diff options
| author | Richie Buturla <richie@linux.ibm.com> | 2026-02-11 16:44:50 +0100 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2026-03-01 09:23:27 +0300 |
| commit | 815a59c50925d7a84e3969896b0e84f133a0befd (patch) | |
| tree | 50b237c0979ffa012219e3f33ac0ab1b1f7e7076 | |
| parent | a9045a734df7c72435f56d6397381aea819e2c93 (diff) | |
| download | qemu-815a59c50925d7a84e3969896b0e84f133a0befd.tar.gz qemu-815a59c50925d7a84e3969896b0e84f133a0befd.zip | |
hw/9pfs: fix data race in v9fs_mark_fids_unreclaim()
A data race between v9fs_mark_fids_unreclaim() and v9fs_path_copy()
causes an inconsistent read of fidp->path. In v9fs_path_copy(), the
path size is set before the data pointer is allocated, creating a
window where size is non-zero but data is NULL.
v9fs_co_open2() holds a write lock during path modifications,
but v9fs_mark_fids_unreclaim() was not acquiring a read
lock, allowing it to race.
Fix by holding the path read lock during FID table iteration.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3300
Signed-off-by: Richie Buturla <richie@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260211154450.254338-1-richie@linux.ibm.com/
Fixes: 7a46274529 ("hw/9pfs: Add file descriptor reclaim support")
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
(cherry picked from commit c96f6d2398a9dc068fa82088ea43020a52e2b26d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/9pfs/9p.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index acfa7db4e1..c70096e6be 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -558,6 +558,7 @@ static int coroutine_fn v9fs_mark_fids_unreclaim(V9fsPDU *pdu, V9fsPath *path) sizeof(V9fsFidState *), 1); gint i; + v9fs_path_read_lock(s); g_hash_table_iter_init(&iter, s->fids); /* @@ -578,6 +579,7 @@ static int coroutine_fn v9fs_mark_fids_unreclaim(V9fsPDU *pdu, V9fsPath *path) g_array_append_val(to_reopen, fidp); } } + v9fs_path_unlock(s); for (i = 0; i < to_reopen->len; i++) { fidp = g_array_index(to_reopen, V9fsFidState*, i); |