diff options
| author | Simon Derr <simon.derr@bull.net> | 2013-06-21 15:32:38 +0200 |
|---|---|---|
| committer | Eric Van Hensbergen <ericvh@gmail.com> | 2013-07-07 22:02:28 -0500 |
| commit | 47229ff85e5a0b0613df2288d212938aeb9687da (patch) | |
| tree | 8ebb938dc2b5187b44bf2e5e980dca96e5e1e3c2 /net | |
| parent | 3fcc62f4e8620fd5f85f957a5e708e69a20adb51 (diff) | |
| download | linux-stable-47229ff85e5a0b0613df2288d212938aeb9687da.tar.gz linux-stable-47229ff85e5a0b0613df2288d212938aeb9687da.tar.bz2 linux-stable-47229ff85e5a0b0613df2288d212938aeb9687da.zip | |
9P/RDMA: Protect against duplicate replies
A well-behaved server would not send twice the reply to a request.
But if it ever happens...
This additional check prevents the kernel from leaking memory
and possibly more nasty consequences in that unlikely event.
Signed-off-by: Simon Derr <simon.derr@bull.net>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/9p/trans_rdma.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c index b8b66d38f5b0..274a9c1d3c3d 100644 --- a/net/9p/trans_rdma.c +++ b/net/9p/trans_rdma.c @@ -294,6 +294,13 @@ handle_recv(struct p9_client *client, struct p9_trans_rdma *rdma, if (!req) goto err_out; + /* Check that we have not yet received a reply for this request. + */ + if (unlikely(req->rc)) { + pr_err("Duplicate reply for request %d", tag); + goto err_out; + } + req->rc = c->rc; req->status = REQ_STATUS_RCVD; p9_client_cb(client, req); |