Re: [PATCH net-next v2] net: usb: asix: reject a truncated Data header in rx_fixup

[Andy Shevchenko]

On Mon, Sep 14, 2026 at 10:23:45PM +0100, Aamir Ahmed wrote:
> asix_rx_fixup_internal() runs its parsing loop while two bytes remain,
> but the branch that starts a new frame reads a four-byte Data header.
> Only a two-byte tail is special-cased, via split_head, so a three-byte
> tail reaches that read and leaves offset at skb->len + 1. The clamp
> below it then takes the unsigned difference skb->len - offset, which
> wraps, so copy_length becomes the full length the device asked for:
> skb_put_data() copies from one byte past the received data and
> usbnet_skb_return() passes the frame to the stack, before the trailing
> skb->len != offset check can report it.
> 
> Reject a Data header that does not fit and reset the parser state, as
> the other malformed-header paths do.
> 
> Only a device emitting an odd skb->len can get there - every asix
> rx_urb_size is even and offset always advances by an even number of
> bytes - so this is net-next material rather than a stable backport.
> 
> Fixes: 8b5b6f5413e9 ("net: asix: handle packets crossing URB boundaries")

If it's a fix, why net-next and not net in the Subject?

-- 
With Best Regards,
Andy Shevchenko