diff options
| author | Haiyang Zhang <haiyangz@microsoft.com> | 2013-04-05 11:44:40 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-04-08 12:15:17 -0400 |
| commit | f1ea3cd70110d482ef1ce6ef158df113aa366f43 (patch) | |
| tree | ead600ab71402db00476255f4ed7f1d723eacdd3 /drivers/net/hyperv/rndis_filter.c | |
| parent | fd5c07a8d6a10c7112b19f3b0d428627c62b06ab (diff) | |
| download | op-kernel-dev-f1ea3cd70110d482ef1ce6ef158df113aa366f43.zip op-kernel-dev-f1ea3cd70110d482ef1ce6ef158df113aa366f43.tar.gz | |
hyperv: Fix RNDIS send_completion code path
In some cases, the VM_PKT_COMP message can arrive later than RNDIS completion
message, which will free the packet memory. This may cause panic due to access
to freed memory in netvsc_send_completion().
This patch fixes this problem by removing rndis_filter_send_request_completion()
from the code path. The function was a no-op.
Reported-by: Long Li <longli@microsoft.com>
Tested-by: Long Li <longli@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/hyperv/rndis_filter.c')
| -rw-r--r-- | drivers/net/hyperv/rndis_filter.c | 14 |
1 files changed, 1 insertions, 13 deletions
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c index 2b657d4..0775f0a 100644 --- a/drivers/net/hyperv/rndis_filter.c +++ b/drivers/net/hyperv/rndis_filter.c @@ -61,9 +61,6 @@ struct rndis_request { static void rndis_filter_send_completion(void *ctx); -static void rndis_filter_send_request_completion(void *ctx); - - static struct rndis_device *get_rndis_device(void) { @@ -241,10 +238,7 @@ static int rndis_filter_send_request(struct rndis_device *dev, packet->page_buf[0].len; } - packet->completion.send.send_completion_ctx = req;/* packet; */ - packet->completion.send.send_completion = - rndis_filter_send_request_completion; - packet->completion.send.send_completion_tid = (unsigned long)dev; + packet->completion.send.send_completion = NULL; ret = netvsc_send(dev->net_dev->dev, packet); return ret; @@ -999,9 +993,3 @@ static void rndis_filter_send_completion(void *ctx) /* Pass it back to the original handler */ filter_pkt->completion(filter_pkt->completion_ctx); } - - -static void rndis_filter_send_request_completion(void *ctx) -{ - /* Noop */ -} |
