min_tx_pkt is a u16 field but the sysfs store handler accepted any unsigned long and assigned it directly. Values that do not fit in 16 bits silently truncate: writing 65537 wraps to 1, turning a "never pad" intent into "always pad". ctx->tx_max can itself reach 65537 because cdc_ncm_update_rxtx_max() increments the negotiated NTB size by one pad byte when it is an exact multiple of the USB maxpacket size. Clamp the stored value to min(tx_max, U16_MAX). Any value above tx_max is already semantically equivalent to tx_max since frame lengths never exceed it; the U16_MAX cap ensures the result is always representable in the u16 field without wrapping. Fixes: 39eb7e0e8c88 ("net: cdc_ncm: allow tuning min_tx_pkt") Signed-off-by: Omer Zalman --- drivers/net/usb/cdc_ncm.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c index 6fcb4d711a64..edd69f4e1596 100644 --- a/drivers/net/usb/cdc_ncm.c +++ b/drivers/net/usb/cdc_ncm.c @@ -242,11 +242,17 @@ static ssize_t min_tx_pkt_store(struct device *d, struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0]; unsigned long val; - /* no need to restrict values - anything from 0 to infinity is OK */ if (kstrtoul(buf, 0, &val)) return -EINVAL; - ctx->min_tx_pkt = val; + /* Clamp to tx_max: the frame length can never exceed tx_max, + * so any threshold above it has the same effect (padding is + * never applied). Also cap at U16_MAX since min_tx_pkt is + * a u16 - without this, values like 65537 silently wrap to 1 + * and invert the intended behavior. + */ + ctx->min_tx_pkt = min_t(unsigned long, val, + min_t(u32, ctx->tx_max, U16_MAX)); return len; } -- 2.39.5 (Apple Git-154)