From nobody Thu Oct 22 19:33:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1792665473; cv=none; d=zohomail.com; s=zohoarc; b=QAjRSO+3Jq1kZkmkfXsTys9sPct3n/mE/O00BySjsdlDy+J7U+oyge4CwcpkC/nF6tqnGdWCbzxGGgySeJ2Hl1auX0VbX0M/SfoDI68tpxFFwkjf1eBEnkfFbnguya1AkPrUjrevq2mEo4/ViuZIXI9MawXJAF9Ll9GYxu14+EQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792665473; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mApZOr2CweZ/S3eePcKqkjr3cKAXptRSFdPEcfe60NE=; b=b3clAKHMXDtl2/niKA2y+rAjUsW5nIF+V1Dkautjri04rQ49+iKjDJj9ozEVdvI+LMThi3sFoIvOyGOsD9JQYHCASWPI9oV7XRxrzijKx49wNiv9aq3jdbkv862Hpr3vwemJRFptZLYPg2EXGw3INeIwU7jIQJNmq5mhyWjYetA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792665473966269.1443872306868; Thu, 22 Oct 2026 03:37:53 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqA2-0003Vw-VU; Thu, 22 Oct 2026 06:36:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqA1-0003VT-FC for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:37 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJq9z-0007lK-QD for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:37 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-237-W9mPkbdWMx-lJDhajqTIWQ-1; Thu, 22 Oct 2026 06:36:32 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 3A6361955F21; Thu, 22 Oct 2026 10:36:31 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.48.5]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 081C530001B9; Thu, 22 Oct 2026 10:36:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792665394; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mApZOr2CweZ/S3eePcKqkjr3cKAXptRSFdPEcfe60NE=; b=VM4TYTutl6AZGZQrVecA2ZYDJvoXBe2PB2Wo+ZQKFCMip2bfjIWq8wv9bxWHTaIpN1bYpx mjyP8aYiUf0m8DsahRn1aJvmTz992ke5Ksma93F7ez9GTc5WuAk4hDH0qmAVRiJA9N6u3s C+qUdAHcNQFIgmKhdxa9uv58Umeu4lU= X-MC-Unique: W9mPkbdWMx-lJDhajqTIWQ-1 X-Mimecast-MFC-AGG-ID: W9mPkbdWMx-lJDhajqTIWQ_1792665391 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Tommaso Califano , Junjie Cao , Luigi Leonardi Subject: [PULL 01/11] hw/usb/dev-mtp: Fix assert crash on undersized BULK IN Date: Thu, 22 Oct 2026 12:36:12 +0200 Message-ID: <20261022103622.1151089-2-thuth@redhat.com> In-Reply-To: <20261022103622.1151089-1-thuth@redhat.com> References: <20261022103622.1151089-1-thuth@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 5 X-Spam_score: 0.5 X-Spam_bar: / X-Spam_report: (0.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1792665475434158500 Content-Type: text/plain; charset="utf-8" From: Tommaso Califano The EP_DATA_IN result path serializes the queued response as a 12 byte MTP container header followed by one 4 byte word per result argument (12 + 4 * argc bytes). The entry check at the top of the function only verifies that the guest-provided transfer buffer holds at least the 12 byte header. If the queued result carries arguments, e.g. RES_SESSION_ALREADY_OPEN which returns the existing session ID, the second usb_packet_copy() writes past the end of the guest-declared buffer and trips the p->actual_length + bytes <=3D iov->size assertion, aborting QEMU. A guest can control the transfer size freely, e.g. TBYTES in the qTD of an EHCI BULK IN. A device must not send more data than the initiator signaled it would accept. Stall the transfer instead, and keep the result queued so that a subsequent BULK IN with a sufficient buffer size delivers the full response. Fixes: 840a178c94db ("usb: mtp filesharing") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3386 Signed-off-by: Tommaso Califano Reviewed-by: Junjie Cao Reviewed-by: Luigi Leonardi Message-ID: <20261012140839.93559-1-tcalifano@redhat.com> Signed-off-by: Thomas Huth --- hw/usb/dev-mtp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index c2d36a73cf9..cbc2be3317f 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1905,6 +1905,13 @@ static void usb_mtp_handle_data(USBDevice *dev, USBP= acket *p) } else if (s->result !=3D NULL) { MTPControl *r =3D s->result; int length =3D sizeof(container) + r->argc * sizeof(uint32_t); + + if (p->iov.size < length) { + trace_usb_mtp_stall(s->dev.addr, + "packet too small to send response"); + p->status =3D USB_RET_STALL; + return; + } if (r->code =3D=3D RES_OK) { trace_usb_mtp_success(s->dev.addr, r->trans, (r->argc > 0) ? r->argv[0] : 0, --=20 2.56.0 From nobody Thu Oct 22 19:33:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1792665446; cv=none; d=zohomail.com; s=zohoarc; b=XjR55VM054ChZC545ysAEgd1pvumQcm+r2aBz9Tm/4zAo+bDNitpV90a9nJgazMXm/w6AjNkFhRSzlqrYjsSooOCV6b6q5tq/fXfxLr6PrvfGkukQu2bvtg1tE78++/O0IVF38kNIlnf4xEsufkjypiBdQbkekcOE0j7E3WZv8k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792665446; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=pux0hQpGS9B3kP/CPRGMWK7hx46SCUyi/4+fSolikcQ=; b=MOcRU0PEU3Kb4AzcwDZoTT96J8AuEYu8RZTV0OUMvIwNuj16IGlPxwIgMW0JVZgLEiYzLLqesAhNrzASCu2DH4Gcvs/b3RcY1DiceDjRb3PH7XSJ2xJzXuZdzZbMIGGXLVw+xrr73LjIOwzQr77qALJx0bYVLqAumKs3jGud3os= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792665446489174.77766997059484; Thu, 22 Oct 2026 03:37:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqA6-0003Xg-13; Thu, 22 Oct 2026 06:36:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqA4-0003X9-JR for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:40 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqA2-0007lg-M5 for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:40 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-680-W_G73-p6OOCzTtAuY3phYA-1; Thu, 22 Oct 2026 10:36:34 +0000 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 8C9E7195606D; Thu, 22 Oct 2026 10:36:33 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.48.5]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id BF9AD30000E7; Thu, 22 Oct 2026 10:36:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792665398; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pux0hQpGS9B3kP/CPRGMWK7hx46SCUyi/4+fSolikcQ=; b=dtcnotwYhSNvE350+VDVkhE3tzBnUbugMFeTOW/eDVsP02eVRh/GvfOWU6KX3CbZ2bYvA5 4qUY6p9V5w3XXJ9mBLfSHebyKQFrfBW6BpCgV75uk80jD5uptS5C/pEGcJEOjchpCOplFF N55+RZTpomgQCT4fN08gIsN3N8vx2Go= X-MC-Unique: W_G73-p6OOCzTtAuY3phYA-1 X-Mimecast-MFC-AGG-ID: W_G73-p6OOCzTtAuY3phYA_1792665393 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Peter Maydell , qemu-stable@nongnu.org Subject: [PULL 02/11] hw/usb/hcd-ohci: Fail iso packets sent to non-iso endpoints and vice-versa Date: Thu, 22 Oct 2026 12:36:13 +0200 Message-ID: <20261022103622.1151089-3-thuth@redhat.com> In-Reply-To: <20261022103622.1151089-1-thuth@redhat.com> References: <20261022103622.1151089-1-thuth@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 5 X-Spam_score: 0.5 X-Spam_bar: / X-Spam_report: (0.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1792665448907158500 Content-Type: text/plain; charset="utf-8" From: Peter Maydell The OHCI USB controller requires software to set up an Endpoint Descriptor data structure. This specifies (among other things) both an EndpointNumber telling the controller which USB endpoint to talk to, and a Format (F) bit which is 1 for Isochronous transfers and 0 for General transfers. The specification requires that software matches the F bit with the endpoint it's setting up the descriptor for, so that Control, Bulk and Interrupt endpoints use F=3D0, and Isochronous endpoints use F=3D1. It doesn't require the controller to check whether software gets this right. The spec isn't totally clear about what happens if software creates an ED with a mismatch, but I believe that the controller just trusts the F bit, and tries to talk to the endpoint with the wrong sequence of USB tokens (notably, isochronous transactions have no handshaking and the others do). This probably results in the transfer failing. In hcd-ehci.c we check for the "iso transfer to non-iso endpoint" and make it fail, but we don't do this in hcd-ohci.c. The result is that a guest that deliberately sets up this situation can cause us to hit the assertion added in commit 7b1eba96aeca, where the endpoint is not isochronous and returns USB_RET_ASYNC to an iso TD handling function that isn't prepared to deal with that. Add checks for both "iso transfer to non-iso endpoint" and "non-iso transfer to iso endpoint" and make those TDs fail rather than blindly sending them to the endpoint. Cc: qemu-stable@nongnu.org CVE: CVE-2026-7180 (together with 7b1eba96aecac32d186d4c16b81c7b4681186844) Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3729 Signed-off-by: Peter Maydell Message-ID: <20261001194756.3003085-1-peter.maydell@linaro.org> Signed-off-by: Thomas Huth --- hw/usb/hcd-ohci.c | 67 +++++++++++++++++++++++++++------------------ hw/usb/trace-events | 2 ++ 2 files changed, 42 insertions(+), 27 deletions(-) diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c index 5e5fe41f473..4d38150a845 100644 --- a/hw/usb/hcd-ohci.c +++ b/hw/usb/hcd-ohci.c @@ -579,7 +579,6 @@ static int ohci_service_iso_td(OHCIState *ohci, struct = ohci_ed *ed) int i; USBDevice *dev; USBEndpoint *ep; - USBPacket *pkt; QEMU_UNINITIALIZED uint8_t buf[8192]; bool int_req; struct ohci_iso_td iso_td; @@ -742,24 +741,31 @@ static int ohci_service_iso_td(OHCIState *ohci, struc= t ohci_ed *ed) return 1; } ep =3D usb_ep_get(dev, pid, OHCI_BM(ed->flags, ED_EN)); - pkt =3D g_new0(USBPacket, 1); - usb_packet_init(pkt); - int_req =3D relative_frame_number =3D=3D frame_count && - OHCI_BM(iso_td.flags, TD_DI) =3D=3D 0; - usb_packet_setup(pkt, pid, ep, 0, addr, false, int_req); - usb_packet_addbuf(pkt, buf, len); - usb_handle_packet(dev, pkt); - - /* The USB core guarantees to never defer ISO TDs. */ - assert(pkt->status !