Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aeca3a77 authored by Jim Baxter's avatar Jim Baxter Committed by David S. Miller
Browse files

net: cdc_ncm: Fix TX zero padding 



The zero padding that is added to NTB's does
not zero the memory correctly.
This is because the skb_put modifies the value
of skb_out->len which results in the memset
command not setting any memory to zero as
(ctx->tx_max - skb_out->len) == 0.

I have resolved this by storing the size of
the memory to be zeroed before the skb_put
and using this in the memset call.

Signed-off-by: default avatarJim Baxter <jim_baxter@mentor.com>
Reviewed-by: default avatarBjørn Mork <bjorn@mork.no>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b210aeae

drivers/net/usb/cdc_ncm.c

+7 −4
Original line number Diff line number Diff line
@@ -1088,6 +1088,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) 
	u16 n = 0, index, ndplen;

	u8 ready2send = 0;

	u32 delayed_ndp_size;

	size_t padding_count;



	/* When our NDP gets written in cdc_ncm_ndp(), then skb_out->len gets updated

	 * accordingly. Otherwise, we should check here.
@@ -1244,11 +1245,13 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) 
	 * a ZLP after full sized NTBs.

	 */

	if (!(dev->driver_info->flags & FLAG_SEND_ZLP) &&

	    skb_out->len > ctx->min_tx_pkt)

		memset(skb_put(skb_out, ctx->tx_max - skb_out->len), 0,

		       ctx->tx_max - skb_out->len);

	else if (skb_out->len < ctx->tx_max && (skb_out->len % dev->maxpacket) == 0)

	    skb_out->len > ctx->min_tx_pkt) {

		padding_count = ctx->tx_max - skb_out->len;

		memset(skb_put(skb_out, padding_count), 0, padding_count);

	} else if (skb_out->len < ctx->tx_max &&

		   (skb_out->len % dev->maxpacket) == 0) {

		*skb_put(skb_out, 1) = 0;	/* force short packet */

	}



	/* set final frame length */

	nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;