1 files changed, 49 insertions, 3 deletions

diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index e18596146013..8975c10591c3 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -270,6 +270,12 @@ struct sock_xprt {
 #define TCP_RCV_COPY_FRAGHDR    (1UL << 1)
 #define TCP_RCV_COPY_XID        (1UL << 2)
 #define TCP_RCV_COPY_DATA       (1UL << 3)
+#define TCP_RCV_COPY_CALLDIR    (1UL << 4)
+
+/*
+ * TCP RPC flags
+ */
+#define TCP_RPC_REPLY           (1UL << 5)
 
 static inline struct sockaddr *xs_addr(struct rpc_xprt *xprt)
 {
@@ -956,7 +962,7 @@ static inline void xs_tcp_read_fraghdr(struct rpc_xprt *xprt, struct xdr_skb_rea
         transport->tcp_offset = 0;
 
         /* Sanity check of the record length */
-        if (unlikely(transport->tcp_reclen < 4)) {
+        if (unlikely(transport->tcp_reclen < 8)) {
                 dprintk("RPC:       invalid TCP record fragment length\n");
                 xprt_force_disconnect(xprt);
                 return;
@@ -991,13 +997,48 @@ static inline void xs_tcp_read_xid(struct sock_xprt *transport, struct xdr_skb_r
         if (used != len)
                 return;
         transport->tcp_flags &= ~TCP_RCV_COPY_XID;
-        transport->tcp_flags |= TCP_RCV_COPY_DATA;
+        transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
         transport->tcp_copied = 4;
-        dprintk("RPC:       reading reply for XID %08x\n",
+        dprintk("RPC:       reading %s XID %08x\n",
+                        (transport->tcp_flags & TCP_RPC_REPLY) ? "reply for"
+                                                              : "request with",
                         ntohl(transport->tcp_xid));
         xs_tcp_check_fraghdr(transport);
 }
 
+static inline void xs_tcp_read_calldir(struct sock_xprt *transport,
+                                       struct xdr_skb_reader *desc)
+{
+        size_t len, used;
+        u32 offset;
+        __be32  calldir;
+
+        /*
+         * We want transport->tcp_offset to be 8 at the end of this routine
+         * (4 bytes for the xid and 4 bytes for the call/reply flag).
+         * When this function is called for the first time,
+         * transport->tcp_offset is 4 (after having already read the xid).
+         */
+        offset = transport->tcp_offset - sizeof(transport->tcp_xid);
+        len = sizeof(calldir) - offset;
+        dprintk("RPC:       reading CALL/REPLY flag (%Zu bytes)\n", len);
+        used = xdr_skb_read_bits(desc, &calldir, len);
+        transport->tcp_offset += used;
+        if (used != len)
+                return;
+        transport->tcp_flags &= ~TCP_RCV_COPY_CALLDIR;
+        transport->tcp_flags |= TCP_RCV_COPY_DATA;
+        transport->tcp_copied += 4;
+        if (ntohl(calldir) == RPC_REPLY)
+                transport->tcp_flags |= TCP_RPC_REPLY;
+        else
+                transport->tcp_flags &= ~TCP_RPC_REPLY;
+        dprintk("RPC:       reading %s CALL/REPLY flag %08x\n",
+                        (transport->tcp_flags & TCP_RPC_REPLY) ?
+                                "reply for" : "request with", calldir);
+        xs_tcp_check_fraghdr(transport);
+}
+
 static inline void xs_tcp_read_request(struct rpc_xprt *xprt, struct xdr_skb_reader *desc)
 {
         struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
@@ -1114,6 +1155,11 @@ static int xs_tcp_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb, uns
                         xs_tcp_read_xid(transport, &desc);
                         continue;
                 }
+                /* Read in the call/reply flag */
+                if (transport->tcp_flags & TCP_RCV_COPY_CALLDIR) {
+                        xs_tcp_read_calldir(transport, &desc);
+                        continue;
+                }
                 /* Read in the request data */
                 if (transport->tcp_flags & TCP_RCV_COPY_DATA) {
                         xs_tcp_read_request(xprt, &desc);