On Sunday, 15 February 2026 13:44:50 CET Christian Schoenebeck wrote:
> Renaming files/dirs is only supported by path-based fs drivers. EOPNOTSUPP
> should be returned on any renaming attempt for not path-based fs drivers.
> This was already the case for 9p "Trename" request type. However for 9p
> request types "Trenameat" and "Twstat" this was yet missing.
> 
> So fix this by checking in Twstat and Trenameat request handlers whether
> the fs driver in use is really path based, if not return EOPNOTSUPP and
> abort further handling of the request.
> 
> This fixes a crash with the 9p "synth" fs driver which is not path-based.
> 
> The crash happened because the synth driver stores and expects a raw
> V9fsSynthNode pointer instead of a C-string on V9fsPath.data. So the
> C-string delivered by 9p server to synth fs driver was incorrectly
> casted to a V9fsSynthNode pointer, eventually causing a segfault.
> 
> Reported-by: Oliver Chang <[email protected]>
> Fixes: https://issues.oss-fuzz.com/issues/477990727
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3298
> Signed-off-by: Christian Schoenebeck <[email protected]>
> ---
>  hw/9pfs/9p.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)

Queued on 9p.next:
https://github.com/cschoenebeck/qemu/commits/9p.next

Thanks!

/Christian



Reply via email to