diff options
| author | Haiyang Zhang <haiyangz@microsoft.com> | 2012-02-02 07:18:00 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-02-02 14:35:12 -0500 |
| commit | c31c151b1c4a29da4dc92212aa8648fb4f8557b9 (patch) | |
| tree | c61eb4b25fcac9f70cc381468b2365d85ca39ad6 /drivers/net/hyperv/rndis_filter.c | |
| parent | 0a282538cc1977655004cdb2eb25dd2b63f20637 (diff) | |
| download | op-kernel-dev-c31c151b1c4a29da4dc92212aa8648fb4f8557b9.zip op-kernel-dev-c31c151b1c4a29da4dc92212aa8648fb4f8557b9.tar.gz | |
net/hyperv: Fix the page buffer when an RNDIS message goes beyond page boundary
There is a possible data corruption if an RNDIS message goes beyond page
boundary in the sending code path. This patch fixes the problem.
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/hyperv/rndis_filter.c')
| -rw-r--r-- | drivers/net/hyperv/rndis_filter.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c index dc2e384..133b7fb 100644 --- a/drivers/net/hyperv/rndis_filter.c +++ b/drivers/net/hyperv/rndis_filter.c @@ -797,6 +797,19 @@ int rndis_filter_send(struct hv_device *dev, (unsigned long)rndisMessage & (PAGE_SIZE-1); pkt->page_buf[0].len = rndisMessageSize; + /* Add one page_buf if the rndis msg goes beyond page boundary */ + if (pkt->page_buf[0].offset + rndisMessageSize > PAGE_SIZE) { + int i; + for (i = pkt->page_buf_cnt; i > 1; i--) + pkt->page_buf[i] = pkt->page_buf[i-1]; + pkt->page_buf_cnt++; + pkt->page_buf[0].len = PAGE_SIZE - pkt->page_buf[0].offset; + pkt->page_buf[1].pfn = virt_to_phys((void *)((ulong) + rndisMessage + pkt->page_buf[0].len)) >> PAGE_SHIFT; + pkt->page_buf[1].offset = 0; + pkt->page_buf[1].len = rndisMessageSize - pkt->page_buf[0].len; + } + /* Save the packet send completion and context */ filterPacket->completion = pkt->completion.send.send_completion; filterPacket->completion_ctx = |