=3D USB_RET_ASYNC); - - if (pkt->status =3D=3D USB_RET_SUCCESS) { - ret =3D pkt->actual_length; + if (ep->type =3D=3D USB_ENDPOINT_XFER_ISOC) { + USBPacket *pkt =3D g_new0(USBPacket, 1); + + usb_packet_init(pkt); + int_req =3D relative_frame_number =3D=3D frame_count && + OHCI_BM(iso_td.flags, TD_DI) =3D=3D 0; + usb_packet_setup(pkt, pid, ep, 0, addr, false, int_req); + usb_packet_addbuf(pkt, buf, len); + usb_handle_packet(dev, pkt); + + /* The USB core guarantees to never defer ISO TDs. */ + assert(pkt->status !=3D USB_RET_ASYNC); + + if (pkt->status =3D=3D USB_RET_SUCCESS) { + ret =3D pkt->actual_length; + } else { + ret =3D pkt->status; + } + usb_packet_cleanup(pkt); + g_free(pkt); } else { - ret =3D pkt->status; + /* Attempted iso transfer to non-iso endpoint */ + ret =3D USB_RET_NAK; + trace_usb_ohci_iso_td_to_non_iso_endpoint(ep->nr); } - usb_packet_cleanup(pkt); - g_free(pkt); =20 trace_usb_ohci_iso_td_so(start_offset, end_offset, start_addr, end_add= r, str, len, ret); @@ -1022,16 +1028,23 @@ static int ohci_service_td(OHCIState *ohci, struct = ohci_ed *ed) trace_usb_ohci_td_too_many_pending(ep->nr); return 1; } - usb_packet_setup(&ohci->usb_packet, pid, ep, 0, addr, !flag_r, - OHCI_BM(td.flags, TD_DI) =3D=3D 0); - usb_packet_addbuf(&ohci->usb_packet, ohci->usb_buf, pktlen); - usb_handle_packet(dev, &ohci->usb_packet); - trace_usb_ohci_td_packet_status(ohci->usb_packet.status); - - if (ohci->usb_packet.status =3D=3D USB_RET_ASYNC) { - usb_device_flush_ep_queue(dev, ep); - ohci->async_td =3D addr; - return 1; + if (ep->type !=3D USB_ENDPOINT_XFER_ISOC) { + usb_packet_setup(&ohci->usb_packet, pid, ep, 0, addr, !flag_r, + OHCI_BM(td.flags, TD_DI) =3D=3D 0); + usb_packet_addbuf(&ohci->usb_packet, ohci->usb_buf, pktlen); + usb_handle_packet(dev, &ohci->usb_packet); + trace_usb_ohci_td_packet_status(ohci->usb_packet.status); + + if (ohci->usb_packet.status =3D=3D USB_RET_ASYNC) { + usb_device_flush_ep_queue(dev, ep); + ohci->async_td =3D addr; + return 1; + } + } else { + /* Attempted non-iso transfer to iso endpoint */ + ohci->usb_packet.status =3D USB_RET_NAK; + ohci->usb_packet.actual_length =3D 0; + trace_usb_ohci_td_to_iso_endpoint(ep->nr); } } if (ohci->usb_packet.status =3D=3D USB_RET_SUCCESS) { diff --git a/hw/usb/trace-events b/hw/usb/trace-events index 80ead23358f..15f2d27dbfd 100644 --- a/hw/usb/trace-events +++ b/hw/usb/trace-events @@ -23,6 +23,7 @@ usb_ohci_iso_td_bad_direction(int dir) "Bad direction %d" usb_ohci_iso_td_bad_bp_be(uint32_t bp, uint32_t be) "ISO_TD bp 0x%.8x be 0= x%.8x" usb_ohci_iso_td_bad_cc_not_accessed(uint32_t start, uint32_t next) "ISO_TD= cc !=3D not accessed 0x%.8x 0x%.8x" usb_ohci_iso_td_bad_cc_overrun(uint32_t start, uint32_t next) "ISO_TD star= t_offset=3D0x%.8x > next_offset=3D0x%.8x" +usb_ohci_iso_td_to_non_iso_endpoint(int ep) "ep=3D%d" usb_ohci_iso_td_so(uint32_t so, uint32_t eo, uint32_t s, uint32_t e, const= char *str, ssize_t len, int ret) "0x%.8x eo 0x%.8x sa 0x%.8x ea 0x%.8x dir= %s len %zu ret %d" usb_ohci_iso_td_data_overrun(int ret, ssize_t len) "DataOverrun %d > %zu" usb_ohci_iso_td_data_underrun(int ret) "DataUnderrun %d" @@ -55,6 +56,7 @@ usb_ohci_td_pkt_short(const char *dir, const char *buf) "= %s data: %s" usb_ohci_td_pkt_full(const char *dir, const char *buf) "%s data: %s" usb_ohci_td_too_many_pending(int ep) "ep=3D%d" usb_ohci_td_packet_status(int status) "status=3D%d" +usb_ohci_td_to_iso_endpoint(int ep) "ep=3D%d" usb_ohci_ed_read_error(uint32_t addr) "ED read error at 0x%x" usb_ohci_ed_pkt(uint32_t cur, int h, int c, uint32_t head, uint32_t tail, = uint32_t next) "ED @ 0x%.8x h=3D%u c=3D%u head=3D0x%.8x tailp=3D0x%.8x next= =3D0x%.8x" usb_ohci_ed_pkt_flags(uint32_t fa, uint32_t en, uint32_t d, int s, int k, = int f, uint32_t mps) "fa=3D%u en=3D%u d=3D%u s=3D%u k=3D%u f=3D%u mps=3D%u" --=20 2.56.0 From nobody Thu Oct 22 19:33:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1792665473; cv=none; d=zohomail.com; s=zohoarc; b=kn6Z1UXI7URQIPAo5kkJAX0978hsnyLYh6QxfSJVTuJlPoR7nNoeOtIET9p+rakwZkpHu0jijQr1skNvmNLgRq7iJrwc8bobXhKy01D3eXau/97wYdQRA+twjGCy/n394X7f6m/E0SqZ2cFmNjUTvHgkfrVL/SjLEazdCu5CwQ4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792665473; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=iQdWkiNvwi6k7U6kS9iTXsH3hG4M/CUpxKK93JxUqZs=; b=j2FwTGvJJJcamdP04+ZMVXZB8iYcyGFRSr16L7t+8oJ73aMIDFace742aVH02xkEbalaNQlXTZkKPzFg2U44U4wdfIuf5d3ImUd73JOu6I34KrXMwuiW8hbHrxBb/K7LdGgqU3jDR+o3Z+Y+aW9xvbFHI3TJPKyDmuLhOUhD9m0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792665473165344.17457315028855; Thu, 22 Oct 2026 03:37:53 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqAH-0003e0-AN; Thu, 22 Oct 2026 06:36:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAF-0003dF-61 for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:51 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAC-0007mp-HA for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:50 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-688-UkwNAJ2eMIS-Eo3bpedoZQ-1; Thu, 22 Oct 2026 10:36:36 +0000 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 906691800593; Thu, 22 Oct 2026 10:36:35 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.48.5]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 0B09430000E7; Thu, 22 Oct 2026 10:36:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792665408; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iQdWkiNvwi6k7U6kS9iTXsH3hG4M/CUpxKK93JxUqZs=; b=gpsUTRTxI2WoKMxMv6xMlbRfo5PaKKYq5Nv4npxV5KAdsu2vZJl1KG3oGjit7n+ARxN14h zHEc1Awv5dBWM6MAQO4/8+/LXfHC4NuhVL/gJBOiXh4ONm/YIwDpiTVc1WF8+JXKEe3ml6 HrHynZqbk89AGk3ykA+Z1X0c8dCn6G0= X-MC-Unique: UkwNAJ2eMIS-Eo3bpedoZQ-1 X-Mimecast-MFC-AGG-ID: UkwNAJ2eMIS-Eo3bpedoZQ_1792665395 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Junjie Cao Subject: [PULL 03/11] tests/qtest: Cover OHCI endpoint type mismatches Date: Thu, 22 Oct 2026 12:36:14 +0200 Message-ID: <20261022103622.1151089-4-thuth@redhat.com> In-Reply-To: <20261022103622.1151089-1-thuth@redhat.com> References: <20261022103622.1151089-1-thuth@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1792665475522158501 Content-Type: text/plain; charset="utf-8" From: Junjie Cao Check guest-visible state for OHCI transfers whose ED type disagrees with the endpoint type. Successful control and isochronous transfers exercise the same endpoint paths, ruling out inactive endpoints or an idle schedule. Signed-off-by: Junjie Cao Message-ID: <20261017062048.610930-1-junjie.cao@linux.dev> Signed-off-by: Thomas Huth --- tests/qtest/usb-hcd-ohci-test.c | 439 ++++++++++++++++++++++++++++++++ 1 file changed, 439 insertions(+) diff --git a/tests/qtest/usb-hcd-ohci-test.c b/tests/qtest/usb-hcd-ohci-tes= t.c index 19d760f3fb2..20225528ab2 100644 --- a/tests/qtest/usb-hcd-ohci-test.c +++ b/tests/qtest/usb-hcd-ohci-test.c @@ -8,6 +8,7 @@ */ =20 #include "qemu/osdep.h" +#include "qemu/bswap.h" #include "libqtest-single.h" #include "qemu/module.h" #include "libqos/usb.h" @@ -21,6 +22,422 @@ struct QOHCI_PCI { QPCIDevice dev; }; =20 +#define HC_CONTROL 0x04 +#define HC_COMMAND_STATUS 0x08 +#define HC_INTERRUPT_STATUS 0x0c +#define HC_HCCA 0x18 +#define HC_CONTROL_HEAD_ED 0x20 +#define HC_DONE_HEAD 0x30 +#define HC_FM_NUMBER 0x3c +#define HC_RH_PORT_STATUS 0x54 +#define HC_CONTROL_PLE (1 << 2) +#define HC_CONTROL_IE (1 << 3) +#define HC_CONTROL_CLE (1 << 4) +#define HC_CONTROL_STATE (3 << 6) +#define HC_OPERATIONAL (2 << 6) +#define HC_CLF (1 << 1) +#define HC_UE (1 << 4) +#define HC_WD (1 << 1) +#define PORT_CCS (1 << 0) +#define PORT_PES (1 << 1) +#define PORT_RESET (1 << 4) +#define TD_CC_NA (15U << 28) +#define TD_CC(flags) ((flags) >> 28) +#define TD_DP_SETUP (0 << 19) +#define TD_DP_OUT (1 << 19) +#define TD_DP_IN (2 << 19) +#define ED_DIR_OUT (1 << 11) +#define ED_DIR_IN (2 << 11) +#define ED_ISO (1 << 15) +#define ED_HEAD_HALT (1 << 0) +#define CC_NOERROR 0 +#define CC_STALL 4 +#define CC_NOTACCESSED 15 +#define FRAME_NS 1000000 + +typedef struct OHCITransferTest { + QTestState *qts; + QPCIDevice *pci; + QPCIBar bar; + uint64_t hcca; + uint64_t desc; + uint64_t data; +} OHCITransferTest; + +enum OHCITransferScenario { + OHCI_TEST_CONTROL, + OHCI_TEST_ISO, + OHCI_TEST_ISO_TO_CONTROL, + OHCI_TEST_GENERAL_TO_ISO, +}; + +#define CTRL_ED(t) ((t)->desc) +#define CTRL_SETUP_TD(t) ((t)->desc + 0x20) +#define CTRL_DATA_TD(t) ((t)->desc + 0x40) +#define CTRL_STATUS_TD(t) ((t)->desc + 0x60) +#define CTRL_TAIL_TD(t) ((t)->desc + 0x80) +#define PERIODIC_ED(t) ((t)->desc + 0x100) +#define PERIODIC_TD(t) ((t)->desc + 0x120) +#define PERIODIC_TAIL(t) ((t)->desc + 0x140) +#define SETUP_BUF(t) ((t)->data) +#define CTRL_BUF(t) ((t)->data + 0x100) +#define ISO_BUF(t) ((t)->data + 0x200) + +static uint32_t ohci_readl(OHCITransferTest *t, unsigned int reg) +{ + return qpci_io_readl(t->pci, t->bar, reg); +} + +static void ohci_writel(OHCITransferTest *t, unsigned int reg, uint32_t va= l) +{ + qpci_io_writel(t->pci, t->bar, reg, val); +} + +/* OHCI DMA structures are little-endian, regardless of the guest CPU. */ +static uint32_t ohci_mem_readl(OHCITransferTest *t, uint64_t addr) +{ + uint32_t value; + + qtest_memread(t->qts, addr, &value, sizeof(value)); + return le32_to_cpu(value); +} + +static uint16_t ohci_mem_readw(OHCITransferTest *t, uint64_t addr) +{ + uint16_t value; + + qtest_memread(t->qts, addr, &value, sizeof(value)); + return le16_to_cpu(value); +} + +static void ohci_mem_writel(OHCITransferTest *t, uint64_t addr, uint32_t v= alue) +{ + value =3D cpu_to_le32(value); + qtest_memwrite(t->qts, addr, &value, sizeof(value)); +} + +static void ohci_mem_writew(OHCITransferTest *t, uint64_t addr, uint16_t v= alue) +{ + value =3D cpu_to_le16(value); + qtest_memwrite(t->qts, addr, &value, sizeof(value)); +} + +static void ohci_write_td(OHCITransferTest *t, uint64_t addr, uint32_t fla= gs, + uint32_t cbp, uint32_t next, uint32_t be) +{ + ohci_mem_writel(t, addr, flags | TD_CC_NA); + ohci_mem_writel(t, addr + 4, cbp); + ohci_mem_writel(t, addr + 8, next); + ohci_mem_writel(t, addr + 12, be); +} + +static void ohci_write_ed(OHCITransferTest *t, uint64_t addr, uint32_t fla= gs, + uint32_t head, uint32_t tail) +{ + ohci_mem_writel(t, addr, flags); + ohci_mem_writel(t, addr + 4, tail); + ohci_mem_writel(t, addr + 8, head); + ohci_mem_writel(t, addr + 12, 0); +} + +static void ohci_step(OHCITransferTest *t) +{ + qtest_clock_step(t->qts, FRAME_NS); + g_assert_cmphex(ohci_readl(t, HC_INTERRUPT_STATUS) & HC_UE, =3D=3D, 0); +} + +static void ohci_drain_done(OHCITransferTest *t, const uint32_t *expected, + unsigned int expected_count) +{ + bool seen[3] =3D { false }; + unsigned int seen_count =3D 0; + unsigned int i; + + g_assert_cmpuint(expected_count, <=3D, G_N_ELEMENTS(seen)); + for (i =3D 0; i < 10; i++) { + uint32_t done =3D ohci_mem_readl(t, t->hcca + 0x84); + + if (expected_count =3D=3D 1 && (done & ~0xfU)) { + g_assert_cmphex(done & ~0xfU, =3D=3D, expected[0]); + } + + while (done & ~0xfU) { + uint32_t td =3D done & ~0xfU; + unsigned int j; + + for (j =3D 0; j < expected_count; j++) { + if (expected[j] =3D=3D td) { + break; + } + } + g_assert_cmpuint(j, <, expected_count); + g_assert_false(seen[j]); + seen[j] =3D true; + seen_count++; + done =3D ohci_mem_readl(t, td + 8); + } + + if (seen_count =3D=3D expected_count && + ohci_mem_readl(t, t->hcca + 0x84) =3D=3D 0 && + !(ohci_readl(t, HC_INTERRUPT_STATUS) & HC_WD) && + ohci_readl(t, HC_DONE_HEAD) =3D=3D 0) { + break; + } + + /* Consume this HCCA batch before allowing another writeback. */ + ohci_mem_writel(t, t->hcca + 0x84, 0); + ohci_writel(t, HC_INTERRUPT_STATUS, HC_WD); + ohci_step(t); + } + + g_assert_cmpuint(i, <, 10); + g_assert_cmpuint(seen_count, =3D=3D, expected_count); + g_assert_cmphex(ohci_mem_readl(t, t->hcca + 0x84), =3D=3D, 0); + g_assert_cmphex(ohci_readl(t, HC_DONE_HEAD), =3D=3D, 0); + g_assert_cmphex(ohci_readl(t, HC_INTERRUPT_STATUS) & HC_WD, =3D=3D, 0); +} + +static void ohci_transfer_init(OHCITransferTest *t, QOHCI_PCI *obj, + QGuestAllocator *alloc) +{ + unsigned int i; + + t->qts =3D global_qtest; + t->pci =3D &obj->dev; + qpci_device_enable(t->pci); + t->bar =3D qpci_iomap(t->pci, 0, NULL); + t->hcca =3D guest_alloc(alloc, 0x1000); + t->desc =3D guest_alloc(alloc, 0x1000); + t->data =3D guest_alloc(alloc, 0x1000); + qtest_memset(t->qts, t->hcca, 0, 0x1000); + qtest_memset(t->qts, t->desc, 0, 0x1000); + qtest_memset(t->qts, t->data, 0, 0x1000); + + g_assert_cmphex(ohci_readl(t, HC_RH_PORT_STATUS) & PORT_CCS, =3D=3D, + PORT_CCS); + ohci_writel(t, HC_RH_PORT_STATUS, PORT_RESET); + g_assert_cmphex(ohci_readl(t, HC_RH_PORT_STATUS) & PORT_PES, =3D=3D, + PORT_PES); + ohci_writel(t, HC_HCCA, t->hcca); + ohci_writel(t, HC_CONTROL_HEAD_ED, CTRL_ED(t)); + ohci_writel(t, HC_CONTROL, + HC_OPERATIONAL | HC_CONTROL_CLE | HC_CONTROL_PLE | + HC_CONTROL_IE); + g_assert_cmphex(ohci_readl(t, HC_CONTROL) & + (HC_CONTROL_STATE | HC_CONTROL_CLE | HC_CONTROL_PLE | + HC_CONTROL_IE), =3D=3D, + HC_OPERATIONAL | HC_CONTROL_CLE | HC_CONTROL_PLE | + HC_CONTROL_IE); + + for (i =3D 0; i < 32; i++) { + ohci_mem_writel(t, t->hcca + 4 * i, 0); + } +} + +static void ohci_control(OHCITransferTest *t, const uint8_t setup[8], + unsigned int data_len) +{ + uint64_t status =3D data_len ? CTRL_STATUS_TD(t) : CTRL_DATA_TD(t); + uint32_t done[3] =3D { CTRL_SETUP_TD(t), CTRL_DATA_TD(t), status }; + unsigned int done_count =3D data_len ? 3 : 2; + unsigned int i; + + qtest_memwrite(t->qts, SETUP_BUF(t), setup, 8); + qtest_memset(t->qts, CTRL_BUF(t), 0xa5, 64); + ohci_write_td(t, CTRL_SETUP_TD(t), TD_DP_SETUP, + SETUP_BUF(t), data_len ? CTRL_DATA_TD(t) : status, + SETUP_BUF(t) + 7); + if (data_len) { + ohci_write_td(t, CTRL_DATA_TD(t), TD_DP_IN | (3 << 24), + CTRL_BUF(t), status, CTRL_BUF(t) + data_len - 1); + } + ohci_write_td(t, status, (data_len ? TD_DP_OUT : TD_DP_IN) | (3 << 24), + 0, CTRL_TAIL_TD(t), 0); + ohci_write_ed(t, CTRL_ED(t), 64 << 16, CTRL_SETUP_TD(t), + CTRL_TAIL_TD(t)); + ohci_writel(t, HC_COMMAND_STATUS, HC_CLF); + + for (i =3D 0; i < 10; i++) { + ohci_step(t); + if ((ohci_mem_readl(t, CTRL_ED(t) + 8) & ~15U) =3D=3D + CTRL_TAIL_TD(t)) { + break; + } + } + g_assert_cmpuint(i, <, 10); + g_assert_cmphex(ohci_mem_readl(t, CTRL_ED(t) + 8) & ED_HEAD_HALT, + =3D=3D, 0); + g_assert_cmpuint(TD_CC(ohci_mem_readl(t, CTRL_SETUP_TD(t))), =3D=3D, + CC_NOERROR); + if (data_len) { + g_assert_cmpuint(TD_CC(ohci_mem_readl(t, CTRL_DATA_TD(t))), =3D=3D, + CC_NOERROR); + } + g_assert_cmpuint(TD_CC(ohci_mem_readl(t, status)), =3D=3D, CC_NOERROR); + /* Do not reuse a TD while its NextTD still links the done queue. */ + ohci_drain_done(t, done, done_count); +} + +static void ohci_get_device_descriptor(OHCITransferTest *t) +{ + const uint8_t setup[8] =3D { 0x80, 6, 0, 1, 0, 0, 18, 0 }; + uint8_t desc[18]; + + ohci_control(t, setup, sizeof(desc)); + qtest_memread(t->qts, CTRL_BUF(t), desc, sizeof(desc)); + g_assert_cmpuint(desc[0], =3D=3D, 18); + g_assert_cmpuint(desc[1], =3D=3D, 1); + g_assert_cmpuint(desc[7], =3D=3D, 64); + g_assert_cmpuint(desc[17], =3D=3D, 1); +} + +static void ohci_enable_audio_stream(OHCITransferTest *t) +{ + const uint8_t configure[8] =3D { 0, 9, 1, 0, 0, 0, 0, 0 }; + const uint8_t interface[8] =3D { 1, 11, 1, 0, 1, 0, 0, 0 }; + + ohci_control(t, configure, 0); + ohci_control(t, interface, 0); +} + +static void ohci_periodic(OHCITransferTest *t, bool iso, unsigned int ep, + bool in, unsigned int len) +{ + uint32_t flags =3D ep << 7 | len << 16 | + (in ? ED_DIR_IN : ED_DIR_OUT) | (iso ? ED_ISO : 0); + uint32_t td =3D PERIODIC_TD(t); + uint32_t buf =3D ISO_BUF(t); + unsigned int i; + + qtest_memset(t->qts, buf, 0, len); + if (iso) { + uint16_t frame =3D (ohci_readl(t, HC_FM_NUMBER) + 2) & 0xffff; + + ohci_mem_writel(t, td, TD_CC_NA | frame); + ohci_mem_writel(t, td + 4, buf); + ohci_mem_writel(t, td + 8, PERIODIC_TAIL(t)); + ohci_mem_writel(t, td + 12, buf + len - 1); + ohci_mem_writew(t, td + 16, 0xe000 | (buf & 0xfff)); + for (i =3D 1; i < 8; i++) { + ohci_mem_writew(t, td + 16 + 2 * i, 0xe000); + } + } else { + ohci_write_td(t, td, in ? TD_DP_IN : TD_DP_OUT, + buf, PERIODIC_TAIL(t), buf + len - 1); + } + ohci_write_ed(t, PERIODIC_ED(t), flags, td, PERIODIC_TAIL(t)); + for (i =3D 0; i < 32; i++) { + ohci_mem_writel(t, t->hcca + 4 * i, PERIODIC_ED(t)); + } +} + +static void ohci_run_valid_iso(OHCITransferTest *t) +{ + uint32_t expected[] =3D { PERIODIC_TD(t) }; + uint32_t frame; + uint32_t head; + uint32_t td_flags; + uint16_t psw; + unsigned int i; + + ohci_periodic(t, true, 1, false, 192); + frame =3D ohci_readl(t, HC_FM_NUMBER) & 0xffff; + for (i =3D 0; i < 5; i++) { + ohci_step(t); + } + g_assert_cmpuint((ohci_readl(t, HC_FM_NUMBER) - frame) & 0xffff, >=3D,= 5); + head =3D ohci_mem_readl(t, PERIODIC_ED(t) + 8); + td_flags =3D ohci_mem_readl(t, PERIODIC_TD(t)); + g_assert_cmphex(head & ~15U, =3D=3D, PERIODIC_TAIL(t)); + g_assert_cmpuint(TD_CC(td_flags), =3D=3D, CC_NOERROR); + psw =3D ohci_mem_readw(t, PERIODIC_TD(t) + 16); + g_assert_cmpuint(psw >> 12, =3D=3D, CC_NOERROR); + g_assert_cmpuint(psw & 0xfff, =3D=3D, 0); + ohci_drain_done(t, expected, G_N_ELEMENTS(expected)); +} + +static void test_ohci_transfer(void *obj, void *data, QGuestAllocator *all= oc) +{ + OHCITransferTest t; + unsigned int scenario =3D GPOINTER_TO_UINT(data); + uint32_t head, td_flags, psw, frame, done; + unsigned int i; + + ohci_transfer_init(&t, obj, alloc); + ohci_get_device_descriptor(&t); + if (scenario =3D=3D OHCI_TEST_CONTROL) { + qpci_iounmap(t.pci, t.bar); + guest_free(alloc, t.data); + guest_free(alloc, t.desc); + guest_free(alloc, t.hcca); + return; + } + if (scenario =3D=3D OHCI_TEST_ISO_TO_CONTROL) { + const uint8_t setup[8] =3D { 0x80, 6, 0, 1, 0, 0, 18, 0 }; + uint32_t expected[] =3D { CTRL_SETUP_TD(&t) }; + + qtest_memwrite(t.qts, SETUP_BUF(&t), setup, 8); + ohci_write_td(&t, CTRL_SETUP_TD(&t), TD_DP_SETUP, + SETUP_BUF(&t), CTRL_TAIL_TD(&t), SETUP_BUF(&t) + 7); + ohci_write_ed(&t, CTRL_ED(&t), 64 << 16, CTRL_SETUP_TD(&t), + CTRL_TAIL_TD(&t)); + ohci_writel(&t, HC_COMMAND_STATUS, HC_CLF); + ohci_step(&t); + g_assert_cmpuint(TD_CC(ohci_mem_readl(&t, CTRL_SETUP_TD(&t))), =3D= =3D, + CC_NOERROR); + ohci_drain_done(&t, expected, G_N_ELEMENTS(expected)); + ohci_periodic(&t, true, 0, true, 18); + } else { + ohci_enable_audio_stream(&t); + if (scenario =3D=3D OHCI_TEST_GENERAL_TO_ISO) { + /* Prove this configured endpoint and periodic schedule work. = */ + ohci_run_valid_iso(&t); + g_assert_cmphex(ohci_mem_readl(&t, t.hcca + 0x84), =3D=3D, 0); + g_assert_cmphex(ohci_readl(&t, HC_DONE_HEAD), =3D=3D, 0); + g_assert_cmphex(ohci_readl(&t, HC_INTERRUPT_STATUS) & HC_WD, = =3D=3D, + 0); + ohci_periodic(&t, false, 1, false, 192); + } else { + ohci_periodic(&t, true, 1, false, 192); + } + } + + frame =3D ohci_readl(&t, HC_FM_NUMBER) & 0xffff; + done =3D ohci_mem_readl(&t, t.hcca + 0x84); + for (i =3D 0; i < 5; i++) { + ohci_step(&t); + } + g_assert_cmpuint((ohci_readl(&t, HC_FM_NUMBER) - frame) & 0xffff, >=3D= , 5); + head =3D ohci_mem_readl(&t, PERIODIC_ED(&t) + 8); + td_flags =3D ohci_mem_readl(&t, PERIODIC_TD(&t)); + if (scenario =3D=3D OHCI_TEST_GENERAL_TO_ISO) { + g_assert_cmphex(ohci_mem_readl(&t, t.hcca + 0x84), =3D=3D, done); + g_assert_cmphex(ohci_readl(&t, HC_DONE_HEAD), =3D=3D, 0); + g_assert_cmphex(ohci_readl(&t, HC_INTERRUPT_STATUS) & HC_WD, =3D= =3D, 0); + g_assert_cmphex(head & ~15U, =3D=3D, PERIODIC_TD(&t)); + g_assert_cmphex(head & ED_HEAD_HALT, =3D=3D, 0); + g_assert_cmpuint(TD_CC(td_flags), =3D=3D, CC_NOTACCESSED); + g_assert_cmphex(ohci_mem_readl(&t, PERIODIC_TD(&t) + 4), =3D=3D, + ISO_BUF(&t)); + } else { + uint32_t expected[] =3D { PERIODIC_TD(&t) }; + + g_assert_cmphex(head & ~15U, =3D=3D, PERIODIC_TAIL(&t)); + /* The iTD CC does not report a packet-level STALL. */ + g_assert_cmpuint(TD_CC(td_flags), =3D=3D, CC_NOERROR); + psw =3D ohci_mem_readw(&t, PERIODIC_TD(&t) + 16); + g_assert_cmpuint(psw >> 12, =3D=3D, + scenario =3D=3D OHCI_TEST_ISO_TO_CONTROL ? CC_STA= LL : + CC_NOERROR); + g_assert_cmpuint(psw & 0xfff, =3D=3D, 0); + ohci_drain_done(&t, expected, G_N_ELEMENTS(expected)); + } + qpci_iounmap(t.pci, t.bar); + guest_free(alloc, t.data); + guest_free(alloc, t.desc); + guest_free(alloc, t.hcca); +} + static void test_ohci_hotplug(void *obj, void *data, QGuestAllocator *allo= c) { usb_test_hotplug(global_qtest, "ohci", "1", NULL); @@ -41,6 +458,7 @@ static void *ohci_pci_get_driver(void *obj, const char *= interface) static void *ohci_pci_create(void *pci_bus, QGuestAllocator *alloc, void *= addr) { QOHCI_PCI *ohci_pci =3D g_new0(QOHCI_PCI, 1); + qpci_device_init(&ohci_pci->dev, pci_bus, addr); ohci_pci->obj.get_driver =3D ohci_pci_get_driver; =20 return &ohci_pci->obj; @@ -62,7 +480,28 @@ libqos_init(ohci_pci_register_nodes); =20 static void register_ohci_pci_test(void) { + QOSGraphTestOptions opts =3D { + /* The descriptors and buffers use guest physical addresses for DM= A. */ + .edge.after_cmd_line =3D "-global pci-host-bridge.bypass-iommu=3Do= n " + "-audiodev none,id=3Dsnd0 " + "-device usb-audio,audiodev=3Dsnd0," + "bus=3Dohci.0,port=3D1", + }; + qos_add_test("ohci_pci-test-hotplug", "pci-ohci", test_ohci_hotplug, N= ULL); + if (!qtest_has_device("usb-audio")) { + return; + } + opts.arg =3D GUINT_TO_POINTER(OHCI_TEST_CONTROL); + qos_add_test("ohci_pci-control", "pci-ohci", test_ohci_transfer, &opts= ); + opts.arg =3D GUINT_TO_POINTER(OHCI_TEST_ISO); + qos_add_test("ohci_pci-iso", "pci-ohci", test_ohci_transfer, &opts); + opts.arg =3D GUINT_TO_POINTER(OHCI_TEST_ISO_TO_CONTROL); + qos_add_test("ohci_pci-iso-to-control", "pci-ohci", test_ohci_transfer, + &opts); + opts.arg =3D GUINT_TO_POINTER(OHCI_TEST_GENERAL_TO_ISO); + qos_add_test("ohci_pci-general-to-iso", "pci-ohci", test_ohci_transfer, + &opts); } =20 libqos_init(register_ohci_pci_test); --=20 2.56.0 From nobody Thu Oct 22 19:33:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1792665456; cv=none; d=zohomail.com; s=zohoarc; b=mUM3hD3eWF3VjGTNGSYdNiB/vdN10BF9RLY7BpEU0Ff9/q3BRFTDhKty5B/C1s4uQ4TAqQzZ88d+0n4rvR/ycpMdbZ/sJiV5OVL9SI301giK+NsKlSGfBoEVURysltKb/7EdH4/tvJLoxzGgYEVjCcW4J+UyVYOOQ6FpN64OJ+g= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792665456; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Y7z3CZkKhLnq6xQGi3khZxgMwph5AE3TQ1rD/9vur7Q=; b=Ay/HJ8EY1s4u4oPXinRyQweh/9oc3A+fnHpWbC/JA1Ydnb+0vIh4mu18g1LLGBsCZ3xaZZRwjxpp5UnFjOwWmnlsxlNzYpR7zbYG5WcNRQqJNNF/ggCYp0K3ZTcSfNaNtiXxORV4YwWpFUbTwYwW7pMBcEGq8yAoG8YQPZajVtM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792665456361120.58666499319793; Thu, 22 Oct 2026 03:37:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqAB-0003ZF-87; Thu, 22 Oct 2026 06:36:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqA8-0003Yc-Vc for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:45 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqA7-0007m8-7t for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:44 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-116-7LdTosYHO8W8CRuA71tk-A-1; Thu, 22 Oct 2026 06:36:39 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 266381955F6A; Thu, 22 Oct 2026 10:36:38 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.48.5]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 101B830000E7; Thu, 22 Oct 2026 10:36:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792665402; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Y7z3CZkKhLnq6xQGi3khZxgMwph5AE3TQ1rD/9vur7Q=; b=cen1o3ZuHEyMcxZxDa4bqi1DUbaR4J9h1ajAVn5irT7ShkzDenKHnk/zkKMyxR3f44goIf GVMG4g3h6oGhsI6XAYWoyHrTng627uAgKCdPxkBxZsEyFe3NwKDxDT5Lk1O2YqjjmH7Ggt DPQ2gaJ4BWOtLUcjWYSHXjLQpxwL+dw= X-MC-Unique: 7LdTosYHO8W8CRuA71tk-A-1 X-Mimecast-MFC-AGG-ID: 7LdTosYHO8W8CRuA71tk-A_1792665398 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Junjie Cao , qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PULL 04/11] usb-host: validate interface number before indexing altsetting Date: Thu, 22 Oct 2026 12:36:15 +0200 Message-ID: <20261022103622.1151089-5-thuth@redhat.com> In-Reply-To: <20261022103622.1151089-1-thuth@redhat.com> References: <20261022103622.1151089-1-thuth@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 5 X-Spam_score: 0.5 X-Spam_bar: / X-Spam_report: (0.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1792665457046158500 From: Junjie Cao usb_host_ep_update() indexes USBDevice.altsetting with the interface number supplied by the active configuration descriptor. A descriptor with bInterfaceNumber >=3D USB_MAX_INTERFACES reads past that array while the host device is opened. Skip such interfaces before the lookup. Record the descriptor's interface number on its endpoints as well. The loop index identifies the descriptor's position in the configuration, which need not equal bInterfaceNumber. Fixes: 0dbe4768b95e ("usb-host: use correct altsetting in usb_host_ep_updat= e") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3975 Cc: qemu-stable@nongnu.org Signed-off-by: Junjie Cao Reviewed-by: Marc-Andr=C3=A9 Lureau Message-ID: <20261005054626.131577-2-junjie.cao@linux.dev> Signed-off-by: Thomas Huth --- hw/usb/host-libusb.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c index 629505c6d35..fd4a16ee8ad 100644 --- a/hw/usb/host-libusb.c +++ b/hw/usb/host-libusb.c @@ -895,6 +895,11 @@ static void usb_host_ep_update(USBHostDevice *s) * then correct the alternate setting value if necessary. */ intf =3D &conf->interface[i].altsetting[0]; + if (intf->bInterfaceNumber >=3D USB_MAX_INTERFACES) { + trace_usb_host_parse_error(s->bus_num, s->addr, + "invalid interface number"); + continue; + } alt =3D udev->altsetting[intf->bInterfaceNumber]; =20 if (alt !=3D 0) { @@ -930,7 +935,7 @@ static void usb_host_ep_update(USBHostDevice *s) usb_ep_set_max_packet_size(udev, pid, ep, endp->wMaxPacketSize); usb_ep_set_type(udev, pid, ep, type); - usb_ep_set_ifnum(udev, pid, ep, i); + usb_ep_set_ifnum(udev, pid, ep, intf->bInterfaceNumber); usb_ep_set_halted(udev, pid, ep, 0); #ifdef HAVE_STREAMS if (type =3D=3D LIBUSB_TRANSFER_TYPE_BULK && --=20 2.56.0 From nobody Thu Oct 22 19:33:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1792665468; cv=none; d=zohomail.com; s=zohoarc; b=fGTlQGbNQgYRn6wrFZ45c3RorROO7mKIqsRU+UKWvTYf65o0s7jcKV6IomHpDEHRDoBxNJC7nngKJRZTw4vIOFE8fuNlkVv/siILufW0PgVFTMuI6lpfJtYVvZHMws/jBVu1UP+OBi+Q7X06o/9DRbDzYdUQQaKsgO6NqhBZlKc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792665468; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=LoCHlSQDLiTPE8LozK4UlEsDixMwrRTMtvcOvGREKss=; b=c3Wq/Xt01UUQiwpewH5khuKG0oYo+AjK7T6cmaKAdeRcVHipJr1D4CyKwwGazIUwbTABI9Ku6+NoSNLmGG753uuYdo18TbeKh2TS2UWB8JgLmuZTSV4uOSbOdIPRMVfCnWHWTdP9qG0xq7R9WIw95cKGlt97FgjohuW6kKfPApA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792665468496264.8495960192263; Thu, 22 Oct 2026 03:37:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqAB-0003ZR-C0; Thu, 22 Oct 2026 06:36:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqA9-0003Yo-AH for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:45 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqA7-0007mG-M2 for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:45 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-641-ZBBZ41YVMV6J1CwuB3Ct_w-1; Thu, 22 Oct 2026 10:36:41 +0000 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 53C8E18007F1; Thu, 22 Oct 2026 10:36:40 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.48.5]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 80E8C30000E7; Thu, 22 Oct 2026 10:36:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792665403; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=LoCHlSQDLiTPE8LozK4UlEsDixMwrRTMtvcOvGREKss=; b=ZDvEVov+qNtIcgGLkKw4FFLKDEyUPouUQ//8mGUreU+5iDFrW6vD02oJx1kAOl8vAbmRGB V/NKrY6Qr0buttm64F35YtyQZszltBxE46R8YSkTlgLVDk8BjPXxfRHZ3nWf2ltJHqaRHh kLJN2rd+DHppiMJf3Q0/iA1yDHRrtms= X-MC-Unique: ZBBZ41YVMV6J1CwuB3Ct_w-1 X-Mimecast-MFC-AGG-ID: ZBBZ41YVMV6J1CwuB3Ct_w_1792665400 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Junjie Cao , qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PULL 05/11] usb-host: free configuration descriptors on error paths Date: Thu, 22 Oct 2026 12:36:16 +0200 Message-ID: <20261022103622.1151089-6-thuth@redhat.com> In-Reply-To: <20261022103622.1151089-1-thuth@redhat.com> References: <20261022103622.1151089-1-thuth@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1792665469450158500 From: Junjie Cao usb_host_ep_update() returns before freeing the active configuration descriptor when an endpoint address is invalid or duplicated. usb_host_claim_interfaces() also returns without freeing it when fewer interfaces can be claimed than the descriptor declares. Each failure leaves one descriptor allocated. Fixes: 2b2325ff6491 ("use libusb for usb-host") Cc: qemu-stable@nongnu.org Signed-off-by: Junjie Cao Reviewed-by: Marc-Andr=C3=A9 Lureau Message-ID: <20261005054626.131577-3-junjie.cao@linux.dev> Signed-off-by: Thomas Huth --- hw/usb/host-libusb.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c index fd4a16ee8ad..cd566b91a37 100644 --- a/hw/usb/host-libusb.c +++ b/hw/usb/host-libusb.c @@ -68,6 +68,10 @@ typedef struct USBHostRequest USBHostRequest; typedef struct USBHostIsoXfer USBHostIsoXfer; typedef struct USBHostIsoRing USBHostIsoRing; =20 +typedef struct libusb_config_descriptor libusb_config_descriptor; +G_DEFINE_AUTOPTR_CLEANUP_FUNC(libusb_config_descriptor, + libusb_free_config_descriptor) + struct USBAutoFilter { uint32_t bus_num; uint32_t addr; @@ -869,7 +873,7 @@ static void usb_host_ep_update(USBHostDevice *s) [USB_ENDPOINT_XFER_INT] =3D "int", }; USBDevice *udev =3D USB_DEVICE(s); - struct libusb_config_descriptor *conf; + g_autoptr(libusb_config_descriptor) conf =3D NULL; const struct libusb_interface_descriptor *intf; const struct libusb_endpoint_descriptor *endp; #ifdef HAVE_STREAMS @@ -948,8 +952,6 @@ static void usb_host_ep_update(USBHostDevice *s) #endif } } - - libusb_free_config_descriptor(conf); } =20 static int usb_host_open(USBHostDevice *s, libusb_device *dev, int hostfd) @@ -1343,7 +1345,7 @@ static void usb_host_attach_kernel(USBHostDevice *s) static int usb_host_claim_interfaces(USBHostDevice *s, int configuration) { USBDevice *udev =3D USB_DEVICE(s); - struct libusb_config_descriptor *conf; + g_autoptr(libusb_config_descriptor) conf =3D NULL; int rc, i, claimed; =20 for (i =3D 0; i < USB_MAX_INTERFACES; i++) { @@ -1381,7 +1383,6 @@ static int usb_host_claim_interfaces(USBHostDevice *s= , int configuration) udev->ninterfaces =3D conf->bNumInterfaces; udev->configuration =3D configuration; =20 - libusb_free_config_descriptor(conf); return USB_RET_SUCCESS; } =20 --=20 2.56.0 From nobody Thu Oct 22 19:33:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1792665465; cv=none; d=zohomail.com; s=zohoarc; b=QzazdOpZ6D4AWJikT1nnOge8fyw/CbN89U/1O+EjVtyNjqe8C40gBt8C63FBTaBNGOqwQ4j2SJUfhXT1JBHtFQr0duaUEG+i9uGwDR5HZpYg/DCawSDK78dvGzmhMSLOW5vUVSJ0Qpg6mqkCPXwfZ65lUXNATb/Exp8Zlq3b+Y8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792665465; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qtipJlkkV1SGWhXJydF2ioHXbH2NpaSbxvIo9dufzCM=; b=MtIHyixUJjX7fs8BQlDn8bexk6COjL8suBF9i8CdGYlgtO58iEIHuy4fwVNeIdeDkiS8ba5aJ3ib9NhY11q5pJ2NA7T97ZdQfpX2TaTWM74fQUOJoFCvft3fCHyVNVUezq+m8Hg4JVtDg69eq0RHbrmXpmBwBZjBL+NzqtW5hqg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792665465114339.73385854587855; Thu, 22 Oct 2026 03:37:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqAG-0003dS-AB; Thu, 22 Oct 2026 06:36:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAD-0003ba-BS for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:49 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAB-0007mh-Kv for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:49 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-623-7lMkJM2pMOiCu8OuEzx9Sg-1; Thu, 22 Oct 2026 10:36:43 +0000 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 4DF9D1955F7F; Thu, 22 Oct 2026 10:36:42 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.48.5]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id DD0AB30000E7; Thu, 22 Oct 2026 10:36:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792665407; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qtipJlkkV1SGWhXJydF2ioHXbH2NpaSbxvIo9dufzCM=; b=FczoZ/UT+KlBhKlf6g9Wi3wUJiAlpwScWBhoO9vOTYU/LR4GszYee2coFLA/q37Vf2t0VQ OmPdBO/4Y3y9OLi6D6WgfYdaXNTLt0DMZxZVHai0BK1obI9UoK5eeQPJAmWlcJMN0bFzNY M1HP2s6NMGLPW1O8/ajWUcnFMmbbg/w= X-MC-Unique: 7lMkJM2pMOiCu8OuEzx9Sg-1 X-Mimecast-MFC-AGG-ID: 7lMkJM2pMOiCu8OuEzx9Sg_1792665402 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Junjie Cao Subject: [PULL 06/11] tests/qtest/usb-hcd-xhci: test interrupt pacing above 2^32 Date: Thu, 22 Oct 2026 12:36:17 +0200 Message-ID: <20261022103622.1151089-7-thuth@redhat.com> In-Reply-To: <20261022103622.1151089-1-thuth@redhat.com> References: <20261022103622.1151089-1-thuth@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 5 X-Spam_score: 0.5 X-Spam_bar: / X-Spam_report: (0.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1792665467438158500 Content-Type: text/plain; charset="utf-8" From: Junjie Cao Commit bfb82d57e7 ("hw/usb/hcd-xhci: fix interval alignment after MFINDEX passes 2^32") fixed both isoch and interrupt scheduling, but the regression test only covers the isoch path. Queue a keyboard report on an interrupt IN endpoint after stepping past 2^32 microframes. Check that the transfer remains pending until the next interval boundary, then completes with the expected report. With the old 32-bit mask, it completes as soon as the doorbell is rung. Link: https://lore.kernel.org/qemu-devel/52c9f935428f2cfc65e4dee7e37638fcb9= 65c6b2.1789968699.git.junjie.cao@intel.com/ Signed-off-by: Junjie Cao Message-ID: <20261004044803.9740-1-junjie.cao@linux.dev> Signed-off-by: Thomas Huth --- tests/qtest/usb-hcd-xhci-test.c | 46 +++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/tests/qtest/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-tes= t.c index 2e173af7506..add2290bffa 100644 --- a/tests/qtest/usb-hcd-xhci-test.c +++ b/tests/qtest/usb-hcd-xhci-test.c @@ -48,6 +48,7 @@ #define TRB_GET_CCODE(status) ((status) >> 24) #define TRB_GET_SLOT(control) ((control) >> 24) =20 +#define TR_NORMAL 1 #define TR_ISOCH 5 #define CR_ENABLE_SLOT 9 #define CR_ADDRESS_DEVICE 11 @@ -59,6 +60,7 @@ #define EP_TYPE_ISOCH_OUT 1 #define EP_TYPE_CONTROL 4 #define EP_TYPE_ISOCH_IN 5 +#define EP_TYPE_INTR_IN 7 =20 #define XHCI_RING_TRBS 64 #define XHCI_MICROFRAME_NS 125000 @@ -392,6 +394,48 @@ static void test_xhci_isoch_mfindex_32bit(void) xhci_test_end(&x); } =20 +static void test_xhci_intr_mfindex_32bit(void) +{ + const unsigned int interval =3D 6; + const uint8_t expected[] =3D { 0, 0, 4, 0, 0, 0, 0, 0 }; + uint8_t report[sizeof(expected)]; + uint32_t status, control; + uint64_t ring, data; + XHCITest x; + + if (!xhci_test_supported("usb-kbd")) { + return; + } + + xhci_test_start(&x, "-device usb-kbd"); + ring =3D xhci_configure_ep(&x, 3, EP_TYPE_INTR_IN, interval, 8); + data =3D xhci_alloc_page(&x); + + qtest_clock_step(x.qts, ((1ULL << 32) + 5) * XHCI_MICROFRAME_NS); + /* A ready report makes an early transfer observable. */ + qtest_qmp_assert_success(x.qts, + "{'execute': 'input-send-event', 'arguments': {'events': [" + "{'type': 'key', 'data': {'down': true, " + "'key': {'type': 'qcode', 'data': 'a'}}}]}}"); + + xhci_write_trb(&x, ring, data, sizeof(report), + TRB_TYPE(TR_NORMAL) | TRB_TR_IOC | TRB_C); + xhci_writel(&x, x.doorbell + 4 * x.slot, 3); + g_assert_false(xhci_next_event(&x, NULL, NULL)); + + qtest_clock_step(x.qts, + ((1U << interval) - 5) * XHCI_MICROFRAME_NS - 1); + g_assert_false(xhci_next_event(&x, NULL, NULL)); + qtest_clock_step(x.qts, 1); + g_assert_true(xhci_next_event(&x, &status, &control)); + g_assert_cmpuint(TRB_GET_TYPE(control), =3D=3D, ER_TRANSFER); + g_assert_cmpuint(TRB_GET_CCODE(status), =3D=3D, CC_SUCCESS); + qtest_memread(x.qts, data, report, sizeof(report)); + g_assert_cmpmem(report, sizeof(report), expected, sizeof(expected)); + + xhci_test_end(&x); +} + /* * The endpoint type in the endpoint context is whatever the guest says. T= ell * the controller that the interrupt endpoint of usb-kbd is isoch. The idle @@ -439,6 +483,8 @@ int main(int argc, char **argv) } qtest_add_func("/xhci/pci/isoch/mfindex-32bit", test_xhci_isoch_mfindex_32bit); + qtest_add_func("/xhci/pci/intr/mfindex-32bit", + test_xhci_intr_mfindex_32bit); qtest_add_func("/xhci/pci/isoch/ep-type-mismatch", test_xhci_isoch_ep_type_mismatch); =20 --=20 2.56.0 From nobody Thu Oct 22 19:33:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1792665493; cv=none; d=zohomail.com; s=zohoarc; b=C2zqIklWLRAEEz35LZLur6ameHtojvX3dxQp6cLeqB7p25vmfNHjEczBnCwW7d6BVQDF2VD7Anv2Legvtb8Th+EhDo/zFch/Ubs/OOPMcUzZc7aSRuI/FOYbRQ2li/a2cltWqMQp/jUjhW5bL5taRwu9kXJIXCLBIcah5CVjVP0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792665493; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ORcjhMpW22RpgZ9kIm64ECA3lO/OZ4kfUGGGdG/6eNI=; b=WvLYrjQKmF8SpmgS6JpEb5mnJG0YS1wP8nSIwaoklYW6k68LH6AVT+GuZPyDb+nd9xrE8rQF1yVejh+WZK+TGEScj2JjlvXc555AHZe5n8ojKXjy1V6ZqeaUMpTXlfbn4xA/Ak9YX9zXXV7NgZ//vUw11gXDUIf3E/D+i8nuI+A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792665493928852.4517981266488; Thu, 22 Oct 2026 03:38:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqAM-0003jL-K6; Thu, 22 Oct 2026 06:36:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAK-0003h7-K3 for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:56 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAI-0007nW-VR for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:56 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-607-aOct88rrPYGnQAp3RG7Phw-1; Thu, 22 Oct 2026 10:36:45 +0000 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 772931955E7A; Thu, 22 Oct 2026 10:36:44 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.48.5]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id BD84A30000E7; Thu, 22 Oct 2026 10:36:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792665414; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ORcjhMpW22RpgZ9kIm64ECA3lO/OZ4kfUGGGdG/6eNI=; b=i4AFQ+AXyEOby+qErtLs4aD3TVv3Coz8dsvFikSuQj7NYajguQmvWFKb+BjWcW3LGI6tUL qT/XB7fNwQHV7hhB85xycyGXRpaSvyPVYg3ybFgV3+NzfoRb2Rcu6K8d/QdapxuvWBwTz5 BAG8zw1HGBuXedfMuqntTUOP/JwGTI8= X-MC-Unique: aOct88rrPYGnQAp3RG7Phw-1 X-Mimecast-MFC-AGG-ID: aOct88rrPYGnQAp3RG7Phw_1792665404 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Haotian Jiang , qemu-stable@nongnu.org Subject: [PULL 07/11] usb-host: free request on libusb submit failure Date: Thu, 22 Oct 2026 12:36:18 +0200 Message-ID: <20261022103622.1151089-8-thuth@redhat.com> In-Reply-To: <20261022103622.1151089-1-thuth@redhat.com> References: <20261022103622.1151089-1-thuth@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 5 X-Spam_score: 0.5 X-Spam_bar: / X-Spam_report: (0.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1792665495794158500 Content-Type: text/plain; charset="utf-8" From: Haotian Jiang When libusb_submit_transfer() fails in usb_host_handle_control() or usb_host_handle_data(), the USBHostRequest already queued via usb_host_req_alloc() is never freed and its r->p pointer is never cleared. The caller (xHCI) may then complete and free the XHCITransfer that embeds the USBPacket r->p points to, leaving a dangling pointer in s->requests. A subsequent usb_host_abort_xfers() -> usb_host_req_abort() dereferences r->p->state on already-freed memory. Call usb_host_req_free(r) before returning, matching the existing pattern in the #else branch of the BULK_STREAMS case. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3595 Fixes: 2b2325ff6491 ("use libusb for usb-host") Reported-by: Haotian Jiang of Tencent Security (Yunding Lab) Signed-off-by: Haotian Jiang Cc: qemu-stable@nongnu.org --- hw/usb/host-libusb.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c index cd566b91a37..bddd50903ae 100644 --- a/hw/usb/host-libusb.c +++ b/hw/usb/host-libusb.c @@ -1526,6 +1526,13 @@ static void usb_host_handle_control(USBDevice *udev,= USBPacket *p, CONTROL_TIMEOUT); rc =3D libusb_submit_transfer(r->xfer); if (rc !=3D 0) { + /* + * Free the request to avoid a dangling r->p pointer. + * When libusb_submit_transfer fails the caller (xHCI) may + * free the XHCITransfer that holds the USBPacket r->p points + * to, so we must remove r from s->requests before returning. + */ + usb_host_req_free(r); p->status =3D USB_RET_NODEV; trace_usb_host_req_complete(s->bus_num, s->addr, p, p->status, p->actual_length); @@ -1620,6 +1627,13 @@ static void usb_host_handle_data(USBDevice *udev, US= BPacket *p) =20 rc =3D libusb_submit_transfer(r->xfer); if (rc !=3D 0) { + /* + * Free the request to avoid a dangling r->p pointer. + * When libusb_submit_transfer fails the caller (xHCI) may + * free the XHCITransfer that holds the USBPacket r->p points + * to, so we must remove r from s->requests before returning. + */ + usb_host_req_free(r); p->status =3D USB_RET_NODEV; trace_usb_host_req_complete(s->bus_num, s->addr, p, p->status, p->actual_length); --=20 2.56.0 From nobody Thu Oct 22 19:33:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1792665485; cv=none; d=zohomail.com; s=zohoarc; b=aEaiAa/3Dmse9cU0ADXFuWjzCvxyF0YNnyJ6pKU9IBCaggHoeadAI0zqnKtLOZqXFGVsIdHvg7Seod7zO381yv9AyUf+aZYYRu7Ltemkq305Ow3//AHDY2tLwAVf/NaTXLQQz1oS/uFv8ESpTOVDDtARVqJdSDDTJnb6+y9xjwo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792665485; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=r25DjAHGho+AEFthyQtdMaPP7Iap18O1a7YHfENK1Jk=; b=UbkpxchhiYO4JISOqW65/GR7+ty9bgN8RtzpkFqMUAerMcU7vTumBpXp0WRtZIowlUJS6HCQA1iQG7xVm8nkiS/3zmItn8YyutC6di/naYZ+ACnt+Fta/5EYE18qPjhtBd7Z8+ZCbQ0YcJT0/g+0GfN3ZugbwPy5HdZgftUo5rA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179266548524285.84910336618645; Thu, 22 Oct 2026 03:38:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqAO-0003lB-FU; Thu, 22 Oct 2026 06:37:00 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAM-0003jD-60 for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:58 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAJ-0007nl-Pa for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:57 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-49-kynUN4iLNe2E4LLf1hLnpA-1; Thu, 22 Oct 2026 06:36:47 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 72F12180058A; Thu, 22 Oct 2026 10:36:46 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.48.5]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id E750230001B9; Thu, 22 Oct 2026 10:36:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792665415; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=r25DjAHGho+AEFthyQtdMaPP7Iap18O1a7YHfENK1Jk=; b=B+AHGaMAQ2OLqnNh8eMcWyl3GJZiAA3BJ+s6J8GiBtT6gcocZ4O7W74XB89Ij9GP+dLrvE KP5xBtBGCZBq2wS7/KdZX3ns3geSnMNxtHj8i3txRU+0FM31WPbJTasrcZkcurG1pBLUV8 8K1gHFpC5PvEXoh5f35kNCbZVAIfWCo= X-MC-Unique: kynUN4iLNe2E4LLf1hLnpA-1 X-Mimecast-MFC-AGG-ID: kynUN4iLNe2E4LLf1hLnpA_1792665406 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Haotian Jiang , qemu-stable@nongnu.org Subject: [PULL 08/11] usb-host: delete bottom halves during unrealize Date: Thu, 22 Oct 2026 12:36:19 +0200 Message-ID: <20261022103622.1151089-9-thuth@redhat.com> In-Reply-To: <20261022103622.1151089-1-thuth@redhat.com> References: <20261022103622.1151089-1-thuth@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1792665485595158500 Content-Type: text/plain; charset="utf-8" From: Haotian Jiang usb_host_nodev() lazily creates s->bh_nodev and usb_host_post_load() lazily creates s->bh_postld, but usb_host_unrealize() never calls qemu_bh_delete() on either. If a BH is still pending when unrealize returns, its callback dereferences the freed USBHostDevice. Delete both BHs in usb_host_unrealize() after usb_host_close() returns. They must be deleted after close because usb_host_close() can process libusb callbacks that call usb_host_nodev(), which lazily recreates bh_nodev. Deleting it before close could therefore leave a recreated BH alive after unrealize. Buglink: https://gitlab.com/qemu-project/qemu/-/work_items/3595 Fixes: 95efb20c7148 ("usb-host: live migration support for the libusb versi= on") Reported-by: Haotian Jiang of Tencent Security (Yunding Lab) Signed-off-by: Haotian Jiang Cc: qemu-stable@nongnu.org --- hw/usb/host-libusb.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c index bddd50903ae..8f7ced95cfe 100644 --- a/hw/usb/host-libusb.c +++ b/hw/usb/host-libusb.c @@ -1275,6 +1275,21 @@ static void usb_host_unrealize(USBDevice *udev) qemu_remove_exit_notifier(&s->exit); QTAILQ_REMOVE(&hostdevs, s, next); usb_host_close(s); + /* + * Delete bottom halves after usb_host_close(). During close, + * libusb callbacks (usb_host_req_complete_ctrl/data) can call + * usb_host_nodev() which lazily creates bh_nodev. If we + * deleted them before close, a newly created BH would leak and + * fire after unrealize, dereferencing freed USBHostDevice. + */ + if (s->bh_nodev) { + qemu_bh_delete(s->bh_nodev); + s->bh_nodev =3D NULL; + } + if (s->bh_postld) { + qemu_bh_delete(s->bh_postld); + s->bh_postld =3D NULL; + } } =20 static void usb_host_cancel_packet(USBDevice *udev, USBPacket *p) --=20 2.56.0 From nobody Thu Oct 22 19:33:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1792665458; cv=none; d=zohomail.com; s=zohoarc; b=SqROqNoXNtHobQMgNwmPiGsWt27Lia7CV+3Wm8V3ox7q8Od+Qvn9xJ6VrnzmI9Ip9KZhfz8mzEGq/IoCI8lyYLwK/hNEceFD8SthAMwzdE1bGfGb+AK88FckZUfnU+6lC/6iu/pr0iM1Caze//4/cYR978OaMQzmIqO8Td53has= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792665458; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=t9lDxusGNEeXPuyYwIaEDlBTmKtiTw44r8B77swI4os=; b=nEZG8zcBIwPpOj2K9qfbKyHngoicXUiAHH9he+M3pmagKIXEND4US+zNpWE1om6SaEggLYiQhnadI5LtWeHgqpKLNZdauLArc5ki+JxSD7EOpBAjsfThFdPxWWPj2XV4eAMrOSJOwhZCnVs9MKs2psf2Euaua4Qc+aoiYKMjts0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792665458446843.7945066496717; Thu, 22 Oct 2026 03:37:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqAK-0003gG-08; Thu, 22 Oct 2026 06:36:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAH-0003eS-KJ for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:53 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAG-0007nH-3V for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:53 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-571-f7qsfLr1OVKS7DuAkh9eeA-1; Thu, 22 Oct 2026 10:36:49 +0000 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 046E71955F6F; Thu, 22 Oct 2026 10:36:49 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.48.5]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id E259930000E7; Thu, 22 Oct 2026 10:36:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792665411; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=t9lDxusGNEeXPuyYwIaEDlBTmKtiTw44r8B77swI4os=; b=YJ/Bfm5e5q+qdg/VwcuGA7CRBCWM5ODwHRi1ZfHVIn/8dzYtp79iDc9Q98WyKb0nXpX2el EnKjnOMmRDp4k0pI+MqjEcsWffzvI6qOnsIXRsYw5N4asRznQ+O9V3hCT0OX3YbyFOi9Rq Ys7Fl6ua+UAugnF/92lXDakn4/2mbjo= X-MC-Unique: f7qsfLr1OVKS7DuAkh9eeA-1 X-Mimecast-MFC-AGG-ID: f7qsfLr1OVKS7DuAkh9eeA_1792665409 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Tommaso Califano , Luigi Leonardi , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PULL 09/11] hw/usb/dev-mtp: Fix assert crash on short CMD_SEND_OBJECT Date: Thu, 22 Oct 2026 12:36:20 +0200 Message-ID: <20261022103622.1151089-10-thuth@redhat.com> In-Reply-To: <20261022103622.1151089-1-thuth@redhat.com> References: <20261022103622.1151089-1-thuth@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 5 X-Spam_score: 0.5 X-Spam_bar: / X-Spam_report: (0.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1792665459055158500 From: Tommaso Califano In usb_mtp_get_data() there is a guest-triggerable assertion that fires when a guest declares a large object size in CMD_SEND_OBJECT_INFO but sends fewer bytes in the subsequent CMD_SEND_OBJECT. The assertion compares the declared size against the actual bytes received. If the guest sends CMD_SEND_OBJECT_INFO with size=3D1000 and then CMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned final USB packet) the assertion fires, killing QEMU. To prevent that is sufficient to remove the assertion, because the case is handled by usb_mtp_write_data() which returns RES_INCOMPLETE_TRANSFER. Fixes: 3e096650a64d ("dev-mtp: Add support for > 4GB file transfers") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3993 Signed-off-by: Tommaso Califano Reviewed-by: Luigi Leonardi Reviewed-by: Marc-Andr=C3=A9 Lureau Message-ID: <20261008122936.45081-1-tcalifano@redhat.com> Signed-off-by: Thomas Huth --- hw/usb/dev-mtp.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index cbc2be3317f..9048cddaaba 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1813,9 +1813,6 @@ static void usb_mtp_get_data(MTPState *s, mtp_contain= er *container, d->offset +=3D dlen; d->data_offset +=3D dlen; if ((p->iov.size % 64) || !p->iov.size) { - assert((s->dataset.size =3D=3D 0xFFFFFFFF) || - (s->dataset.size =3D=3D d->offset)); - if (d->length =3D=3D MTP_WRITE_BUF_SZ) { d->write_status =3D WRITE_END; } else { --=20 2.56.0 From nobody Thu Oct 22 19:33:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1792665446; cv=none; d=zohomail.com; s=zohoarc; b=js/qAMMmiY7hhN+qc68+cYxntMneyIZlk9o5CJqfheelTZENqPhE3Kg0/GvLtKGQAZRe89rJjKoCSpaN21+V5T7UWkTR2MBS6iAV7G986ZkyjmH1CJDkvAden1ybKB42pJEE31pbkCqhCCmWT8ZPDdIJ2yDEfAAcwZX151tGDn0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792665446; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=upinaihgQEorXOt8lf32xXgKwhjgCT4vLcN/gUWyPAE=; b=Psmr0GDh5uHi4eH/TvAuRY7tLsvVXJ1+0jQ4mHYKefiruNn70LKe/Mfb+c+ylU+kRsYJGzjaMfy3CRnBl7x3+GU2CLLh7AiYAmfCR47oeUI0TwbsB01zWH3FEksOfMRQ4Vye7SAIBOY/BBPeXhh5snsMVY7KktqqN/EPWfBnMRo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792665446684922.8197404914648; Thu, 22 Oct 2026 03:37:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqAW-00040R-KX; Thu, 22 Oct 2026 06:37:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAU-0003zX-SE for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:37:06 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAT-0007pi-3d for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:37:06 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-593-GDw7BSoCMdm1ZSdoPXyhcw-1; Thu, 22 Oct 2026 10:36:51 +0000 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id ECD71195606B; Thu, 22 Oct 2026 10:36:50 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.48.5]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 725DD30000E7; Thu, 22 Oct 2026 10:36:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792665424; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=upinaihgQEorXOt8lf32xXgKwhjgCT4vLcN/gUWyPAE=; b=fr0Gq8f3n+k9Z/XfUT1Jab0+6pebU+T2zXKykpk4vA9IsebB9CSP55NtRIaYKIMEmjBFPS 5kov0IrSwYZUPmZm0DuikrVr6WrFUXxGPIPkSjyQ0VhPR20u8uX0QRAipu/VA88kFiOIaV ykh8RD+bFENEDqhW/Gy9UTc9873uVTI= X-MC-Unique: GDw7BSoCMdm1ZSdoPXyhcw-1 X-Mimecast-MFC-AGG-ID: GDw7BSoCMdm1ZSdoPXyhcw_1792665411 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Tommaso Califano , Luigi Leonardi Subject: [PULL 10/11] hw/usb/dev-mtp: Fix heap OOB read in usb_mtp_write_metadata() Date: Thu, 22 Oct 2026 12:36:21 +0200 Message-ID: <20261022103622.1151089-11-thuth@redhat.com> In-Reply-To: <20261022103622.1151089-1-thuth@redhat.com> References: <20261022103622.1151089-1-thuth@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 5 X-Spam_score: 0.5 X-Spam_bar: / X-Spam_report: (0.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1792665448867158500 Content-Type: text/plain; charset="utf-8" From: Tommaso Califano usb_mtp_write_metadata() computed the number of filename characters as filename_chars =3D dlen - offsetof(ObjectInfo, filename) where dlen is the amount of data copied by the last USB packet of the transfer, not the size of the ObjectInfo dataset. If the final packet has fewer than 53 bytes, filename_chars underflows to SIZE_MAX, causing utf16_to_str() to read far beyond the heap buffer, leaking QEMU host process memory. Use d->length instead: it is the size of the buffer holding the dataset, and usb_mtp_write_metadata() is only reached once all d->length bytes have been received. d->length is guest-controlled, so reject datasets too small to hold the fixed part of ObjectInfo before dereferencing it. The check is "<=3D" rather than "<" because a dataset of exactly offsetof(ObjectInfo,filename) bytes would yield an empty filename. Fixes: 90c1a74271ce ("usb-mtp: Limit filename to object information size") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3992 Signed-off-by: Tommaso Califano Reviewed-by: Luigi Leonardi Message-ID: <20261007143738.58509-1-tcalifano@redhat.com> Signed-off-by: Thomas Huth --- hw/usb/dev-mtp.