Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9e096868 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'hv_netvsc-Fix-improve-RX-path-error-handling' 



Haiyang Zhang says:

====================
hv_netvsc: Fix/improve RX path error handling

Fix the status code returned to the host. Also add range
check for rx packet offset and length.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 74b4bed9 c5d24bdd

drivers/net/hyperv/hyperv_net.h

+1 −0
Original line number Diff line number Diff line
@@ -793,6 +793,7 @@ struct netvsc_device { 


	/* Receive buffer allocated by us but manages by NetVSP */

	void *recv_buf;

	u32 recv_buf_size; /* allocated bytes */

	u32 recv_buf_gpadl_handle;

	u32 recv_section_cnt;

	u32 recv_section_size;

drivers/net/hyperv/netvsc.c

+21 −4
Original line number Diff line number Diff line
@@ -282,6 +282,8 @@ static int netvsc_init_buf(struct hv_device *device, 
		goto cleanup;

	}



	net_device->recv_buf_size = buf_size;



	/*

	 * Establish the gpadl handle for this buffer on this

	 * channel.  Note: This call uses the vmbus connection rather
@@ -1095,15 +1097,30 @@ static int netvsc_receive(struct net_device *ndev, 


	/* Each range represents 1 RNDIS pkt that contains 1 ethernet frame */

	for (i = 0; i < count; i++) {

		void *data = recv_buf

			+ vmxferpage_packet->ranges[i].byte_offset;

		u32 offset = vmxferpage_packet->ranges[i].byte_offset;

		u32 buflen = vmxferpage_packet->ranges[i].byte_count;

		void *data;

		int ret;



		if (unlikely(offset + buflen > net_device->recv_buf_size)) {

			status = NVSP_STAT_FAIL;

			netif_err(net_device_ctx, rx_err, ndev,

				  "Packet offset:%u + len:%u too big\n",

				  offset, buflen);



			continue;

		}



		data = recv_buf + offset;



		trace_rndis_recv(ndev, q_idx, data);



		/* Pass it to the upper layer */

		status = rndis_filter_receive(ndev, net_device,

		ret = rndis_filter_receive(ndev, net_device,

					   channel, data, buflen);



		if (unlikely(ret != NVSP_STAT_SUCCESS))

			status = NVSP_STAT_FAIL;

	}



	enq_receive_complete(ndev, net_device, q_idx,

drivers/net/hyperv/netvsc_drv.c

+1 −1
Original line number Diff line number Diff line
@@ -831,7 +831,7 @@ int netvsc_recv_callback(struct net_device *net, 
	u64_stats_update_end(&rx_stats->syncp);



	napi_gro_receive(&nvchan->napi, skb);

	return 0;

	return NVSP_STAT_SUCCESS;

}



static void netvsc_get_drvinfo(struct net_device *net,

drivers/net/hyperv/rndis_filter.c

+2 −2
Original line number Diff line number Diff line
@@ -437,10 +437,10 @@ int rndis_filter_receive(struct net_device *ndev, 
			"unhandled rndis message (type %u len %u)\n",

			   rndis_msg->ndis_msg_type,

			   rndis_msg->msg_len);

		break;

		return NVSP_STAT_FAIL;

	}



	return 0;

	return NVSP_STAT_SUCCESS;

}



static int rndis_filter_query_device(struct rndis_device *dev,