Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

net: usb: rtl8150: Fix frame padding

TX frames aren't padded and unknown memory is sent into the ether.

Theoretically, it isn't even guaranteed that the extra memory exists
and can be sent out, which could cause further problems. In practice,
I found that plenty of tailroom exists in the skb itself (in my test
with ping at least) and skb_padto() easily succeeds, so use it here.

In the event of -ENOMEM drop the frame like other drivers do.

The use of one more padding byte instead of a USB zero-length packet
is retained to avoid regression. I have a dodgy Etron xHCI controller
which doesn't seem to support sending ZLPs at all.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251014203528.3f9783c4.michal.pecio@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Michal Pecio and committed by
Jakub Kicinski
75cea986 634ec1fc

+9 -2
+9 -2
drivers/net/usb/rtl8150.c
··· 685 685 rtl8150_t *dev = netdev_priv(netdev); 686 686 int count, res; 687 687 688 + /* pad the frame and ensure terminating USB packet, datasheet 9.2.3 */ 689 + count = max(skb->len, ETH_ZLEN); 690 + if (count % 64 == 0) 691 + count++; 692 + if (skb_padto(skb, count)) { 693 + netdev->stats.tx_dropped++; 694 + return NETDEV_TX_OK; 695 + } 696 + 688 697 netif_stop_queue(netdev); 689 - count = (skb->len < 60) ? 60 : skb->len; 690 - count = (count & 0x3f) ? count : count + 1; 691 698 dev->tx_skb = skb; 692 699 usb_fill_bulk_urb(dev->tx_urb, dev->udev, usb_sndbulkpipe(dev->udev, 2), 693 700 skb->data, count, write_bulk_callback, dev);