Commit 4e77d3ec authored by Dave Penkler's avatar Dave Penkler Committed by Greg Kroah-Hartman
Browse files

usb: usbtmc: Fix erroneous generic_read ioctl return 



wait_event_interruptible_timeout returns a long
The return value was being assigned to an int causing an integer overflow
when the remaining jiffies > INT_MAX which resulted in random error
returns.

Use a long return value, converting to the int ioctl return only on error.

Fixes: bb99794a ("usb: usbtmc: Add ioctl for vendor specific read")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDave Penkler <dpenkler@gmail.com>
Link: https://lore.kernel.org/r/20250502070941.31819-4-dpenkler@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a9747c9b

drivers/usb/class/usbtmc.c

+12 −6
Original line number Diff line number Diff line
@@ -833,6 +833,7 @@ static ssize_t usbtmc_generic_read(struct usbtmc_file_data *file_data, 
	unsigned long expire;

	int bufcount = 1;

	int again = 0;

	long wait_rv;



	/* mutex already locked */
@@ -945,19 +946,24 @@ static ssize_t usbtmc_generic_read(struct usbtmc_file_data *file_data, 
		if (!(flags & USBTMC_FLAG_ASYNC)) {

			dev_dbg(dev, "%s: before wait time %lu\n",

				__func__, expire);

			retval = wait_event_interruptible_timeout(

			wait_rv = wait_event_interruptible_timeout(

				file_data->wait_bulk_in,

				usbtmc_do_transfer(file_data),

				expire);



			dev_dbg(dev, "%s: wait returned %d\n",

				__func__, retval);

			dev_dbg(dev, "%s: wait returned %ld\n",

				__func__, wait_rv);



			if (retval <= 0) {

				if (retval == 0)

			if (wait_rv < 0) {

				retval = wait_rv;

				goto error;

			}



			if (wait_rv == 0) {

				retval = -ETIMEDOUT;

				goto error;

			}



		}



		urb = usb_get_from_anchor(&file_data->in_anchor);