From: Chuck Lever <chuck.lever@oracle.com>
Date: Mon, 16 Oct 2017 15:01:06 -0400
Subject: [PATCH] xprtrdma: Throw away reply when version is unrecognized
Git-commit: 61433af56077f5fd8815281b44938d84feb04687
Patch-mainline: v4.15
References: git-fixes

A reply with an unrecognized value in the version field means the
transport header is potentially garbled and therefore all the fields
are untrustworthy.

Fixes: 59aa1f9a3cce3 ("xprtrdma: Properly handle RDMA_ERROR ... ")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Acked-by: NeilBrown <neilb@suse.com>

---
 net/sunrpc/xprtrdma/rpc_rdma.c |   17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1013,6 +1013,9 @@ rpcrdma_reply_handler(struct work_struct
 	if (rpcrdma_is_bcall(headerp))
 		goto out_bcall;
 #endif
+	if (headerp->rm_vers != rpcrdma_version)
+		goto out_badversion;
+
 
 	/* Match incoming rpcrdma_rep to an rpcrdma_req to
 	 * get context for handling any incoming chunks.
@@ -1056,8 +1059,6 @@ rpcrdma_reply_handler(struct work_struct
 	if (!rqst)
 		goto out_norqst;
 	xprt->reestablish_timeout = 0;
-	if (headerp->rm_vers != rpcrdma_version)
-		goto out_badversion;
 
 	/* check for expected message types */
 	/* The order of some of these tests is important. */
@@ -1155,17 +1156,15 @@ out_bcall:
 	return;
 #endif
 
-/* If the incoming reply terminated a pending RPC, the next
- * RPC call will post a replacement receive buffer as it is
- * being marshaled.
- */
 out_badversion:
 	dprintk("RPC:       %s: invalid version %d\n",
 		__func__, be32_to_cpu(headerp->rm_vers));
-	status = -EIO;
-	r_xprt->rx_stats.bad_reply_count++;
-	goto out;
+	goto repost;
 
+/* If the incoming reply terminated a pending RPC, the next
+ * RPC call will post a replacement receive buffer as it is
+ * being marshaled.
+ */
 out_rdmaerr:
 	rmerr = be32_to_cpu(headerp->rm_body.rm_error.rm_err);
 	switch (rmerr) {