Merge tag 'pull-9p-20260629' of https://github.com/cschoenebeck/qemu into staging

9pfs changes:

- Fix DoS via Treaddir (CVE-2026-9238).

- Add xattr FID limit (CVE-2026-8348).

- Fix union V9fsFidOpenState type confusion.

# -----BEGIN PGP SIGNATURE-----
#
# iQJLBAABCgA1FiEEltjREM96+AhPiFkBNMK1h2Wkc5UFAmpCcvMXHHFlbXVfb3Nz
# QGNydWRlYnl0ZS5jb20ACgkQNMK1h2Wkc5UEIQ//c6rNZ+7zFFdhJHiqC5dzpppp
# qob6B11/JPZ1T9+UL2Gp29JK6hCvg5ho3WJBE+xrz3z5MnD4L3w0Xmc+JNEBmmHn
# F3jcivOBJYqWRpWfJiM1ils88sMlb4wydWOBOCw6RuHrONaiW0of4o00Nqgv9CGg
# LNuUCrf5PHfu19+rpDxrVmaQrG/FYfyBuTuRF3QJPcqMwTmZ3JB0kEM9L6HONPLl
# xaHHuBB1soRP8ymHXaSTn7h4JuN6JfZ5RfF49JCKaYX+Ye2QRy85eTEOMkXdrBjr
# z6Bdzg2rqUnRDezr8RpUyHnnfYnMOuUTrhteTuE3rdt3LoIVdK3imR0OkNqmryJb
# RlffeoQDOhJng0YGfOgAm7BADIq9QKjeMresVUWziHuZOYS7X0TJX5U/oQYNQS02
# p1rOGVMUhs4bAsWQ3PoaXZyn99PH27Lv24mBqk9Lu5Q3fva58b2ox0O+K3QgIQku
# fTAy2HWBNPXtLDXNVnd0ISylkovTAqCW0aOCiLbhuqKAFirRFpkazhkA1vfMwOfo
# xbrHET8k8bpub+hbcHucu3pHULGRacB8WEq/t2TyjNdEPPERvxIHT24UPdiAHhAm
# ncgm+zKqiqhPgm17KpymCjKnwt1Rh1S/QW07ncW3PSV/nJhmDj7zN7iZFLWCx+tY
# XQsGbhXRrMDtTVY2oTE=
# =Jj/P
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 29 Jun 2026 15:28:19 CEST
# gpg:                using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395
# gpg:                issuer "qemu_oss@crudebyte.com"
# gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown]
# gpg: Note: This key has expired!
# Primary key fingerprint: ECAB 1A45 4014 1413 BA38  4926 30DB 47C3 A012 D5F4
#      Subkey fingerprint: 96D8 D110 CF7A F808 4F88  5901 34C2 B587 65A4 7395

* tag 'pull-9p-20260629' of https://github.com/cschoenebeck/qemu: (23 commits)
  hw/9pfs/local: harden local_fid_fd() on FID types
  hw/9pfs: fix invalid union access by v9fs_co_fstat()
  hw/9pfs: fix invalid union access by v9fs_co_fsync()
  tests/9p: add 3 xattr FID limit test cases (local fs driver)
  tests/9p: add 3 xattr FID limit test cases (synth fs driver)
  tests/9p: add virtio_9p_add_synth_driver_args() test client function
  tests/9p: increase P9_MAX_SIZE for test client
  hw/9pfs: add xattr count query interface to fs synth driver
  hw/9pfs: enable xattr (mockup) support for synth fs driver
  tests/9p: add Txattrcreate / Rxattrcreate test client functions
  tests/9p: add Tclunk / Rclunk test client functions
  tests/9p: add Tread / Rread test client functions
  qemu-options: document 9pfs max_xattr option
  hw/9pfs: add max_xattr option
  hw/9pfs: add xattr FID limit to prevent memory exhaustion
  hw/9pfs: cap Treaddir allocation (CVE-2026-9238)
  9pfs/xen: implement response_buffer_size callback
  9pfs/virtio: implement response_buffer_size callback
  hw/9pfs: add response_buffer_size transport callback
  hw/9pfs: cap negotiated msize to transport limit
  ...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

1 files changed, 6 insertions, 1 deletions

diff --git a/system/vl.c b/system/vl.c
index 1c0da7df29..1d14e2e207 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -3260,7 +3260,7 @@ void qemu_init(int argc, char **argv)
                 QemuOpts *fsdev;
                 QemuOpts *device;
                 const char *writeout, *sock_fd, *socket, *path, *security_model,
-                           *multidevs;
+                           *multidevs, *max_xattr_str;
 
                 olist = qemu_find_opts("virtfs");
                 if (!olist) {
@@ -3324,6 +3324,11 @@ void qemu_init(int argc, char **argv)
                 if (multidevs) {
                     qemu_opt_set(fsdev, "multidevs", multidevs, &error_abort);
                 }
+                max_xattr_str = qemu_opt_get(opts, "max_xattr");
+                if (max_xattr_str) {
+                    qemu_opt_set(fsdev, "max_xattr", max_xattr_str,
+                                 &error_abort);
+                }
                 device = qemu_opts_create(qemu_find_opts("device"), NULL, 0,
                                           &error_abort);
                 qemu_opt_set(device, "driver", "virtio-9p-pci", &error_abort);