From nobody Sun Jul 26 13:26:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=crudebyte.com ARC-Seal: i=1; a=rsa-sha256; t=1781624887; cv=none; d=zohomail.com; s=zohoarc; b=BrGpmfvJk2ZXRLAEbZEDY50Ga9/cOVjcs6uVa6zhjI6JVg73whuXoih9xpXFQfHtCjuTXKw+Iqc+g9u7+YYZbQv1Wt47I4bLjvC8QMCk3jqAxjbkDCZwLHqbAySCD+k6itxhCgfe+5HxxD5VaPn/WN6QYtgKiqBmz7AgyeorWBc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1781624887; h=Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=7NyJ2XsVvajSIhIIvEmJyLqzswgkwsSYrVdjDPRCdX8=; b=b/vHcZTv2fH4sDGYK9W7gtuwhkorbUO92uy08OeIxUiDtT6LHjpnC8dLKckmAvy61Tb77/wsJdnPspQHf1SIBpFCNZIYOl4GBsPfATe7hrtJQ78bZ1sIrhpstldUDseXGjUzv43AnEf4pe/EaWC9T4OulcppIs+6mPFEXuu7+VQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178162488734210.320212282224702; Tue, 16 Jun 2026 08:48:07 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wZW0M-000766-DG; Tue, 16 Jun 2026 11:47:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wZW0L-00075t-EH; Tue, 16 Jun 2026 11:47:09 -0400 Received: from kylie.crudebyte.com ([5.189.157.229]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wZW0K-0000CM-3Y; Tue, 16 Jun 2026 11:47:09 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=crudebyte.com; s=kylie; h=Cc:To:Subject:Date:From:References:In-Reply-To: Message-ID:Content-Type:Content-Transfer-Encoding:MIME-Version:Content-ID: Content-Description; bh=7NyJ2XsVvajSIhIIvEmJyLqzswgkwsSYrVdjDPRCdX8=; b=Y4kQq hVuP+t2dfpLZ3R43vVyVdWQE/a1NY88V/iBuRhyuwlPngOaIz1TjL9OFpedusS7XFNFjSb8H/Hcvw SoV5Jn1K2RKfF/+XlcTiSC6YLxOzaBHfFvqV/lKV9VQ98JWOCF6g0sXFeWxbTcy+ZkzddQ8wmurew Djcq3gH9uZnjX/8my4KMFqhk5zsrYwGDDa8Oc52lT7iga3tdFeLhb5FfZ6XAjEUAea8LsZnm7S7RT 38RT/BrQKtpDcA8UlA70X4rSxGwn0cSAg3g3J/NmZdSNDZXkST9dFhE9kNsuLsAM/Y5s/sOui1cBe 66E2McsIeK9gxkQOAFKz5lKGdgBsPpeC5aYQWrywJIMaIi1OvHnhIpZvpVuRoODIrQlcP3r7EOexC SKHA5IqyDx/U18rcHP3SExNZAWYv8bw4ulReL54iLycwsBkmL136ldG2/THAY3KnkTwPv4RDTMlb1 kTN5mnWS+qTkW9TcHc4ghWGn6/SGpoDCb4dwjxy00qORndmUbkNUzhs7Ctte5wNEGl6/cfZ+jOG1w Yz+twlGOpFrfF9TTOYmtvS9JItQvBioKWDw2j4db42Qn3XurwJkw54Sk373fogKp4vOqg3Jk/ehaq 700jfItOQMBkfLShwVKA1JfMcjaGnU28LdxmT13rDmXXmD5uAZ1a0UNowJR+s8=; Message-ID: In-Reply-To: References: From: Christian Schoenebeck Date: Tue, 16 Jun 2026 17:00:11 +0200 Subject: [PATCH 1/3] hw/9pfs: fix invalid union access by v9fs_co_fsync() To: qemu-devel@nongnu.org, qemu-stable@nongnu.org Cc: Greg Kurz , Feifan Qian Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=5.189.157.229; envelope-from=b583e29d5a0776e41263732c93ac9f0da0a6016d@kylie.crudebyte.com; helo=kylie.crudebyte.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @crudebyte.com) X-ZM-MESSAGEID: 1781624889624158500 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The individual FID types (P9_FID_NONE, P9_FID_FILE, P9_FID_DIR, P9_FID_XATT= R) share union V9fsFidOpenState with FID-type specific fields. Accessing any of the union fields must comply with the FID-type to avoid undefined behaviour or information disclosure. Fix this in v9fs_fsync() and v9fs_wstat() by checking if FID has a valid fi= le descriptor before calling v9fs_co_fsync(). Fixes: 10b468bdc533 ("virtio-9p: Implement TXATTRCREATE") Reported-by: Feifan Qian Signed-off-by: Christian Schoenebeck --- hw/9pfs/9p.