linux/drivers/net/usb
Javier Carrasco 8f8abb863f net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
syzbot has found an uninit-value bug triggered by the dm9601 driver [1].

This error happens because the variable res is not updated if the call
to dm_read_shared_word returns an error. In this particular case -EPROTO
was returned and res stayed uninitialized.

This can be avoided by checking the return value of dm_read_shared_word
and propagating the error if the read operation failed.

[1] https://syzkaller.appspot.com/bug?extid=1f53a30781af65d2c955

Cc: stable@vger.kernel.org
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Reported-and-tested-by: syzbot+1f53a30781af65d2c955@syzkaller.appspotmail.com
Acked-by: Peter Korsgaard <peter@korsgaard.com>
Fixes: d0374f4f9c ("USB: Davicom DM9601 usbnet driver")
Link: https://lore.kernel.org/r/20231009-topic-dm9601_uninit_mdio_read-v2-1-f2fe39739b6c@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-10-10 20:08:11 -07:00
..
Kconfig usbnet: ipheth: update Kconfig description 2023-06-09 10:26:57 +01:00
Makefile
aqc111.c net: move from strlcpy with unused retval to strscpy 2022-08-31 14:11:07 -07:00
aqc111.h
asix.h net: asix: ax88772: migrate to phylink 2022-08-26 10:00:52 +01:00
asix_common.c net: move from strlcpy with unused retval to strscpy 2022-08-31 14:11:07 -07:00
asix_devices.c net: asix: fix modprobe "sysfs: cannot create duplicate filename" 2023-03-22 22:04:04 -07:00
ax88172a.c
ax88179_178a.c Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" 2022-08-10 09:28:56 +01:00
catc.c net: move from strlcpy with unused retval to strscpy 2022-08-31 14:11:07 -07:00
cdc-phonet.c
cdc_eem.c cdc-eem: always use BIT 2022-07-01 13:39:03 +01:00
cdc_ether.c USB: zaurus: Add ID for A-300/B-500/C-700 2023-08-01 14:44:27 -07:00
cdc_mbim.c net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 2023-03-07 15:27:01 +01:00
cdc_ncm.c net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize 2023-05-18 19:56:17 -07:00
cdc_subset.c net: usb: delete extra space and tab in blank line 2022-07-28 21:48:20 -07:00
ch9200.c
cx82310_eth.c
dm9601.c net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read 2023-10-10 20:08:11 -07:00
gl620a.c usbnet: gl620a: Replace one-element array with flexible-array member 2022-02-22 17:00:54 -08:00
hso.c tty: hso: simplify hso_serial_write() 2023-08-11 21:12:47 +02:00
huawei_cdc_ncm.c
int51x1.c
ipheth.c usbnet: ipheth: add CDC NCM support 2023-06-09 10:26:57 +01:00
kalmia.c net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path 2023-02-13 09:41:14 +00:00
kaweth.c net: usb: delete extra space and tab in blank line 2022-07-28 21:48:20 -07:00
lan78xx.c net: usb: lan78xx: reorder cleanup operations to avoid UAF bugs 2023-07-31 09:58:29 +01:00
lan78xx.h
lg-vl600.c
mcs7830.c
net1080.c
pegasus.c net: move from strlcpy with unused retval to strscpy 2022-08-31 14:11:07 -07:00
pegasus.h
plusb.c usb: plusb: remove unused pl_clear_QuickLink_features function 2023-03-20 10:16:27 +00:00
qmi_wwan.c net: usb: qmi_wwan: add Quectel EM05GV2 2023-07-31 14:09:38 -07:00
r8152.c r8152: check budget for r8152_poll() 2023-09-11 09:58:34 +01:00
r8153_ecm.c
rndis_host.c usb: rndis_host: Secure rndis_query check against int overflow 2023-01-03 09:24:41 +00:00
rtl8150.c net: move from strlcpy with unused retval to strscpy 2022-08-31 14:11:07 -07:00
sierra_net.c treewide: Convert del_timer*() to timer_shutdown*() 2022-12-25 13:38:09 -08:00
smsc75xx.c net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg 2023-10-03 10:19:29 +02:00
smsc75xx.h
smsc95xx.c net: usb: smsc95xx: Limit packet length to skb->len 2023-03-17 21:58:26 -07:00
smsc95xx.h
sr9700.c net: usb: sr9700: Handle negative len 2023-01-17 11:50:42 +01:00
sr9700.h
sr9800.c
sr9800.h USB2NET : SR9800 : change SR9800_BULKIN_SIZE from global to static 2022-04-22 12:43:35 +01:00
usbnet.c net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb 2023-07-13 20:37:23 -07:00
zaurus.c USB: zaurus: Add ID for A-300/B-500/C-700 2023-08-01 14:44:27 -07:00