connection: only one KDBUS_ITEM_CANCEL_FD item is allowed

Make sure that only one KDBUS_ITEM_CANCEL_FD item is passed.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>

diff --git a/connection.c b/connection.c
index 7045d92a3b372465f35c51e554b7710b36e0c83a..a0f749a7e10a5b6237bb4a9a94a895e8e89be607 100644 (file)
--- a/connection.c
+++ b/connection.c
@@ -799,6 +799,11 @@ int kdbus_cmd_msg_send(struct kdbus_conn *conn_src,
                        break;
 
                case KDBUS_ITEM_CANCEL_FD:
+                       if (cancel_fd) {
+                               ret = -EEXIST;
+                               goto exit_put_cancelfd;
+                       }
+
                        cancel_fd = fget(item->fds[0]);
                        if (IS_ERR(cancel_fd))
                                return PTR_ERR(cancel_fd);