Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks

The switch statement in netvsc_send_completion() is incorrectly validating
the length of incoming network packets by falling through to the next case.
Avoid the fallthrough. Instead break after a case match and then process
the complete() call.
The current code has not caused any known failures. But nonetheless, the
code should be corrected as a different ordering of the switch cases might
cause a length check to fail when it should not.

Signed-off-by: Sonia Sharma <sonia.sharma@linux.microsoft.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Sonia Sharma and committed by
David S. Miller
9bae5b05 0e594c1f

+10 -8
+10 -8
drivers/net/hyperv/netvsc.c
··· 851 851 msglen); 852 852 return; 853 853 } 854 - fallthrough; 854 + break; 855 855 856 856 case NVSP_MSG1_TYPE_SEND_RECV_BUF_COMPLETE: 857 857 if (msglen < sizeof(struct nvsp_message_header) + ··· 860 860 msglen); 861 861 return; 862 862 } 863 - fallthrough; 863 + break; 864 864 865 865 case NVSP_MSG1_TYPE_SEND_SEND_BUF_COMPLETE: 866 866 if (msglen < sizeof(struct nvsp_message_header) + ··· 869 869 msglen); 870 870 return; 871 871 } 872 - fallthrough; 872 + break; 873 873 874 874 case NVSP_MSG5_TYPE_SUBCHANNEL: 875 875 if (msglen < sizeof(struct nvsp_message_header) + ··· 878 878 msglen); 879 879 return; 880 880 } 881 - /* Copy the response back */ 882 - memcpy(&net_device->channel_init_pkt, nvsp_packet, 883 - sizeof(struct nvsp_message)); 884 - complete(&net_device->channel_init_wait); 885 881 break; 886 882 887 883 case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE: ··· 900 904 901 905 netvsc_send_tx_complete(ndev, net_device, incoming_channel, 902 906 desc, budget); 903 - break; 907 + return; 904 908 905 909 default: 906 910 netdev_err(ndev, 907 911 "Unknown send completion type %d received!!\n", 908 912 nvsp_packet->hdr.msg_type); 913 + return; 909 914 } 915 + 916 + /* Copy the response back */ 917 + memcpy(&net_device->channel_init_pkt, nvsp_packet, 918 + sizeof(struct nvsp_message)); 919 + complete(&net_device->channel_init_wait); 910 920 } 911 921 912 922 static u32 netvsc_get_next_send_section(struct netvsc_device *net_device)