From: Sonia Sharma <sonia.sharma@linux.microsoft.com>
The switch statement in netvsc_send_completion() is incorrectly validating
the length of incoming network packets by falling through to the next case.
Avoid the fallthrough. Instead break after a case match and then process
the complete() call.
The current code has not caused any known failures. But nonetheless, the
code should be corrected as a different ordering of the switch cases might
cause a length check to fail when it should not.
Signed-off-by: Sonia Sharma <sonia.sharma@linux.microsoft.com>
---
Changes in v3:
* added return statement in default case as pointed by Michael Kelley.
Changes in v4:
* added fixes tag
* modified commit message to explain the issue fixed by patch.
Changes in v5:
* Dropped fixes tag as suggested by Simon Horman.
* fixed indentation
---
drivers/net/hyperv/netvsc.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 82e9796c8f5e..0f7e4d377776 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -851,7 +851,7 @@ static void netvsc_send_completion(struct net_device *ndev,
msglen);
return;
}
- fallthrough;
+ break;
case NVSP_MSG1_TYPE_SEND_RECV_BUF_COMPLETE:
if (msglen < sizeof(struct nvsp_message_header) +
@@ -860,7 +860,7 @@ static void netvsc_send_completion(struct net_device *ndev,
msglen);
return;
}
- fallthrough;
+ break;
case NVSP_MSG1_TYPE_SEND_SEND_BUF_COMPLETE:
if (msglen < sizeof(struct nvsp_message_header) +
@@ -869,7 +869,7 @@ static void netvsc_send_completion(struct net_device *ndev,
msglen);
return;
}
- fallthrough;
+ break;
case NVSP_MSG5_TYPE_SUBCHANNEL:
if (msglen < sizeof(struct nvsp_message_header) +
@@ -878,10 +878,6 @@ static void netvsc_send_completion(struct net_device *ndev,
msglen);
return;
}
- /* Copy the response back */
- memcpy(&net_device->channel_init_pkt, nvsp_packet,
- sizeof(struct nvsp_message));
- complete(&net_device->channel_init_wait);
break;
case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE:
@@ -904,13 +900,19 @@ static void netvsc_send_completion(struct net_device *ndev,
netvsc_send_tx_complete(ndev, net_device, incoming_channel,
desc, budget);
- break;
+ return;
default:
netdev_err(ndev,
"Unknown send completion type %d received!!\n",
nvsp_packet->hdr.msg_type);
+ return;
}
+
+ /* Copy the response back */
+ memcpy(&net_device->channel_init_pkt, nvsp_packet,
+ sizeof(struct nvsp_message));
+ complete(&net_device->channel_init_wait);
}
static u32 netvsc_get_next_send_section(struct netvsc_device *net_device)
--
2.25.1From: Sonia Sharma <sosha@linux.microsoft.com> Sent: Wednesday, September 27, 2023 2:19 PM > Patches to the Hyper-V netvsc driver usually have the patch subject prefix as only "hv_netvsc: ". Look at the commit log for the files in drivers/net/hyperv. There's value in consistency unless someone really thinks we need the "net:" prefix as well. > The switch statement in netvsc_send_completion() is incorrectly validating > the length of incoming network packets by falling through to the next case. > Avoid the fallthrough. Instead break after a case match and then process > the complete() call. > The current code has not caused any known failures. But nonetheless, the > code should be corrected as a different ordering of the switch cases might > cause a length check to fail when it should not. > > Signed-off-by: Sonia Sharma <sonia.sharma@linux.microsoft.com> > > --- > Changes in v3: > * added return statement in default case as pointed by Michael Kelley. > Changes in v4: > * added fixes tag > * modified commit message to explain the issue fixed by patch. > Changes in v5: > * Dropped fixes tag as suggested by Simon Horman. > * fixed indentation Is there anything different in this v6 versus the previous v5? I received v5 twice -- on 9/26 @ 10:50pm and then on 9/27 @ 2:17pm just a couple of minutes before this v6. Maybe the second v5 was intended to be v6? Is the difference another indentation change? In any case, the code looks good, Reviewed-by: Michael Kelley <mikelley@microsoft.com> > --- > drivers/net/hyperv/netvsc.c | 18 ++++++++++-------- > 1 file changed, 10 insertions(+), 8 deletions(-) > > diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c > index 82e9796c8f5e..0f7e4d377776 100644 > --- a/drivers/net/hyperv/netvsc.c > +++ b/drivers/net/hyperv/netvsc.c > @@ -851,7 +851,7 @@ static void netvsc_send_completion(struct net_device *ndev, > msglen); > return; > } > - fallthrough; > + break; > > case NVSP_MSG1_TYPE_SEND_RECV_BUF_COMPLETE: > if (msglen < sizeof(struct nvsp_message_header) + > @@ -860,7 +860,7 @@ static void netvsc_send_completion(struct net_device *ndev, > msglen); > return; > } > - fallthrough; > + break; > > case NVSP_MSG1_TYPE_SEND_SEND_BUF_COMPLETE: > if (msglen < sizeof(struct nvsp_message_header) + > @@ -869,7 +869,7 @@ static void netvsc_send_completion(struct net_device *ndev, > msglen); > return; > } > - fallthrough; > + break; > > case NVSP_MSG5_TYPE_SUBCHANNEL: > if (msglen < sizeof(struct nvsp_message_header) + > @@ -878,10 +878,6 @@ static void netvsc_send_completion(struct net_device *ndev, > msglen); > return; > } > - /* Copy the response back */ > - memcpy(&net_device->channel_init_pkt, nvsp_packet, > - sizeof(struct nvsp_message)); > - complete(&net_device->channel_init_wait); > break; > > case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE: > @@ -904,13 +900,19 @@ static void netvsc_send_completion(struct net_device > *ndev, > > netvsc_send_tx_complete(ndev, net_device, incoming_channel, > desc, budget); > - break; > + return; > > default: > netdev_err(ndev, > "Unknown send completion type %d received!!\n", > nvsp_packet->hdr.msg_type); > + return; > } > + > + /* Copy the response back */ > + memcpy(&net_device->channel_init_pkt, nvsp_packet, > + sizeof(struct nvsp_message)); > + complete(&net_device->channel_init_wait); > } > > static u32 netvsc_get_next_send_section(struct netvsc_device *net_device) > -- > 2.25.1
On Wed, Sep 27, 2023 at 02:19:16PM -0700, Sonia Sharma wrote: > From: Sonia Sharma <sonia.sharma@linux.microsoft.com> > > The switch statement in netvsc_send_completion() is incorrectly validating > the length of incoming network packets by falling through to the next case. > Avoid the fallthrough. Instead break after a case match and then process > the complete() call. > The current code has not caused any known failures. But nonetheless, the > code should be corrected as a different ordering of the switch cases might > cause a length check to fail when it should not. > > Signed-off-by: Sonia Sharma <sonia.sharma@linux.microsoft.com> Reviewed-by: Simon Horman <horms@kernel.org>
© 2016 - 2025 Red Hat, Inc.