Commit 9bae5b05 authored by Sonia Sharma's avatar Sonia Sharma Committed by David S. Miller
Browse files

hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks 



The switch statement in netvsc_send_completion() is incorrectly validating
the length of incoming network packets by falling through to the next case.
Avoid the fallthrough. Instead break after a case match and then process
the complete() call.
The current code has not caused any known failures. But nonetheless, the
code should be corrected as a different ordering of the switch cases might
cause a length check to fail when it should not.

Signed-off-by: default avatarSonia Sharma <sonia.sharma@linux.microsoft.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0e594c1f

drivers/net/hyperv/netvsc.c

+10 −8
Original line number Diff line number Diff line
@@ -851,7 +851,7 @@ static void netvsc_send_completion(struct net_device *ndev, 
				   msglen);

			return;

		}

		fallthrough;

		break;



	case NVSP_MSG1_TYPE_SEND_RECV_BUF_COMPLETE:

		if (msglen < sizeof(struct nvsp_message_header) +
@@ -860,7 +860,7 @@ static void netvsc_send_completion(struct net_device *ndev, 
				   msglen);

			return;

		}

		fallthrough;

		break;



	case NVSP_MSG1_TYPE_SEND_SEND_BUF_COMPLETE:

		if (msglen < sizeof(struct nvsp_message_header) +
@@ -869,7 +869,7 @@ static void netvsc_send_completion(struct net_device *ndev, 
				   msglen);

			return;

		}

		fallthrough;

		break;



	case NVSP_MSG5_TYPE_SUBCHANNEL:

		if (msglen < sizeof(struct nvsp_message_header) +
@@ -878,10 +878,6 @@ static void netvsc_send_completion(struct net_device *ndev, 
				   msglen);

			return;

		}

		/* Copy the response back */

		memcpy(&net_device->channel_init_pkt, nvsp_packet,

		       sizeof(struct nvsp_message));

		complete(&net_device->channel_init_wait);

		break;



	case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE:
@@ -904,13 +900,19 @@ static void netvsc_send_completion(struct net_device *ndev, 


		netvsc_send_tx_complete(ndev, net_device, incoming_channel,

					desc, budget);

		break;

		return;



	default:

		netdev_err(ndev,

			   "Unknown send completion type %d received!!\n",

			   nvsp_packet->hdr.msg_type);

		return;

	}



	/* Copy the response back */

	memcpy(&net_device->channel_init_pkt, nvsp_packet,

	       sizeof(struct nvsp_message));

	complete(&net_device->channel_init_wait);

}



static u32 netvsc_get_next_send_section(struct netvsc_device *net_device)