QEMU USB smartcard reader gets CVE fixes and xHCI repair

QEMU contributor Marc-André Lureau has posted a large cleanup of the emulated USB CCID smartcard reader that closes three security bugs, unblocks live migration, and restores correct operation under xHCI.

The device lets guests talk to smartcards through passthrough or libcacard. While addressing CVE-class flaws, Lureau also found correctness problems that had left the reader fragile in real deployments. The series was tested with pcscd on Linux and OpenSC on Windows.

Three fixes target out-of-bounds reads and an assertion failure in the bulk-in path and ATR parsing. One overflow involved a length truncation that could overrun a fixed bulk-in buffer; Lureau notes the length comes from the card backend rather than the guest, so it is not guest-exploitable, but still needed hardening against a buggy or compromised backend. Related changes reject oversized responses safely and validate interrupt transfer lengths.

Separately, short bulk-in completions were left queued whenever a chunk hit exactly 64 bytes. That is correct for UHCI-style one-packet requests that need a zero-length packet, but wrong when xHCI presents a larger combined transfer: the response sat forever waiting for a ZLP that never arrived, stalling later smartcard traffic. The device now releases an exact-64-byte reply when it is already short relative to the host request.

Migration was effectively broken with in-flight I/O. Pending answer queue indices were never saved, so responses could vanish across a migrate; the series blocks migration while queues are non-empty, migrates the missing state under a compatibility gate, and validates loaded fields on restore. Device reset now clears all I/O state.

Spec and robustness work rounds out the set: bulk-out lengths are decoded as little-endian, per-command length checks reject malformed messages, invalid slots get the mandated error, Secure/Escape/SetDataRate commands use the correct response types, PIN support is no longer advertised by default, and T=1 can be advertised for passthrough cards that need it.