From nobody Sun Apr 12 04:21:18 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=crudebyte.com ARC-Seal: i=1; a=rsa-sha256; t=1770978828; cv=none; d=zohomail.com; s=zohoarc; b=gMFz2wbhYAPyDMKxz2HmQxStdwC1tIwe47k2kO9JgG2LAWmqHYlUACRR4k8bWEMH0NudSp17vrEZwp39jZaX4Lyk/YnE9Gy1pYLW5ssFwqAI1gZvZ4aHMVVQc0Zi2yLqhpfCKfU6ijiQJzIIqyPei+X+Jsf24D1lqERuic7fuDQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1770978828; h=Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ChQcJ6bhf/IOl7AGzGV04RHDMwEkZgcdk7bnXDJBvhg=; b=FL39XRwN9uiIkr/4c2JgIVABtamvUauulRLO8gLC4UlWbxYdEhXIEanszfSC47yyOYwaQjSUed4TT3ygqsyehZdRKK9G713fRFRmYe8NzUloR8s+B32pdW6qSvWFQ+GCHUP9ednwfQUIBdlTIbbsVNdif4IYN9s0UxTlzKbRyNo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1770978828366227.20916643493194; Fri, 13 Feb 2026 02:33:48 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vqqUQ-0003xc-7o; Fri, 13 Feb 2026 05:33:34 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <433d91b2a7751d2df86337a655d321bbed2841db@kylie.crudebyte.com>) id 1vqqUM-0003w6-Vi for qemu-devel@nongnu.org; Fri, 13 Feb 2026 05:33:31 -0500 Received: from kylie.crudebyte.com ([5.189.157.229]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <433d91b2a7751d2df86337a655d321bbed2841db@kylie.crudebyte.com>) id 1vqqUK-0000v1-9z for qemu-devel@nongnu.org; Fri, 13 Feb 2026 05:33:30 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=crudebyte.com; s=kylie; h=Message-Id:Cc:To:Subject:Date:From:Content-Type: Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Content-ID: Content-Description; bh=ChQcJ6bhf/IOl7AGzGV04RHDMwEkZgcdk7bnXDJBvhg=; b=ct1g8 BRwF4sj4CXmyvatZK2tTSiBjGFd/ajcq+447kYJSj48Zmb+6mJJZTif8XPDI3Lc7eEUCaE1SBVxEc 8IBq4rbxuJ49tj9FecPWa4/5i0U98h+2PFP+5YzVrheWFXofNUtdMOI324p+vyCd/XxGLZq0ZV1Wc 6OFy+iGcBFDUxDYHMpDc771JiHBR7uFVePjebokQoH1cX2uLDG7ySAmsQSYXRwn9d9UlfAUeMnR6d aPSk4/MvD2oqFJyBt4V5q8Kxu168UNfwLcfiTivhOkZzwyFUtvr/H4NU8mOWxWLjYhYcvyXIMP3M5 DY2Pyz9FQMSznIsedpm6KdpmL0w0iGP5+wq7AZNHVMxCk2QXcxPBw7je6mdBDsHzu8k/Lnrjdveot Uv6ndLZCf58JssTQf8icXzCym5Ws3N95V0XDARpL4MaBm/CGWTK0emDH8jjYRhoxC1xkXFCCeLJ8d lbZBTMWJ+R8Ln8c8kJYW874uNmsmIZbiuIR+GC8/K4TXdVzHNPlBLCIwtlgJrj64+0+HTIFCO91Oz Zg44dL2kWDvQSsYrKsci5GYsgdWG227rvJZRo0Hq1oTx6p8MU+NTvNEODwBByrZcJ+tsTrLv7jHKN ECFti/RZ8ilIeghoxJuPg9DT67Ln201y4NkCDP6x5A43e8upRuCBiP7qyFcMio=; From: Christian Schoenebeck Date: Fri, 13 Feb 2026 10:56:05 +0100 Subject: [PATCH] hw/9pfs: fix heap-buffer-overflow in v9fs_complete_rename To: qemu-devel@nongnu.org Cc: Oliver Chang , Alexander Bulekov , Mauro Matteo Cascella , Greg Kurz Message-Id: Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=5.189.157.229; envelope-from=433d91b2a7751d2df86337a655d321bbed2841db@kylie.crudebyte.com; helo=kylie.crudebyte.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @crudebyte.com) X-ZM-MESSAGEID: 1770978829928154100 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Oliver Chang When `v9fs_complete_rename` is called with `newdirfid =3D=3D -1`, it attemp= ts to derive the directory name from `fidp->path.data` using `g_path_get_dirname`. This logic assumes that `fidp->path.data` always contains a null-terminated string representing a pathname. While this assumption holds for the 'local' backend, the 'synth' backend st= ores a `V9fsSynthNode *` pointer directly in the `V9fsPath.data` buffer. When us= ing 'synth', `g_path_get_dirname` treats this pointer as a string, often result= ing in a short string like ".". The subsequent call to `v9fs_co_name_to_path` invokes `synth_name_to_path`, which expects `dir_path.data` to contain a `V9fsSynthNode *`. It attempts to read 8 bytes (on 64-bit) from the buffer. If `g_path_get_dirname` returned a short string, this results in a heap-buffer-overflow read. Fix this by checking for the `V9FS_PATHNAME_FSCONTEXT` flag in the export flags. This flag indicates that the backend supports string-based pathnames= . If it is not set (as in the 'synth' backend), return `-EOPNOTSUPP` to prevent invalid memory access. Co-authored-by: CodeMender Fixes: https://issues.oss-fuzz.com/issues/477990727 --- hw/9pfs/9p.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 6fbe604ce8..546e70f75c 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3310,9 +3310,16 @@ static int coroutine_fn v9fs_complete_rename(V9fsPDU= *pdu, V9fsFidState *fidp, goto out; } } else { - char *dir_name =3D g_path_get_dirname(fidp->path.data); + char *dir_name; V9fsPath dir_path; =20 + if (!(s->ctx.export_flags & V9FS_PATHNAME_FSCONTEXT)) { + /* path renaming is only supported for path based fid */ + err =3D -EOPNOTSUPP; + goto out; + } + + dir_name =3D g_path_get_dirname(fidp->path.data); v9fs_path_init(&dir_path); v9fs_path_sprintf(&dir_path, "%s", dir_name); g_free(dir_name); --