Re: [PATCH v2] 9p/xen: fix refcount leak in p9_xen_response() on wrong tag

[Dominique Martinet <asmadeus@codewreck.org>]

Yifei Gao wrote on Thu, Aug 06, 2026 at 02:42:54PM +0000:
> p9_xen_response() looks up the request for an incoming reply with
> p9_tag_lookup(), which takes a reference on the returned p9_req_t. When
> the tag does not resolve to a request in REQ_STATUS_SENT, the function
> warns and continues the loop without dropping that reference, permanently
> leaking the p9_req_t and its msize buffers. The reply header, including
> the tag, is supplied by the backend, so a malicious or buggy 9P backend
> can leak kernel memory on every crafted response.
> 
> Drop the reference before continuing.
> 
> Fixes: 728356dedeff ("9p: Add refcount to p9_req_t")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Yifei Gao <gyf161023@gmail.com>
> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

Thanks, I've picked this up for 7.4

If someone is interested in the 9pfs xen backend security then sashiko
had a lot of "pre-existing issues" to talk about[1]... I tend to agree
with Stefano's point of view that the 9p backend is mostly trusted
though, so I'll take patches if someone wants to spend the effort, but
won't actively be able to contribute much more.

[1] https://sashiko.dev/#/patchset/20260806144255.4167019-1-gyf161023@gmail.com

-- 
Dominique