From 24ae2dc565b0ca024175330b55eb4ba0fd9823b9 Mon Sep 17 00:00:00 2001
From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Date: Wed, 1 Feb 2012 20:17:23 +0000
Subject: [PATCH] --- yaml --- r: 287477 b: refs/heads/master c:
 4b8a8bc9249f144803d840f2f7608ee9bbf1ea51 h: refs/heads/master i:   287475:
 e2d72b1310d0c004d975b57655d950baa96dd464 v: v3

---
 [refs]                                  |  2 +-
 trunk/drivers/net/hyperv/rndis_filter.c | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 89d096a2830f..a3970b551f09 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: c43b874d5d714f271b80d4c3f49e05d0cbf51ed2
+refs/heads/master: 4b8a8bc9249f144803d840f2f7608ee9bbf1ea51
diff --git a/trunk/drivers/net/hyperv/rndis_filter.c b/trunk/drivers/net/hyperv/rndis_filter.c
index da181f9a49d1..dc2e3849573b 100644
--- a/trunk/drivers/net/hyperv/rndis_filter.c
+++ b/trunk/drivers/net/hyperv/rndis_filter.c
@@ -321,6 +321,25 @@ static void rndis_filter_receive_data(struct rndis_device *dev,
 	data_offset = RNDIS_HEADER_SIZE + rndis_pkt->data_offset;
 
 	pkt->total_data_buflen -= data_offset;
+
+	/*
+	 * Make sure we got a valid RNDIS message, now total_data_buflen
+	 * should be the data packet size plus the trailer padding size
+	 */
+	if (pkt->total_data_buflen < rndis_pkt->data_len) {
+		netdev_err(dev->net_dev->ndev, "rndis message buffer "
+			   "overflow detected (got %u, min %u)"
+			   "...dropping this message!\n",
+			   pkt->total_data_buflen, rndis_pkt->data_len);
+		return;
+	}
+
+	/*
+	 * Remove the rndis trailer padding from rndis packet message
+	 * rndis_pkt->data_len tell us the real data length, we only copy
+	 * the data packet to the stack, without the rndis trailer padding
+	 */
+	pkt->total_data_buflen = rndis_pkt->data_len;
 	pkt->data = (void *)((unsigned long)pkt->data + data_offset);
 
 	pkt->is_data_pkt = true;