From nobody Tue Apr 7 21:27:35 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773257999; cv=none; d=zohomail.com; s=zohoarc; b=eaNBR3uIm9ntoW7UWsdJj/x5lFApfXDsQp3wRNqWQ1Vwlxxd8K4/TraTL0J56I1mqxF3QYZEwDHnRi2HUBmBCb3ha9xsWa9D9EkZLwbten2LnXx2ZTQ9YlQEkPr3gBCpbj63lT4jlA8odZJr5mJQM0Bb5foelaOjKAGwPGQW+vA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773257999; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=c66HibitO0lgXZ3nR0gl8Jz7+L8u8Mz7H24/HnfxCxM=; b=hqXVjq/1uOLhvai1jWunMheEGKGt7iwAvVK0yPA7CxsxUFUfPxjrAY32SUFGEm40zGAelyVb5OBSrqfSo3aDXt+ymoEkdJE/wdpysmw6zCUxC+WEPPVAm4T57t3o4/jNZK3xMA7W5DqXF7Qa3qG3WkSP1EJ0kfJoJ0mAcB6LlzQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773257999212782.1841433449724; Wed, 11 Mar 2026 12:39:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0PMu-0002sO-6m; Wed, 11 Mar 2026 15:37:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0PMY-00021F-83; Wed, 11 Mar 2026 15:37:02 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0PMU-0000Ll-BR; Wed, 11 Mar 2026 15:36:55 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 21AAF192101; Wed, 11 Mar 2026 22:34:28 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 6305237C466; Wed, 11 Mar 2026 22:35:06 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773257668; bh=BIze4T5aXJtgdZO5QZNHp5TBXi0hPbk13fyDU3GcPls=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=an3wEKbWLeNvHm0bipBw7aqpk1mZ+tPAQm9kqAKL29qrXLRFIbYf5SZAXy3nfbUU+ B7Dd1jo9W/zUpESBaXPhp/YX8HVe6YoEyRQWGlJGEZBgzpvkmaqWjh158pObMh135K rN8pFcAXQlpvtRL7lQ6zMHmebKVNAlKNpCuky1rEcOmsmWfuPODb3I8s53ol/u7jn8 /i6fFkGxdyY9J6SrotCMkGnzpiAKiZSDNEucXChCedE96ZQJCy55P1sZgkXNouaYKq ntKKP02ECREH7IF7Ht4Z3tGs8EZPNQEF/ynpr2AuLfnOAavWgusxIN+P82QZwHag0F 8XTSaxwa+L86Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Oliver Chang , Greg Kurz , Michael Tokarev Subject: [Stable-10.2.2 25/53] hw/9pfs: fix missing EOPNOTSUPP on Twstat and Trenameat for fs synth driver Date: Wed, 11 Mar 2026 22:34:18 +0300 Message-ID: <20260311193449.1096110-25-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773258001342158500 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Renaming files/dirs is only supported by path-based fs drivers. EOPNOTSUPP should be returned on any renaming attempt for not path-based fs drivers. This was already the case for 9p "Trename" request type. However for 9p request types "Trenameat" and "Twstat" this was yet missing. So fix this by checking in Twstat and Trenameat request handlers whether the fs driver in use is really path based, if not return EOPNOTSUPP and abort further handling of the request. This fixes a crash with the 9p "synth" fs driver which is not path-based. The crash happened because the synth driver stores and expects a raw V9fsSynthNode pointer instead of a C-string on V9fsPath.data. So the C-string delivered by 9p server to synth fs driver was incorrectly casted to a V9fsSynthNode pointer, eventually causing a segfault. Reported-by: Oliver Chang Fixes: https://issues.oss-fuzz.com/issues/477990727 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3298 Signed-off-by: Christian Schoenebeck Reviewed-by: Greg Kurz Link: https://lore.kernel.org/qemu-devel/E1vrbaP-000Gqb-B3@kylie.crudebyte.= com/ (cherry picked from commit b72d15f47cbd2fc93580f33fa86a7e23595a68dd) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 127e02a077..9062a064fb 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3516,6 +3516,12 @@ static void coroutine_fn v9fs_renameat(void *opaque) goto out_err; } =20 + /* if fs driver is not path based, return EOPNOTSUPP */ + if (!(s->ctx.export_flags & V9FS_PATHNAME_FSCONTEXT)) { + err =3D -EOPNOTSUPP; + goto out_err; + } + v9fs_path_write_lock(s); err =3D v9fs_complete_renameat(pdu, olddirfid, &old_name, newdirfid, &new_name); @@ -3606,6 +3612,11 @@ static void coroutine_fn v9fs_wstat(void *opaque) } } if (v9stat.name.size !=3D 0) { + /* if fs driver is not path based, return EOPNOTSUPP */ + if (!(s->ctx.export_flags & V9FS_PATHNAME_FSCONTEXT)) { + err =3D -EOPNOTSUPP; + goto out; + } v9fs_path_write_lock(s); err =3D v9fs_complete_rename(pdu, fidp, -1, &v9stat.name); v9fs_path_unlock(s); --=20 2.47.3