[PATCH net v2] net: usb: cdc_ncm: reject short GET_NTB_PARAMETERS responses

[Xinsheng Zhu]

usbnet_read_cmd() returns the actual transfer length, but cdc_ncm_init()
only checks for negative errors when reading the NTB parameters. A short
response therefore leaves the missing bytes zero-filled, and
initialization continues with parameters that were not supplied by the
device.

CDC NCM 1.1, section 7.2.1, Table 7-3 defines a 28-byte NTB
parameter structure. Require GET_NTB_PARAMETERS to return the
complete structure before continuing initialization.

Return -EIO for short responses, including zero-length responses, and
preserve negative errors from usbnet_read_cmd(). This ensures that a
zero-byte response cannot be reported as successful initialization when
rejecting an incomplete response.

The issue is theoretical and was found by manual inspection of
usbnet_read_cmd() callers with LLM assistance.

Fixes: 36c35416a94f ("cdc_ncm: fix endianness problem.")
Signed-off-by: Xinsheng Zhu <xinsheng.zhu.ny@xxxxxxxxx>
---
Changes in v2:
- Return -EIO for short responses, including zero-length responses,
  while preserving negative errors from usbnet_read_cmd().
- Add the missing Fixes tag.
- Changes of description in the commit message.

v1: https://lore.kernel.org/netdev/20261005041525.49111-1-xinsheng.zhu.ny@xxxxxxxxx/

 drivers/net/usb/cdc_ncm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 35db38cb3e4a..79893d2342ca 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -524,9 +524,9 @@ static int cdc_ncm_init(struct usbnet *dev)
 			      |USB_RECIP_INTERFACE,
 			      0, iface_no, &ctx->ncm_parm,
 			      sizeof(ctx->ncm_parm));
-	if (err < 0) {
+	if (err != sizeof(ctx->ncm_parm)) {
 		dev_err(&dev->intf->dev, "failed GET_NTB_PARAMETERS\n");
-		return err; /* GET_NTB_PARAMETERS is required */
+		return err < 0 ? err : -EIO; /* GET_NTB_PARAMETERS is required */
 	}
 
 	/* set CRC Mode */

base-commit: 6dc989ea46b96ce170840174b4a38c4a387fb005
-- 
2.54.0 (Apple Git-157)