Re: [PATCH net] net: usb: cdc_ncm: reject negative chained NDP offsets

From: Oliver Neukum

Date: Mon Apr 13 2026 - 04:36:40 EST




On 11.04.26 12:53, Greg Kroah-Hartman wrote:
cdc_ncm_rx_fixup() reads dwNextNdpIndex from each NDP32 to chain to the
next one. The 32-bit value from the device is stored into the signed
int ndpoffset so that means values with the high bit set become

Well, then isn't the problem rather that you should not store an
unsigned value in a signed variable?

Regards
Oliver