The nframes bounds check in cdc_ncm_rx_verify_ndp16() and
cdc_ncm_rx_verify_ndp32() does not account for ndpoffset,
allowing out-of-bounds reads when the NDP is placed near the
end of the NTB.

Changes since v2:
- Save struct_size_t() result to a temp variable to avoid
  awkward line wrapping (Jakub)
- Fix From/Signed-off-by mismatch
- Move "Compile-tested only" out of the Signed-off-by line
  into the commit message body

Tobi Gaertner (2):
  net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
  net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check

 drivers/net/usb/cdc_ncm.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

-- 
2.43.0