Re: [PATCH] net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom

[Oleksij Rempel <o.rempel@pengutronix.de>]

On Tue, Sep 30, 2025 at 02:19:02PM +0530, Bhanu Seshu Kumar Valluri wrote:
> Syzbot reported read of uninitialized variable BUG with following call stack.
> 
> lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout
> =====================================================
> BUG: KMSAN: uninit-value in lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline]
> BUG: KMSAN: uninit-value in lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline]
> BUG: KMSAN: uninit-value in lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241
>  lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline]
>  lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline]
>  lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241
>  lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766
>  lan78xx_probe+0x225c/0x3310 drivers/net/usb/lan78xx.c:4707
> 
> Local variable sig.i.i created at:
>  lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1092 [inline]
>  lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline]
>  lan78xx_reset+0x77e/0x2cd0 drivers/net/usb/lan78xx.c:3241
>  lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766
> 
> The function lan78xx_read_raw_eeprom failed to properly propagate EEPROM
> read timeout errors (-ETIMEDOUT). In the fallthrough path, it first
> attempted to restore the pin configuration for LED outputs and then
> returned only the status of that restore operation, discarding the
> original timeout error.
> 
> As a result, callers could mistakenly treat the data buffer as valid
> even though the EEPROM read had actually timed out with no data or partial
> data.
> 
> To fix this, handle errors in restoring the LED pin configuration separately.
> If the restore succeeds, return any prior EEPROM timeout error correctly
> to the caller.
> 
> Reported-by: syzbot+62ec8226f01cb4ca19d9@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=62ec8226f01cb4ca19d9
> Fixes: 8b1b2ca83b20 ("net: usb: lan78xx: Improve error handling in EEPROM and OTP operations")
> Signed-off-by: Bhanu Seshu Kumar Valluri <bhanuseshukumar@gmail.com>

Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |