@samitouri / QOSamiQemu / commits / 5a8da7e979

9pfs: fix missing rename lock in v9fs_co_readdir_many (CVE-2026-48004)

v9fs_co_readdir_many() dispatches do_readdir_many() to a worker thread that reads V9fsFidState's path.data without holding a rename lock. A concurrent rename request, e.g. of its parent dir, causes the FID's absolute path to be altered by freeing the old path string and assigning a new one. This causes a heap-use-after-free race condition while do_readdir_many() is still accessing the old object. This allows a DoS by an unprivileged guest user. Fix this by wrapping the worker thread dispatch block within a pair of v9fs_path_read_lock() and v9fs_path_unlock() calls, like it's done at other places. Fixes: 2149675b195f ("9pfs: add new function v9fs_co_readdir_many()") Fixes: CVE-2026-48004 Reported-by: sin99xx <sin99xx@proton.me> Signed-off-by: sin99xx <sin99xx@proton.me> [Christian Schoenebeck: add commit log message] Link: https://lore.kernel.org/qemu-devel/E1wPkYi-000adH-4E@kylie.crudebyte.com Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>

sin99xx committed May 20, 2026 at 19:11 UTC 5a8da7e979f1f56b1cab82c2354833f309f1a78f

1 file changed +3

hw/9pfs/codir.c

@@ -220,13 +220,16 @@ int coroutine_fn v9fs_co_readdir_many(V9fsPDU *pdu, V9fsFidState *fidp,

220 bool dostat)

221 {

222 int err = 0;

223 + V9fsState *s = pdu->s;

224

225 if (v9fs_request_cancelled(pdu)) {

226 return -EINTR;

227 }

228 + v9fs_path_read_lock(s);

229 v9fs_co_run_in_worker({

230 err = do_readdir_many(pdu, fidp, entries, offset, maxsize, dostat);

231 });

232 + v9fs_path_unlock(s);

233 return err;

234 }

235