On Thursday, 9 July 2026 15:50:36 CEST Christian Schoenebeck wrote: > A guest can trigger a heap-use-after-free in the virtio transport > unrealize path by submitting a Treaddir request and immediately > ejecting the device via ACPI PCI hotplug. The unrealize path frees > struct LocalData while a worker thread still holds a reference > on it, causing a UAF in local_open_nofollow(). > > Fix this by draining all in-flight 9p PDUs by calling v9fs_reset() > before final server cleanup. This ensures all coroutines completed, > all FIDs are closed, and no worker thread still holds references > on 9p server state when it is freed. > > Reported-by: Jia Jia <[email protected]> > Suggested-by: Jia Jia <[email protected]> > Fixes: 6cecf09373 ("virtio-9p-device: add minimal unrealize handler") > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3937 > Signed-off-by: Christian Schoenebeck <[email protected]> > ---
Jia, if desired, I can make you the official author of this patch. If that's what you want, then please reply-to-all to this message with the same email address that you used for your report already, and acknowledge that you would be fine that I add a: Signed-off-by: Jia Jia <[email protected]> tag on behalf of you, for the reason described here: https://www.qemu.org/docs/master/devel/submitting-a-patch.html > hw/9pfs/virtio-9p-device.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c > index 50dc93091d..1ec48fc9e0 100644 > --- a/hw/9pfs/virtio-9p-device.c > +++ b/hw/9pfs/virtio-9p-device.c > @@ -243,6 +243,7 @@ static void virtio_9p_device_unrealize(DeviceState *dev) > V9fsVirtioState *v = VIRTIO_9P(dev); > V9fsState *s = &v->state; > > + v9fs_reset(s); > virtio_delete_queue(v->vq); > virtio_cleanup(vdev); > v9fs_device_unrealize_common(s);
