friedkiwi/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hw/9pfs: fix invalid union access by v9fs_co_fstat()

Browse Source 
The individual FID types (P9_FID_NONE, P9_FID_FILE, P9_FID_DIR, P9_FID_XATTR)
share union V9fsFidOpenState with FID-type specific fields. Accessing any of
the union fields must comply with the FID-type to avoid undefined behaviour
or information disclosure.

Fix this in v9fs_lock() and v9fs_getlock() by checking if FID has a valid
file descriptor before calling v9fs_co_fstat().

Fixes: 10b468bdc5 ("virtio-9p: Implement TXATTRCREATE")
Link: https://lore.kernel.org/qemu-devel/4b33cd1aaa2551efda220a6f651e3660d27f4746.1781621428.git.qemu_oss@crudebyte.com
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
This commit is contained in:
Christian Schoenebeck
2026-06-16 17:00:11 +02:00
parent 32cae47c33
commit c3aa2491cd
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
hw/9pfs/9p.c
View File

@@ -3908,6 +3908,10 @@ static void coroutine_fn v9fs_lock(void *opaque)
err = -ENOENT;
goto out_nofid;
}
if (!fid_has_valid_file_handle(pdu->s, fidp)) {
err = -EBADF;
goto out;
}
err = v9fs_co_fstat(pdu, fidp, &stbuf);
if (err < 0) {
goto out;
@@ -3953,6 +3957,10 @@ static void coroutine_fn v9fs_getlock(void *opaque)
err = -ENOENT;
goto out_nofid;
}
if (!fid_has_valid_file_handle(pdu->s, fidp)) {
err = -EBADF;
goto out;
}
err = v9fs_co_fstat(pdu, fidp, &stbuf);
if (err < 0) {
goto out;