diff options
| author | Yousef Alhouseen <alhouseenyousef@gmail.com> | 2026-06-30 12:12:16 +0200 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-07-02 10:57:48 +0200 |
| commit | 8c9c5b9a689612dcb92a04a4218c975cd19f19d8 (patch) | |
| tree | cd452a3b6e8e951cf159938af42c4d89ddfc2eeb | |
| parent | f5afff65a7743af1d68c338e358ae3f4936d3a7f (diff) | |
| download | linux-next-8c9c5b9a689612dcb92a04a4218c975cd19f19d8.tar.gz linux-next-8c9c5b9a689612dcb92a04a4218c975cd19f19d8.zip | |
net: usb: rtl8150: handle link status read failures
set_carrier() ignores the result of the USB control transfer and tests
the stack variable supplied as its receive buffer. If the device rejects
or aborts the request, that variable remains uninitialized and the driver
chooses an arbitrary carrier state.
Leave the existing carrier state unchanged when the link status cannot be
read. A transient USB error should not be treated as link loss.
Reported-by: syzbot+9db6c624635564ad813c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9db6c624635564ad813c
Suggested-by: Petko Manolov <petkan@nucleusys.com>
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20260630101216.10365-1-alhouseenyousef@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
| -rw-r--r-- | drivers/net/usb/rtl8150.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index c880c95c41a5..d51e43170e03 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -732,7 +732,9 @@ static void set_carrier(struct net_device *netdev) rtl8150_t *dev = netdev_priv(netdev); short tmp; - get_registers(dev, CSCR, 2, &tmp); + if (get_registers(dev, CSCR, 2, &tmp)) + return; + if (tmp & CSCR_LINK_STATUS) netif_carrier_on(netdev); else |