@samitouri / QOSamiQemu / commits / c3aa2491cd

hw/9pfs: fix invalid union access by v9fs_co_fstat()

The individual FID types (P9_FID_NONE, P9_FID_FILE, P9_FID_DIR, P9_FID_XATTR) share union V9fsFidOpenState with FID-type specific fields. Accessing any of the union fields must comply with the FID-type to avoid undefined behaviour or information disclosure. Fix this in v9fs_lock() and v9fs_getlock() by checking if FID has a valid file descriptor before calling v9fs_co_fstat(). Fixes: 10b468bdc533 ("virtio-9p: Implement TXATTRCREATE") Link: https://lore.kernel.org/qemu-devel/4b33cd1aaa2551efda220a6f651e3660d27f4746.1781621428.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>

Christian Schoenebeck committed Jun 16, 2026 at 17:00 UTC c3aa2491cd2cd89e2f484d32f323ee447e782984
1 file changed +8
hw/9pfs/9p.c
+8
@@ -3908,6 +3908,10 @@ static void coroutine_fn v9fs_lock(void *opaque)
3908 err = -ENOENT;
3909 goto out_nofid;
3910 }
3911 + if (!fid_has_valid_file_handle(pdu->s, fidp)) {
3912 + err = -EBADF;
3913 + goto out;
3914 + }
3915 err = v9fs_co_fstat(pdu, fidp, &stbuf);
3916 if (err < 0) {
3917 goto out;
@@ -3953,6 +3957,10 @@ static void coroutine_fn v9fs_getlock(void *opaque)
3957 err = -ENOENT;
3958 goto out_nofid;
3959 }
3960 + if (!fid_has_valid_file_handle(pdu->s, fidp)) {
3961 + err = -EBADF;
3962 + goto out;
3963 + }
3964 err = v9fs_co_fstat(pdu, fidp, &stbuf);
3965 if (err < 0) {
3966 goto out;