The xen-9p disconnect path has two issues:
1. It frees the Xen9pfsRing structures while in-flight PDUs may still
reference them via pdu->tag to index rings[]. This causes a UAF
in xen_9pfs_push_and_notify() when worker threads resume after
completing filesystem operations.
2. It never calls v9fs_device_unrealize_common(), which means server
state (struct LocalData, mountfd, FIDs) is never cleaned up on
disconnect, causing a resource leak on every guest-initiated
disconnect.
Fix both by draining in-flight PDUs via v9fs_reset() before tearing
down rings, and calling v9fs_device_unrealize_common() to clean up
server state.
Fixes: b37eeb0201 ("xen/9pfs: introduce Xen 9pfs backend")
Signed-off-by: Christian Schoenebeck <[email protected]>
---
hw/9pfs/xen-9p-backend.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/9pfs/xen-9p-backend.c b/hw/9pfs/xen-9p-backend.c
index 24c90d97ec..3b7a68779a 100644
--- a/hw/9pfs/xen-9p-backend.c
+++ b/hw/9pfs/xen-9p-backend.c
@@ -368,10 +368,14 @@ static void xen_9pfs_evtchn_event(void *opaque)
static void xen_9pfs_disconnect(struct XenLegacyDevice *xendev)
{
Xen9pfsDev *xen_9pdev = container_of(xendev, Xen9pfsDev, xendev);
+ V9fsState *s = &xen_9pdev->state;
int i;
trace_xen_9pfs_disconnect(xendev->name);
+ v9fs_reset(s);
+ v9fs_device_unrealize_common(s);
+
for (i = 0; i < xen_9pdev->num_rings; i++) {
if (xen_9pdev->rings[i].evtchndev != NULL) {
qemu_set_fd_handler(qemu_xen_evtchn_fd(xen_9pdev->rings[i].evtchndev),
--
2.47.3
