From e350834c3514f1a95bc92d3669a179fbb4f2a394 Mon Sep 17 00:00:00 2001 From: Roger Pau Monne Date: Fri, 7 Aug 2026 11:03:48 +0200 Subject: [PATCH] x86/emul: cope with internal handlers returning X86EMUL_RETRY MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hvm_io_intercept() can return X86EMUL_RETRY, and as such it needs to be handled in the switch in hvmemul_do_io() to avoid triggering the BUG() from the default case. Reset the vCPU state to no in-flight IOREQ and return X86EMUL_RETRY so that the access is retried. This is XSA-510 / CVE-2026-79602. Reported-by: Jiqian Chen Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 62aff073266bd83fa2d675913d913134abd3c82b) --- xen/arch/x86/hvm/emulate.c | 1 + 1 file changed, 1 insertion(+) diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index 3a7976729b..41f2d0c7e1 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -308,6 +308,7 @@ static int hvmemul_do_io( switch ( rc ) { case X86EMUL_OKAY: + case X86EMUL_RETRY: vio->req.state = STATE_IOREQ_NONE; break; case X86EMUL_UNHANDLEABLE: