[PATCH net] net: usb: cdc_ncm: reject short GET_NTB_PARAMETERS responses
From: Xinsheng Zhu
Date: Mon Oct 05 2026 - 00:16:07 EST
usbnet_read_cmd() returns the number of bytes read on success, which may
be smaller than the requested size. cdc_ncm_init() calls it and only
checks for negative return values, allowing initialization to continue
with an incomplete NTB parameter response.
The context is allocated and zero-initialized by kzalloc_obj() in
cdc_ncm_bind_common(). Bytes missing from a short response therefore
remain zero and may be interpreted as device-provided parameters.
Require the return value to equal sizeof(ctx->ncm_parm), consistent with
the existing exact-length check for GET_MAX_DATAGRAM_SIZE in
cdc_ncm_set_dgram_size().
Signed-off-by: Xinsheng Zhu <xinsheng.zhu.ny@xxxxxxxxx>
---
drivers/net/usb/cdc_ncm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 35db38cb3e4a..66f40f0d9c27 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -524,7 +524,7 @@ static int cdc_ncm_init(struct usbnet *dev)
|USB_RECIP_INTERFACE,
0, iface_no, &ctx->ncm_parm,
sizeof(ctx->ncm_parm));
- if (err < 0) {
+ if (err != sizeof(ctx->ncm_parm)) {
dev_err(&dev->intf->dev, "failed GET_NTB_PARAMETERS\n");
return err; /* GET_NTB_PARAMETERS is required */
}
base-commit: 6dc989ea46b96ce170840174b4a38c4a387fb005
--
2.54.0 (Apple Git-157)