOoIMK6qg37+IRqjLJIB/HAD5 OjH4FvflkBMGbEk0wcvvYCZoGkalDuaua0ZPdv/3xDUDsckd323rvbeLEdc9YKgphXf2hgVZBAM ngIuMQEtOdIGXse8aMz1lnPOJJXxUf0edwEzdGrHbAt8GiwVYroOvWm1NJHoRSgKuKn5pqSbPh8 KEwzNxMK03cLXejZUhdH3GQmdCMG1tEC0to1qPaTC0IQBt7qcCzZ4GK03UpUHENrKQKRUCeGFNd RovBptE/kJaKmwPCnlg/1rcsaprbhlg27xyEuKf9pQpSvQ7KeQbFZGyzdrW005M0o/c7/M6Ju1+ vfqxugMOKmU1bnw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861667849158500 The CCID descriptor only advertised T=3D0, but it actually handles t=3D1 since it shuttles framed blocks to the backend. libcacard advertized T=3D0 in the ATR, so it works fine. This allows passthrough cards to work at t=3D1 if they need to. Add a configurable property to also advertise T=3D1 in the dwProtocols field, enabled by default. Use the correct error code (7, ICC protocol not supported) instead of CMD_NOT_SUPPORTED when SetParameters receives an invalid protocol. Note: I only tested with libcacard emulation. Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/core/machine.c | 1 + hw/usb/dev-smartcard-reader.c | 10 +++++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/hw/core/machine.c b/hw/core/machine.c index a5a168d72521..d9ac4b419a36 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -59,6 +59,7 @@ GlobalProperty hw_compat_11_0[] =3D { { "migration", "switchover-ack-legacy", "on" }, { "usb-ccid", "x-accurate-message-length", "off" }, { "usb-ccid", "x-pin-support", "on" }, + { "usb-ccid", "x-t1-support", "off" }, { "usb-ccid", "x-migrate-pending-answers", "off" }, }; const size_t hw_compat_11_0_len =3D G_N_ELEMENTS(hw_compat_11_0); diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 8520a2dab216..99086befe0b8 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -169,6 +169,7 @@ enum { ERROR_CMD_SLOT_BUSY =3D -32, ERROR_BAD_DWLENGTH =3D 1, ERROR_SLOT_NOT_EXIST =3D 5, + ERROR_PROTOCOL_INVALID =3D 7, }; =20 /* 6.2.6 RDR_to_PC_SlotStatus definitions */ @@ -330,6 +331,7 @@ struct USBCCIDState { bool migrate_pending_answers; bool pending_answers_loaded; bool pin_support; + bool t1_support; }; =20 static uint32_t ccid_bulk_in_pending_num(USBCCIDState *s) @@ -368,6 +370,7 @@ static uint8_t qemu_ccid_descriptor[] =3D { */ 0x07, /* u8 bVoltageSupport; 01h - 5.0v, 02h - 3.0, 03 - 1.= 8 */ =20 +#define CCID_DESC_OFFSET_DW_PROTOCOLS 0x06 0x01, 0x00, /* u32 dwProtocols; RRRR PPPP. RRRR =3D 0000h.*/ 0x00, 0x00, /* PPPP: 0001h =3D Protocol T=3D0, 0002h =3D Protocol = T=3D1 */ /* u32 dwDefaultClock; in kHZ (0x0fa0 is 4 MHz) */ @@ -968,7 +971,7 @@ static void ccid_set_parameters(USBCCIDState *s, CCID_H= eader *recv) uint32_t protocol_num =3D ph->bProtocolNum & 3; =20 if (protocol_num !=3D 0 && protocol_num !