On 29.06.2026 16:28, Christian Schoenebeck wrote:
9pfs changes:- Fix DoS via Treaddir (CVE-2026-9238). - Add xattr FID limit (CVE-2026-8348). - Fix union V9fsFidOpenState type confusion. ---------------------------------------------------------------- Christian Schoenebeck (23): hw/9pfs: add msize_limit transport callback 9pfs/virtio: implement msize_limit callback 9pfs/xen: implement msize_limit callback hw/9pfs: cap negotiated msize to transport limit hw/9pfs: add response_buffer_size transport callback 9pfs/virtio: implement response_buffer_size callback 9pfs/xen: implement response_buffer_size callback hw/9pfs: cap Treaddir allocation (CVE-2026-9238) hw/9pfs: add xattr FID limit to prevent memory exhaustion hw/9pfs: add max_xattr option qemu-options: document 9pfs max_xattr option tests/9p: add Tread / Rread test client functions tests/9p: add Tclunk / Rclunk test client functions tests/9p: add Txattrcreate / Rxattrcreate test client functions hw/9pfs: enable xattr (mockup) support for synth fs driver hw/9pfs: add xattr count query interface to fs synth driver tests/9p: increase P9_MAX_SIZE for test client tests/9p: add virtio_9p_add_synth_driver_args() test client function tests/9p: add 3 xattr FID limit test cases (synth fs driver) tests/9p: add 3 xattr FID limit test cases (local fs driver) hw/9pfs: fix invalid union access by v9fs_co_fsync() hw/9pfs: fix invalid union access by v9fs_co_fstat() hw/9pfs/local: harden local_fid_fd() on FID types
Thank you for this work! FWIW, I've applied this to 11.0.x and 10.0.x. For the latter, I also picked up the following two commits which are simple refactoring: commit c84ebaa6b2cf9a27fc051b4692a42350adf6358e Author: Greg Kurz <[email protected]> Date: Wed Mar 12 16:29:28 2025 +0100 9pfs: Don't use file descriptors in core code commit 29070a13e7c131448ff35c90c70ff42e2989d420 Author: Greg Kurz <[email protected]> Date: Wed Mar 12 16:29:27 2025 +0100 9pfs: local : Introduce local_fid_fd() helper What do you think, for older 7.2.x series, which was an LTS but now security-only support, which of the above should be picked up? I mean, which are the most important ones here? Thanks, /mjt
