hw/9pfs: fix invalid union access by v9fs_co_fstat()
The individual FID types (P9_FID_NONE, P9_FID_FILE, P9_FID_DIR, P9_FID_XATTR) share union V9fsFidOpenState with FID-type specific fields. Accessing any of the union fields must comply with the FID-type to avoid undefined behaviour or information disclosure. Fix this in v9fs_lock() and v9fs_getlock() by checking if FID has a valid file descriptor before calling v9fs_co_fstat(). Fixes: 10b468bdc533 ("virtio-9p: Implement TXATTRCREATE") Link: https://lore.kernel.org/qemu-devel/4b33cd1aaa2551efda220a6f651e3660d27f4746.1781621428.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Christian Schoenebeck committed
Jun 16, 2026 at 17:00 UTC
c3aa2491cd2cd89e2f484d32f323ee447e782984
1 file changed
+8
hw/9pfs/9p.c
+8
@@ -3908,6 +3908,10 @@ static void coroutine_fn v9fs_lock(void *opaque)
3908
err = -ENOENT;
3909
goto out_nofid;
3910
}
3911
+ if (!fid_has_valid_file_handle(pdu->s, fidp)) {
3912
+ err = -EBADF;
3913
+ goto out;
3914
+ }
3915
err = v9fs_co_fstat(pdu, fidp, &stbuf);
3916
if (err < 0) {
3917
goto out;
@@ -3953,6 +3957,10 @@ static void coroutine_fn v9fs_getlock(void *opaque)
3957
err = -ENOENT;
3958
goto out_nofid;
3959
}
3960
+ if (!fid_has_valid_file_handle(pdu->s, fidp)) {
3961
+ err = -EBADF;
3962
+ goto out;
3963
+ }
3964
err = v9fs_co_fstat(pdu, fidp, &stbuf);
3965
if (err < 0) {
3966
goto out;