[PATCH 1/2] net: usb: cdc_ncm: convert sysfs show() callbacks to sysfs_emit()

[PATCH 1/2] net: usb: cdc_ncm: convert sysfs show() callbacks to sysfs_emit()

[Omer Zalman]

sysfs_emit() was introduced in v5.10 as the preferred replacement for
sprintf() in sysfs show() handlers. It bounds output to PAGE_SIZE and
avoids potential buffer overruns.

Convert all show() callbacks and the NCM_PARM_ATTR macro from sprintf()
to sysfs_emit().

Signed-off-by: Omer Zalman <omerzalman42@gmail.com>
---
 drivers/net/usb/cdc_ncm.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 7057c6c0cfc6..6fcb4d711a64 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -204,7 +204,7 @@ static ssize_t min_tx_pkt_show(struct device *d,
 	struct usbnet *dev = netdev_priv(to_net_dev(d));
 	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
 
-	return sprintf(buf, "%u\n", ctx->min_tx_pkt);
+	return sysfs_emit(buf, "%u\n", ctx->min_tx_pkt);
 }
 
 static ssize_t rx_max_show(struct device *d,
@@ -213,7 +213,7 @@ static ssize_t rx_max_show(struct device *d,
 	struct usbnet *dev = netdev_priv(to_net_dev(d));
 	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
 
-	return sprintf(buf, "%u\n", ctx->rx_max);
+	return sysfs_emit(buf, "%u\n", ctx->rx_max);
 }
 
 static ssize_t tx_max_show(struct device *d,
@@ -222,7 +222,7 @@ static ssize_t tx_max_show(struct device *d,
 	struct usbnet *dev = netdev_priv(to_net_dev(d));
 	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
 
-	return sprintf(buf, "%u\n", ctx->tx_max);
+	return sysfs_emit(buf, "%u\n", ctx->tx_max);
 }
 
 static ssize_t tx_timer_usecs_show(struct device *d,
@@ -231,7 +231,7 @@ static ssize_t tx_timer_usecs_show(struct device *d,
 	struct usbnet *dev = netdev_priv(to_net_dev(d));
 	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
 
-	return sprintf(buf, "%u\n", ctx->timer_interval / (u32)NSEC_PER_USEC);
+	return sysfs_emit(buf, "%u\n", ctx->timer_interval / (u32)NSEC_PER_USEC);
 }
 
 static ssize_t min_tx_pkt_store(struct device *d,
@@ -313,7 +313,7 @@ static ssize_t ndp_to_end_show(struct device *d, struct device_attribute *attr,
 	struct usbnet *dev = netdev_priv(to_net_dev(d));
 	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
 
-	return sprintf(buf, "%c\n", ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END ? 'Y' : 'N');
+	return sysfs_emit(buf, "%c\n", ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END ? 'Y' : 'N');
 }
 
 static ssize_t ndp_to_end_store(struct device *d,  struct device_attribute *attr, const char *buf, size_t len)
@@ -362,7 +362,7 @@ static ssize_t cdc_ncm_show_##name(struct device *d, struct device_attribute *at
 { \
 	struct usbnet *dev = netdev_priv(to_net_dev(d)); \
 	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0]; \
-	return sprintf(buf, format "\n", tocpu(ctx->ncm_parm.name));	\
+	return sysfs_emit(buf, format "\n", tocpu(ctx->ncm_parm.name));	\
 } \
 static DEVICE_ATTR(name, 0444, cdc_ncm_show_##name, NULL)
 
-- 
2.39.5 (Apple Git-154)

[PATCH 2/2] net: usb: cdc_ncm: prevent silent u16 truncation in min_tx_pkt_store()

[Omer Zalman]

min_tx_pkt is a u16 field but the sysfs store handler accepted any
unsigned long and assigned it directly. Values that do not fit in 16
bits silently truncate: writing 65537 wraps to 1, turning a
"never pad" intent into "always pad".

ctx->tx_max can itself reach 65537 because cdc_ncm_update_rxtx_max()
increments the negotiated NTB size by one pad byte when it is an exact
multiple of the USB maxpacket size.

Clamp the stored value to min(tx_max, U16_MAX). Any value above tx_max
is already semantically equivalent to tx_max since frame lengths never
exceed it; the U16_MAX cap ensures the result is always representable
in the u16 field without wrapping.

