lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 13 Dec 2022 12:40:52 -0500
From:   "Seija K." <>
To:     Bjørn Mork <>,
        "David S. Miller" <>,
        Eric Dumazet <>,
        Jakub Kicinski <>,
        Paolo Abeni <>
Subject: [PATCH] net: Fix for packets being rejected in the xHCI controller's
 ring buffer

When a packet larger than MTU arrives in Linux from the modem, it is
discarded with -EOVERFLOW error (Babble error).

This is seen on USB3.0 and USB2.0 buses.

This is because the MRU (Max Receive Size) is not a separate entity
from the MTU (Max Transmit Size), and the received packets can be
larger than those transmitted.

Following the babble error, there was an endless supply of zero-length
URBs that were rejected with -EPROTO (increasing the rx input error
counter each time).

This is only seen on USB3.0. These continue to come ad infinitum until
the modem is shut down.

There appears to be a bug in the core USB handling code in Linux that
doesn't deal with network MTUs smaller than 1500 bytes well.

By default, the dev->hard_mtu (the real MTU) is in lockstep with
dev->rx_urb_size (essentially an MRU), and the latter is causing

This has nothing to do with the modems; the issue can be reproduced by
getting a USB-Ethernet dongle, setting the MTU to 1430, and pinging
with size greater than 1406.

Signed-off-by: Seija Kijin <>

Co-Authored-By: TarAldarion <>
drivers/net/usb/qmi_wwan.c | 7 +++++++
1 file changed, 7 insertions(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 554d4e2a84a4..39db53a74b5a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -842,6 +842,13 @@ static int qmi_wwan_bind(struct usbnet *dev,
struct usb_interface *intf)
dev->net->netdev_ops = &qmi_wwan_netdev_ops;
dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group;
+ /* LTE Networks don't always respect their own MTU on the receiving side;
+ * e.g. AT&T pushes 1430 MTU but still allows 1500 byte packets from
+ * far-end networks. Make the receive buffer large enough to accommodate
+ * them, and add four bytes so MTU does not equal MRU on network
+ * with 1500 MTU. Otherwise, usbnet_change_mtu() will change both.
+ */
+ dev->rx_urb_size = ETH_DATA_LEN + 4;
return status;

Powered by blists - more mailing lists