Re: [PATCH net-next v3] net: usb: cdc_ncm: reject short GET_NTB_PARAMETERS responses

[Paolo Abeni]

On 11/2/26 01:11, Xinsheng Zhu wrote:
> usbnet_read_cmd() returns the actual transfer length, but cdc_ncm_init()
> only checks for negative errors when reading the NTB parameters. A short
> response therefore leaves the missing bytes zero-filled, and
> initialization continues with parameters that were not supplied by the
> device.
>
> CDC NCM 1.1, section 7.2.1, Table 7-3 defines a 28-byte NTB parameter
> structure. The pre-errata structure also contains 28 bytes: NCM 1.0
> Errata 1, Issue K.
>
> Require GET_NTB_PARAMETERS to return the complete structure before
> continuing initialization. Return -EIO for short responses, including
> zero-length responses, and preserve negative errors from
> usbnet_read_cmd().
>
> The issue is theoretical and was found by manual inspection of
> usbnet_read_cmd() callers with LLM assistance.
>
> Signed-off-by: Xinsheng Zhu <xinsheng.zhu.ny@xxxxxxxxx>
Sashiko noted on v2 that this may cause regression:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261011035150.53315-1-xinsheng.zhu.ny@xxxxxxxxx

Since thei issue is theoretical I think we are better off without
this change.

/P