hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks

The switch statement in netvsc_send_completion() is incorrectly validating
the length of incoming network packets by falling through to the next case.
Avoid the fallthrough. Instead break after a case match and then process
the complete() call.
The current code has not caused any known failures. But nonetheless, the
code should be corrected as a different ordering of the switch cases might
cause a length check to fail when it should not.

Signed-off-by: Sonia Sharma <sonia.sharma@linux.microsoft.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 82e9796c8f5e5f9f8574cfed7bfbcefb35828172..1dafa44155d0eb31dfaea9cacdc3954ebee75f4b 100644 (file)
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -851,7 +851,7 @@ static void netvsc_send_completion(struct net_device *ndev,
                                   msglen);
                        return;
                }
-               fallthrough;
+               break;
 
        case NVSP_MSG1_TYPE_SEND_RECV_BUF_COMPLETE:
                if (msglen < sizeof(struct nvsp_message_header) +
@@ -860,7 +860,7 @@ static void netvsc_send_completion(struct net_device *ndev,
                                   msglen);
                        return;
                }
-               fallthrough;
+               break;
 
        case NVSP_MSG1_TYPE_SEND_SEND_BUF_COMPLETE:
                if (msglen < sizeof(struct nvsp_message_header) +
@@ -869,7 +869,7 @@ static void netvsc_send_completion(struct net_device *ndev,
                                   msglen);
                        return;
                }
-               fallthrough;
+               break;
 
        case NVSP_MSG5_TYPE_SUBCHANNEL:
                if (msglen < sizeof(struct nvsp_message_header) +
@@ -878,10 +878,6 @@ static void netvsc_send_completion(struct net_device *ndev,
                                   msglen);
                        return;
                }
-               /* Copy the response back */
-               memcpy(&net_device->channel_init_pkt, nvsp_packet,
-                      sizeof(struct nvsp_message));
-               complete(&net_device->channel_init_wait);
                break;
 
        case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE:
@@ -904,13 +900,19 @@ static void netvsc_send_completion(struct net_device *ndev,
 
                netvsc_send_tx_complete(ndev, net_device, incoming_channel,
                                        desc, budget);
-               break;
+               return;
 
        default:
                netdev_err(ndev,
                           "Unknown send completion type %d received!!\n",
                           nvsp_packet->hdr.msg_type);
+               return;
        }
+
+       /* Copy the response back */
+       memcpy(&net_device->channel_init_pkt, nvsp_packet,
+              sizeof(struct nvsp_message));
+       complete(&net_device->channel_init_wait);
 }
 
 static u32 netvsc_get_next_send_section(struct netvsc_device *net_device)