[PATCH] 9p: release the request when the response tag is not in flight

[PATCH] 9p: release the request when the response tag is not in flight

[Wentao Liang]

usb9pfs_rx_header() takes a reference on the request returned by
p9_tag_lookup(), but the shared error check returns NULL without
dropping it when the lookup succeeds and the request is no longer in
REQ_STATUS_SENT. That state is reachable: a cancelled request can still
be found in the idr with REQ_STATUS_FLSHD, and a duplicate reply can
arrive while the client still holds the request in REQ_STATUS_RCVD.
Only the parse and lookup failures may return without a reference.

Split the check and put the reference on the unexpected tag path, like
the other error paths in the function.

Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 net/9p/trans_usbg.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/9p/trans_usbg.c b/net/9p/trans_usbg.c
index 419cda13a7b5..c677ca0e4440 100644
--- a/net/9p/trans_usbg.c
+++ b/net/9p/trans_usbg.c
@@ -203,11 +203,17 @@ static struct p9_req_t *usb9pfs_rx_header(struct f_usb9pfs *usb9pfs, void *buf)
 		 usb9pfs, rc.size, rc.tag);
 
 	p9_rx_req = p9_tag_lookup(usb9pfs->client, rc.tag);
-	if (!p9_rx_req || p9_rx_req->status != REQ_STATUS_SENT) {
+	if (!p9_rx_req) {
 		p9_debug(P9_DEBUG_ERROR, "Unexpected packet tag %d\n", rc.tag);
 		return NULL;
 	}
 
+	if (p9_rx_req->status != REQ_STATUS_SENT) {
+		p9_debug(P9_DEBUG_ERROR, "Unexpected packet tag %d\n", rc.tag);
+		p9_req_put(usb9pfs->client, p9_rx_req);
+		return NULL;
+	}
+
 	if (rc.size > p9_rx_req->rc.capacity) {
 		p9_debug(P9_DEBUG_ERROR,
 			 "requested packet size too big: %d for tag %d with capacity %zd\n",
-- 
2.34.1

Re: [PATCH] 9p: release the request when the response tag is not in flight

[sashiko-bot]

> usb9pfs_rx_header() takes a reference on the request returned by
> p9_tag_lookup(), but the shared error check returns NULL without
> dropping it when the lookup succeeds and the request is no longer in
> REQ_STATUS_SENT. That state is reachable: a cancelled request can still
> be found in the idr with REQ_STATUS_FLSHD, and a duplicate reply can
> arrive while the client still holds the request in REQ_STATUS_RCVD.
> Only the parse and lookup failures may return without a reference.
> 
> Split the check and put the reference on the unexpected tag path, like
> the other error paths in the function.
> 
> Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104022807.1484097-1-vulab@iscas.ac.cn?part=1

Re: [PATCH] 9p: release the request when the response tag is not in flight

[Krzysztof Kozlowski]

On Wed, 04 Nov 2026 02:28:07 +0000, Wentao Liang wrote:
> usb9pfs_rx_header() takes a reference on the request returned by
> p9_tag_lookup(), but the shared error check returns NULL without
> dropping it when the lookup succeeds and the request is no longer in
> REQ_STATUS_SENT. That state is reachable: a cancelled request can still
> be found in the idr with REQ_STATUS_FLSHD, and a duplicate reply can
> arrive while the client still holds the request in REQ_STATUS_RCVD.
> Only the parse and lookup failures may return without a reference.
> 
> Split the check and put the reference on the unexpected tag path, like
> the other error paths in the function.
> 
> Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  net/9p/trans_usbg.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof