net: usb: sr9700: fix uninitialized variable use in sr_mdio_read

It could lead to error happen because the variable res is not updated if
the call to sr_share_read_word returns an error. In this particular case
error code was returned and res stayed uninitialized. Same issue also
applies to sr_read_reg.

This can be avoided by checking the return value of sr_share_read_word
and sr_read_reg, and propagating the error if the read operation failed.

Found by code review.

Cc: stable@vger.kernel.org
Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Reviewed-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Hariprasad Kelam <hkelam@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
index 0a662e42ed96593cf20d4209af2bc64a74f307df..cb7d2f798fb43622c7e954aeebeab8edede4cb49 100644 (file)
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -179,6 +179,7 @@ static int sr_mdio_read(struct net_device *netdev, int phy_id, int loc)
        struct usbnet *dev = netdev_priv(netdev);
        __le16 res;
        int rc = 0;
+       int err;
 
        if (phy_id) {
                netdev_dbg(netdev, "Only internal phy supported\n");
@@ -189,11 +190,17 @@ static int sr_mdio_read(struct net_device *netdev, int phy_id, int loc)
        if (loc == MII_BMSR) {
                u8 value;
 
-               sr_read_reg(dev, SR_NSR, &value);
+               err = sr_read_reg(dev, SR_NSR, &value);
+               if (err < 0)
+                       return err;
+
                if (value & NSR_LINKST)
                        rc = 1;
        }
-       sr_share_read_word(dev, 1, loc, &res);
+       err = sr_share_read_word(dev, 1, loc, &res);
+       if (err < 0)
+               return err;
+
        if (rc == 1)
                res = le16_to_cpu(res) | BMSR_LSTATUS;
        else