Re: [PATCH net] net: usb: cdc_ncm: reject negative chained NDP offsets

[Oliver Neukum]

On 13.04.26 12:43, Greg Kroah-Hartman wrote:
> On Mon, Apr 13, 2026 at 10:36:19AM +0200, Oliver Neukum wrote:
> > On 11.04.26 12:53, Greg Kroah-Hartman wrote:
> > > cdc_ncm_rx_fixup() reads dwNextNdpIndex from each NDP32 to chain to the
> > > next one.  The 32-bit value from the device is stored into the signed
> > > int ndpoffset so that means values with the high bit set become
> >
> > Well, then isn't the problem rather that you should not store an
> > unsigned value in a signed variable?
>
> No.  well, yes.  but no.
>
> cdc_ncm_rx_verify_nth16() returns an int, and is negative if something
> went wrong, so we need it that way, and then we need to check it, like
> we properly do at the top of the loop, it's just that at the bottom of
> the loop we also need to do the same exact thing.

Doesn't that suggest that cdc_ncm_rx_verify_nth16() is the problem?
To be precise, the way it indicates errors?
As this is an offset into a buffer and the header must be at the start
of the buffer, isn't 0 the natural indication of an error?

	Regards
		Oliver