@samitouri / QOSamiQemu / commits / 32cae47c33

hw/9pfs: fix invalid union access by v9fs_co_fsync()

The individual FID types (P9_FID_NONE, P9_FID_FILE, P9_FID_DIR, P9_FID_XATTR) share union V9fsFidOpenState with FID-type specific fields. Accessing any of the union fields must comply with the FID-type to avoid undefined behaviour or information disclosure. Fix this in v9fs_fsync() and v9fs_wstat() by checking if FID has a valid file descriptor before calling v9fs_co_fsync(). Fixes: 10b468bdc533 ("virtio-9p: Implement TXATTRCREATE") Reported-by: Feifan Qian <bea1e@proton.me> Link: https://lore.kernel.org/qemu-devel/b583e29d5a0776e41263732c93ac9f0da0a6016d.1781621428.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>

Christian Schoenebeck committed Jun 16, 2026 at 17:00 UTC 32cae47c332f88241632905e0a3abcbb35b019c3
1 file changed +9
hw/9pfs/9p.c
+9
@@ -2305,10 +2305,15 @@ static void coroutine_fn v9fs_fsync(void *opaque)
2305 err = -ENOENT;
2306 goto out_nofid;
2307 }
2308 + if (!fid_has_valid_file_handle(pdu->s, fidp)) {
2309 + err = -EBADF;
2310 + goto out;
2311 + }
2312 err = v9fs_co_fsync(pdu, fidp, datasync);
2313 if (!err) {
2314 err = offset;
2315 }
2316 +out:
2317 put_fid(pdu, fidp);
2318 out_nofid:
2319 pdu_complete(pdu, err);
@@ -3640,6 +3645,10 @@ static void coroutine_fn v9fs_wstat(void *opaque)
3645 }
3646 /* do we need to sync the file? */
3647 if (donttouch_stat(&v9stat)) {
3648 + if (!fid_has_valid_file_handle(s, fidp)) {
3649 + err = -EBADF;
3650 + goto out;
3651 + }
3652 err = v9fs_co_fsync(pdu, fidp, 0);
3653 goto out;
3654 }