Re: [PATCH net v3] net: usb: asix: reject a truncated Data header in rx_fixup

[Andy Shevchenko]

On Tue, Sep 15, 2026 at 11:57:24PM +0100, Aamir Ahmed wrote:
> asix_rx_fixup_internal() runs its parsing loop while two bytes remain,
> but the branch that starts a new frame reads a four-byte Data header.
> Only a two-byte tail is special-cased, via split_head, so a three-byte
> tail reaches that read and leaves offset at skb->len + 1. The clamp
> below it then takes the unsigned difference skb->len - offset, which
> wraps, so copy_length becomes the full length the device asked for:
> skb_put_data() copies from one byte past the received data and
> usbnet_skb_return() passes the frame to the stack, before the trailing
> skb->len != offset check can report it.
> 
> Reject a Data header that does not fit and reset the parser state, as
> the other malformed-header paths do.
> 
> Only a device emitting an odd skb->len can get there, since offset
> always advances by an even number of bytes.

...

> int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,

> +				if (offset + sizeof(u32) > skb->len) {
> +					netdev_err(dev->net, "asix_rx_fixup() Short Data header, offset %d, len %d\n",
> +						   offset, skb->len);
> +					reset_asix_rx_fixup_info(rx);
> +					return 0;
> +				}

I don't know the rules about __func__ in the error messages in net, but above
may be simplified as

					netdev_err(dev->net, "%s(): Short Data header, offset %d, len %d\n",
						   __func__, offset, skb->len);

-- 
With Best Regards,
Andy Shevchenko