From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 98256C4450A for ; Thu, 16 Jul 2026 12:32:53 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wkLGA-00021P-EC; Thu, 16 Jul 2026 08:32:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wkLG9-000219-MK; Thu, 16 Jul 2026 08:32:13 -0400 Received: from kylie.crudebyte.com ([5.189.157.229]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wkLG7-0006f6-UH; Thu, 16 Jul 2026 08:32:13 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=crudebyte.com; s=kylie; h=Content-Type:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From: Content-ID:Content-Description; bh=6foyLyGEqbjbk5SZkNGEBLcK0puNEBhjbXvm2dc8pLA=; b=Ful+kZufAJoFyTxMkkqYt2q81W ECcc1gKdO4OG/X622o3MpO3d1gP4VCPvbgLUuMN/B1dx6QKLH4MCsQWJNNC6DsTZxHSKz1CdYqhNQ Wpuf3VAMnmlbqiKH/lalvBLAAwBXmRfkBa2zkvKSDOaE1lGDkdQiUvDxzXhOFPwV3mGVoAls3biFD DH6eJbZySmzDJYG3TTKxYs1L+6sTWEv6zzMvt7ZP0Wou40ux7kd798pya67Y0ZpuVmAfqxQ58UFRr LOo1b+FekonIhh3PeKM3fGrYPV4WITNwBWmE2D7c4nwreUDIkr8QeMbCmvFUyTCXWRk720zINd6mZ pGliqOYgA6vob/IiCX6Oj2rhNed/MAZHNJPjsy6bWwjJKlXlvIrw7scgM9W/WNzGubVzfS6OQ2jGP GsHP+yfFuALGpb8RId8xPqBbzEwjMvW7zwBhWbTQ/cMIDOaxNeUccpO7l+dkIJrm77N8v95DFp7Jk Z0AU7QY5BuGBhN4Ug8ZujoR7tiDZ0GUl1kZhXjBuSkWEWUUaWQDJEaV/3f/EBG8omMLLDrfQ2YUIZ WgnMiS49ZT9FIEVdcUIGtnZhcTWgzy1si/qahCSO7MNvggrynjtQUh6huTHaoO3fhk41OEyGrWu4b PD2EdwHerdWp4XlczY59mi0TFTTUa0C0UAGIy5Q10=; From: Christian Schoenebeck To: Stefano Stabellini Cc: qemu-devel@nongnu.org, qemu-stable@nongnu.org, Greg Kurz , Anthony PERARD , "Edgar E. Iglesias" Subject: Re: [PATCH 3/3] hw/9pfs/xen: drain in-flight PDUs before xen-9p disconnect Date: Thu, 16 Jul 2026 14:32:06 +0200 Message-ID: <12932229.O9o76ZdvQC@weasel> In-Reply-To: <6811fc561b7d20610e5f39234d08542cc1f31fd7.1783604079.git.qemu_oss@crudebyte.com> References: <6811fc561b7d20610e5f39234d08542cc1f31fd7.1783604079.git.qemu_oss@crudebyte.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="utf-8" Received-SPF: pass client-ip=5.189.157.229; envelope-from=qemu_oss@crudebyte.com; helo=kylie.crudebyte.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Hi Stefano, do you might have a chance to look at this Xen patch? /Christian On Thursday, 9 July 2026 15:50:36 CEST Christian Schoenebeck wrote: > The xen-9p disconnect path has two issues: > > 1. It frees the Xen9pfsRing structures while in-flight PDUs may still > reference them via pdu->tag to index rings[]. This causes a UAF > in xen_9pfs_push_and_notify() when worker threads resume after > completing filesystem operations. > > 2. It never calls v9fs_device_unrealize_common(), which means server > state (struct LocalData, mountfd, FIDs) is never cleaned up on > disconnect, causing a resource leak on every guest-initiated > disconnect. > > Fix both by draining in-flight PDUs via v9fs_reset() before tearing > down rings, and calling v9fs_device_unrealize_common() to clean up > server state. > > Fixes: b37eeb0201 ("xen/9pfs: introduce Xen 9pfs backend") > Signed-off-by: Christian Schoenebeck > --- > hw/9pfs/xen-9p-backend.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/hw/9pfs/xen-9p-backend.c b/hw/9pfs/xen-9p-backend.c > index 24c90d97ec..3b7a68779a 100644 > --- a/hw/9pfs/xen-9p-backend.c > +++ b/hw/9pfs/xen-9p-backend.c > @@ -368,10 +368,14 @@ static void xen_9pfs_evtchn_event(void *opaque) > static void xen_9pfs_disconnect(struct XenLegacyDevice *xendev) > { > Xen9pfsDev *xen_9pdev = container_of(xendev, Xen9pfsDev, xendev); > + V9fsState *s = &xen_9pdev->state; > int i; > > trace_xen_9pfs_disconnect(xendev->name); > > + v9fs_reset(s); > + v9fs_device_unrealize_common(s); > + > for (i = 0; i < xen_9pdev->num_rings; i++) { > if (xen_9pdev->rings[i].evtchndev != NULL) { > > qemu_set_fd_handler(qemu_xen_evtchn_fd(xen_9pdev->rings[i].evtchndev),