Commit 4b064126 authored by Pavel Skripkin's avatar Pavel Skripkin Committed by Cheng Yu
Browse files

asix: fix wrong return value in asix_check_host_enable() 

mainline inclusion
from mainline-v5.16-rc7
commit d1652b70
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95RDW
CVE: CVE-2021-47101

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d1652b70d07cc3eed96210c876c4879e1655f20e



--------------------------------

If asix_read_cmd() returns 0 on 30th interation, 0 will be returned from
asix_check_host_enable(), which is logically wrong. Fix it by returning
-ETIMEDOUT explicitly if we have exceeded 30 iterations

Also, replaced 30 with #define as suggested by Andrew

Fixes: a786e319 ("net: asix: fix uninit value bugs")
Reported-by: default avatarAndrew Lunn <andrew@lunn.ch>
Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/ecd3470ce6c2d5697ac635d0d3b14a47defb4acb.1640117288.git.paskripkin@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarCheng Yu <serein.chengyu@huawei.com>
parent dfb9ca86

drivers/net/usb/asix_common.c

+4 −2
Original line number Diff line number Diff line
@@ -21,6 +21,8 @@ 


#include "asix.h"



#define AX_HOST_EN_RETRIES	30



int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,

		  u16 size, void *data, int in_pm)

{
@@ -80,7 +82,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm) 
	int i, ret;

	u8 smsr;



	for (i = 0; i < 30; ++i) {

	for (i = 0; i < AX_HOST_EN_RETRIES; ++i) {

		ret = asix_set_sw_mii(dev, in_pm);

		if (ret == -ENODEV || ret == -ETIMEDOUT)

			break;
@@ -95,7 +97,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm) 
			break;

	}



	return ret;

	return i >= AX_HOST_EN_RETRIES ? -ETIMEDOUT : ret;

}



static void reset_asix_rx_fixup_info(struct asix_rx_fixup_info *rx)