This is a note to let you know that I've just added the patch titled net: 9p: fix refcount leak in p9_read_work() error handling to the 5.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-9p-fix-refcount-leak-in-p9_read_work-error-handl.patch and it can be found in the queue-5.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit cf4fd192e28a8b479a0b3364d98fa8ea3181714a Author: Hangyu Hua <hbh25y@xxxxxxxxx> Date: Wed Jul 13 09:55:11 2022 +0900 net: 9p: fix refcount leak in p9_read_work() error handling [ Upstream commit 4ac7573e1f9333073fa8d303acc941c9b7ab7f61 ] p9_req_put need to be called when m->rreq->rc.sdata is NULL to avoid temporary refcount leak. Link: https://lkml.kernel.org/r/20220712104438.30800-1-hbh25y@xxxxxxxxx Fixes: 728356dedeff ("9p: Add refcount to p9_req_t") Signed-off-by: Hangyu Hua <hbh25y@xxxxxxxxx> [Dominique: commit wording adjustments, p9_req_put argument fixes for rebase] Signed-off-by: Dominique Martinet <asmadeus@xxxxxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index 007c3f45fe05..e758978b44be 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -343,6 +343,7 @@ static void p9_read_work(struct work_struct *work) p9_debug(P9_DEBUG_ERROR, "No recv fcall for tag %d (req %p), disconnecting!\n", m->rc.tag, m->rreq); + p9_req_put(m->client, m->rreq); m->rreq = NULL; err = -EIO; goto error;