| From foo@baz Mon Apr 9 17:09:24 CEST 2018 |
| From: Jim Baxter <jim_baxter@mentor.com> |
| Date: Mon, 8 May 2017 13:49:57 +0100 |
| Subject: net: cdc_ncm: Fix TX zero padding |
| |
| From: Jim Baxter <jim_baxter@mentor.com> |
| |
| |
| [ Upstream commit aeca3a77b1e0ed06a095933b89c86aed007383eb ] |
| |
| The zero padding that is added to NTB's does |
| not zero the memory correctly. |
| This is because the skb_put modifies the value |
| of skb_out->len which results in the memset |
| command not setting any memory to zero as |
| (ctx->tx_max - skb_out->len) == 0. |
| |
| I have resolved this by storing the size of |
| the memory to be zeroed before the skb_put |
| and using this in the memset call. |
| |
| Signed-off-by: Jim Baxter <jim_baxter@mentor.com> |
| Reviewed-by: Bjørn Mork <bjorn@mork.no> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/usb/cdc_ncm.c | 11 +++++++---- |
| 1 file changed, 7 insertions(+), 4 deletions(-) |
| |
| --- a/drivers/net/usb/cdc_ncm.c |
| +++ b/drivers/net/usb/cdc_ncm.c |
| @@ -1118,6 +1118,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev |
| u16 n = 0, index, ndplen; |
| u8 ready2send = 0; |
| u32 delayed_ndp_size; |
| + size_t padding_count; |
| |
| /* When our NDP gets written in cdc_ncm_ndp(), then skb_out->len gets updated |
| * accordingly. Otherwise, we should check here. |
| @@ -1274,11 +1275,13 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev |
| * a ZLP after full sized NTBs. |
| */ |
| if (!(dev->driver_info->flags & FLAG_SEND_ZLP) && |
| - skb_out->len > ctx->min_tx_pkt) |
| - memset(skb_put(skb_out, ctx->tx_max - skb_out->len), 0, |
| - ctx->tx_max - skb_out->len); |
| - else if (skb_out->len < ctx->tx_max && (skb_out->len % dev->maxpacket) == 0) |
| + skb_out->len > ctx->min_tx_pkt) { |
| + padding_count = ctx->tx_max - skb_out->len; |
| + memset(skb_put(skb_out, padding_count), 0, padding_count); |
| + } else if (skb_out->len < ctx->tx_max && |
| + (skb_out->len % dev->maxpacket) == 0) { |
| *skb_put(skb_out, 1) = 0; /* force short packet */ |
| + } |
| |
| /* set final frame length */ |
| nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data; |