From 8df0638138d3e0344fd1fb36cf2d1ca1cf5028f0 Mon Sep 17 00:00:00 2001 From: Xinsheng Zhu Date: Mon, 5 Oct 2026 11:59:20 -0400 Subject: [PATCH] net: usb: sierra_net: reject short firmware attribute reads sierra_net_get_fw_attr() only checks usbnet_read_cmd() for negative return values before converting attrdata and storing it in *datap. A zero-length or one-byte response leaves attrdata wholly or partially uninitialized. Although sierra_net_bind() rejects responses of unexpected length, its dev_dbg() call uses fwattr before that check. When the debug message is enabled, the incomplete value may therefore be used in the debug output. Require the return value to equal sizeof(attrdata) before accessing the buffer. Return -EIO for short reads, retaining the existing handling of negative errors and leaving the output parameter untouched on failure. Found by manual code inspection with LLM assistance. The issue has not been reproduced at runtime. Cc: stable+noautosel@kernel.org # LLM report + LLM fix, untested Fixes: eb4fd8cd355c ("net/usb: add sierra_net.c driver") Signed-off-by: Xinsheng Zhu Link: https://patch.msgid.link/20261005155920.27735-1-xinsheng.zhu.ny@gmail.com Signed-off-by: Jakub Kicinski --- drivers/net/usb/sierra_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c index 4d3ed642b3e7..95668a5ccd5f 100644 --- a/drivers/net/usb/sierra_net.c +++ b/drivers/net/usb/sierra_net.c @@ -637,7 +637,7 @@ static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap) sizeof(attrdata) /* __u16 size */ ); - if (result < 0) + if (result != sizeof(attrdata)) return -EIO; *datap = le16_to_cpu(attrdata);