Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Merge tag 'ieee802154-for-net-2022-01-05' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan

Stefan Schmidt says:

====================
pull-request: ieee802154 for net 2022-01-05

Below I have a last minute fix for the atusb driver.

Pavel fixes a KASAN uninit report for the driver. This version is the
minimal impact fix to ease backporting. A bigger rework of the driver to
avoid potential similar problems is ongoing and will come through net-next
when ready.

* tag 'ieee802154-for-net-2022-01-05' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan:
ieee802154: atusb: fix uninit value in atusb_set_extended_addr
====================

Link: https://lore.kernel.org/r/20220105153914.512305-1-stefan@datenfreihafen.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

+6 -4
+6 -4
drivers/net/ieee802154/atusb.c
··· 93 93 94 94 ret = usb_control_msg(usb_dev, pipe, request, requesttype, 95 95 value, index, data, size, timeout); 96 - if (ret < 0) { 96 + if (ret < size) { 97 + ret = ret < 0 ? ret : -ENODATA; 98 + 97 99 atusb->err = ret; 98 100 dev_err(&usb_dev->dev, 99 101 "%s: req 0x%02x val 0x%x idx 0x%x, error %d\n", ··· 863 861 if (!build) 864 862 return -ENOMEM; 865 863 866 - ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0), 867 - ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0, 868 - build, ATUSB_BUILD_SIZE, 1000); 864 + /* We cannot call atusb_control_msg() here, since this request may read various length data */ 865 + ret = usb_control_msg(atusb->usb_dev, usb_rcvctrlpipe(usb_dev, 0), ATUSB_BUILD, 866 + ATUSB_REQ_FROM_DEV, 0, 0, build, ATUSB_BUILD_SIZE, 1000); 869 867 if (ret >= 0) { 870 868 build[ret] = 0; 871 869 dev_info(&usb_dev->dev, "Firmware: build %s\n", build);