No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Qasim Ijaz 119766de49 net: ch9200: fix uninitialised access during mii_nway_restart
commit 9ad0452c0277b816a435433cca601304cfac7c21 upstream.

In mii_nway_restart() the code attempts to call
mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read()
utilises a local buffer called "buff", which is initialised
with control_read(). However "buff" is conditionally
initialised inside control_read():

        if (err == size) {
                memcpy(data, buf, size);
        }

If the condition of "err == size" is not met, then
"buff" remains uninitialised. Once this happens the
uninitialised "buff" is accessed and returned during
ch9200_mdio_read():

        return (buff[0] | buff[1] << 8);

The problem stems from the fact that ch9200_mdio_read()
ignores the return value of control_read(), leading to
uinit-access of "buff".

To fix this we should check the return value of
control_read() and return early on error.

Reported-by: syzbot <syzbot+3361c2d6f78a3e0892f9@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=3361c2d6f78a3e0892f9
Tested-by: syzbot <syzbot+3361c2d6f78a3e0892f9@syzkaller.appspotmail.com>
Fixes: 4a476bd6d1 ("usbnet: New driver for QinHeng CH9200 devices")
Cc: stable@vger.kernel.org
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
Link: https://patch.msgid.link/20250526183607.66527-1-qasdev00@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-27 11:02:52 +01:00
arch parisc: fix building with gcc-15 2025-06-27 11:02:51 +01:00
block block: fix 'kmem_cache of name 'bio-108' already exists' 2025-04-10 14:29:37 +02:00
certs
crypto crypto: algif_hash - fix double free in hash_accept 2025-06-04 14:32:35 +02:00
Documentation x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 2025-06-04 14:32:32 +02:00
drivers net: ch9200: fix uninitialised access during mii_nway_restart 2025-06-27 11:02:52 +01:00
fs f2fs: prevent kernel warning due to negative i_nlink from corrupted image 2025-06-27 11:02:51 +01:00
include coredump: hand a pidfd to the usermode coredump helper 2025-06-04 14:32:36 +02:00
init sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP 2025-05-02 07:39:28 +02:00
ipc ipc: fix to protect IPCS lookups using RCU 2025-06-27 11:02:52 +01:00
kernel ftrace: Fix UAF when lookup kallsym after ftrace disabled 2025-06-27 11:02:52 +01:00
lib dql: Fix dql->limit value when reset. 2025-06-04 14:32:30 +02:00
LICENSES
mm mm: fix ratelimit_pages update error in dirty_ratio_handler() 2025-06-27 11:02:52 +01:00
net NFC: nci: uart: Set tty->disc_data only in success path 2025-06-27 11:02:51 +01:00
samples samples/bpf: Fix a resource leak 2024-12-14 19:44:50 +01:00
scripts kbuild: fix argument parsing in scripts/config 2025-06-04 14:32:31 +02:00
security smack: recognize ipv4 CIPSO w/o categories 2025-06-04 14:32:33 +02:00
sound ALSA: pcm: Fix race of buffer access at PCM OSS layer 2025-06-04 14:32:35 +02:00
tools perf record: Fix incorrect --user-regs comments 2025-06-27 11:02:48 +01:00
usr
virt KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status 2024-12-19 18:05:04 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Remove *.orig pattern from .gitignore 2024-11-08 16:20:33 +01:00
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.294 2025-06-04 14:32:37 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.