Re: [PATCH] net: usb: cx82310_eth: bound partial receive continuation

[Andrew Lunn]

On Sun, Jul 05, 2026 at 04:36:09PM +0800, Pengpeng Hou wrote:
> cx82310_rx_fixup() completes a packet that started in the previous URB
> by copying dev->partial_rem bytes from the current skb. It then pulls
> the same continuation extent, rounded up to an even byte count. The code
> does not first prove that the current skb contains that continuation.
> 
> Add a fail-closed bound check before the copy and pull. If the
> continuation is shorter than the pending packet state expects, drop that
> pending partial packet before returning so later URBs are not consumed as
> stale continuation bytes. This keeps the existing cross-URB packet
> model, but avoids consuming bytes that are not present in the current
> skb.

Please take a read of:

https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html

The Subject: line is wrong.

How has this been tested? 

>  static int cx82310_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
>  {
> -	int len;
> +	int len, pull_len;
>  	struct sk_buff *skb2;
>  	struct cx82310_priv *priv = dev->driver_priv;

Although the reverse christmas tree is already broken here, you should
try to keep with it, and put the new line at the end.

>  
> @@ -251,6 +251,13 @@
>  	 * end of that packet at the beginning.
>  	 */
>  	if (dev->partial_rem) {
> +		pull_len = (dev->partial_rem + 1) & ~1;
> +		if (skb->len < pull_len) {
> +			dev->partial_len = 0;
> +			dev->partial_rem = 0;
> +			return 0;
> +		}
> +
>  		len = dev->partial_len + dev->partial_rem;
>  		skb2 = alloc_skb(len, GFP_ATOMIC);
>  		if (!skb2)
> @@ -261,7 +265,7 @@
>  		memcpy(skb2->data + dev->partial_len, skb->data,
>  		       dev->partial_rem);
>  		usbnet_skb_return(dev, skb2);
> -		skb_pull(skb, (dev->partial_rem + 1) & ~1);
> +		skb_pull(skb, pull_len);
>  		dev->partial_rem = 0;
>  		if (skb->len < 2)
>  			return 1;
>