From: Pavel Skripkin paskripkin@gmail.com
mainline inclusion from mainline-v5.16-rc7 commit d1652b70d07cc3eed96210c876c4879e1655f20e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95RDW CVE: CVE-2021-47101
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
If asix_read_cmd() returns 0 on 30th interation, 0 will be returned from asix_check_host_enable(), which is logically wrong. Fix it by returning -ETIMEDOUT explicitly if we have exceeded 30 iterations
Also, replaced 30 with #define as suggested by Andrew
Fixes: a786e3195d6a ("net: asix: fix uninit value bugs") Reported-by: Andrew Lunn andrew@lunn.ch Signed-off-by: Pavel Skripkin paskripkin@gmail.com Reviewed-by: Andrew Lunn andrew@lunn.ch Link: https://lore.kernel.org/r/ecd3470ce6c2d5697ac635d0d3b14a47defb4acb.164011728... Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Cheng Yu serein.chengyu@huawei.com --- drivers/net/usb/asix_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c index 11554bce19b0..43a20e59311a 100644 --- a/drivers/net/usb/asix_common.c +++ b/drivers/net/usb/asix_common.c @@ -9,6 +9,8 @@
#include "asix.h"
+#define AX_HOST_EN_RETRIES 30 + int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, u16 size, void *data, int in_pm) { @@ -68,7 +70,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm) int i, ret; u8 smsr;
- for (i = 0; i < 30; ++i) { + for (i = 0; i < AX_HOST_EN_RETRIES; ++i) { ret = asix_set_sw_mii(dev, in_pm); if (ret == -ENODEV || ret == -ETIMEDOUT) break; @@ -83,7 +85,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm) break; }
- return ret; + return i >= AX_HOST_EN_RETRIES ? -ETIMEDOUT : ret; }
static void reset_asix_rx_fixup_info(struct asix_rx_fixup_info *rx)