@samitouri / QOSamiQemu / commits / 1de8aea061

hw/9pfs/xen: drain in-flight PDUs before xen-9p disconnect

The xen-9p disconnect path has two issues: 1. It frees the Xen9pfsRing structures while in-flight PDUs may still reference them via pdu->tag to index rings[]. This causes a UAF in xen_9pfs_push_and_notify() when worker threads resume after completing filesystem operations. 2. It never calls v9fs_device_unrealize_common(), which means server state (struct LocalData, mountfd, FIDs) is never cleaned up on disconnect, causing a resource leak on every guest-initiated disconnect. Fix both by draining in-flight PDUs via v9fs_reset() before tearing down rings, and calling v9fs_device_unrealize_common() to clean up server state. Additionally, explicit calls of xen_9pfs_disconnect() in the error paths of xen_9pfs_pdu_vmarshal() and xen_9pfs_pdu_vunmarshal() must be deferred (via aio_bh_schedule_oneshot()), because xen_9pfs_pdu_v(un)marshal() are running within a coroutine context which makes them unsafe [1] for calling v9fs_reset() directly, as the latter e.g. has a loop like: while (!QLIST_EMPTY(&s->active_list)) { aio_poll(qemu_get_aio_context(), true); } which would a) never terminate (as the coroutine is on the active_list) and b) aio_poll() is marked as no_coroutine_fn. [1] https://lore.kernel.org/qemu-devel/3351181.5fSG56mABF@weasel/ And finally, add an idempotent guard to xen_9pfs_disconnect() for the v9fs_reset(s) and v9fs_device_unrealize_common(s) calls specifically [2], just to be sure. [2] https://lore.kernel.org/qemu-devel/alpine.DEB.2.22.394.2607221815520.5295@ubuntu-linux-20-04-desktop/ Fixes: b37eeb0201 ("xen/9pfs: introduce Xen 9pfs backend") Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Link: https://lore.kernel.org/qemu-devel/82bc736158e827e05d4b55da27c39d42e2062e96.1784809978.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>

Christian Schoenebeck committed Jul 23, 2026 at 14:43 UTC 1de8aea061b9d5bc7aaed182e2eebe9554debd68

2 files changed +16 -2

hw/9pfs/9p.c

@@ -4530,6 +4530,7 @@ void v9fs_device_unrealize_common(V9fsState *s)

4530 qp_table_destroy(&s->qpp_table);

4531 qp_table_destroy(&s->qpf_table);

4532 g_free(s->ctx.fs_root);

4533 + s->transport = NULL;

4534 }

4535

4536 typedef struct VirtfsCoResetData {

hw/9pfs/xen-9p-backend.c

+15 -2

@@ -68,6 +68,11 @@ typedef struct Xen9pfsDev {

69 static void xen_9pfs_disconnect(struct XenLegacyDevice *xendev);

71 +static void xen_9pfs_disconnect_bh(void *opaque)

72 +{

73 + xen_9pfs_disconnect(opaque);

74 +}

75 +

76 static void xen_9pfs_in_sg(Xen9pfsRing *ring,

77 struct iovec *in_sg,

78 int *num,

@@ -150,7 +155,8 @@ static ssize_t xen_9pfs_pdu_vmarshal(V9fsPDU *pdu,

155 "Failed to encode VirtFS reply type %d\n",

156 pdu->id + 1);

157 xen_be_set_state(&xen_9pfs->xendev, XenbusStateClosing);

153 - xen_9pfs_disconnect(&xen_9pfs->xendev);

158 + aio_bh_schedule_oneshot(qemu_get_aio_context(),

159 + xen_9pfs_disconnect_bh, &xen_9pfs->xendev);

160 }

161 return ret;

162 }

@@ -173,7 +179,8 @@ static ssize_t xen_9pfs_pdu_vunmarshal(V9fsPDU *pdu,

179 xen_pv_printf(&xen_9pfs->xendev, 0,

180 "Failed to decode VirtFS request type %d\n", pdu->id);

181 xen_be_set_state(&xen_9pfs->xendev, XenbusStateClosing);

176 - xen_9pfs_disconnect(&xen_9pfs->xendev);

182 + aio_bh_schedule_oneshot(qemu_get_aio_context(),

183 + xen_9pfs_disconnect_bh, &xen_9pfs->xendev);

184 }

185 return ret;

186 }

@@ -368,10 +375,16 @@ static void xen_9pfs_evtchn_event(void *opaque)

375 static void xen_9pfs_disconnect(struct XenLegacyDevice *xendev)

376 {

377 Xen9pfsDev *xen_9pdev = container_of(xendev, Xen9pfsDev, xendev);

378 + V9fsState *s = &xen_9pdev->state;

379 int i;

380

381 trace_xen_9pfs_disconnect(xendev->name);

382

383 + if (s->transport) {

384 + v9fs_reset(s); /* cancel all in-flight PDUs to prevent UAF */

385 + v9fs_device_unrealize_common(s);

386 + }

387 +

388 for (i = 0; i < xen_9pdev->num_rings; i++) {

389 if (xen_9pdev->rings[i].evtchndev != NULL) {

390 qemu_set_fd_handler(qemu_xen_evtchn_fd(xen_9pdev->rings[i].evtchndev),