Re: [PATCH] net: usb: rtl8150: handle link status read failures
From: Petko Manolov <petkan@nucleusys.com>
Date: 2026-06-28 15:25:14
Also in:
linux-usb, lkml, stable
On 26-06-28 11:39:29, Yousef Alhouseen wrote:
quoted hunk ↗ jump to hunk
set_carrier() ignores the result of the USB control transfer and tests the stack variable supplied as its receive buffer. If the device rejects or aborts the request, that variable remains uninitialized and the driver chooses an arbitrary carrier state. Report carrier down when the link status cannot be read. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+9db6c624635564ad813c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9db6c624635564ad813c Cc: stable@vger.kernel.org Signed-off-by: Yousef Alhouseen <redacted> --- drivers/net/usb/rtl8150.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index c880c95c41a5..5606490aaea0 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c@@ -732,7 +732,11 @@ static void set_carrier(struct net_device *netdev) rtl8150_t *dev = netdev_priv(netdev); short tmp; - get_registers(dev, CSCR, 2, &tmp); + if (get_registers(dev, CSCR, 2, &tmp)) { + netif_carrier_off(netdev); + return; + } + if (tmp & CSCR_LINK_STATUS) netif_carrier_on(netdev); else
I'd rather do something along these lines:
@@ -732,7 +732,9 @@ static void set_carrier(struct net_device *netdev) rtl8150_t *dev = netdev_priv(netdev); short tmp; - get_registers(dev, CSCR, 2, &tmp); + if (get_registers(dev, CSCR, 2, &tmp) + return; + if (tmp & CSCR_LINK_STATUS) netif_carrier_on(netdev); else
IIRC it is possible for the message get lost in bus noise while the device is still operating correctly. So if my memory isn't failing me, it is better to not do anything if usb_control_msg_recv() is non-zero and only change the carrier status if 'tmp' contains meaningful value. Petko