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 9048cddaaba..8507e516ab1 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1696,7 +1696,7 @@ close: s->write_pending =3D false; } =20 -static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen) +static void usb_mtp_write_metadata(MTPState *s) { MTPData *d =3D s->data_out; ObjectInfo *dataset =3D (ObjectInfo *)d->data; @@ -1704,7 +1704,15 @@ static void usb_mtp_write_metadata(MTPState *s, uint= 64_t dlen) MTPObject *o; MTPObject *p =3D usb_mtp_object_lookup(s, s->dataset.parent_handle); uint32_t next_handle =3D s->next_handle; - size_t filename_chars =3D dlen - offsetof(ObjectInfo, filename); + size_t filename_chars; + + if (d->length <=3D offsetof(ObjectInfo, filename)) { + usb_mtp_queue_result(s, RES_INVALID_OBJECTINFO, d->trans, + 0, 0, 0, 0); + return; + } + + filename_chars =3D d->length - offsetof(ObjectInfo, filename); =20 /* * filename is utf-16. We're intentionally doing @@ -1801,7 +1809,7 @@ static void usb_mtp_get_data(MTPState *s, mtp_contain= er *container, if (d->data_offset =3D=3D d->length) { /* The operation might have already failed */ if (!s->result) { - usb_mtp_write_metadata(s, dlen); + usb_mtp_write_metadata(s); } usb_mtp_data_free(s->data_out); s->data_out =3D NULL; --=20 2.56.0 From nobody Thu Oct 22 19:33:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1792665434; cv=none; d=zohomail.com; s=zohoarc; b=gkTQc6BIfv2p4EULOeB9T2+xbHBN2EqjYkN5790SIWgJz+oflgv6LllOx01sPLH+b8ziDSbU6Ii7cRaJqzhIhSlyN+O31XMNe3wu0RaWCXjUktShxyCtlwxMGcV06KdGWECO6oMMyFXAv7s7uM/6fhNP6oDi3wTEs0zIPDTVUHw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792665434; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=VDbShbMKWVIUFIflYk6b3e2Dgp0hn9J4zxXnrBscNyk=; b=aIOah2mm1Ubhkgf0PxiOf7a5lDaj966maJUvIyqBmxg1uO/aPuVYnLuqXhOzVuOjoHCO0BRYHJ6jOD2QxRXyR/7pF4jwsEc7Ql7JuO1VtVmdhA/kTk2cJyRsypqBMIpPtVqAq/jP1K+E5wQB1Tb69vYYqfhmXDwZkokAN4IuNWw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792665434565950.6636744446658; Thu, 22 Oct 2026 03:37:14 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqAQ-0003mX-1b; Thu, 22 Oct 2026 06:37:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAN-0003kc-UT for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:37:00 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqAM-0007oO-3u for qemu-devel@nongnu.org; Thu, 22 Oct 2026 06:36:59 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-307-d5aYC6T5MPCZwJDr1QbwUA-1; Thu, 22 Oct 2026 06:36:53 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B2ED71955E7A; Thu, 22 Oct 2026 10:36:52 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.48.5]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 6A06830000E7; Thu, 22 Oct 2026 10:36:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792665417; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=VDbShbMKWVIUFIflYk6b3e2Dgp0hn9J4zxXnrBscNyk=; b=QmoaVHU/DDtDaOu9GVdDAfPXMsNPLMIbFcs2eWs8ug9KBfMWTXOeb8B5lfULD63eybwMvZ LE0hv50AREiQfGJ9+jJ9U7AjkDCY6Et1Nv0hq2fIwIFuuMmWtBqF05PMMT+JrOADocwYcb XgoZMFauFHRb/6XAZ52VD8TANMo/5CY= X-MC-Unique: d5aYC6T5MPCZwJDr1QbwUA-1 X-Mimecast-MFC-AGG-ID: d5aYC6T5MPCZwJDr1QbwUA_1792665412 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Nikhil Agrawal Subject: [PULL 11/11] hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code Date: Thu, 22 Oct 2026 12:36:22 +0200 Message-ID: <20261022103622.1151089-12-thuth@redhat.com> In-Reply-To: <20261022103622.1151089-1-thuth@redhat.com> References: <20261022103622.1151089-1-thuth@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 5 X-Spam_score: 0.5 X-Spam_bar: / X-Spam_report: (0.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1792665437222158500 Content-Type: text/plain; charset="utf-8" The XHCI controller's USB port and bus callbacks -- xhci_complete(), xhci_wakeup_endpoint(), xhci_attach(), xhci_detach(), and xhci_wakeup() -- can be invoked from outside any MMIO handler context. The device's mem_reentrancy_guard is therefore not engaged during this processing. A malicious guest can exploit this gap via MSI-X self-targeting: it programs the MSI-X vector's message address to point at the XHCI doorbell register array (both reside in the same BAR0 MemoryRegion). When any of these callbacks posts an event via xhci_event() -> xhci_intr_raise(), the resulting msix_notify() -> pci_msi_trigger() issues an address_space_stl_le() that writes doorbell 0, triggering xhci_process_commands() reentrantly. A CR_DISABLE_SLOT command planted on the command ring then frees XHCITransfer/XHCIEPContext objects that the outer call stack still references, causing a heap use-after-free. Fix this by setting engaged_in_io on the device's mem_reentrancy_guard around the processing in all five callbacks. The guard is set conditionally (only when not already engaged) because these callbacks may also be reached from within a guarded MMIO context. xhci_child_detach() is intentionally left unguarded: it only calls xhci_detach_slot() which passes report=3D0 to xhci_ep_nuke_xfers(), suppressing event generation, so it never reaches xhci_event(). Note: This is similar to the fixes done for CVE-2026-17588, see f91b0544fe ("Set reentrancy guard in timer functions"). CVE: CVE-2026-111819 Message-ID: <20261020114031.687929-1-thuth@redhat.com> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4625 Reported-by: Ken Hsu, Royce Lu, and Bo Qu of Palo Alto Networks Buglink: https://gitlab.com/qemu-project/qemu/-/work_items/4642 Reported-by: Nikhil Agrawal Signed-off-by: Thomas Huth --- hw/usb/hcd-xhci.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index 376bc00264d..5d7a77b8bcf 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -3251,49 +3251,73 @@ static const MemoryRegionOps xhci_doorbell_ops =3D { .endianness =3D DEVICE_LITTLE_ENDIAN, }; =20 +static bool xhci_engage_reentrancy_guard(XHCIState *xhci) +{ + bool prev_engaged =3D xhci->parent.mem_reentrancy_guard.engaged_in_io; + + xhci->parent.mem_reentrancy_guard.engaged_in_io =3D true; + return prev_engaged; +} + +static void xhci_restore_reentrancy_guard(XHCIState *xhci, bool engaged) +{ + xhci->parent.mem_reentrancy_guard.engaged_in_io =3D engaged; +} + static void xhci_attach(USBPort *usbport) { XHCIState *xhci =3D usbport->opaque; XHCIPort *port =3D xhci_lookup_port(xhci, usbport); + bool prev_engaged =3D xhci_engage_reentrancy_guard(xhci); =20 xhci_port_update(port, 0); + xhci_restore_reentrancy_guard(xhci, prev_engaged); } =20 static void xhci_detach(USBPort *usbport) { XHCIState *xhci =3D usbport->opaque; XHCIPort *port =3D xhci_lookup_port(xhci, usbport); + bool prev_engaged =3D xhci_engage_reentrancy_guard(xhci); =20 xhci_detach_slot(xhci, usbport); xhci_port_update(port, 1); + xhci_restore_reentrancy_guard(xhci, prev_engaged); } =20 static void xhci_wakeup(USBPort *usbport) { XHCIState *xhci =3D usbport->opaque; XHCIPort *port =3D xhci_lookup_port(xhci, usbport); + bool prev_engaged; =20 assert(port); if (get_field(port->portsc, PORTSC_PLS) !=3D PLS_U3) { return; } + prev_engaged =3D xhci_engage_reentrancy_guard(xhci); set_field(&port->portsc, PLS_RESUME, PORTSC_PLS); xhci_port_notify(port, PORTSC_PLC); + xhci_restore_reentrancy_guard(xhci, prev_engaged); } =20 static void xhci_complete(USBPort *port, USBPacket *packet) { XHCITransfer *xfer =3D container_of(packet, XHCITransfer, packet); + XHCIState *xhci =3D xfer->epctx->xhci; + bool prev_engaged; =20 if (packet->status =3D=3D USB_RET_REMOVE_FROM_QUEUE) { xhci_ep_nuke_one_xfer(xfer, 0); return; } + prev_engaged =3D xhci_engage_reentrancy_guard(xhci); xhci_try_complete_packet(xfer); xhci_kick_epctx(xfer->epctx, xfer->streamid); if (xfer->complete) { xhci_ep_free_xfer(xfer); } + xhci_restore_reentrancy_guard(xhci, prev_engaged); } =20 static void xhci_child_detach(USBPort *uport, USBDevice *child) @@ -3345,6 +3369,7 @@ static void xhci_wakeup_endpoint(USBBus *bus, USBEndp= oint *ep, { XHCIState *xhci =3D container_of(bus, XHCIState, bus); int slotid; + bool prev_engaged; =20 DPRINTF("%s\n", __func__); slotid =3D ep->dev->addr; @@ -3353,7 +3378,9 @@ static void xhci_wakeup_endpoint(USBBus *bus, USBEndp= oint *ep, DPRINTF("%s: oops, no slot for dev %d\n", __func__, ep->dev->addr); return; } + prev_engaged =3D xhci_engage_reentrancy_guard(xhci); xhci_kick_ep(xhci, slotid, xhci_find_epid(ep), stream); + xhci_restore_reentrancy_guard(xhci, prev_engaged); } =20 static USBBusOps xhci_bus_ops =3D { --=20 2.56.0