From patchwork Mon Oct 28 07:41:39 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Koichiro Den X-Patchwork-Id: 2003137 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4XcQMr027Mz1xxY for ; Mon, 28 Oct 2024 18:42:31 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1t5KOK-0002hB-EB; Mon, 28 Oct 2024 07:42:20 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1t5KOI-0002gt-EE for kernel-team@lists.ubuntu.com; Mon, 28 Oct 2024 07:42:18 +0000 Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 133693F2A2 for ; Mon, 28 Oct 2024 07:42:18 +0000 (UTC) Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-2e2fc2b1ce1so4045974a91.0 for ; Mon, 28 Oct 2024 00:42:18 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1730101336; x=1730706136; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=owij+TGMMn7P2/ACHSCteZ5zWT6hY4OMk/lFU8KwDWY=; b=kOfMUGuLs/OzSq9kYoxXjSbeF4yy7DCUZU2/rpUVuIOMU9z5pLXKgvyueQB9uwzn7q st7S7tWRIvWjHSFzR9YBr2kp0uyQ1i6OTURjUwK36yJqJ1UqwR3yygtNJ1Em3A2DrgXj bmfSJpe5yi0g4+E0Ne4FoLMv9jlXJwPa1IRtH3pLbyyJKVd9y56zij90qUNnt06tOqhE /pxZlzxCmA5IXAWBiVose3bfHE6zAXumTG1rPLnu6ALpQL1GdpdF1KQ7BPu2JLt6i3zV YbNj8WH4HUbmXYtf23vm9iHOmGyS1YNu3LqLI2XXtTjK5JsI87jK1Jcj1Xhnydal0Kif SrCw== X-Gm-Message-State: AOJu0Yy2cEKAeetsS+Q4Pyscb122c/lVMKSIpSfKRhchBptvNqXjgSuN sC0Bss3eUfGOwSZY4p5DYnvmEqdgiuIFNXSgWLvENHo33+5zZWr6z1LNdcNJ6woAKPBoDrYEfUV o4zQouS25Xo5XRGEnmqEYZjyoZnz29mIu53aOPn2ar5SI+U4BdvHqdD+u/65EqgrjBvfQaDGeOu Fdl3ewE5MwOA== X-Received: by 2002:a17:903:228a:b0:20f:ab4a:db2e with SMTP id d9443c01a7336-210c6c08352mr99268925ad.29.1730101336554; Mon, 28 Oct 2024 00:42:16 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFpURhstqHjP1mta1YCreWV+0KRrjV+LwJLDPVxUo6q5HVB9FPm7bpaH0NfCNyWWu/yTvyUNQ== X-Received: by 2002:a17:903:228a:b0:20f:ab4a:db2e with SMTP id d9443c01a7336-210c6c08352mr99268775ad.29.1730101336169; Mon, 28 Oct 2024 00:42:16 -0700 (PDT) Received: from localhost.localdomain ([240f:74:7be:1:fc2f:5f77:13cb:653f]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-210bc0167f3sm45344785ad.150.2024.10.28.00.42.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Oct 2024 00:42:15 -0700 (PDT) From: Koichiro Den To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH v2 2/3] asix: fix wrong return value in asix_check_host_enable() Date: Mon, 28 Oct 2024 16:41:39 +0900 Message-ID: <20241028074150.112511-3-koichiro.den@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20241028074150.112511-1-koichiro.den@canonical.com> References: <20241028074150.112511-1-koichiro.den@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Pavel Skripkin If asix_read_cmd() returns 0 on 30th interation, 0 will be returned from asix_check_host_enable(), which is logically wrong. Fix it by returning -ETIMEDOUT explicitly if we have exceeded 30 iterations Also, replaced 30 with #define as suggested by Andrew Fixes: a786e3195d6a ("net: asix: fix uninit value bugs") Reported-by: Andrew Lunn Signed-off-by: Pavel Skripkin Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/ecd3470ce6c2d5697ac635d0d3b14a47defb4acb.1640117288.git.paskripkin@gmail.com Signed-off-by: Jakub Kicinski (cherry picked from commit d1652b70d07cc3eed96210c876c4879e1655f20e) [koichiroden: Follow-up fix commit for the preceding prereq commit] CVE-2021-47101 Signed-off-by: Koichiro Den --- drivers/net/usb/asix_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c index 12ce52600eaf..65fd0d5e9cc5 100644 --- a/drivers/net/usb/asix_common.c +++ b/drivers/net/usb/asix_common.c @@ -9,6 +9,8 @@ #include "asix.h" +#define AX_HOST_EN_RETRIES 30 + int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, u16 size, void *data, int in_pm) { @@ -68,7 +70,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm) int i, ret; u8 smsr; - for (i = 0; i < 30; ++i) { + for (i = 0; i < AX_HOST_EN_RETRIES; ++i) { ret = asix_set_sw_mii(dev, in_pm); if (ret == -ENODEV || ret == -ETIMEDOUT) break; @@ -83,7 +85,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm) break; } - return ret; + return i >= AX_HOST_EN_RETRIES ? -ETIMEDOUT : ret; } static void reset_asix_rx_fixup_info(struct asix_rx_fixup_info *rx)