[PATCH 00/27] CCID smartcard reader fixes

Hi,

While tackling some CVEs issues, I also found several correctness and
robustness improvements/fixes. The series:

- has 3 CVE fixes (OOB/assert)
- fixes xHCI compatibility
- some endianness fixes
- blocks & fixes migration
- better spec compliancy

Tested on Linux with pcscd and Windows with OpenSC.

Signed-off-by: Marc-André Lureau <[email protected]>
---
Marc-André Lureau (27):
      hw/usb/dev-smartcard-reader: validate interrupt transfer length
      hw/usb/dev-smartcard-reader: fix OOB read from pending bulk-in ring
      hw/usb/dev-smartcard-reader: fix assert on pending answers overflow
      hw/usb/dev-smartcard-reader: decode bulk-out length as little-endian
      hw/usb/dev-smartcard-reader: fix dwMaxCCIDMessageLength descriptor
      hw/usb/dev-smartcard-reader: fix OOB read in atr_get_protocol_num()
      hw/usb/dev-smartcard-reader: block migration with pending queues
      hw/usb/dev-smartcard-reader: drop needless state fields
      hw/usb/dev-smartcard-reader: validate migrated fields in post_load
      hw/usb/dev-smartcard-reader: reset all I/O state on device reset
      hw/usb/dev-smartcard-reader: apply backpressure to bulk-out
      hw/usb/dev-smartcard-reader: fix RDR_to_PC_Parameters dwLength
      hw/usb/dev-smartcard-reader: reject oversized responses safely
      hw/usb/dev-smartcard-reader: release short bulk-in responses with xHCI
      hw/usb/dev-smartcard-reader: drop current_bulk_in pointer
      hw/usb/dev-smartcard-reader: derive queue counts from start/end indices
      hw/usb/dev-smartcard-reader: fix pending queue migration
      hw/usb/dev-smartcard-reader: handle Secure, Escape and SetDataRate commands
      hw/usb/dev-smartcard-reader: reject commands for invalid slots
      hw/usb/dev-smartcard-reader: zero bChainParameter in DataBlock responses
      hw/usb/dev-smartcard-reader: report error on XfrBlock with no card
      hw/usb/dev-smartcard-reader: stop advertising PIN support
      hw/usb/dev-smartcard-reader: validate per-command dwLength
      hw/usb/dev-smartcard-reader: use usb_packet_size() accessor
      hw/usb/dev-smartcard-reader: advertise T=1 protocol support
      hw/usb/dev-smartcard-reader: correct CCID_IccPowerOff
      hw/usb/ccid-card-emulated: free libcacard context

 hw/core/machine.c             |   4 +
 hw/usb/ccid-card-emulated.c   |   2 +
 hw/usb/dev-smartcard-reader.c | 523 ++++++++++++++++++++++++++++++++++--------
 3 files changed, 428 insertions(+), 101 deletions(-)
---
base-commit: 3e3ccab106f879b1512f8e0d51a827dd4de30e22
change-id: 20260805-smartcard-fixes-1df707e447ab

Best regards,
--  
Marc-André Lureau <[email protected]>