summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTim Smith <tim@electronghost.co.uk>2014-02-07 18:58:43 +0000
committerDavid Howells <dhowells@redhat.com>2014-02-07 18:58:43 +0000
commitb6f3a40cb70fa53a5160b8f061ff219b00992626 (patch)
tree80504efb1a3d5b89143b17f668a1e40eb420793a
parent8961749e5f498d91ded20dc797bb77aa366bca2e (diff)
downloadlinux-b6f3a40cb70fa53a5160b8f061ff219b00992626.tar.bz2
af_rxrpc: Prevent RxRPC peers from ABORT-storming one another
When an ABORT is sent, aborting a connection, the sender quite reasonably forgets about the connection. If another frame is received, another ABORT will be sent. When the receiver gets it, it no longer applies to an extant connection, so an ABORT is sent, and so on... Prevent this by never sending a rejection for an ABORT packet. Signed-off-by: Tim Smith <tim@electronghost.co.uk> Signed-off-by: David Howells <dhowells@redhat.com>
-rw-r--r--net/rxrpc/ar-input.c12
1 files changed, 8 insertions, 4 deletions
diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
index 529572f18d1f..eb7e16276cc1 100644
--- a/net/rxrpc/ar-input.c
+++ b/net/rxrpc/ar-input.c
@@ -606,8 +606,10 @@ dead_call:
}
_debug("dead call");
- skb->priority = RX_CALL_DEAD;
- rxrpc_reject_packet(conn->trans->local, skb);
+ if (sp->hdr.type != RXRPC_PACKET_TYPE_ABORT) {
+ skb->priority = RX_CALL_DEAD;
+ rxrpc_reject_packet(conn->trans->local, skb);
+ }
goto done;
/* resend last packet of a completed call
@@ -790,8 +792,10 @@ cant_route_call:
skb->priority = RX_CALL_DEAD;
}
- _debug("reject");
- rxrpc_reject_packet(local, skb);
+ if (sp->hdr.type != RXRPC_PACKET_TYPE_ABORT) {
+ _debug("reject type %d",sp->hdr.type);
+ rxrpc_reject_packet(local, skb);
+ }
rxrpc_put_local(local);
_leave(" [no call]");
return;