9P/RDMA: Protect against duplicate replies

A well-behaved server would not send twice the reply to a request.
But if it ever happens...
This additional check prevents the kernel from leaking memory
and possibly more nasty consequences in that unlikely event.

Signed-off-by: Simon Derr <simon.derr@bull.net>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>

diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index b8b66d38f5b06be49ab5fc0dce3c1f9be3d50d63..274a9c1d3c3deeb00b0ddd96a0eff91dac5b0b2c 100644 (file)
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -294,6 +294,13 @@ handle_recv(struct p9_client *client, struct p9_trans_rdma *rdma,
        if (!req)
                goto err_out;
 
+       /* Check that we have not yet received a reply for this request.
+        */
+       if (unlikely(req->rc)) {
+               pr_err("Duplicate reply for request %d", tag);
+               goto err_out;
+       }
+
        req->rc = c->rc;
        req->status = REQ_STATUS_RCVD;
        p9_client_cb(client, req);