Fixes: 39eb7e0e8c88 ("net: cdc_ncm: allow tuning min_tx_pkt")
Signed-off-by: Omer Zalman <omerzalman42@gmail.com>
---
 drivers/net/usb/cdc_ncm.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 6fcb4d711a64..edd69f4e1596 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -242,11 +242,17 @@ static ssize_t min_tx_pkt_store(struct device *d,
 	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
 	unsigned long val;
 
-	/* no need to restrict values - anything from 0 to infinity is OK */
 	if (kstrtoul(buf, 0, &val))
 		return -EINVAL;
 
-	ctx->min_tx_pkt = val;
+	/* Clamp to tx_max: the frame length can never exceed tx_max,
+	 * so any threshold above it has the same effect (padding is
+	 * never applied).  Also cap at U16_MAX since min_tx_pkt is
+	 * a u16 - without this, values like 65537 silently wrap to 1
+	 * and invert the intended behavior.
+	 */
+	ctx->min_tx_pkt = min_t(unsigned long, val,
+				min_t(u32, ctx->tx_max, U16_MAX));
 	return len;
 }
 
-- 
2.39.5 (Apple Git-154)

Re: [PATCH 2/2] net: usb: cdc_ncm: prevent silent u16 truncation in min_tx_pkt_store()

[Greg KH]

On Tue, Mar 17, 2026 at 11:06:32PM -0500, Omer Zalman wrote:
> min_tx_pkt is a u16 field but the sysfs store handler accepted any
> unsigned long and assigned it directly. Values that do not fit in 16
> bits silently truncate: writing 65537 wraps to 1, turning a
> "never pad" intent into "always pad".
> 
> ctx->tx_max can itself reach 65537 because cdc_ncm_update_rxtx_max()
> increments the negotiated NTB size by one pad byte when it is an exact
> multiple of the USB maxpacket size.
> 
> Clamp the stored value to min(tx_max, U16_MAX). Any value above tx_max
> is already semantically equivalent to tx_max since frame lengths never
> exceed it; the U16_MAX cap ensures the result is always representable
> in the u16 field without wrapping.
> 
> Fixes: 39eb7e0e8c88 ("net: cdc_ncm: allow tuning min_tx_pkt")
> Signed-off-by: Omer Zalman <omerzalman42@gmail.com>
> ---
>  drivers/net/usb/cdc_ncm.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
> index 6fcb4d711a64..edd69f4e1596 100644
> --- a/drivers/net/usb/cdc_ncm.c
> +++ b/drivers/net/usb/cdc_ncm.c
> @@ -242,11 +242,17 @@ static ssize_t min_tx_pkt_store(struct device *d,
>  	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
>  	unsigned long val;
>  
> -	/* no need to restrict values - anything from 0 to infinity is OK */
>  	if (kstrtoul(buf, 0, &val))
>  		return -EINVAL;
>  
> -	ctx->min_tx_pkt = val;
> +	/* Clamp to tx_max: the frame length can never exceed tx_max,
> +	 * so any threshold above it has the same effect (padding is
> +	 * never applied).  Also cap at U16_MAX since min_tx_pkt is
> +	 * a u16 - without this, values like 65537 silently wrap to 1
> +	 * and invert the intended behavior.
> +	 */
> +	ctx->min_tx_pkt = min_t(unsigned long, val,
> +				min_t(u32, ctx->tx_max, U16_MAX));
>  	return len;
>  }
>  
> -- 
> 2.39.5 (Apple Git-154)
> 
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- You have marked a patch with a "Fixes:" tag for a commit that is in an
  older released kernel, yet you do not have a cc: stable line in the
  signed-off-by area at all, which means that the patch will not be
  applied to any older kernel releases.  To properly fix this, please
  follow the documented rules in the
  Documentation/process/stable-kernel-rules.rst file for how to resolve
  this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot

Re: [PATCH 1/2] net: usb: cdc_ncm: convert sysfs show() callbacks to sysfs_emit()

[Greg KH]

On Tue, Mar 17, 2026 at 11:06:31PM -0500, Omer Zalman wrote:
> sysfs_emit() was introduced in v5.10 as the preferred replacement for
> sprintf() in sysfs show() handlers. It bounds output to PAGE_SIZE and
> avoids potential buffer overruns.
> 
> Convert all show() callbacks and the NCM_PARM_ATTR macro from sprintf()
> to sysfs_emit().

There is no need to change existing show functions to sysfs_emit(),
unless you are doing some other work in the same area.  Otherwise it
would be a huge churn all across the tree.

So no need for this patch, sorry.

thanks,

greg k-h