[PATCH net] net: usb: r8153_ecm: reject short register reads

[Xinsheng Zhu]

pla_read_word() and pla_write_word() read four bytes into an
uninitialized stack variable, but only check usbnet_read_cmd() for
negative return values. The helper can also return a non-negative
length smaller than requested, leaving part or all of tmp
uninitialized.

pla_read_word() may then derive the register value from uninitialized
bytes. pla_write_word() may include uninitialized bytes in the buffer
sent to the device during its read-modify-write operation.

Require the return value to equal sizeof(tmp) before using the buffer.
Return -ENODATA for short reads while preserving negative errors from
usbnet_read_cmd().

Found by manual code inspection with LLM assistance. The issue has not
been reproduced at runtime.

Fixes: c1aedf015ebd ("net/usb/r8153_ecm: support ECM mode for RTL8153")
Signed-off-by: Xinsheng Zhu <xinsheng.zhu.ny@xxxxxxxxx>
---
 drivers/net/usb/r8153_ecm.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/r8153_ecm.c b/drivers/net/usb/r8153_ecm.c
index 8d860dacdf49..0988a3444c55 100644
--- a/drivers/net/usb/r8153_ecm.c
+++ b/drivers/net/usb/r8153_ecm.c
@@ -23,8 +23,10 @@ static int pla_read_word(struct usbnet *dev, u16 index)
 
 	ret = usbnet_read_cmd(dev, RTL8152_REQ_GET_REGS, RTL8152_REQT_READ, index,
 			      MCU_TYPE_PLA | byen, &tmp, sizeof(tmp));
-	if (ret < 0)
+	if (ret != sizeof(tmp)) {
+		ret = ret < 0 ? ret : -ENODATA;
 		goto out;
+	}
 
 	ret = __le32_to_cpu(tmp);
 	ret >>= (shift * 8);
@@ -55,8 +57,10 @@ static int pla_write_word(struct usbnet *dev, u16 index, u32 data)
 	ret = usbnet_read_cmd(dev, RTL8152_REQ_GET_REGS, RTL8152_REQT_READ, index,
 			      MCU_TYPE_PLA | byen, &tmp, sizeof(tmp));
 
-	if (ret < 0)
+	if (ret != sizeof(tmp)) {
+		ret = ret < 0 ? ret : -ENODATA;
 		goto out;
+	}
 
 	data |= __le32_to_cpu(tmp) & ~mask;
 	tmp = __cpu_to_le32(data);

base-commit: 6dc989ea46b96ce170840174b4a38c4a387fb005
-- 
2.54.0 (Apple Git-157)