Commit f1d80501 authored by Ma Ke's avatar Ma Ke Committed by ZhangPeng
Browse files

net: usb: sr9700: fix uninitialized variable use in sr_mdio_read 

stable inclusion
from stable-v6.6.45
commit f2b5be33a3b54564e6a1d8d290f7536f1aceeef5
bugzilla: https://gitee.com/openeuler/kernel/issues/IAJEIR

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f2b5be33a3b54564e6a1d8d290f7536f1aceeef5



--------------------------------

commit 08f3a5c38087d1569e982a121aad1e6acbf145ce upstream.

It could lead to error happen because the variable res is not updated if
the call to sr_share_read_word returns an error. In this particular case
error code was returned and res stayed uninitialized. Same issue also
applies to sr_read_reg.

This can be avoided by checking the return value of sr_share_read_word
and sr_read_reg, and propagating the error if the read operation failed.

Found by code review.

Cc: stable@vger.kernel.org
Fixes: c9b37458 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support")
Signed-off-by: default avatarMa Ke <make24@iscas.ac.cn>
Reviewed-by: default avatarShigeru Yoshida <syoshida@redhat.com>
Reviewed-by: default avatarHariprasad Kelam <hkelam@marvell.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhangPeng <zhangpeng362@huawei.com>
parent 745e0c86

drivers/net/usb/sr9700.c

+9 −2
Original line number Diff line number Diff line
@@ -179,6 +179,7 @@ static int sr_mdio_read(struct net_device *netdev, int phy_id, int loc) 
	struct usbnet *dev = netdev_priv(netdev);

	__le16 res;

	int rc = 0;

	int err;



	if (phy_id) {

		netdev_dbg(netdev, "Only internal phy supported\n");
@@ -189,11 +190,17 @@ static int sr_mdio_read(struct net_device *netdev, int phy_id, int loc) 
	if (loc == MII_BMSR) {

		u8 value;



		sr_read_reg(dev, SR_NSR, &value);

		err = sr_read_reg(dev, SR_NSR, &value);

		if (err < 0)

			return err;



		if (value & NSR_LINKST)

			rc = 1;

	}

	sr_share_read_word(dev, 1, loc, &res);

	err = sr_share_read_word(dev, 1, loc, &res);

	if (err < 0)

		return err;



	if (rc == 1)

		res = le16_to_cpu(res) | BMSR_LSTATUS;

	else