usbnet_read_cmd() returns the actual transfer length, but cdc_ncm_init() only checks for negative errors when reading the NTB parameters. A short response therefore leaves the missing bytes zero-filled, and initialization continues with parameters that were not supplied by the device. CDC NCM 1.1, section 7.2.1, Table 7-3 defines a 28-byte NTB parameter structure. The pre-errata structure also contains 28 bytes: NCM 1.0 Errata 1, Issue K. Require GET_NTB_PARAMETERS to return the complete structure before continuing initialization. Return -EIO for short responses, including zero-length responses, and preserve negative errors from usbnet_read_cmd(). The issue is theoretical and was found by manual inspection of usbnet_read_cmd() callers with LLM assistance. Signed-off-by: Xinsheng Zhu --- Changes in v3: - Target net-next and drop the Fixes tag, as requested by Andrew Lunn. - No changes to logic since v2. v2: https://lore.kernel.org/netdev/20261011035150.53315-1-xinsheng.zhu.ny@gmail.com/ drivers/net/usb/cdc_ncm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c index 19db5a668dcb..5715c4bf732f 100644 --- a/drivers/net/usb/cdc_ncm.c +++ b/drivers/net/usb/cdc_ncm.c @@ -524,9 +524,9 @@ static int cdc_ncm_init(struct usbnet *dev) |USB_RECIP_INTERFACE, 0, iface_no, &ctx->ncm_parm, sizeof(ctx->ncm_parm)); - if (err < 0) { + if (err != sizeof(ctx->ncm_parm)) { dev_err(&dev->intf->dev, "failed GET_NTB_PARAMETERS\n"); - return err; /* GET_NTB_PARAMETERS is required */ + return err < 0 ? err : -EIO; /* GET_NTB_PARAMETERS is required */ } /* set CRC Mode */ base-commit: 4dd16e31135ea8437a720222df34e8745f385d6d -- 2.54.0 (Apple Git-157)