| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Wed, 4 Jul 2018 12:29:38 +0300 |
| Subject: USB: serial: ch341: fix type promotion bug in ch341_control_in() |
| |
| commit e33eab9ded328ccc14308afa51b5be7cbe78d30b upstream. |
| |
| The "r" variable is an int and "bufsize" is an unsigned int so the |
| comparison is type promoted to unsigned. If usb_control_msg() returns a |
| negative that is treated as a high positive value and the error handling |
| doesn't work. |
| |
| Fixes: 2d5a9c72d0c4 ("USB: serial: ch341: fix control-message error handling") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/usb/serial/ch341.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/usb/serial/ch341.c |
| +++ b/drivers/usb/serial/ch341.c |
| @@ -131,7 +131,7 @@ static int ch341_control_in(struct usb_d |
| r = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), request, |
| USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, |
| value, index, buf, bufsize, DEFAULT_TIMEOUT); |
| - if (r < bufsize) { |
| + if (r < (int)bufsize) { |
| if (r >= 0) { |
| dev_err(&dev->dev, |
| "short control message received (%d < %u)\n", |
