linux-kernel - Re: [PATCH] net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aNzrpEaYwoNwcbrd@pengutronix.de>
Date: Wed, 1 Oct 2025 10:51:48 +0200
From: Oleksij Rempel <o.rempel@...gutronix.de>
To: Bhanu Seshu Kumar Valluri <bhanuseshukumar@...il.com>
Cc: Thangaraj.S@...rochip.com, Rengarajan.S@...rochip.com,
	UNGLinuxDriver@...rochip.com, andrew+netdev@...n.ch,
	davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
	pabeni@...hat.com, netdev@...r.kernel.org,
	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
	syzbot+62ec8226f01cb4ca19d9@...kaller.appspotmail.com
Subject: Re: [PATCH] net: usb: lan78xx: Fix lost EEPROM read timeout
 error(-ETIMEDOUT) in lan78xx_read_raw_eeprom

On Tue, Sep 30, 2025 at 02:19:02PM +0530, Bhanu Seshu Kumar Valluri wrote:
> Syzbot reported read of uninitialized variable BUG with following call stack.
> 
> lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout
> =====================================================
> BUG: KMSAN: uninit-value in lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline]
> BUG: KMSAN: uninit-value in lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline]
> BUG: KMSAN: uninit-value in lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241
>  lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline]
>  lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline]
>  lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241
>  lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766
>  lan78xx_probe+0x225c/0x3310 drivers/net/usb/lan78xx.c:4707
> 
> Local variable sig.i.i created at:
>  lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1092 [inline]
>  lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline]
>  lan78xx_reset+0x77e/0x2cd0 drivers/net/usb/lan78xx.c:3241
>  lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766
> 
> The function lan78xx_read_raw_eeprom failed to properly propagate EEPROM
> read timeout errors (-ETIMEDOUT). In the fallthrough path, it first
> attempted to restore the pin configuration for LED outputs and then
> returned only the status of that restore operation, discarding the
> original timeout error.
> 
> As a result, callers could mistakenly treat the data buffer as valid
> even though the EEPROM read had actually timed out with no data or partial
> data.
> 
> To fix this, handle errors in restoring the LED pin configuration separately.
> If the restore succeeds, return any prior EEPROM timeout error correctly
> to the caller.
> 
> Reported-by: syzbot+62ec8226f01cb4ca19d9@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=62ec8226f01cb4ca19d9
> Fixes: 8b1b2ca83b20 ("net: usb: lan78xx: Improve error handling in EEPROM and OTP operations")
> Signed-off-by: Bhanu Seshu Kumar Valluri <bhanuseshukumar@...il.com>

Reviewed-by: Oleksij Rempel <o.rempel@...gutronix.de> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |