Unverified Commit e89315eb authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5727 fix CVE-2021-47101 

Merge Pull Request from: @ci-robot 
 
PR sync from: Cheng Yu <serein.chengyu@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/3A33OCEP4GK35M2Z36XNAA332HSI62CB/ 
fix CVE-2021-47101

Pavel Skripkin (3):
  net: asix: fix uninit value bugs
  asix: fix uninit-value in asix_mdio_read()
  asix: fix wrong return value in asix_check_host_enable()


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/I95RDW 
 
Link:https://gitee.com/openeuler/kernel/pulls/5727

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 9082d71c 4b064126

drivers/net/usb/asix_common.c

+33 −40
Original line number Diff line number Diff line
@@ -21,6 +21,8 @@ 


#include "asix.h"



#define AX_HOST_EN_RETRIES	30



int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,

		  u16 size, void *data, int in_pm)

{
@@ -75,6 +77,29 @@ void asix_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value, u16 index, 
			       value, index, data, size);

}



static int asix_check_host_enable(struct usbnet *dev, int in_pm)

{

	int i, ret;

	u8 smsr;



	for (i = 0; i < AX_HOST_EN_RETRIES; ++i) {

		ret = asix_set_sw_mii(dev, in_pm);

		if (ret == -ENODEV || ret == -ETIMEDOUT)

			break;

		usleep_range(1000, 1100);

		ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG,

				    0, 0, 1, &smsr, in_pm);

		if (ret == -ENODEV)

			break;

		else if (ret < sizeof(smsr))

			continue;

		else if (smsr & AX_HOST_EN)

			break;

	}



	return i >= AX_HOST_EN_RETRIES ? -ETIMEDOUT : ret;

}



static void reset_asix_rx_fixup_info(struct asix_rx_fixup_info *rx)

{

	/* Reset the variables that have a lifetime outside of
@@ -458,19 +483,11 @@ int asix_mdio_read(struct net_device *netdev, int phy_id, int loc) 
{

	struct usbnet *dev = netdev_priv(netdev);

	__le16 res;

	u8 smsr;

	int i = 0;

	int ret;



	mutex_lock(&dev->phy_mutex);

	do {

		ret = asix_set_sw_mii(dev, 0);

		if (ret == -ENODEV || ret == -ETIMEDOUT)

			break;

		usleep_range(1000, 1100);

		ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG,

				    0, 0, 1, &smsr, 0);

	} while (!(smsr & AX_HOST_EN) && (i++ < 30) && (ret != -ENODEV));



	ret = asix_check_host_enable(dev, 0);

	if (ret == -ENODEV || ret == -ETIMEDOUT) {

		mutex_unlock(&dev->phy_mutex);

		return ret;
@@ -491,22 +508,14 @@ void asix_mdio_write(struct net_device *netdev, int phy_id, int loc, int val) 
{

	struct usbnet *dev = netdev_priv(netdev);

	__le16 res = cpu_to_le16(val);

	u8 smsr;

	int i = 0;

	int ret;



	netdev_dbg(dev->net, "asix_mdio_write() phy_id=0x%02x, loc=0x%02x, val=0x%04x\n",

			phy_id, loc, val);



	mutex_lock(&dev->phy_mutex);

	do {

		ret = asix_set_sw_mii(dev, 0);

		if (ret == -ENODEV)

			break;

		usleep_range(1000, 1100);

		ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG,

				    0, 0, 1, &smsr, 0);

	} while (!(smsr & AX_HOST_EN) && (i++ < 30) && (ret != -ENODEV));



	ret = asix_check_host_enable(dev, 0);

	if (ret == -ENODEV) {

		mutex_unlock(&dev->phy_mutex);

		return;
@@ -522,19 +531,11 @@ int asix_mdio_read_nopm(struct net_device *netdev, int phy_id, int loc) 
{

	struct usbnet *dev = netdev_priv(netdev);

	__le16 res;

	u8 smsr;

	int i = 0;

	int ret;



	mutex_lock(&dev->phy_mutex);

	do {

		ret = asix_set_sw_mii(dev, 1);

		if (ret == -ENODEV || ret == -ETIMEDOUT)

			break;

		usleep_range(1000, 1100);

		ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG,

				    0, 0, 1, &smsr, 1);

	} while (!(smsr & AX_HOST_EN) && (i++ < 30) && (ret != -ENODEV));



	ret = asix_check_host_enable(dev, 1);

	if (ret == -ENODEV || ret == -ETIMEDOUT) {

		mutex_unlock(&dev->phy_mutex);

		return ret;
@@ -556,22 +557,14 @@ asix_mdio_write_nopm(struct net_device *netdev, int phy_id, int loc, int val) 
{

	struct usbnet *dev = netdev_priv(netdev);

	__le16 res = cpu_to_le16(val);

	u8 smsr;

	int i = 0;

	int ret;



	netdev_dbg(dev->net, "asix_mdio_write() phy_id=0x%02x, loc=0x%02x, val=0x%04x\n",

			phy_id, loc, val);



	mutex_lock(&dev->phy_mutex);

	do {

		ret = asix_set_sw_mii(dev, 1);

		if (ret == -ENODEV)

			break;

		usleep_range(1000, 1100);

		ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG,

				    0, 0, 1, &smsr, 1);

	} while (!(smsr & AX_HOST_EN) && (i++ < 30) && (ret != -ENODEV));



	ret = asix_check_host_enable(dev, 1);

	if (ret == -ENODEV) {

		mutex_unlock(&dev->phy_mutex);

		return;