| From 36356a669eddb32917fc4b5c2b9b8bf80ede69de Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Thu, 12 Jan 2017 14:56:16 +0100 |
| Subject: [PATCH] USB: serial: mct_u232: fix modem-status error handling |
| |
| commit 36356a669eddb32917fc4b5c2b9b8bf80ede69de upstream. |
| |
| Make sure to detect short control-message transfers so that errors are |
| logged when reading the modem status at open. |
| |
| Note that while this also avoids initialising the modem status using |
| uninitialised heap data, these bits could not leak to user space as they |
| are currently not used. |
| |
| Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") |
| Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| |
| diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c |
| index 885655315de1..edbc81f205c2 100644 |
| --- a/drivers/usb/serial/mct_u232.c |
| +++ b/drivers/usb/serial/mct_u232.c |
| @@ -322,8 +322,12 @@ static int mct_u232_get_modem_stat(struct usb_serial_port *port, |
| MCT_U232_GET_REQUEST_TYPE, |
| 0, 0, buf, MCT_U232_GET_MODEM_STAT_SIZE, |
| WDR_TIMEOUT); |
| - if (rc < 0) { |
| + if (rc < MCT_U232_GET_MODEM_STAT_SIZE) { |
| dev_err(&port->dev, "Get MODEM STATus failed (error = %d)\n", rc); |
| + |
| + if (rc >= 0) |
| + rc = -EIO; |
| + |
| *msr = 0; |
| } else { |
| *msr = buf[0]; |
| -- |
| 2.12.0 |
| |
