[PATCH net v2] net: usb: rtl8150: Fix frame padding

[PATCH net v2] net: usb: rtl8150: Fix frame padding

[Michal Pecio]

TX frames aren't padded and unknown memory is sent into the ether.

Theoretically, it isn't even guaranteed that the extra memory exists
and can be sent out, which could cause further problems. In practice,
I found that plenty of tailroom exists in the skb itself (in my test
with ping at least) and skb_padto() easily succeeds, so use it here.

In the event of -ENOMEM drop the frame like other drivers do.

The use of one more padding byte instead of a USB zero-length packet
is retained to avoid regression. I have a dodgy Etron xHCI controller
which doesn't seem to support sending ZLPs at all.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
---

v2: update TX stats when dropping packets

v1: https://lore.kernel.org/netdev/20251012220042.4ca776b1.michal.pecio@gmail.com/

 drivers/net/usb/rtl8150.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 92add3daadbb..278e6cb6f4d9 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -685,9 +685,16 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
 	rtl8150_t *dev = netdev_priv(netdev);
 	int count, res;
 
+	/* pad the frame and ensure terminating USB packet, datasheet 9.2.3 */
+	count = max(skb->len, ETH_ZLEN);
+	if (count % 64 == 0)
+		count++;
+	if (skb_padto(skb, count)) {
+		netdev->stats.tx_dropped++;
+		return NETDEV_TX_OK;
+	}
+
 	netif_stop_queue(netdev);
-	count = (skb->len < 60) ? 60 : skb->len;
-	count = (count & 0x3f) ? count : count + 1;
 	dev->tx_skb = skb;
 	usb_fill_bulk_urb(dev->tx_urb, dev->udev, usb_sndbulkpipe(dev->udev, 2),
 		      skb->data, count, write_bulk_callback, dev);
-- 
2.48.1

Re: [PATCH net v2] net: usb: rtl8150: Fix frame padding

[Simon Horman]

On Tue, Oct 14, 2025 at 08:35:28PM +0200, Michal Pecio wrote:
> TX frames aren't padded and unknown memory is sent into the ether.
> 
> Theoretically, it isn't even guaranteed that the extra memory exists
> and can be sent out, which could cause further problems. In practice,
> I found that plenty of tailroom exists in the skb itself (in my test
> with ping at least) and skb_padto() easily succeeds, so use it here.
> 
> In the event of -ENOMEM drop the frame like other drivers do.
> 
> The use of one more padding byte instead of a USB zero-length packet
> is retained to avoid regression. I have a dodgy Etron xHCI controller
> which doesn't seem to support sending ZLPs at all.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
> ---
> 
> v2: update TX stats when dropping packets
> 
> v1: https://lore.kernel.org/netdev/20251012220042.4ca776b1.michal.pecio@gmail.com/

Thanks for the update.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net v2] net: usb: rtl8150: Fix frame padding

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 14 Oct 2025 20:35:28 +0200 you wrote:
> TX frames aren't padded and unknown memory is sent into the ether.
> 
> Theoretically, it isn't even guaranteed that the extra memory exists
> and can be sent out, which could cause further problems. In practice,
> I found that plenty of tailroom exists in the skb itself (in my test
> with ping at least) and skb_padto() easily succeeds, so use it here.
> 
> [...]

Here is the summary with links:
  - [net,v2] net: usb: rtl8150: Fix frame padding
    https://git.kernel.org/netdev/net/c/75cea9860aa6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html