[PATCH net] usbnet: cap max_mtu for drivers without bind callback

[PATCH net] usbnet: cap max_mtu for drivers without bind callback

[Laurent Vivier]

Commit c7159e960f14 ("usbnet: limit max_mtu based on device's hard_mtu")
caps max_mtu inside the if (info->bind) block in usbnet_probe(). Drivers
without a bind callback never enter this block, so max_mtu stays at
ETH_MAX_MTU.

QEMU's usb-net device (0x0525/0xa4a2) is claimed by the cdc_subset
driver which has no bind callback. The guest accepts any MTU from DHCP
(e.g. 65520 from passt), leading to TCP segments that exceed the
device's 2048-byte receive buffer and are silently dropped.

Move the max_mtu capping after the if/else block so it applies to all
usbnet drivers.

Fixes: c7159e960f14 ("usbnet: limit max_mtu based on device's hard_mtu")
Cc: stable@vger.kernel.org
Link: https://gitlab.com/qemu-project/qemu/-/issues/3268
Link: https://bugs.passt.top/show_bug.cgi?id=189
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
---
 drivers/net/usb/usbnet.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 25518635b7b7..d87299025552 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1825,10 +1825,6 @@ usbnet_probe(struct usb_interface *udev, const struct usb_device_id *prod)
 		if ((dev->driver_info->flags & FLAG_NOARP) != 0)
 			net->flags |= IFF_NOARP;
 
-		if ((dev->driver_info->flags & FLAG_NOMAXMTU) == 0 &&
-		    net->max_mtu > (dev->hard_mtu - net->hard_header_len))
-			net->max_mtu = dev->hard_mtu - net->hard_header_len;
-
 		if (net->mtu > (dev->hard_mtu - net->hard_header_len))
 			net->mtu = dev->hard_mtu - net->hard_header_len;
 
@@ -1851,6 +1847,10 @@ usbnet_probe(struct usb_interface *udev, const struct usb_device_id *prod)
 		if (status == 0 && !usb_check_bulk_endpoints(udev, ep_addrs))
 			status = -EINVAL;
 	}
+	if ((dev->driver_info->flags & FLAG_NOMAXMTU) == 0 &&
+	    net->max_mtu > (dev->hard_mtu - net->hard_header_len))
+		net->max_mtu = dev->hard_mtu - net->hard_header_len;
+
 	if (status >= 0 && dev->status)
 		status = init_status(dev, udev);
 	if (status < 0)
-- 
2.54.0

Re: [PATCH net] usbnet: cap max_mtu for drivers without bind callback

[Jakub Kicinski]

On Fri, 17 Jul 2026 17:16:26 +0200 Laurent Vivier wrote:
> Commit c7159e960f14 ("usbnet: limit max_mtu based on device's hard_mtu")
> caps max_mtu inside the if (info->bind) block in usbnet_probe().

Okay... but before that commit the logic was also missing,
and that commit only refines the condition. I don't think
that's the right commit for Fixes.

> Drivers without a bind callback never enter this block, so max_mtu
> stays at ETH_MAX_MTU.
> 
> QEMU's usb-net device (0x0525/0xa4a2) is claimed by the cdc_subset
> driver which has no bind callback. The guest accepts any MTU from DHCP
> (e.g. 65520 from passt), leading to TCP segments that exceed the
> device's 2048-byte receive buffer and are silently dropped.
> 
> Move the max_mtu capping after the if/else block so it applies to all
> usbnet drivers.

A short explanation here why the changes was made under the bind would
be quite useful (presumably it was done there because that's where the
existing MTU check was, and the existing MTU check only mattered if the
device specific callback could modify the state etc.)

It feels like we should update the max_mtu instead of capping it later
for devices without bind (note that only a device with bind sets
NOMAXMTU, too)
-- 
pw-bot: cr

Re: [PATCH net] usbnet: cap max_mtu for drivers without bind callback

[Laurent Vivier]

On 7/23/26 17:43, Jakub Kicinski wrote:
> On Fri, 17 Jul 2026 17:16:26 +0200 Laurent Vivier wrote:
>> Commit c7159e960f14 ("usbnet: limit max_mtu based on device's hard_mtu")
>> caps max_mtu inside the if (info->bind) block in usbnet_probe().
> 
> Okay... but before that commit the logic was also missing,
> and that commit only refines the condition. I don't think
> that's the right commit for Fixes.

So it's:

Fixes: f77f0aee4da4 ("net: use core MTU range checking in USB NIC drivers")
Cc: jarod@redhat.com

> 
>> Drivers without a bind callback never enter this block, so max_mtu
>> stays at ETH_MAX_MTU.
>>
>> QEMU's usb-net device (0x0525/0xa4a2) is claimed by the cdc_subset
>> driver which has no bind callback. The guest accepts any MTU from DHCP
>> (e.g. 65520 from passt), leading to TCP segments that exceed the
>> device's 2048-byte receive buffer and are silently dropped.
>>
>> Move the max_mtu capping after the if/else block so it applies to all
>> usbnet drivers.
> 
> A short explanation here why the changes was made under the bind would
> be quite useful (presumably it was done there because that's where the
> existing MTU check was, and the existing MTU check only mattered if the
> device specific callback could modify the state etc.)

Yes, I put max_mtu here because the existing mtu check was here.

> 
> It feels like we should update the max_mtu instead of capping it later
> for devices without bind (note that only a device with bind sets
> NOMAXMTU, too)

What do you think of:

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 25518635b7b7..9ec038a1b6f5 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1794,7 +1794,7 @@ usbnet_probe(struct usb_interface *udev, const struct usb_device_id 
*prod)
  	 */
  	dev->hard_mtu = net->mtu + net->hard_header_len;
  	net->min_mtu = 0;
-	net->max_mtu = ETH_MAX_MTU;
+	net->max_mtu = dev->hard_mtu - net->hard_header_len;

  	net->netdev_ops = &usbnet_netdev_ops;
  	net->watchdog_timeo = TX_TIMEOUT_JIFFIES;
@@ -1825,8 +1825,9 @@ usbnet_probe(struct usb_interface *udev, const struct usb_device_id 
*prod)
  		if ((dev->driver_info->flags & FLAG_NOARP) != 0)
  			net->flags |= IFF_NOARP;

-		if ((dev->driver_info->flags & FLAG_NOMAXMTU) == 0 &&
-		    net->max_mtu > (dev->hard_mtu - net->hard_header_len))
+		if (dev->driver_info->flags & FLAG_NOMAXMTU) == 0)
+			net->max_mtu = ETH_MAX_MTU;
+		else
  			net->max_mtu = dev->hard_mtu - net->hard_header_len;

  		if (net->mtu > (dev->hard_mtu - net->hard_header_len))

Thanks,
Laurent

Re: [PATCH net] usbnet: cap max_mtu for drivers without bind callback

[Jakub Kicinski]

On Thu, 23 Jul 2026 19:20:30 +0200 Laurent Vivier wrote:
>   	dev->hard_mtu = net->mtu + net->hard_header_len;
>   	net->min_mtu = 0;
> -	net->max_mtu = ETH_MAX_MTU;
> +	net->max_mtu = dev->hard_mtu - net->hard_header_len;

But we assigned 

	dev->hard_mtu = net->mtu + net->hard_header_len;

two lines earlier, so this is just:

	net->max_mtu = net->mtu;

is this the expected max_mtu for most USB adapters?
I suppose so given the patch under discussion?