kernel/drivers/net/usb/ax88172a.c, branch linux-rolling-stable

net: usb: asix: validate PHY address before use

2026-01-08T09:16:47Z

[ Upstream commit a1e077a3f76eea0dc671ed6792e7d543946227e8 ] The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), which causes a warning in mdiobus_get_phy(): addr 207 out of range WARNING: drivers/net/phy/mdio_bus.c:76 Validate the PHY address in asix_read_phy_addr() and remove the now-redundant check in ax88172a.c. Reported-by: syzbot+3d43c9066a5b54902232@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3d43c9066a5b54902232 Tested-by: syzbot+3d43c9066a5b54902232@syzkaller.appspotmail.com Fixes: 7e88b11a862a ("net: usb: asix: refactor asix_read_phy_addr() and handle errors on return") Link: https://lore.kernel.org/all/20251217085057.270704-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251218011156.276824-1-kartikey406@gmail.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin

net: usb: asix: ax88772: Increase phy_name size

2025-03-25T21:35:32Z

GCC compiler (Debian 14.2.0-17) is not happy about printing into a too short buffer (when build with `make W=1`): drivers/net/usb/ax88172a.c:311:9: note: ‘snprintf’ output between 4 and 66 bytes into a destination of size 20 Indeed, the buffer size is chosen based on some assumptions, while in general the assigned name might not fit. Increase the buffer size to cover the minimum required one. With that, change snprintf() to use sizeof() instead of the hard coded value. While at it, make sure that the PHY address is not bigger than the allowed maximum. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250324144751.1271761-3-andriy.shevchenko@linux.intel.com Signed-off-by: Jakub Kicinski

asix: Add check for usbnet_get_endpoints

2024-01-04T10:50:57Z

Add check for usbnet_get_endpoints() and return the error if it fails in order to transfer the error. Fixes: 16626b0cc3d5 ("asix: Add a new driver for the AX88172A") Signed-off-by: Chen Ni Signed-off-by: David S. Miller

net: usb: use eth_hw_addr_set()

2021-10-02T13:18:25Z

Commit 406f42fa0d3c ("net-next: When a bond have a massive amount of VLANs...") introduced a rbtree for faster Ethernet address look up. To maintain netdev->dev_addr in this tree we need to make all the writes to it got through appropriate helpers. Convert usb drivers from memcpy(... ETH_ADDR) to eth_hw_addr_set(): @@ expression dev, np; @@ - memcpy(dev->dev_addr, np, ETH_ALEN) + eth_hw_addr_set(dev, np) Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller

dev_ioctl: split out ndo_eth_ioctl

2021-07-27T19:11:45Z

Most users of ndo_do_ioctl are ethernet drivers that implement the MII commands SIOCGMIIPHY/SIOCGMIIREG/SIOCSMIIREG, or hardware timestamping with SIOCSHWTSTAMP/SIOCGHWTSTAMP. Separate these from the few drivers that use ndo_do_ioctl to implement SIOCBOND, SIOCBR and SIOCWANDEV commands. This is a purely cosmetic change intended to help readers find their way through the implementation. Cc: Doug Ledford Cc: Jason Gunthorpe Cc: Jay Vosburgh Cc: Veaceslav Falico Cc: Andy Gospodarek Cc: Andrew Lunn Cc: Vivien Didelot Cc: Florian Fainelli Cc: Vladimir Oltean Cc: Leon Romanovsky Cc: linux-rdma@vger.kernel.org Signed-off-by: Arnd Bergmann Acked-by: Jason Gunthorpe Signed-off-by: David S. Miller

net: usb: asix: ax88772: Fix less than zero comparison of a u16

2021-06-09T21:54:03Z

The comparison of the u16 priv->phy_addr < 0 is always false because phy_addr is unsigned. Fix this by assigning the return from the call to function asix_read_phy_addr to int ret and using this for the less than zero error check comparison. Fixes: 7e88b11a862a ("net: usb: asix: refactor asix_read_phy_addr() and handle errors on return") Addresses-Coverity: ("Unsigned compared against 0") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller

net: usb: asix: ax88772: add phylib support

2021-06-07T20:23:02Z

To be able to use ax88772 with external PHYs and use advantage of existing PHY drivers, we need to port at least ax88772 part of asix driver to the phylib framework. Signed-off-by: Oleksij Rempel Signed-off-by: David S. Miller

net: usb: asix: refactor asix_read_phy_addr() and handle errors on return

2021-06-07T20:23:02Z

Refactor asix_read_phy_addr() to return usable error value directly and make sure all callers handle this error. Signed-off-by: Oleksij Rempel Signed-off-by: David S. Miller

net: usb: switch to dev_get_tstats64 and remove usbnet_get_stats64 alias

2020-11-12T22:58:27Z

Replace usbnet_get_stats64() with new identical core function dev_get_tstats64() in all users and remove usbnet_get_stats64(). Signed-off-by: Heiner Kallweit Acked-by: Bjørn Mork Signed-off-by: Jakub Kicinski

ax88172a: fix ax88172a_unbind() failures

2020-07-16T01:26:29Z

If ax88172a_unbind() fails, make sure that the return code is less than zero so that cleanup is done properly and avoid UAF. Fixes: a9a51bd727d1 ("ax88172a: fix information leak on short answers") Signed-off-by: George Kennedy Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com Signed-off-by: Jakub Kicinski