hw/9pfs: fix invalid union access by v9fs_co_fsync()
The individual FID types (P9_FID_NONE, P9_FID_FILE, P9_FID_DIR, P9_FID_XATTR) share union V9fsFidOpenState with FID-type specific fields. Accessing any of the union fields must comply with the FID-type to avoid undefined behaviour or information disclosure. Fix this in v9fs_fsync() and v9fs_wstat() by checking if FID has a valid file descriptor before calling v9fs_co_fsync(). Fixes: 10b468bdc533 ("virtio-9p: Implement TXATTRCREATE") Reported-by: Feifan Qian <bea1e@proton.me> Link: https://lore.kernel.org/qemu-devel/b583e29d5a0776e41263732c93ac9f0da0a6016d.1781621428.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Christian Schoenebeck committed
Jun 16, 2026 at 17:00 UTC
32cae47c332f88241632905e0a3abcbb35b019c3
1 file changed
+9
hw/9pfs/9p.c
+9
@@ -2305,10 +2305,15 @@ static void coroutine_fn v9fs_fsync(void *opaque)
2305
err = -ENOENT;
2306
goto out_nofid;
2307
}
2308
+ if (!fid_has_valid_file_handle(pdu->s, fidp)) {
2309
+ err = -EBADF;
2310
+ goto out;
2311
+ }
2312
err = v9fs_co_fsync(pdu, fidp, datasync);
2313
if (!err) {
2314
err = offset;
2315
}
2316
+out:
2317
put_fid(pdu, fidp);
2318
out_nofid:
2319
pdu_complete(pdu, err);
@@ -3640,6 +3645,10 @@ static void coroutine_fn v9fs_wstat(void *opaque)
3645
}
3646
/* do we need to sync the file? */
3647
if (donttouch_stat(&v9stat)) {
3648
+ if (!fid_has_valid_file_handle(s, fidp)) {
3649
+ err = -EBADF;
3650
+ goto out;
3651
+ }
3652
err = v9fs_co_fsync(pdu, fidp, 0);
3653
goto out;
3654
}