Merge: CVE-2025-38086: net: ch9200: fix uninitialised access during mii_nway_restart

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1132

JIRA: https://issues.redhat.com/browse/RHEL-101222
CVE: CVE-2025-38086

```
commit 9ad0452
Author: Qasim Ijaz <qasdev00@gmail.com>
Date:   Mon May 26 19:36:07 2025 +0100

    net: ch9200: fix uninitialised access during mii_nway_restart

    In mii_nway_restart() the code attempts to call
    mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read()
    utilises a local buffer called "buff", which is initialised
    with control_read(). However "buff" is conditionally
    initialised inside control_read():

            if (err == size) {
                    memcpy(data, buf, size);
            }

    If the condition of "err == size" is not met, then
    "buff" remains uninitialised. Once this happens the
    uninitialised "buff" is accessed and returned during
    ch9200_mdio_read():

            return (buff[0] | buff[1] << 8);

    The problem stems from the fact that ch9200_mdio_read()
    ignores the return value of control_read(), leading to
    uinit-access of "buff".

    To fix this we should check the return value of
    control_read() and return early on error.

    Reported-by: syzbot <syzbot+3361c2d6f78a3e0892f9@syzkaller.appspotmail.com>
    Closes: https://syzkaller.appspot.com/bug?extid=3361c2d6f78a3e0892f9
    Tested-by: syzbot <syzbot+3361c2d6f78a3e0892f9@syzkaller.appspotmail.com>
    Fixes: 4a476bd ("usbnet: New driver for QinHeng CH9200 devices")
    Cc: stable@vger.kernel.org
    Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
    Link: https://patch.msgid.link/20250526183607.66527-1-qasdev00@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
```

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

---

<small>Created 2025-07-01 10:00 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter)</small>

Approved-by: Jarod Wilson <jarod@redhat.com>
Approved-by: Michal Schmidt <mschmidt@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>

Author: CKI KWF Bot

drivers/net/usb/ch9200.c

@@ -178,15 +178,18 @@ static int ch9200_mdio_read(struct net_device *netdev, int phy_id, int loc)
 {
 	struct usbnet *dev = netdev_priv(netdev);
 	unsigned char buff[2];
+	int ret;
 
 	netdev_dbg(netdev, "%s phy_id:%02x loc:%02x\n",
 		   __func__, phy_id, loc);
 
 	if (phy_id != 0)
 		return -ENODEV;
 
-	control_read(dev, REQUEST_READ, 0, loc * 2, buff, 0x02,
-		     CONTROL_TIMEOUT_MS);
+	ret = control_read(dev, REQUEST_READ, 0, loc * 2, buff, 0x02,
+			   CONTROL_TIMEOUT_MS);
+	if (ret < 0)
+		return ret;
 
 	return (buff[0] | buff[1] << 8);
 }