Re: [PATCH net v2] net: usb: cdc_ncm: reject short GET_NTB_PARAMETERS responses

[Andrew Lunn <andrew@lunn.ch>]

On Sat, Oct 10, 2026 at 11:51:50PM -0400, Xinsheng Zhu wrote:
> usbnet_read_cmd() returns the actual transfer length, but cdc_ncm_init()
> only checks for negative errors when reading the NTB parameters. A short
> response therefore leaves the missing bytes zero-filled, and
> initialization continues with parameters that were not supplied by the
> device.
> 
> CDC NCM 1.1, section 7.2.1, Table 7-3 defines a 28-byte NTB
> parameter structure. Require GET_NTB_PARAMETERS to return the
> complete structure before continuing initialization.
> 
> Return -EIO for short responses, including zero-length responses, and
> preserve negative errors from usbnet_read_cmd(). This ensures that a
> zero-byte response cannot be reported as successful initialization when
> rejecting an incomplete response.
> 
> The issue is theoretical and was found by manual inspection of
> usbnet_read_cmd() callers with LLM assistance.

If this is theoretical, please drop the Fixes tag and post to
net-next.

	Andrew