From 4d183e6f153245aca2534e372152583b868dd925 Mon Sep 17 00:00:00 2001 From: Yifei Gao Date: Thu, 6 Aug 2026 14:42:54 +0000 Subject: [PATCH] 9p/xen: fix refcount leak in p9_xen_response() on wrong tag p9_xen_response() looks up the request for an incoming reply with p9_tag_lookup(), which takes a reference on the returned p9_req_t. When the tag does not resolve to a request in REQ_STATUS_SENT, the function warns and continues the loop without dropping that reference, permanently leaking the p9_req_t and its msize buffers. The reply header, including the tag, is supplied by the backend, so a malicious or buggy 9P backend can leak kernel memory on every crafted response. Drop the reference before continuing. Fixes: 728356dedeff ("9p: Add refcount to p9_req_t") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Yifei Gao Reviewed-by: Stefano Stabellini Message-ID: <20260806144255.4167019-1-gyf161023@gmail.com> Signed-off-by: Dominique Martinet --- net/9p/trans_xen.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index f9fb2db7a066..8eea0da8797f 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -203,6 +203,8 @@ static void p9_xen_response(struct work_struct *work) req = p9_tag_lookup(priv->client, h.tag); if (!req || req->status != REQ_STATUS_SENT) { dev_warn(&priv->dev->dev, "Wrong req tag=%x\n", h.tag); + if (req) + p9_req_put(priv->client, req); cons += h.size; virt_mb(); ring->intf->in_cons = cons;