summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorSimon Derr <simon.derr@bull.net>2013-06-21 15:32:38 +0200
committerEric Van Hensbergen <ericvh@gmail.com>2013-07-08 05:02:28 +0200
commit47229ff85e5a0b0613df2288d212938aeb9687da (patch)
tree8ebb938dc2b5187b44bf2e5e980dca96e5e1e3c2 /net
parent9P/RDMA: increase P9_RDMA_MAXSIZE to 1MB (diff)
downloadlinux-47229ff85e5a0b0613df2288d212938aeb9687da.tar.xz
linux-47229ff85e5a0b0613df2288d212938aeb9687da.zip
9P/RDMA: Protect against duplicate replies
A well-behaved server would not send twice the reply to a request. But if it ever happens... This additional check prevents the kernel from leaking memory and possibly more nasty consequences in that unlikely event. Signed-off-by: Simon Derr <simon.derr@bull.net> Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Diffstat (limited to 'net')
-rw-r--r--net/9p/trans_rdma.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index b8b66d38f5b0..274a9c1d3c3d 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -294,6 +294,13 @@ handle_recv(struct p9_client *client, struct p9_trans_rdma *rdma,
if (!req)
goto err_out;
+ /* Check that we have not yet received a reply for this request.
+ */
+ if (unlikely(req->rc)) {
+ pr_err("Duplicate reply for request %d", tag);
+ goto err_out;
+ }
+
req->rc = c->rc;
req->status = REQ_STATUS_RCVD;
p9_client_cb(client, req);