From 669c1fc61679f7e85f467c852bfe7b6c9dd75d25 Mon Sep 17 00:00:00 2001 From: Haiyang Zhang Date: Thu, 1 Sep 2011 12:19:47 -0700 Subject: [PATCH] staging: hv: fix the page buffer when rndis data go across page boundary In rndis_filter_receive_data(), we need to drop the 0th page and move the rest of pages forward if the rndis data go across page boundary, otherwise the page offset will overflow. Signed-off-by: Haiyang Zhang Signed-off-by: K. Y. Srinivasan Signed-off-by: Greg Kroah-Hartman --- drivers/staging/hv/rndis_filter.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/staging/hv/rndis_filter.c b/drivers/staging/hv/rndis_filter.c index 20e673d9e4b8..b32534507d4e 100644 --- a/drivers/staging/hv/rndis_filter.c +++ b/drivers/staging/hv/rndis_filter.c @@ -323,6 +323,7 @@ static void rndis_filter_receive_data(struct rndis_device *dev, { struct rndis_packet *rndis_pkt; u32 data_offset; + int i; rndis_pkt = &msg->msg.pkt; @@ -338,6 +339,15 @@ static void rndis_filter_receive_data(struct rndis_device *dev, pkt->page_buf[0].offset += data_offset; pkt->page_buf[0].len -= data_offset; + /* Drop the 0th page, if rndis data go beyond page boundary */ + if (pkt->page_buf[0].offset >= PAGE_SIZE) { + pkt->page_buf[1].offset = pkt->page_buf[0].offset - PAGE_SIZE; + pkt->page_buf[1].len -= pkt->page_buf[1].offset; + pkt->page_buf_cnt--; + for (i = 0; i < pkt->page_buf_cnt; i++) + pkt->page_buf[i] = pkt->page_buf[i+1]; + } + pkt->is_data_pkt = true; netvsc_recv_callback(dev->net_dev->dev, pkt); -- 2.20.1