ksmbd: fix type confusion via race condition when using ipc_msg_send_request

namjaejeon · namjaejeon · commit be31428f47e3 · 2025-02-21T14:13:54.000+09:00
Signed-off-by: Namjae Jeon &lt;linkinjeon@kernel.org&gt;
diff --git a/transport_ipc.c b/transport_ipc.c
@@ -283,6 +283,7 @@ static int handle_response(int type, void *payload, size_t sz)
 		if (entry->type + 1 != type) {
 			pr_err("Waiting for IPC type %d, got %d. Ignore.\n",
 			       entry->type + 1, type);
+			continue;
 		}
 
 		entry->response = kvzalloc(sz, KSMBD_DEFAULT_GFP);

Original file line number	Diff line number	Diff line change
`@@ -283,6 +283,7 @@ static int handle_response(int type, void *payload, size_t sz)`
`283`	`283`	`if (entry->type + 1 != type) {`
`284`	`284`	`pr_err("Waiting for IPC type %d, got %d. Ignore.\n",`
`285`	`285`	`entry->type + 1, type);`
	`286`	`+ continue;`
`286`	`287`	`}`
`287`	`288`
`288`	`289`	`entry->response = kvzalloc(sz, KSMBD_DEFAULT_GFP);`