| From 1eac5c244f705182d1552a53e2f74e2775ed95d6 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Thu, 12 Jan 2017 14:56:22 +0100 |
| Subject: [PATCH] USB: serial: ssu100: fix control-message error handling |
| |
| commit 1eac5c244f705182d1552a53e2f74e2775ed95d6 upstream. |
| |
| Make sure to detect short control-message transfers rather than continue |
| with zero-initialised data when retrieving modem status and during |
| device initialisation. |
| |
| Fixes: 52af95459939 ("USB: add USB serial ssu100 driver") |
| Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| |
| diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c |
| index 2a156144c76c..55814538ff1f 100644 |
| --- a/drivers/usb/serial/ssu100.c |
| +++ b/drivers/usb/serial/ssu100.c |
| @@ -80,9 +80,17 @@ static inline int ssu100_setdevice(struct usb_device *dev, u8 *data) |
| |
| static inline int ssu100_getdevice(struct usb_device *dev, u8 *data) |
| { |
| - return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), |
| - QT_SET_GET_DEVICE, 0xc0, 0, 0, |
| - data, 3, 300); |
| + int ret; |
| + |
| + ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), |
| + QT_SET_GET_DEVICE, 0xc0, 0, 0, |
| + data, 3, 300); |
| + if (ret < 3) { |
| + if (ret >= 0) |
| + ret = -EIO; |
| + } |
| + |
| + return ret; |
| } |
| |
| static inline int ssu100_getregister(struct usb_device *dev, |
| @@ -90,10 +98,17 @@ static inline int ssu100_getregister(struct usb_device *dev, |
| unsigned short reg, |
| u8 *data) |
| { |
| - return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), |
| - QT_SET_GET_REGISTER, 0xc0, reg, |
| - uart, data, sizeof(*data), 300); |
| + int ret; |
| + |
| + ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), |
| + QT_SET_GET_REGISTER, 0xc0, reg, |
| + uart, data, sizeof(*data), 300); |
| + if (ret < sizeof(*data)) { |
| + if (ret >= 0) |
| + ret = -EIO; |
| + } |
| |
| + return ret; |
| } |
| |
| |
| @@ -289,8 +304,10 @@ static int ssu100_open(struct tty_struct *tty, struct usb_serial_port *port) |
| QT_OPEN_CLOSE_CHANNEL, |
| QT_TRANSFER_IN, 0x01, |
| 0, data, 2, 300); |
| - if (result < 0) { |
| + if (result < 2) { |
| dev_dbg(&port->dev, "%s - open failed %i\n", __func__, result); |
| + if (result >= 0) |
| + result = -EIO; |
| kfree(data); |
| return result; |
| } |
| -- |
| 2.12.0 |
| |