Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 669c1fc6 authored by Haiyang Zhang's avatar Haiyang Zhang Committed by Greg Kroah-Hartman
Browse files

staging: hv: fix the page buffer when rndis data go across page boundary 



In rndis_filter_receive_data(), we need to drop the 0th page and move the
rest of pages forward if the rndis data go across page boundary, otherwise
the page offset will overflow.

Signed-off-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: default avatarK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent bf769375

drivers/staging/hv/rndis_filter.c

+10 −0
Original line number Diff line number Diff line
@@ -323,6 +323,7 @@ static void rndis_filter_receive_data(struct rndis_device *dev, 
{

	struct rndis_packet *rndis_pkt;

	u32 data_offset;

	int i;



	rndis_pkt = &msg->msg.pkt;
@@ -338,6 +339,15 @@ static void rndis_filter_receive_data(struct rndis_device *dev, 
	pkt->page_buf[0].offset += data_offset;

	pkt->page_buf[0].len -= data_offset;



	/* Drop the 0th page, if rndis data go beyond page boundary */

	if (pkt->page_buf[0].offset >= PAGE_SIZE) {

		pkt->page_buf[1].offset = pkt->page_buf[0].offset - PAGE_SIZE;

		pkt->page_buf[1].len -= pkt->page_buf[1].offset;

		pkt->page_buf_cnt--;

		for (i = 0; i < pkt->page_buf_cnt; i++)

			pkt->page_buf[i] = pkt->page_buf[i+1];

	}



	pkt->is_data_pkt = true;



	netvsc_recv_callback(dev->net_dev->dev, pkt);