| Message ID | 1371821563-5784-6-git-send-email-simon.derr@bull.net (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c index b8b66d3..274a9c1 100644 --- a/net/9p/trans_rdma.c +++ b/net/9p/trans_rdma.c @@ -294,6 +294,13 @@ handle_recv(struct p9_client *client, struct p9_trans_rdma *rdma, if (!req) goto err_out; + /* Check that we have not yet received a reply for this request. + */ + if (unlikely(req->rc)) { + pr_err("Duplicate reply for request %d", tag); + goto err_out; + } + req->rc = c->rc; req->status = REQ_STATUS_RCVD; p9_client_cb(client, req);
A well-behaved server would not send twice the reply to a request. But if it ever happens... This additional check prevents the kernel from leaking memory and possibly more nasty consequences in that unlikely event. Signed-off-by: Simon Derr <simon.derr@bull.net> --- net/9p/trans_rdma.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)