Commit f1ea3cd7 authored by Haiyang Zhang's avatar Haiyang Zhang Committed by David S. Miller
Browse files

hyperv: Fix RNDIS send_completion code path 



In some cases, the VM_PKT_COMP message can arrive later than RNDIS completion
message, which will free the packet memory. This may cause panic due to access
to freed memory in netvsc_send_completion().

This patch fixes this problem by removing rndis_filter_send_request_completion()
from the code path. The function was a no-op.

Reported-by: default avatarLong Li <longli@microsoft.com>
Tested-by: default avatarLong Li <longli@microsoft.com>
Signed-off-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: default avatarK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fd5c07a8

drivers/net/hyperv/netvsc.c

+12 −5
Original line number Diff line number Diff line
@@ -470,8 +470,10 @@ static void netvsc_send_completion(struct hv_device *device, 
			packet->trans_id;



		/* Notify the layer above us */

		if (nvsc_packet)

			nvsc_packet->completion.send.send_completion(

			nvsc_packet->completion.send.send_completion_ctx);

				nvsc_packet->completion.send.

				send_completion_ctx);



		num_outstanding_sends =

			atomic_dec_return(&net_device->num_outstanding_sends);
@@ -498,6 +500,7 @@ int netvsc_send(struct hv_device *device, 
	int ret = 0;

	struct nvsp_message sendMessage;

	struct net_device *ndev;

	u64 req_id;



	net_device = get_outbound_net_device(device);

	if (!net_device)
@@ -518,20 +521,24 @@ int netvsc_send(struct hv_device *device, 
		0xFFFFFFFF;

	sendMessage.msg.v1_msg.send_rndis_pkt.send_buf_section_size = 0;



	if (packet->completion.send.send_completion)

		req_id = (u64)packet;

	else

		req_id = 0;



	if (packet->page_buf_cnt) {

		ret = vmbus_sendpacket_pagebuffer(device->channel,

						  packet->page_buf,

						  packet->page_buf_cnt,

						  &sendMessage,

						  sizeof(struct nvsp_message),

						  (unsigned long)packet);

						  req_id);

	} else {

		ret = vmbus_sendpacket(device->channel, &sendMessage,

				sizeof(struct nvsp_message),

				(unsigned long)packet,

				req_id,

				VM_PKT_DATA_INBAND,

				VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);



	}



	if (ret == 0) {

drivers/net/hyperv/rndis_filter.c

+1 −13
Original line number Diff line number Diff line
@@ -61,9 +61,6 @@ struct rndis_request { 


static void rndis_filter_send_completion(void *ctx);



static void rndis_filter_send_request_completion(void *ctx);







static struct rndis_device *get_rndis_device(void)

{
@@ -241,10 +238,7 @@ static int rndis_filter_send_request(struct rndis_device *dev, 
			packet->page_buf[0].len;

	}



	packet->completion.send.send_completion_ctx = req;/* packet; */

	packet->completion.send.send_completion =

		rndis_filter_send_request_completion;

	packet->completion.send.send_completion_tid = (unsigned long)dev;

	packet->completion.send.send_completion = NULL;



	ret = netvsc_send(dev->net_dev->dev, packet);

	return ret;
@@ -999,9 +993,3 @@ static void rndis_filter_send_completion(void *ctx) 
	/* Pass it back to the original handler */

	filter_pkt->completion(filter_pkt->completion_ctx);

}
 




static void rndis_filter_send_request_completion(void *ctx)

{

	/* Noop */

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE