From 796537311797d600c0c716d0c015531fc41abb92 Mon Sep 17 00:00:00 2001 From: Roger Pau Monne Date: Fri, 7 Aug 2026 11:03:48 +0200 Subject: [PATCH] x86/emul: cope with internal handlers returning X86EMUL_RETRY MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hvm_io_intercept() can return X86EMUL_RETRY, and as such it needs to be handled in the switch in hvmemul_do_io() to avoid triggering the BUG() from the default case. Reset the vCPU state to no in-flight IOREQ and return X86EMUL_RETRY so that the access is retried. This is XSA-510 / CVE-2026-79602. Reported-by: Jiqian Chen Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/emulate.c | 1 + 1 file changed, 1 insertion(+) diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index 2efb1d4f0823..c09ea002ec62 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -308,6 +308,7 @@ static int hvmemul_do_io( switch ( rc ) { case X86EMUL_OKAY: + case X86EMUL_RETRY: vio->req.state = STATE_IOREQ_NONE; break; case X86EMUL_UNHANDLEABLE: -- 2.53.0