Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-26 06:02:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks

Browse Source 
The switch statement in netvsc_send_completion() is incorrectly validating
the length of incoming network packets by falling through to the next case.
Avoid the fallthrough. Instead break after a case match and then process
the complete() call.
The current code has not caused any known failures. But nonetheless, the
code should be corrected as a different ordering of the switch cases might
cause a length check to fail when it should not.

Signed-off-by: Sonia Sharma <sonia.sharma@linux.microsoft.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Sonia Sharma 2023-10-09 01:00:16 -07:00 committed by David S. Miller
parent 0e594c1f5d
commit 9bae5b0550
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/net/hyperv/netvsc.c
View File

@ -851,7 +851,7 @@ static void netvsc_send_completion(struct net_device *ndev,
msglen); msglen);
return; return;
} }
fallthrough; break;
case NVSP_MSG1_TYPE_SEND_RECV_BUF_COMPLETE: case NVSP_MSG1_TYPE_SEND_RECV_BUF_COMPLETE:
if (msglen < sizeof(struct nvsp_message_header) + if (msglen < sizeof(struct nvsp_message_header) +
@ -860,7 +860,7 @@ static void netvsc_send_completion(struct net_device *ndev,
msglen); msglen);
return; return;
} }
fallthrough; break;
case NVSP_MSG1_TYPE_SEND_SEND_BUF_COMPLETE: case NVSP_MSG1_TYPE_SEND_SEND_BUF_COMPLETE:
if (msglen < sizeof(struct nvsp_message_header) + if (msglen < sizeof(struct nvsp_message_header) +
@ -869,7 +869,7 @@ static void netvsc_send_completion(struct net_device *ndev,
msglen); msglen);
return; return;
} }
fallthrough; break;
case NVSP_MSG5_TYPE_SUBCHANNEL: case NVSP_MSG5_TYPE_SUBCHANNEL:
if (msglen < sizeof(struct nvsp_message_header) + if (msglen < sizeof(struct nvsp_message_header) +
@ -878,10 +878,6 @@ static void netvsc_send_completion(struct net_device *ndev,
msglen); msglen);
return; return;
} }
/* Copy the response back */
memcpy(&net_device->channel_init_pkt, nvsp_packet,
sizeof(struct nvsp_message));
complete(&net_device->channel_init_wait);
break; break;
case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE: case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE:
@ -904,13 +900,19 @@ static void netvsc_send_completion(struct net_device *ndev,
netvsc_send_tx_complete(ndev, net_device, incoming_channel, netvsc_send_tx_complete(ndev, net_device, incoming_channel,
desc, budget); desc, budget);
break; return;
default: default:
netdev_err(ndev, netdev_err(ndev,
"Unknown send completion type %d received!!\n", "Unknown send completion type %d received!!\n",
nvsp_packet->hdr.msg_type); nvsp_packet->hdr.msg_type);
return;
} }
/* Copy the response back */
memcpy(&net_device->channel_init_pkt, nvsp_packet,
sizeof(struct nvsp_message));
complete(&net_device->channel_init_wait);
} }
static u32 netvsc_get_next_send_section(struct netvsc_device *net_device) static u32 netvsc_get_next_send_section(struct netvsc_device *net_device)