Check get_registers() when reading CSCR in set_carrier(). If the control transfer fails, don't use the stack value. Reported-by: syzbot+9db6c624635564ad813c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9db6c624635564ad813c Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Morduan Zang --- drivers/net/usb/rtl8150.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index 4cda0643afb6..7e32726d3e6f 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -722,7 +722,11 @@ static void set_carrier(struct net_device *netdev) rtl8150_t *dev = netdev_priv(netdev); short tmp; - get_registers(dev, CSCR, 2, &tmp); + if (get_registers(dev, CSCR, 2, &tmp) < 0) { + netif_carrier_off(netdev); + return; + } + if (tmp & CSCR_LINK_STATUS) netif_carrier_on(netdev); else -- 2.50.1