Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 422abacd authored by Prashant Malani's avatar Prashant Malani Committed by Greg Kroah-Hartman
Browse files

r8152: Set memory to all 0xFFs on failed reg reads 



[ Upstream commit f53a7ad189594a112167efaf17ea8d0242b5ac00 ]

get_registers() blindly copies the memory written to by the
usb_control_msg() call even if the underlying urb failed.

This could lead to junk register values being read by the driver, since
some indirect callers of get_registers() ignore the return values. One
example is:
  ocp_read_dword() ignores the return value of generic_ocp_read(), which
  calls get_registers().

So, emulate PCI "Master Abort" behavior by setting the buffer to all
0xFFs when usb_control_msg() fails.

This patch is copied from the r8152 driver (v2.12.0) published by
Realtek (www.realtek.com).

Signed-off-by: default avatarPrashant Malani <pmalani@chromium.org>
Acked-by: default avatarHayes Wang <hayeswang@realtek.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent a1653da6

drivers/net/usb/r8152.c

+4 −1
Original line number Diff line number Diff line
@@ -689,8 +689,11 @@ int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) 
	ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0),

			      RTL8152_REQ_GET_REGS, RTL8152_REQT_READ,

			      value, index, tmp, size, 500);



	if (ret < 0)

		memset(data, 0xff, size);

	else

		memcpy(data, tmp, size);



	kfree(tmp);



	return ret;