@samitouri / QOSamiQemu / commits / 7f5445e7e4

hw/9pfs: fix abort due to illegal name with Twstat rename

The legacy Twstat 9p request can be used to rename files and directories. Unlike the other, more recent rename requests like Trename and Trenameat, Twstat does not validate the submitted new name before passing it to v9fs_complete_rename(). A priviliged guest user with direct communication access to 9p server could pass a string containing '/' as new name, which causes an assertion fault (DoS) in local_name_to_path(). Fix this by rejecting such strings by checking the client supplied new name with name_is_illegal(), similar to how Trename and Trenameat handlers do already. Reported-by: Feifan Qian <bea1e@proton.me> Fixes: 8cf89e007a ("virtio-9p: Add P9_TWSTAT support") Link: https://lore.kernel.org/qemu-devel/ba09716828e82992f9d8cac7f00eee0bc1c43c61.1780072238.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>

Christian Schoenebeck committed May 29, 2026 at 18:29 UTC 7f5445e7e4050cc117ed4b137bb7dd1474e49d57

1 file changed +5

hw/9pfs/9p.c

@@ -3638,6 +3638,11 @@ static void coroutine_fn v9fs_wstat(void *opaque)

3638 err = -EOPNOTSUPP;

3639 goto out;

3640 }

3641 + if (name_is_illegal(v9stat.name.data)) {

3642 + err = -ENOENT;

3643 + goto out;

3644 + }

3645 +

3646 v9fs_path_write_lock(s);

3647 err = v9fs_complete_rename(pdu, fidp, -1, &v9stat.name);

3648 v9fs_path_unlock(s);