9P/RDMA: Protect against duplicate replies

A well-behaved server would not send twice the reply to a request.
But if it ever happens...
This additional check prevents the kernel from leaking memory
and possibly more nasty consequences in that unlikely event.

Signed-off-by: Simon Derr <simon.derr@bull.net>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index b8b66d38f5b0..274a9c1d3c3d 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -294,6 +294,13 @@ handle_recv(struct p9_client *client, struct p9_trans_rdma *rdma,
         if (!req)
                 goto err_out;
 
+        /* Check that we have not yet received a reply for this request.
+         */
+        if (unlikely(req->rc)) {
+                pr_err("Duplicate reply for request %d", tag);
+                goto err_out;
+        }
+
         req->rc = c->rc;
         req->status = REQ_STATUS_RCVD;
         p9_client_cb(client, req);