CVE-2025-38153

In the Linux kernel, the following vulnerability has been resolved:

net: usb: aqc111: fix error handling of usbnet read calls

Syzkaller, courtesy of syzbot, identified an error (see report [1]) in aqc111 driver, caused by incomplete sanitation of usb read calls' results. This problem is quite similar to the one fixed in commit 920a9fa27e78 ("net: asix: add proper error handling of usb read errors").

For instance, usbnetreadcmd() may read fewer than 'size' bytes, even if the caller expected the full amount, and aqc111readcmd() will not check its result properly. As [1] shows, this may lead to MAC address in aqc111_bind() being only partly initialized, triggering KMSAN warnings.

Fix the issue by verifying that the number of bytes read is as expected and not less.

[1] Partial syzbot report: BUG: KMSAN: uninit-value in isvalidetheraddr include/linux/etherdevice.h:208 [inline] BUG: KMSAN: uninit-value in usbnetprobe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 isvalidetheraddr include/linux/etherdevice.h:208 [inline] usbnetprobe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 usbprobeinterface+0xd01/0x1310 drivers/usb/core/driver.c:396 calldriverprobe drivers/base/dd.c:-1 [inline] really_probe+0x4d1/0xd90 drivers/base/dd.c:658 __driverprobedevice+0x268/0x380 drivers/base/dd.c:800 ...

Uninit was stored to memory at: devaddrmod+0xb0/0x550 net/core/devaddrlists.c:582 _devaddrset include/linux/netdevice.h:4874 [inline] ethhwaddrset include/linux/etherdevice.h:325 [inline] aqc111bind+0x35f/0x1150 drivers/net/usb/aqc111.c:717 usbnetprobe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usbprobeinterface+0xd01/0x1310 drivers/usb/core/driver.c:396 ...

Uninit was stored to memory at: etheraddrcopy include/linux/etherdevice.h:305 [inline] aqc111readpermmac drivers/net/usb/aqc111.c:663 [inline] aqc111bind+0x794/0x1150 drivers/net/usb/aqc111.c:713 usbnetprobe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usbprobeinterface+0xd01/0x1310 drivers/usb/core/driver.c:396 calldriver_probe drivers/base/dd.c:-1 [inline] ...

Local variable buf.i created at: aqc111readpermmac drivers/net/usb/aqc111.c:656 [inline] aqc111bind+0x221/0x1150 drivers/net/usb/aqc111.c:713 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772