Skip to content

Commit a9747c9

Browse files
dpenklergregkh
authored andcommitted
usb: usbtmc: Fix erroneous wait_srq ioctl return
wait_event_interruptible_timeout returns a long The return was being assigned to an int causing an integer overflow when the remaining jiffies > INT_MAX resulting in random error returns. Use a long return value, converting to the int ioctl return only on error. Fixes: 739240a ("usb: usbtmc: Add ioctl USBTMC488_IOCTL_WAIT_SRQ") Cc: stable@vger.kernel.org Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250502070941.31819-3-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent cac01bd commit a9747c9

File tree

1 file changed

+11
-12
lines changed

1 file changed

+11
-12
lines changed

drivers/usb/class/usbtmc.c

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -606,9 +606,9 @@ static int usbtmc488_ioctl_wait_srq(struct usbtmc_file_data *file_data,
606606
{
607607
struct usbtmc_device_data *data = file_data->data;
608608
struct device *dev = &data->intf->dev;
609-
int rv;
610609
u32 timeout;
611610
unsigned long expire;
611+
long wait_rv;
612612

613613
if (!data->iin_ep_present) {
614614
dev_dbg(dev, "no interrupt endpoint present\n");
@@ -622,25 +622,24 @@ static int usbtmc488_ioctl_wait_srq(struct usbtmc_file_data *file_data,
622622

623623
mutex_unlock(&data->io_mutex);
624624

625-
rv = wait_event_interruptible_timeout(
626-
data->waitq,
627-
atomic_read(&file_data->srq_asserted) != 0 ||
628-
atomic_read(&file_data->closing),
629-
expire);
625+
wait_rv = wait_event_interruptible_timeout(
626+
data->waitq,
627+
atomic_read(&file_data->srq_asserted) != 0 ||
628+
atomic_read(&file_data->closing),
629+
expire);
630630

631631
mutex_lock(&data->io_mutex);
632632

633633
/* Note! disconnect or close could be called in the meantime */
634634
if (atomic_read(&file_data->closing) || data->zombie)
635-
rv = -ENODEV;
635+
return -ENODEV;
636636

637-
if (rv < 0) {
638-
/* dev can be invalid now! */
639-
pr_debug("%s - wait interrupted %d\n", __func__, rv);
640-
return rv;
637+
if (wait_rv < 0) {
638+
dev_dbg(dev, "%s - wait interrupted %ld\n", __func__, wait_rv);
639+
return wait_rv;
641640
}
642641

643-
if (rv == 0) {
642+
if (wait_rv == 0) {
644643
dev_dbg(dev, "%s - wait timed out\n", __func__);
645644
return -ETIMEDOUT;
646645
}

0 commit comments

Comments
 (0)