samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

usb: usbtmc: Fix erroneous generic_read ioctl return

Browse Source 
commit 4e77d3ec7c7c0d9535ccf1138827cb9bb5480b9b upstream.

wait_event_interruptible_timeout returns a long
The return value was being assigned to an int causing an integer overflow
when the remaining jiffies > INT_MAX which resulted in random error
returns.

Use a long return value, converting to the int ioctl return only on error.

Fixes: bb99794a47 ("usb: usbtmc: Add ioctl for vendor specific read")
Cc: stable@vger.kernel.org
Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://lore.kernel.org/r/20250502070941.31819-4-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dave Penkler
2025-05-02 09:09:41 +02:00
committed by Greg Kroah-Hartman
parent 1991ed796d
commit 37a55b692d
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/usb/class/usbtmc.c
View File

@@ -833,6 +833,7 @@ static ssize_t usbtmc_generic_read(struct usbtmc_file_data *file_data,
unsigned long expire; unsigned long expire;
int bufcount = 1; int bufcount = 1;
int again = 0; int again = 0;
long wait_rv;
/* mutex already locked */ /* mutex already locked */
@@ -945,19 +946,24 @@ static ssize_t usbtmc_generic_read(struct usbtmc_file_data *file_data,
if (!(flags & USBTMC_FLAG_ASYNC)) { if (!(flags & USBTMC_FLAG_ASYNC)) {
dev_dbg(dev, "%s: before wait time %lu\n", dev_dbg(dev, "%s: before wait time %lu\n",
__func__, expire); __func__, expire);
retval = wait_event_interruptible_timeout( wait_rv = wait_event_interruptible_timeout(
file_data->wait_bulk_in, file_data->wait_bulk_in,
usbtmc_do_transfer(file_data), usbtmc_do_transfer(file_data),
expire); expire);
dev_dbg(dev, "%s: wait returned %d\n", dev_dbg(dev, "%s: wait returned %ld\n",
__func__, retval); __func__, wait_rv);
if (retval <= 0) { if (wait_rv < 0) {
if (retval == 0) retval = wait_rv;
retval = -ETIMEDOUT;
goto error; goto error;
} }
if (wait_rv == 0) {
retval = -ETIMEDOUT;
goto error;
}
} }
urb = usb_get_from_anchor(&file_data->in_anchor); urb = usb_get_from_anchor(&file_data->in_anchor);