From: Simon Derr <simon.derr@bull.net>
Date: Fri, 21 Jun 2013 13:32:38 +0000 (+0200)
Subject: 9P/RDMA: Protect against duplicate replies
X-Git-Tag: firefly_0821_release~176^2~5716^2~6
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=47229ff85e5a0b0613df2288d212938aeb9687da;p=firefly-linux-kernel-4.4.55.git

9P/RDMA: Protect against duplicate replies

A well-behaved server would not send twice the reply to a request.
But if it ever happens...
This additional check prevents the kernel from leaking memory
and possibly more nasty consequences in that unlikely event.

Signed-off-by: Simon Derr <simon.derr@bull.net>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
---

diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index b8b66d38f5b0..274a9c1d3c3d 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -294,6 +294,13 @@ handle_recv(struct p9_client *client, struct p9_trans_rdma *rdma,
 	if (!req)
 		goto err_out;
 
+	/* Check that we have not yet received a reply for this request.
+	 */
+	if (unlikely(req->rc)) {
+		pr_err("Duplicate reply for request %d", tag);
+		goto err_out;
+	}
+
 	req->rc = c->rc;
 	req->status = REQ_STATUS_RCVD;
 	p9_client_cb(client, req);