# Re: \[PATCH\] net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx\_read\_raw\_eeprom - From: Oleksij Rempel \ - Date: 2025-10-01 08:52:03 - List: netdev - Page: https://ratatoskr.run/netdev/2025/10/3237280 - Thread: https://ratatoskr.run/netdev/2025/09/3236054/t.md ```text On Tue, Sep 30, 2025 at 02:19:02PM +0530, Bhanu Seshu Kumar Valluri wrote: > Syzbot reported read of uninitialized variable BUG with following call stack. > > lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout > ===================================================== > BUG: KMSAN: uninit-value in lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] > BUG: KMSAN: uninit-value in lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] > BUG: KMSAN: uninit-value in lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 > lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] > lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] > lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 > lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 > lan78xx_probe+0x225c/0x3310 drivers/net/usb/lan78xx.c:4707 > > Local variable sig.i.i created at: > lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1092 [inline] > lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] > lan78xx_reset+0x77e/0x2cd0 drivers/net/usb/lan78xx.c:3241 > lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 > > The function lan78xx_read_raw_eeprom failed to properly propagate EEPROM > read timeout errors (-ETIMEDOUT). In the fallthrough path, it first > attempted to restore the pin configuration for LED outputs and then > returned only the status of that restore operation, discarding the > original timeout error. > > As a result, callers could mistakenly treat the data buffer as valid > even though the EEPROM read had actually timed out with no data or partial > data. > > To fix this, handle errors in restoring the LED pin configuration separately. > If the restore succeeds, return any prior EEPROM timeout error correctly > to the caller. > > Reported-by: > Closes: https://syzkaller.appspot.com/bug?extid=62ec8226f01cb4ca19d9 > Fixes: 8b1b2ca83b20 ("net: usb: lan78xx: Improve error handling in EEPROM and OTP operations") > Signed-off-by: Bhanu Seshu Kumar Valluri Reviewed-by: Oleksij Rempel -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | ```