Skip to content

Commit cac01bd

Browse files
dpenklergregkh
authored andcommitted
usb: usbtmc: Fix erroneous get_stb ioctl error returns
wait_event_interruptible_timeout returns a long The return was being assigned to an int causing an integer overflow when the remaining jiffies > INT_MAX resulting in random error returns. Use a long return value and convert to int ioctl return only on error. When the return value of wait_event_interruptible_timeout was <= INT_MAX the number of remaining jiffies was returned which has no meaning for the user. Return 0 on success. Reported-by: Michael Katzmann <vk2bea@gmail.com> Fixes: dbf3e7f ("Implement an ioctl to support the USMTMC-USB488 READ_STATUS_BYTE operation.") Cc: stable@vger.kernel.org Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250502070941.31819-2-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent e918d39 commit cac01bd

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

drivers/usb/class/usbtmc.c

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -482,6 +482,7 @@ static int usbtmc_get_stb(struct usbtmc_file_data *file_data, __u8 *stb)
482482
u8 *buffer;
483483
u8 tag;
484484
int rv;
485+
long wait_rv;
485486

486487
dev_dbg(dev, "Enter ioctl_read_stb iin_ep_present: %d\n",
487488
data->iin_ep_present);
@@ -511,16 +512,17 @@ static int usbtmc_get_stb(struct usbtmc_file_data *file_data, __u8 *stb)
511512
}
512513

513514
if (data->iin_ep_present) {
514-
rv = wait_event_interruptible_timeout(
515+
wait_rv = wait_event_interruptible_timeout(
515516
data->waitq,
516517
atomic_read(&data->iin_data_valid) != 0,
517518
file_data->timeout);
518-
if (rv < 0) {
519-
dev_dbg(dev, "wait interrupted %d\n", rv);
519+
if (wait_rv < 0) {
520+
dev_dbg(dev, "wait interrupted %ld\n", wait_rv);
521+
rv = wait_rv;
520522
goto exit;
521523
}
522524

523-
if (rv == 0) {
525+
if (wait_rv == 0) {
524526
dev_dbg(dev, "wait timed out\n");
525527
rv = -ETIMEDOUT;
526528
goto exit;
@@ -539,6 +541,8 @@ static int usbtmc_get_stb(struct usbtmc_file_data *file_data, __u8 *stb)
539541

540542
dev_dbg(dev, "stb:0x%02x received %d\n", (unsigned int)*stb, rv);
541543

544+
rv = 0;
545+
542546
exit:
543547
/* bump interrupt bTag */
544548
data->iin_bTag += 1;

0 commit comments

Comments
 (0)