[PATCH net-next v3] net: usb: cdc_ncm: reject short GET_NTB_PARAMETERS responses

[Xinsheng Zhu]

usbnet_read_cmd() returns the actual transfer length, but cdc_ncm_init()
only checks for negative errors when reading the NTB parameters. A short
response therefore leaves the missing bytes zero-filled, and
initialization continues with parameters that were not supplied by the
device.

CDC NCM 1.1, section 7.2.1, Table 7-3 defines a 28-byte NTB parameter
structure. The pre-errata structure also contains 28 bytes: NCM 1.0
Errata 1, Issue K.

Require GET_NTB_PARAMETERS to return the complete structure before
continuing initialization. Return -EIO for short responses, including
zero-length responses, and preserve negative errors from
usbnet_read_cmd().

The issue is theoretical and was found by manual inspection of
usbnet_read_cmd() callers with LLM assistance.

Signed-off-by: Xinsheng Zhu <xinsheng.zhu.ny@xxxxxxxxx>
---
Changes in v3:
- Target net-next and drop the Fixes tag, as requested by Andrew Lunn.
- No changes to logic since v2.

v2: https://lore.kernel.org/netdev/20261011035150.53315-1-xinsheng.zhu.ny@xxxxxxxxx/

 drivers/net/usb/cdc_ncm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 19db5a668dcb..5715c4bf732f 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -524,9 +524,9 @@ static int cdc_ncm_init(struct usbnet *dev)
 			      |USB_RECIP_INTERFACE,
 			      0, iface_no, &ctx->ncm_parm,
 			      sizeof(ctx->ncm_parm));
-	if (err < 0) {
+	if (err != sizeof(ctx->ncm_parm)) {
 		dev_err(&dev->intf->dev, "failed GET_NTB_PARAMETERS\n");
-		return err; /* GET_NTB_PARAMETERS is required */
+		return err < 0 ? err : -EIO; /* GET_NTB_PARAMETERS is required */
 	}
 
 	/* set CRC Mode */

base-commit: 4dd16e31135ea8437a720222df34e8745f385d6d
-- 
2.54.0 (Apple Git-157)