From nobody Thu Aug 13 09:21:56 2026 Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E7B246D09C for ; Tue, 4 Aug 2026 21:35:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785879360; cv=none; b=egCsVsNr0Clk9XTJdXCJtQP5dYPJMsgL2LMSbNNBB7pfboFDIvjwWx0M8A/24tLZbq+t3zNUvox6bk4UU1ogHLhD2yVlv9TNKDZ7/0pPi96IYheFCYgdx/8pXdojrmhZajIOUoDS0fIX8wIiMwsQVnbxKf82lPLUyuuDiKqcnfM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785879360; c=relaxed/simple; bh=tEcMDoHS6/C19lkFbIVxAgB2kcG2kHidnTH70KxDhC8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=oLTOMhOeWeQbAjRsAw1i8zbii4HkmOOFFSWNjvx8INL+Vmzib7nfSN2d5mrfW8r6XujuDdcZc/sOxjsZGK87irDjY0roszFeGxerF+SEhg1TSzkG5rShmFEQsFAsn17h/ZS33mnkTu3fMagtMi+nas9YZYX0cm/FgpiQkOZ8MGY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=FfZuIDSR; arc=none smtp.client-ip=209.85.215.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FfZuIDSR" Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-ca97d139d5fso194976a12.0 for ; Tue, 04 Aug 2026 14:35:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785879358; x=1786484158; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=QH2K5FogbEg2Pu5YlCvSeafRigFtD0Kz01lkbZ2ZcwI=; b=FfZuIDSR70WeRoFn/4JXgvTeMfL3yjKqiklVlObWEBtylPr2TytptTv1ZZlyZdpPcY KaH+JrLDEDcenLGpcLz6MJdCmRMxLtu9/6ZWPGQ+Wd2gA1+suLazDH3Mkz9PYrWtPcvR IwffqK4Lu9lo/N/VahYObHkD+Pivo+fEghO7S9UJ5yqm1ql7CVGksA0C2lMedgr/M5GH eJy9+7uw5vJR6CIbThNvDcNotzV+0pgRE0yl4ftwqpiim2sTwLOdN0qWWUrUOrP6bgw3 vxPulotlbKPO6Ru7DhR7RmmPgR3jxEW1NkGV0ouIUCStV3qa4XenjRY/XpDIOowffzr3 C4IA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785879358; x=1786484158; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QH2K5FogbEg2Pu5YlCvSeafRigFtD0Kz01lkbZ2ZcwI=; b=SaQG7BUYER+unUsoAbgvqf/aY8LeTjPjN8Yt7E/g1V7KAco5qxymSqg4KcFMvGLGhK s3vY3MOunD3VZpMmGMNz+nKOJFaCglVZHGJrn55SwpV/0FVsTygYuOUO609sxO75Z5+O 2VNsHtfliUTrhO1G0HfQfYgrOn9skQDm9GQ0VY2/KslmnskPAsV749/EqXtRr5WSVK/Z oGALpPV1370EoGL1/lXBf1Lz6WsLhqmlUYPScU+UzJjpiyneHGCRFgAQv/HxxKH+DVLd Q5f1BHoF/itMdxe9gPH/xgPgylVYA1kvMCvoAQ2wvIPecZnlhbMRZuH5rIMn4wiIccfP TIlQ== X-Forwarded-Encrypted: i=1; AHgh+RocekmhrZdxEGHo3yRmhAPNcVa6lwUPNTpCOU/Cfx9uMgQLtPR1N5a5lVhQbz5QojRymkecN3f2RAaW4TM=@vger.kernel.org X-Gm-Message-State: AOJu0YyJVW5/pNNUH/+dzA6KwUqpttZ5ALTIfliOMWjVsCAl94SQqjPW 1Yk07Snya3GOeVbSUwiLaIMTf8wB7YxoDKd+y4VOqzIbihB85fiLCEGF X-Gm-Gg: AR+sD124yhnpah+Z6dP9/Fjz4rwdc+P8wqMpmy0BBKgBwtj31OEl95xuai+s9FhELMQ 5VGjsOWmOD714JNFHhBNm5D+vzRtiRaXdGidcp9WpgNT3elJl7wQ3lkZOnDC5FC8495LE7mXUYM zh2mptSx+pHXhrJsLfnX/7iQY2nZe7CFQfeLAxXhN2T5gOMEV8Ou2+sF8Flc1M9rkr3ZearFW+1 NURixx63ofaniEIXCFMpjbImb30jksLM5DNuUnhGz29qbUR7iovsCc/bE3JIhTay8TDBBIe58e0 WFhSM9U+wG0w9G2nh4kZ1Z5+bMp5s2V7AjAYsjStnEiyMkl6TEeMUEgUERGI8dOU7l2sNZ/jpFm qNwocSa/ge8hOMAaKetAs3z/HyYfhD8CCvuOpz/7IGoTEKSmGXx6PuelSL44utENoYSrtkSezJe 7yZQ5Q1LLVrjUXXsKeVd0IZAVy5xj2WfaKS7GQYjYzIY/zdSQpg4fNlEEaTMgc5DGitfWZwO3/E 1CBPvGNUhEBb1RcABzwXfXlNSZqm57LzjD5u9YypKQ= X-Received: by 2002:a05:6a21:50b:b0:3c3:8aa8:6caf with SMTP id adf61e73a8af0-3cb85efb72bmr1956240637.27.1785879358555; Tue, 04 Aug 2026 14:35:58 -0700 (PDT) Received: from LAPTOP-DPAKMOI4.it.purdue.edu (pal-210-106-74.itap.purdue.edu. [128.210.106.74]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31586447d52sm7628775eec.12.2026.08.04.14.35.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Aug 2026 14:35:58 -0700 (PDT) From: Yifei Gao To: Eric Van Hensbergen , Latchesar Ionkov , Dominique Martinet , v9fs@lists.linux.dev Cc: Christian Schoenebeck , Juergen Gross , Boris Ostrovsky , Stefano Stabellini , xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org, Yifei Gao , stable@vger.kernel.org Subject: [PATCH] 9p/xen: fix refcount leak in p9_xen_response() on wrong tag Date: Tue, 4 Aug 2026 21:35:49 +0000 Message-ID: <20260804213550.3409638-1-gyf161023@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" p9_xen_response() looks up the request for an incoming reply with p9_tag_lookup(), which takes a reference on the returned p9_req_t. When the tag does not resolve to a request in REQ_STATUS_SENT, the function warns and continues the loop without dropping that reference, permanently leaking the p9_req_t and its msize buffers. The reply header, including the tag, is supplied by the backend, so a malicious or buggy 9P backend can leak kernel memory on every crafted response. Drop the reference before continuing, mirroring the equivalent path in trans_fd.c. Fixes: f66c72bea129 ("xen/9pfs: receive responses") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Yifei Gao Reviewed-by: Stefano Stabellini --- net/9p/trans_xen.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index f9fb2db7a066..8eea0da8797f 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -203,6 +203,8 @@ static void p9_xen_response(struct work_struct *work) req =3D p9_tag_lookup(priv->client, h.tag); if (!req || req->status !=3D REQ_STATUS_SENT) { dev_warn(&priv->dev->dev, "Wrong req tag=3D%x\n", h.tag); + if (req) + p9_req_put(priv->client, req); cons +=3D h.size; virt_mb(); ring->intf->in_cons =3D cons; --=20 2.43.0