Re: [PATCH] 9p/xen: fix refcount leak in p9_xen_response() on wrong tag

[Jürgen Groß]

On 05.08.26 02:06, Stefano Stabellini wrote:
> On Tue, 4 Aug 2026, Yifei Gao wrote:
> > p9_xen_response() looks up the request for an incoming reply with
> > p9_tag_lookup(), which takes a reference on the returned p9_req_t. When
> > the tag does not resolve to a request in REQ_STATUS_SENT, the function
> > warns and continues the loop without dropping that reference, permanently
> > leaking the p9_req_t and its msize buffers. The reply header, including
> > the tag, is supplied by the backend, so a malicious or buggy 9P backend
> > can leak kernel memory on every crafted response.
>
> Most backend are trusted, including this. So I would avoid "malicious".

No, I think this is fine.

Especially with driver domains malicious backends are a thing. They should
only be capable to deliver wrong or no data to the frontend, but ideally
the frontend should not trust the backend.

Any work towards that goal is to be supported IMHO, and there are already
frontends listed in Xen's support statement following this rule, so any
violation of that principle in those frontends will be regarded to be a
security issue worth an XSA.


Juergen

Attachment: OpenPGP_0xB0DE9DD628BF132F.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature