From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lf1-f54.google.com (mail-lf1-f54.google.com [209.85.167.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA3623F44EA for ; Thu, 18 Jun 2026 12:19:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781785149; cv=none; b=ZP6tXlIm6sWg7Ep90KJDWWxg+GvmDlfQWYZKa3oDpUHQkSkZVooR+IyhZJTT8OSdK86FQgRbM/d4lNBXSn+G4cwhCdqcYiFHJBLJr00LtRbKaNqbtAfhqRMqvTl7q9g6mZzxGkh8lmxs5Tumpt10xlAre5kwhAyqTDfvABwnNKw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781785149; c=relaxed/simple; bh=1h85HEiwu5SrvP6LXSFmCX8HYJCZmpF9jCx93UjL+R4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=CQGKMxmQyqkc+YOe/Kgc3ImcDuRFzzL4KSbgYZfCm76Q0OgF9q1Xig/ZvYXjGN/Lb34QPfzfaub2HkCw+eqBCbEGFVAj5OkIeLBi5C12ACtPgV64ilTJ8GPjqA1g06pLCJWzyzo7YMdSOJwMdyhnvUy7HQiZ9oYB9Wyb6tZBNmY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Z8Mri2I0; arc=none smtp.client-ip=209.85.167.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Z8Mri2I0" Received: by mail-lf1-f54.google.com with SMTP id 2adb3069b0e04-5aa6792e7b8so989843e87.1 for ; Thu, 18 Jun 2026 05:19:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781785145; x=1782389945; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=UqmSWHmzTjiXv/ea7OlEQSmT2M86q0mo+1Enkd+tLH4=; b=Z8Mri2I03uhCf8ZQU9bkmM3N7GPUTMl+4ZjPcsDsqcCmbkD7GJ5iQfCLQ0uxyOGklx nBDEYg0NEV/V6LOs2lO21+S1RQr2Pv799svKwZvOPke+3yjE0pATWAW6w2u8sLQ8V2yt Av/YJO7vXd30SByDTBmEtEoT8g9bEd7TmHgzBrVDLZwujwPBGYsbfDnmoLUxOqy1YPAV xxOoIkDZy/H/unUv97wFzSRKOpaG8Yyt3yB03HJZivotuBiZlKYJYFxW891/VudVxd2P O+SJCTAg6nVu7bUcGagB99IEzkNC18TDp0kUP6vTiPSVC+tGa8s9+VVzdRuf51KklwHv qDag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781785145; x=1782389945; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=UqmSWHmzTjiXv/ea7OlEQSmT2M86q0mo+1Enkd+tLH4=; b=JNcFVpL/OM8xg0u2d/8RYHqvteINQtXPqJBEeDOHD6rJRQ9y0f80nDqRBSYrXtQ9if 8siiqI4eT2HSxjAmaRkSwmaEJmZILZhCy7L0xA3xEe8XODzWq32zqZIiUuBNnluBtV6p pfGvFMIE/+BhJRbxjHkBZt1kSObDE3FzV7e8j+LY+0z7Xde0jTRyOP6AgUyIk0cLatqc ANJWzdQ1N7HxeMaIPoMW0CbIcT2ZaJn3KSEq5n0IelvgUEh5bPRDQCHGk35JiDwH6+PX J6NaRbTn/GAj1Z6zW+YxuVKVb7oqYyOaiZIIcUbtxTLYdpwXP0L1LUV4182GP0fQhih/ NJpw== X-Forwarded-Encrypted: i=1; AFNElJ8zq9CZuPnaGdC7HglB0WOlzTXWFekaRoRlz8JEpt5k5ViLzEnsxdrQqCs01vwCxqOmAhIBaDoPlQfaAh4=@vger.kernel.org X-Gm-Message-State: AOJu0Yy4iZ5cTm7o/lo0G/iTuarqx0X/ZDUIgbA/CZCsahx5ud5z1ZAb jGyTYsm18ZdXP0bxanTXGFD+8MX9LmqVYziGTA5+zYoDLrV7kPnPoaBZ X-Gm-Gg: AfdE7cnosQUttqLPKjj6P9HNMM+qluTWxXySQ40hMCeGs5qG4CwqmORRvpp7MZ6IUJ4 qioT9pegk7rFThylczrzx87V1fSQHspOT1VjEs6hEJhLBzonPbQMoEo8j+NSfNoGN6XNtIUlJlj AvfmJv7BVcZ6LNC8+O/yGt11ItEOdk+0b2ptShZMM43NaSRvcg+PSWR1KlggYNsQoJUA7wg9GI8 jcE+iTq94TnmsAB/CzgQaYVpZsccIDPesDolkGOS8VzPA4Q4oRsPw8dkoh7KFo+RugatXChvM22 JyJkl3ByozmiXJlLMwy0ZvoCyHU20FpncMMi+hLwSKp1Oa/O7hMBhRIt6JD6JLjzrDcGEDfQH10 TGTUDGPgEy6mhiJO3KVsdRZrzR+4lTXTa6K/0Y9z8k7zSNsxCArFJgWN4h4kot2VEDv55BBg5FI r9YKKi4OlmaA+N3fjB0agtcCjhUre0Tg== X-Received: by 2002:a05:6512:3509:b0:5ad:3035:fa47 with SMTP id 2adb3069b0e04-5ad4dadd259mr879893e87.53.1781785144944; Thu, 18 Jun 2026 05:19:04 -0700 (PDT) Received: from grower.astralinux.ru ([81.9.21.4]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5ad4eb57734sm657424e87.34.2026.06.18.05.19.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Jun 2026 05:19:04 -0700 (PDT) From: Alexander Martyniuk To: stable@vger.kernel.org, Greg Kroah-Hartman Cc: Alexander Martyniuk , Eric Van Hensbergen , Latchesar Ionkov , Dominique Martinet , "David S. Miller" , Jakub Kicinski , Tomas Bortoli , v9fs-developer@lists.sourceforge.net, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Eric Van Hensbergen , Christian Schoenebeck , v9fs@lists.linux.dev, lvc-project@linuxtesting.org, Hangyu Hua Subject: [PATCH 5.10] net: 9p: fix refcount leak in p9_read_work() error handling Date: Thu, 18 Jun 2026 15:19:21 +0000 Message-ID: <20260618151940.76321-1-alexevgmart@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Hangyu Hua commit 4ac7573e1f9333073fa8d303acc941c9b7ab7f61 upstream. p9_req_put need to be called when m->rreq->rc.sdata is NULL to avoid temporary refcount leak. Link: https://lkml.kernel.org/r/20220712104438.30800-1-hbh25y@gmail.com Fixes: 728356dedeff ("9p: Add refcount to p9_req_t") Signed-off-by: Hangyu Hua [Dominique: commit wording adjustments, p9_req_put argument fixes for rebase] Signed-off-by: Dominique Martinet [Alexander: this branch doesn't contain 8b11ff098af4 ("9p: Add client parameter to p9_req_put()"), therefore the parameter is removed from the added line] Signed-off-by: Alexander Martyniuk --- Backport fix for CVE-2022-50114 net/9p/trans_fd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index 40d458c438df..bd6a54e6f427 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -346,6 +346,7 @@ static void p9_read_work(struct work_struct *work) p9_debug(P9_DEBUG_ERROR, "No recv fcall for tag %d (req %p), disconnecting!\n", m->rc.tag, m->rreq); + p9_req_put(m->rreq); m->rreq = NULL; err = -EIO; goto error; -- 2.47.3