=3D 1) { - ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED); + ccid_report_error_failed(s, ERROR_PROTOCOL_INVALID); return; } s->bProtocolNum =3D protocol_num; @@ -1546,6 +1549,9 @@ static void ccid_realize(USBDevice *dev, Error **errp) if (!s->pin_support) { qemu_ccid_descriptor[CCID_DESC_OFFSET_B_PIN_SUPPORT] =3D 0; } + if (s->t1_support) { + qemu_ccid_descriptor[CCID_DESC_OFFSET_DW_PROTOCOLS] |=3D 0x2; + } usb_desc_create_serial(dev); usb_desc_init(dev); qbus_init(&s->bus, sizeof(s->bus), TYPE_CCID_BUS, DEVICE(dev), NULL); @@ -1742,6 +1748,8 @@ static const Property ccid_properties[] =3D { accurate_message_length, true), DEFINE_PROP_BOOL("x-pin-support", USBCCIDState, pin_support, false), + DEFINE_PROP_BOOL("x-t1-support", USBCCIDState, + t1_support, true), DEFINE_PROP_BOOL("x-migrate-pending-answers", USBCCIDState, migrate_pending_answers, true), }; --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861688; cv=none; d=zohomail.com; s=zohoarc; b=N2AeSRy2cnGyfKoILaHbPMttdQ6MfFWUBUyKJsx/wgM4KSGi3qRd9ydZ52tv7ABs3OckOLwWqKiH969Rue62jP7Kjy7Zmo4owKHq+q2uvFwdTHwzNZwescrP/KxIgcqplQZb8XQTseOySZSyx51AaGkDYo+EFtOALWwncKYjPSg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861688; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ofML6BJ95Ba4YzYEQVrCMCG9cao+U7lAMJ/mDJt7Cqs=; b=equ7OPLtc8aUOeiR0GAp4uvdz3KSnv3mU8eY+IO3hr2HAvQb6F5C8OqCALJR4/W5DLCDfHWmOUHa9b/FShUfST6Qi9NTUj0D4t3D4zoLR9pZ/efCpyUXkLr9m4BawRMtpjId8TsDUtK9L+eVyxD9GUGmwArIUj9866MW+N2IwYg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861688414196.3164134595686; Thu, 1 Oct 2026 06:34:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGtl-0002Na-1F; Thu, 01 Oct 2026 09:32:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsf-0000G8-3J for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:25 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsd-0006SC-KS for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:24 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-550-cd20zX97NYKC1o47Zq3cSw-1; Thu, 01 Oct 2026 09:31:18 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 716A3195394D; Thu, 1 Oct 2026 13:31:16 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id A5F7D1956095; Thu, 1 Oct 2026 13:31:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861483; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ofML6BJ95Ba4YzYEQVrCMCG9cao+U7lAMJ/mDJt7Cqs=; b=dHpVsVVTHR5KbYNSWmBiFNAE8z06xvZR3xbWOKSfmaqFGuBdi6FMp/6fLeM87+CHchAgdk XepNT5XhQefoSmfWMvwndNEOYRON9fXt2DjR0WJ7DFSLCh4+QHkbeCtdt1uYo6sNDXPStT 5BCZtCRuo/bX+cCN7Z+cpvJBJRmrlHs= X-MC-Unique: cd20zX97NYKC1o47Zq3cSw-1 X-Mimecast-MFC-AGG-ID: cd20zX97NYKC1o47Zq3cSw_1790861476 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:30:05 +0400 Subject: [GIT PULL 26/27] hw/usb/dev-smartcard-reader: correct CCID_IccPowerOff MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-26-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=805; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=7RhYZdLE06FM7tYKFfMTkTMhWgTFc0CmbaCJDELrgqU=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBJVArRG2BtnZ2iJ/WKAQol+1HjcrgqNBx7t zz6oJMUVueJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSQAKCRDa6OEJdZac 5XpyEACYk1efv87x438mCRlzd9jh7baLzvL9eYqziBNEeS58SZMQF5b+Ey8lItUoUMuB47qGDxZ sNVfDosq9Ld5fQaYmxsBzPi/nJVXJWccBvg5LBKTGR24zjrEBpwTwiOaiwxyW25njWC8uuU7Wb1 m3DWTNqiiKnfZNQZzq9z9sGJspzMYE9fLgooQKjd4KgxiaRgvtwgWw8lSQ5AVaN5o7qV/UiCfWI AJH7mV18Oni51GuHKnAXweI1UCdiqd0fhSn3LCG7+mmiIvj9bvD5PzXwux39+DPJ2Hx4J8IL8M+ zvpemF/EykCVo+YUddFyId45yTZS9yWygDpdcjtf/CAMDx/RnGuF42TSeYyv5TWQ2PO6wym6Y8n PpKVoUlD1cxeBKn/QE2JXI+NLZ/KyYoRFVJWwqWJUqmCGspRp5ounUog+QAXphPBrYMmST54lh/ rgMg2cxDxkmGXib15oKQxI1o4F40u3pKpJnL8qbWx02AxfsPkE04ER3w0ULR/wZwDqKiZ6gVLht 3XqpGCmGNYLriyLEvC/G4rxhw/AGXDhp/kKblrncAGBXiyrxGmguq0VQ/U5UeYPrReknVNCVNfT gVSnqkkIvmVfzzVibYbR07+ErGIqbc3ofmla/fMOIBI969Iq3Tvnbd2kbabrslorGXvBGcHgYU6 GR1O7hBjD75lu8A== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 9 X-Spam_score: 0.9 X-Spam_bar: / X-Spam_report: (0.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861690014158501 The struct has 3 bytes reserved according to spec. Fortunately, it's not used yet. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau --- hw/usb/dev-smartcard-reader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 99086befe0b8..752571043ee6 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -264,7 +264,7 @@ typedef struct QEMU_PACKED CCID_IccPowerOn { =20 typedef struct QEMU_PACKED CCID_IccPowerOff { CCID_Header hdr; - uint16_t abRFU; + uint8_t abRFU[3]; } CCID_IccPowerOff; =20 typedef struct QEMU_PACKED CCID_SetParameters { --=20 2.56.0.rc0.29.g47ce80527c56 From nobody Sat Oct 24 00:33:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1790861528; cv=none; d=zohomail.com; s=zohoarc; b=e6k6VKjWHMXXJ3kB5ZRrJXjVBsz0qali+IEr0Wpawplu7TDKrYUJ5gulePUfrDORdJaHAU/Lg4MMrQiEFNRjFNSd+RgNrwdRCyw/AIDrE1fo0EeS9QMxHCaeDum6x/xkHlVdO0R5KDgDv8rR8veQDI82FqkGNSmTr3DlnSEUir8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790861528; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ZqIMFM17JRJH4GAHqZOi3jz6sMxriUkE8LYm7CrZ1w4=; b=nvcJ8GbGgjG12isJXcdvqfGr5ewJN1VhVFBg/cLsFTTcRFcSQDUZveoLb4TXHM/JfM61ZzoPtiVzIxQ6AO+QDMRV017d/ACMp//rnpsCnxHDdOMli7WrvS7Qy0XwJ5YwB1OlKsI5uYqdchf4hn2v21GIZ2TvOc/ruZGndwFmuoc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790861528255563.55993031581; Thu, 1 Oct 2026 06:32:08 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCGst-0001CL-Td; Thu, 01 Oct 2026 09:31:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGsg-0000KC-8e for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:26 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCGse-0006SO-JV for qemu-devel@nongnu.org; Thu, 01 Oct 2026 09:31:25 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-590-VEbavofhOEaSZrDRX3YHqA-1; Thu, 01 Oct 2026 09:31:20 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A45E918011F3; Thu, 1 Oct 2026 13:31:19 +0000 (UTC) Received: from localhost (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id DA0441956095; Thu, 1 Oct 2026 13:31:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790861484; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZqIMFM17JRJH4GAHqZOi3jz6sMxriUkE8LYm7CrZ1w4=; b=dN1mJ/9S4oDEeRM6B576FJ245eGY4jnnpeVE7JFgoJyZiNH7moJdQqEzzDIEhl3nRuYmKI fimmyB4ZZMB8T1FyheVnMP9kplEy1c4LnnXqhMsIPx9H38kv1XBgIykkYyS5+TXelF2PKN xp9omAR7C2/VG7OPXMrEQYp6DNiSUUk= X-MC-Unique: VEbavofhOEaSZrDRX3YHqA-1 X-Mimecast-MFC-AGG-ID: VEbavofhOEaSZrDRX3YHqA_1790861479 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Thu, 01 Oct 2026 17:30:06 +0400 Subject: [GIT PULL 27/27] hw/usb/ccid-card-emulated: free libcacard context MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261001-smartcard-fixes-v1-27-ebb5a40dd497@redhat.com> References: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> In-Reply-To: <20261001-smartcard-fixes-v1-0-ebb5a40dd497@redhat.com> To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org X-Developer-Signature: v=1; a=openpgp-sha256; l=939; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=DdjWdK7TYZ8eR88HZapaS5WSyEaD7cpPnolJ+mF4/4k=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqvmBJSy6hkLtjK0rRfeStUuJoJo11D2CiJn6YA lYp78613jGJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCar5gSQAKCRDa6OEJdZac 5QJqD/0Q84vS4mdVT8VY3OD/UMppS1JhoCprApigYJRbq9DAEf6cG9e/ny4nrUyX7wPeLf6aLVT e14cY2VwEaRKUUogxuLHNUQt4DD2S0P6hIjw8HmJjJ+omkyQIEs1rV0B43C1eHtKx7OEzgXJucO FF9LZcQN+qjRwE41Lbwt/qZlGzRMARbNiMgozL2g94uNC0r20fOLg3RsuQyn5txTbxZ4X7JnUZ8 Sbzr4aXpt15FupM5KguihG9PWwQgzJ6UukxTulCei9eWBPwIiG0aKRwGBIVlOHaVSkL+McsOOAJ tb7Z+n+5yxMgTtaaYI+VxECn1N221ztDk98EyhlqnDnjYyrLg6cq29cft9vL01jkyGC/9Os8G5f 1WNnokMOtsUevX0YVRVLXrTPWXPeyaS1CrOrv8h7ZNH2RVecBVhlvUkK+3vwoMJ/A+xaXwDfmh2 HphRk/lQSn6D2vEaipeys2aoOqVNk/4TLPDfO/6PfkFfEt3k7+2QobpfFNq2PcWea9/DDUF2cmN 3jklT+79UfRZalf5IPr3ynXgT+Pe6PyE6iqhukgDIxxlHwDOQAgQHSLqN+6+BZA37R4l9KRYFyh VyNTktHHc3MdcyRqyz8tLWRmdfWmHtVrRMs7Xp1Kko+RUgDacdJK7bCLgXf62a8Llrx90HmnTBG 8wFw+FND3g8+x3A== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.331, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1790861528776158501 libcacard uses a global context, but we can call finalize since vcard_emul_init() would have failed earlier if a second card context was used. This fixes libtss2-fapi leaks spotted by ASAN. Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 --- hw/usb/ccid-card-emulated.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c index 985f21997aa8..6c8eec39faa9 100644 --- a/hw/usb/ccid-card-emulated.c +++ b/hw/usb/ccid-card-emulated.c @@ -580,6 +580,8 @@ static void emulated_unrealize(CCIDCardState *base) qemu_mutex_destroy(&card->handle_apdu_mutex); qemu_mutex_destroy(&card->vreader_mutex); qemu_mutex_destroy(&card->event_list_mutex); + + vcard_emul_finalize(); } =20 static const Property emulated_card_properties[] =3D { --=20 2.56.0.rc0.29.g47ce80527c56