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index b4314d2549..6dd6a57e7a 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -2247,10 +2247,15 @@ static void coroutine_fn v9fs_fsync(void *opaque) err =3D -ENOENT; goto out_nofid; } + if (!fid_has_valid_file_handle(pdu->s, fidp)) { + err =3D -EBADF; + goto out; + } err =3D v9fs_co_fsync(pdu, fidp, datasync); if (!err) { err =3D offset; } +out: put_fid(pdu, fidp); out_nofid: pdu_complete(pdu, err); @@ -3584,6 +3589,10 @@ static void coroutine_fn v9fs_wstat(void *opaque) } /* do we need to sync the file? */ if (donttouch_stat(&v9stat)) { + if (!fid_has_valid_file_handle(s, fidp)) { + err =3D -EBADF; + goto out; + } err =3D v9fs_co_fsync(pdu, fidp, 0); goto out; } --=20 2.47.3 From nobody Sun Jul 26 13:26:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=crudebyte.com ARC-Seal: i=1; a=rsa-sha256; t=1781624885; cv=none; d=zohomail.com; s=zohoarc; b=A9hD+jsyCCVgKvB58qVdUuh41zeqpuwpJqX0wmYD91Hs/TEW9VqvzAy5VulOQniwfeW8GX4LdV7NPNRZaG3bY7Yj2VkT+oniepDGf0ZF4dg0OLAY2I4pZKJf8q/WuOPKztCpMRlvmfroaAT5XSEjaPRdvNbq9vaglmquFyP+6m0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1781624885; h=Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=FJnPQEyZdoiQuQZJb2PXLEBll9rUFdPWbbpBDzmHekw=; b=JpwcYmPKU92kPojpCeMJe1HYTqfr5ZgN96qOOaPY1odJi7UUpgXnhtY/2ZW8ZFKufy0YF7S0q/PiqK9yyGZwyMvjr6tEUary6uwlGqhKmmT+4t4c6a2U01TUjKiAdPxHxsuldLZ7e1mJnB+wbr+1h4XObsgQUmY5U81kkJ0fTl8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1781624885527492.91981701926227; Tue, 16 Jun 2026 08:48:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wZW0Q-00077B-8b; Tue, 16 Jun 2026 11:47:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <4b33cd1aaa2551efda220a6f651e3660d27f4746@kylie.crudebyte.com>) id 1wZW0O-00076h-QH; Tue, 16 Jun 2026 11:47:12 -0400 Received: from kylie.crudebyte.com ([5.189.157.229]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <4b33cd1aaa2551efda220a6f651e3660d27f4746@kylie.crudebyte.com>) id 1wZW0N-0000Cq-Cb; Tue, 16 Jun 2026 11:47:12 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=crudebyte.com; s=kylie; h=Cc:To:Subject:Date:From:References:In-Reply-To: Message-ID:Content-Type:Content-Transfer-Encoding:MIME-Version:Content-ID: Content-Description; bh=FJnPQEyZdoiQuQZJb2PXLEBll9rUFdPWbbpBDzmHekw=; b=VyXcY Y12CeyImnPa46AkTEAgKhA1gL/PHafgRa5HDryaRUs2/CAmdJivzA5V27xAcad6IC+6H/e6fcgBz+ hmRtzYSUUu5svURVmNF+Al4utajFmKSRI2w6DoK+tPPFzDX5D1HWsdsrQyTlYDoQeETXD60K8MO6M aoRAH4YEQQ7FgiBLHd1CXpsmGqKTxKuy5rXnYt+f6MP+4ZURpI/5tjGA2y1zquu+6GqSi/eF3OV4v dn+akxPK6feLS3I0BVWk4j7aqg4VwfA2JUzo9gJsUI6bkc9ai/+/eVv1nvL3EjsWuvMn4QW5eRLOb KnDkppU9SDS6CeQ85lpN98U4KAd8xtyR9ILFuktFfN+3LeKme+8wBRLDsXXRO9usqzoTquw1yh5JF H4dPXVo+WC/Nq1Xu+DDAGdd7vM9sjcb7l9+4Z5XLQMj9HIk2eHrzjznWQggYj0oljZJATzaOkv6Uh CHd8cjiDvGE8++efvG4IJ0Ps815ANVc8xkZCpcbjJz23jRhf89EEmEodVjVUaRwT1xIbJSb1Hfa4F 9kI38EUDiasihyCcK3qAKR0j3Ul9hPko/UGjg/atiJ0dcPbHz7Ch6FalKzeWpeeSErpbJzH14MqK8 cm+VLFE0nMvgWP6hb/qT7PGc7tl3r/D3eVQRXzpkrkVZqfhzI2E0QpVxFHOWd4=; Message-ID: <4b33cd1aaa2551efda220a6f651e3660d27f4746.1781621428.git.qemu_oss@crudebyte.com> In-Reply-To: References: From: Christian Schoenebeck Date: Tue, 16 Jun 2026 17:00:11 +0200 Subject: [PATCH 2/3] hw/9pfs: fix invalid union access by v9fs_co_fstat() To: qemu-devel@nongnu.org, qemu-stable@nongnu.org Cc: Greg Kurz , Feifan Qian Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=5.189.157.229; envelope-from=4b33cd1aaa2551efda220a6f651e3660d27f4746@kylie.crudebyte.com; helo=kylie.crudebyte.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @crudebyte.com) X-ZM-MESSAGEID: 1781624887618158500 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The individual FID types (P9_FID_NONE, P9_FID_FILE, P9_FID_DIR, P9_FID_XATT= R) share union V9fsFidOpenState with FID-type specific fields. Accessing any of the union fields must comply with the FID-type to avoid undefined behaviour or information disclosure. Fix this in v9fs_lock() and v9fs_getlock() by checking if FID has a valid file descriptor before calling v9fs_co_fstat(). Fixes: 10b468bdc533 ("virtio-9p: Implement TXATTRCREATE") Signed-off-by: Christian Schoenebeck --- hw/9pfs/9p.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 6dd6a57e7a..c83df57698 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3852,6 +3852,10 @@ static void coroutine_fn v9fs_lock(void *opaque) err =3D -ENOENT; goto out_nofid; } + if (!fid_has_valid_file_handle(pdu->s, fidp)) { + err =3D -EBADF; + goto out; + } err =3D v9fs_co_fstat(pdu, fidp, &stbuf); if (err < 0) { goto out; @@ -3897,6 +3901,10 @@ static void coroutine_fn v9fs_getlock(void *opaque) err =3D -ENOENT; goto out_nofid; } + if (!fid_has_valid_file_handle(pdu->s, fidp)) { + err =3D -EBADF; + goto out; + } err =3D v9fs_co_fstat(pdu, fidp, &stbuf); if (err < 0) { goto out; --=20 2.47.3 From nobody Sun Jul 26 13:26:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=crudebyte.com ARC-Seal: i=1; a=rsa-sha256; t=1781624879; cv=none; d=zohomail.com; s=zohoarc; b=nVcYCRbh6et/CCtFg3lUrnUId1gFpJ3xnQA55MlbiphYy58k60HGehEsqyyNC7kUtRAkiOzZ8TqWbrhT7MztqBDfV8YCBG3Srh0f+PJ98NSmoZ2UKXo26VLwo8xNRRdYl1qffYF49cCCD/lKIy2d7z4lioBEKHpVRmMHBJ2c/Es= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1781624879; h=Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Ike6TkXVNwA63st+thYc7epozG8pldJu6pFRJVDCGsM=; b=RHHd1Lw3tQhPle7I0ecLpvLbhCOzNC05gnueb6rzydEOopThiKRXOhSQ7NyzYj4l8sGzNf4sOT2NvyqyY+L3DVF48MOleuX80HoAEY4krs1/xRJTjMengYczgX6dkL3gw3dBhZ7NrQcyUkA2fYJciZMoIk3OqbxYiKv9pGE64Q4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178162487941948.42351100944143; Tue, 16 Jun 2026 08:47:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wZW0X-00078k-VF; Tue, 16 Jun 2026 11:47:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <531f6b81bc1bf1a48c3d4afaa60a65db10511041@kylie.crudebyte.com>) id 1wZW0U-00077l-HG; Tue, 16 Jun 2026 11:47:18 -0400 Received: from kylie.crudebyte.com ([5.189.157.229]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <531f6b81bc1bf1a48c3d4afaa60a65db10511041@kylie.crudebyte.com>) id 1wZW0T-0000DG-81; Tue, 16 Jun 2026 11:47:18 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=crudebyte.com; s=kylie; h=Cc:To:Subject:Date:From:References:In-Reply-To: Message-ID:Content-Type:Content-Transfer-Encoding:MIME-Version:Content-ID: Content-Description; bh=Ike6TkXVNwA63st+thYc7epozG8pldJu6pFRJVDCGsM=; b=Ti9uj fnJvdJEO8l11XhpQcA+boR+EuPFK0uaNc0nxRUfquGEb2tDs24V+2oAlNz+9Z71KeXOczLPb3v3+Q 5pxiH1rv7B9kx6c8QH1Ox/a8yW0v5Myvi4vAaYZ30Pkd5hk1s+wLW2Zd7dO5k9wONhaOw7pAL70Sz aPro3pAWQj98p+edHKlfN1vcj2+PudTEZH6sS2Edbupwj4DUMkVJPXHdQoTpX7pJWxRRrXlcu6MO+ R2Zcm8Ntr+NSDypGQ/rmjPr7HDq/BPNchR//B6xHMW5HPX3Q0IPdEiShpz5eQ+HcRqLwYvEL3ZGpP KP2c/8RoB0tSnZ9gBRa9fqMBh6MkXNCRWhFuAc/pifyglinKW5LjVEQX0ybZt+ZNev2BVXyv1ie00 sI2WM9+9XFr2nFIeVqsslmohhU5iF2qcW45iiKPyvDlCrCaCStWcwx02ncBcHqQs6l5hpzLYwaNC/ tU9mlzFUYSziLxSxA8CzbFhxkR3SKF76KVPQCAFKk+dlv3Qigm70Q0y6rb+DJHJRikvgnE3HyOe67 //NP3R8cEbfb4u213F1B/Ws+dToq1aGXahH0F8E5l1w0zTxZR4ujudjjn2g0lP0V2+UybvXOkMUY7 6FwPo4L8y9fF76jyT0pew7zZm1iKA+XsuL6oVbjCW2EgsQ/HUl/yGw5fphUF/E=; Message-ID: <531f6b81bc1bf1a48c3d4afaa60a65db10511041.1781621428.git.qemu_oss@crudebyte.com> In-Reply-To: References: From: Christian Schoenebeck Date: Tue, 16 Jun 2026 17:00:11 +0200 Subject: [PATCH 3/3] hw/9pfs/local: harden local_fid_fd() on FID types To: qemu-devel@nongnu.org, qemu-stable@nongnu.org Cc: Greg Kurz , Feifan Qian Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=5.189.157.229; envelope-from=531f6b81bc1bf1a48c3d4afaa60a65db10511041@kylie.crudebyte.com; helo=kylie.crudebyte.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @crudebyte.com) X-ZM-MESSAGEID: 1781624881573158500 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" local_fid_fd() returns fs->fd for any FID type that is not P9_FID_DIR. Since P9_FID_XATTR and P9_FID_NONE share union V9fsFidOpenState, calling local_fid_fd() on these types misinterprets xattr state as a file descriptor, potentially leading to undefined behaviour or information disclosure. Even though we are catching these FID type mismatches on protocol level in 9p.c already, previous patches proofed this to be error prone. So let's add another safety layer in local_fid_fd() that would return -1 if the FID type would not possess a valid file descriptor, to prevent wrong file descriptors from reaching fs backend calls. Signed-off-by: Christian Schoenebeck --- hw/9pfs/9p-local.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index aa48306b0e..724f57dc3d 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -775,8 +775,11 @@ static int local_fid_fd(int fid_type, V9fsFidOpenState= *fs) { if (fid_type =3D=3D P9_FID_DIR) { return dirfd(fs->dir.stream); - } else { + } else if (fid_type =3D=3D P9_FID_FILE) { return fs->fd; + } else { + errno =3D EBADF; + return -1; } } =20 --=20 2.47.3