[PATCH net v2] usbnet: cap max_mtu for drivers without bind callback

[PATCH net v2] usbnet: cap max_mtu for drivers without bind callback

[Laurent Vivier]

usbnet_probe() initializes max_mtu to ETH_MAX_MTU and only caps it
inside the if (info->bind) block. Drivers without a bind callback
never enter this block, so max_mtu stays at ETH_MAX_MTU.

QEMU's usb-net device (0x0525/0xa4a2) is claimed by the cdc_subset
driver which has no bind callback. The guest accepts any MTU from DHCP
(e.g. 65520 from passt), leading to TCP segments that exceed the
device's 2048-byte receive buffer and are silently dropped.

Initialize max_mtu to net->mtu at probe time and update it inside
the bind block based on the device's hard_mtu.

Fixes: f77f0aee4da4 ("net: use core MTU range checking in USB NIC drivers")
Cc: jarod@redhat.com
Cc: stable@vger.kernel.org
Link: https://gitlab.com/qemu-project/qemu/-/issues/3268
Link: https://bugs.passt.top/show_bug.cgi?id=189
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
---

Notes:
    v2:
    - Set max_mtu to net->mtu at init, update inside bind
    - Fix Fixes tag to f77f0aee4da4

 drivers/net/usb/usbnet.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 25518635b7b7..9f11ca449aad 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1794,7 +1794,7 @@ usbnet_probe(struct usb_interface *udev, const struct usb_device_id *prod)
 	 */
 	dev->hard_mtu = net->mtu + net->hard_header_len;
 	net->min_mtu = 0;
-	net->max_mtu = ETH_MAX_MTU;
+	net->max_mtu = net->mtu;
 
 	net->netdev_ops = &usbnet_netdev_ops;
 	net->watchdog_timeo = TX_TIMEOUT_JIFFIES;
@@ -1825,8 +1825,9 @@ usbnet_probe(struct usb_interface *udev, const struct usb_device_id *prod)
 		if ((dev->driver_info->flags & FLAG_NOARP) != 0)
 			net->flags |= IFF_NOARP;
 
-		if ((dev->driver_info->flags & FLAG_NOMAXMTU) == 0 &&
-		    net->max_mtu > (dev->hard_mtu - net->hard_header_len))
+		if (dev->driver_info->flags & FLAG_NOMAXMTU)
+			net->max_mtu = ETH_MAX_MTU;
+		else
 			net->max_mtu = dev->hard_mtu - net->hard_header_len;
 
 		if (net->mtu > (dev->hard_mtu - net->hard_header_len))
-- 
2.54.0

Re: [PATCH net v2] usbnet: cap max_mtu for drivers without bind callback

[Jakub Kicinski]

On Mon, 27 Jul 2026 09:23:04 +0200 Laurent Vivier wrote:
> -		if ((dev->driver_info->flags & FLAG_NOMAXMTU) == 0 &&
> -		    net->max_mtu > (dev->hard_mtu - net->hard_header_len))
> +		if (dev->driver_info->flags & FLAG_NOMAXMTU)
> +			net->max_mtu = ETH_MAX_MTU;
> +		else
>  			net->max_mtu = dev->hard_mtu - net->hard_header_len;

Sashikos point out that this will causes issues for existing drivers in
both directions. Some drivers explicitly set max_mtu. So we need to move
the

	net->max_mtu = ETH_MAX_MTU;

line before the call to ->bind ?
-- 
pw-bot: cr

Re: [PATCH net v2] usbnet: cap max_mtu for drivers without bind callback

[Laurent Vivier]

On 7/30/26 02:52, Jakub Kicinski wrote:
> On Mon, 27 Jul 2026 09:23:04 +0200 Laurent Vivier wrote:
>> -		if ((dev->driver_info->flags & FLAG_NOMAXMTU) == 0 &&
>> -		    net->max_mtu > (dev->hard_mtu - net->hard_header_len))
>> +		if (dev->driver_info->flags & FLAG_NOMAXMTU)
>> +			net->max_mtu = ETH_MAX_MTU;
>> +		else
>>   			net->max_mtu = dev->hard_mtu - net->hard_header_len;
> 
> Sashikos point out that this will causes issues for existing drivers in
> both directions. Some drivers explicitly set max_mtu. So we need to move
> the
> 
> 	net->max_mtu = ETH_MAX_MTU;
> 
> line before the call to ->bind ?

So you mean like my v1?

Thanks,
Laurent

Re: [PATCH net v2] usbnet: cap max_mtu for drivers without bind callback

[Jakub Kicinski]

On Thu, 30 Jul 2026 09:30:57 +0200 Laurent Vivier wrote:
> On 7/30/26 02:52, Jakub Kicinski wrote:
> > On Mon, 27 Jul 2026 09:23:04 +0200 Laurent Vivier wrote:  
> >> -		if ((dev->driver_info->flags & FLAG_NOMAXMTU) == 0 &&
> >> -		    net->max_mtu > (dev->hard_mtu - net->hard_header_len))
> >> +		if (dev->driver_info->flags & FLAG_NOMAXMTU)
> >> +			net->max_mtu = ETH_MAX_MTU;
> >> +		else
> >>   			net->max_mtu = dev->hard_mtu - net->hard_header_len;  
> > 
> > Sashikos point out that this will causes issues for existing drivers in
> > both directions. Some drivers explicitly set max_mtu. So we need to move
> > the
> > 
> > 	net->max_mtu = ETH_MAX_MTU;
> > 
> > line before the call to ->bind ?  
> 
> So you mean like my v1?

No, there should be no conditional stuff on the non-bind path.
Init the max_mtu to net->mtu like you do in v2.
Override it to ETH_MAX_MTU _under if (info->bind)_
And I think that's it - the conditions can stay as they are right now?

What I'm getting at is after the patch the code should say "we have
some extra MTU discovery path for drivers with info->bind, all
remaining drivers get net->mtu". I think the change I described above
will make that clear.