tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

usb: usbtmc: Fix erroneous wait_srq ioctl return

Browse Source 
commit a9747c9b8b59ab4207effd20eb91a890acb44e16 upstream.

wait_event_interruptible_timeout returns a long
The return was being assigned to an int causing an integer overflow when
the remaining jiffies > INT_MAX resulting in random error returns.

Use a long return value,  converting to the int ioctl return only on
error.

Fixes: 739240a9f6 ("usb: usbtmc: Add ioctl USBTMC488_IOCTL_WAIT_SRQ")
Cc: stable@vger.kernel.org
Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://lore.kernel.org/r/20250502070941.31819-3-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dave Penkler
2025-05-02 09:09:40 +02:00
committed by Greg Kroah-Hartman
parent 29e1773746
commit 2073913776
1 changed files with 11 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/usb/class/usbtmc.c
+11 -12
View File
@@ -606,9 +606,9 @@ static int usbtmc488_ioctl_wait_srq(struct usbtmc_file_data *file_data,
{ {
struct usbtmc_device_data *data = file_data->data; struct usbtmc_device_data *data = file_data->data;
struct device *dev = &data->intf->dev; struct device *dev = &data->intf->dev;
int rv;
u32 timeout; u32 timeout;
unsigned long expire; unsigned long expire;
long wait_rv;
if (!data->iin_ep_present) { if (!data->iin_ep_present) {
dev_dbg(dev, "no interrupt endpoint present\n"); dev_dbg(dev, "no interrupt endpoint present\n");
@@ -622,25 +622,24 @@ static int usbtmc488_ioctl_wait_srq(struct usbtmc_file_data *file_data,
mutex_unlock(&data->io_mutex); mutex_unlock(&data->io_mutex);
rv = wait_event_interruptible_timeout( wait_rv = wait_event_interruptible_timeout(
data->waitq, data->waitq,
atomic_read(&file_data->srq_asserted) != 0 || atomic_read(&file_data->srq_asserted) != 0 ||
atomic_read(&file_data->closing), atomic_read(&file_data->closing),
expire); expire);
mutex_lock(&data->io_mutex); mutex_lock(&data->io_mutex);
/* Note! disconnect or close could be called in the meantime */ /* Note! disconnect or close could be called in the meantime */
if (atomic_read(&file_data->closing) || data->zombie) if (atomic_read(&file_data->closing) || data->zombie)
rv = -ENODEV; return -ENODEV;
if (rv < 0) { if (wait_rv < 0) {
/* dev can be invalid now! */ dev_dbg(dev, "%s - wait interrupted %ld\n", __func__, wait_rv);
pr_debug("%s - wait interrupted %d\n", __func__, rv); return wait_rv;
return rv;
} }
if (rv == 0) { if (wait_rv == 0) {
dev_dbg(dev, "%s - wait timed out\n", __func__); dev_dbg(dev, "%s - wait timed out\n", __func__);
return -ETIMEDOUT; return -ETIMEDOUT;
} }