Re: [PATCH net] net: usb: cdc_ncm: reject negative chained NDP offsets

Oliver Neukum
2026-04-13T08:36:28Z

On 11.04.26 12:53, Greg Kroah-Hartman wrote:
> cdc_ncm_rx_fixup() reads dwNextNdpIndex from each NDP32 to chain to the
> next one. The 32-bit value from the device is stored into the signed
> int ndpoffset so that means values with the high bit set become

Well, then isn't the problem rather that you should not store an
unsigned value in a signed variable?

Regards
Oliver