Re: [PATCH net v4 2/2] net: usb: lan78xx: reject short register and statistics transfers

[Andrew Lunn]

On Tue, Oct 20, 2026 at 08:16:21AM +0800, Wei Jie Law wrote:
> lan78xx_read_reg() and lan78xx_read_stats() read from the device into
> a freshly kmalloc()ed buffer, but only treat a negative return value
> from usb_control_msg() as an error. A device that answers with fewer
> bytes than requested leaves part or all of the buffer uninitialized,
> and those bytes are then used as the register value or the counters.
> 
> Treat a short transfer as -EIO in both helpers. lan78xx_write_reg()
> does not use uninitialized data, since it fills its buffer before the
> transfer, but make it fail on a short transfer as well, so that all the
> register helpers report a partial transfer as an error.
> 
> The write path validation was suggested by Andrew.
> 
> Found by code review with LLM assistance and reproduced with an
> emulated USB device (raw-gadget + dummy_hcd).
> 
> Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Suggested-by: Andrew Lunn <andrew@xxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Wei Jie Law <law.wei.jie@xxxxxxxxxxxxxx>

It probably never happens or users would of noticed. Please post to
net-next, without the Fixes: tag, once the merge window closes.

Reviewed-by: Andrew Lunn <andrew@xxxxxxx>

    Andrew