Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 61433af5 authored by Chuck Lever's avatar Chuck Lever Committed by Anna Schumaker
Browse files

xprtrdma: Throw away reply when version is unrecognized 



A reply with an unrecognized value in the version field means the
transport header is potentially garbled and therefore all the fields
are untrustworthy.

Fixes: 59aa1f9a ("xprtrdma: Properly handle RDMA_ERROR ... ")
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent 2b4f8923

net/sunrpc/xprtrdma/rpc_rdma.c

+8 −9
Original line number Diff line number Diff line
@@ -1248,6 +1248,9 @@ rpcrdma_reply_handler(struct work_struct *work) 
	p++;	/* credits */

	proc = *p++;



	if (vers != rpcrdma_version)

		goto out_badversion;



	if (rpcrdma_is_bcall(r_xprt, rep, xid, proc))

		return;
@@ -1280,8 +1283,6 @@ rpcrdma_reply_handler(struct work_struct *work) 
	}



	xprt->reestablish_timeout = 0;

	if (vers != rpcrdma_version)

		goto out_badversion;



	switch (proc) {

	case rdma_msg:
@@ -1321,17 +1322,15 @@ rpcrdma_reply_handler(struct work_struct *work) 
	}

	return;



/* If the incoming reply terminated a pending RPC, the next

 * RPC call will post a replacement receive buffer as it is

 * being marshaled.

 */

out_badversion:

	dprintk("RPC:       %s: invalid version %d\n",

		__func__, be32_to_cpu(vers));

	status = -EIO;

	r_xprt->rx_stats.bad_reply_count++;

	goto out;

	goto repost;



/* If the incoming reply terminated a pending RPC, the next

 * RPC call will post a replacement receive buffer as it is

 * being marshaled.

 */

out_badheader:

	dprintk("RPC: %5u %s: invalid rpcrdma reply (type %u)\n",

		rqst->rq_task->tk_pid, __func__, be32_to_cpu(proc));