From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AAB4B2D0C62; Wed, 28 Jan 2026 15:35:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769614552; cv=none; b=iRyijPaVoq4ey/fMLx0tGjh0qaiEd67QbR6LADNqyBl4byGk6enVuY9B0nk1Zs0GdWAMxtjxwMLCa7M6khb3GLRzLsV+qUwqWcrO7v9c+OVJcPcriK9Av9nxbuN+X/zq3QQeLGhJaOV4+RXbWEHEN/x9ETPLYA8yUgP8AmXWuAA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769614552; c=relaxed/simple; bh=NIV2zycBfHcGmFyiwaOotDr11z277vcbB2t95cK60YI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LI/pqUmVBg5VOkvD0/fHejGuFo0niKKawNhy9bpgSQ906Hmkd1E3SXKlHjK/81q6hycNyReCpFpz74WhN22Hy1R5kIvuPOpbrrs4yzFB+jpj+nZsNAjt4+rR7VqzVL3j9pLGc9FLyzhwBTaPHMjvWOfO45hggz/lX5sUj4EK7Gw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=StMTwkVy; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="StMTwkVy" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D52CEC4CEF1; Wed, 28 Jan 2026 15:35:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1769614552; bh=NIV2zycBfHcGmFyiwaOotDr11z277vcbB2t95cK60YI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=StMTwkVyLFHF5OJkU+3SffR5wg9yKnx1kQMj8LNuBPoWLlyeA8WXf9nhlU+/vfd4/ +c2dgG/dxHUtEBb7zSdFwHFsBtmSW6omORktC69H8QXlqmXcMLTzMUccsKffq3EkSQ e8BJmkJndsHoHJRzeVnBwyCXhkj/U2cClc2yJM9M= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Laurent Vivier , Stefano Brivio , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.6 170/254] usbnet: limit max_mtu based on devices hard_mtu Date: Wed, 28 Jan 2026 16:22:26 +0100 Message-ID: <20260128145350.924305851@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260128145344.698118637@linuxfoundation.org> References: <20260128145344.698118637@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Laurent Vivier [ Upstream commit c7159e960f1472a5493ac99aff0086ab1d683594 ] The usbnet driver initializes net->max_mtu to ETH_MAX_MTU before calling the device's bind() callback. When the bind() callback sets dev->hard_mtu based the device's actual capability (from CDC Ethernet's wMaxSegmentSize descriptor), max_mtu is never updated to reflect this hardware limitation). This allows userspace (DHCP or IPv6 RA) to configure MTU larger than the device can handle, leading to silent packet drops when the backend sends packet exceeding the device's buffer size. Fix this by limiting net->max_mtu to the device's hard_mtu after the bind callback returns. See https://gitlab.com/qemu-project/qemu/-/issues/3268 and https://bugs.passt.top/attachment.cgi?bugid=189 Fixes: f77f0aee4da4 ("net: use core MTU range checking in USB NIC drivers") Signed-off-by: Laurent Vivier Link: https://bugs.passt.top/show_bug.cgi?id=189 Reviewed-by: Stefano Brivio Link: https://patch.msgid.link/20260119075518.2774373-1-lvivier@redhat.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- drivers/net/usb/usbnet.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index e6a1864f03f94..e41649365efff 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -1799,9 +1799,12 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) if ((dev->driver_info->flags & FLAG_NOARP) != 0) net->flags |= IFF_NOARP; - /* maybe the remote can't receive an Ethernet MTU */ - if (net->mtu > (dev->hard_mtu - net->hard_header_len)) - net->mtu = dev->hard_mtu - net->hard_header_len; + if (net->max_mtu > (dev->hard_mtu - net->hard_header_len)) + net->max_mtu = dev->hard_mtu - net->hard_header_len; + + if (net->mtu > net->max_mtu) + net->mtu = net->max_mtu; + } else if (!info->in || !info->out) status = usbnet_get_endpoints (dev, udev); else { -- 2.51.0