Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

USB: serial: ch341: fix type promotion bug in ch341_control_in()

The "r" variable is an int and "bufsize" is an unsigned int so the
comparison is type promoted to unsigned. If usb_control_msg() returns a
negative that is treated as a high positive value and the error handling
doesn't work.

Fixes: 2d5a9c72d0c4 ("USB: serial: ch341: fix control-message error handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>

authored by

Dan Carpenter and committed by
Johan Hovold
e33eab9d 021c9179

+1 -1
+1 -1
drivers/usb/serial/ch341.c
··· 128 128 r = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), request, 129 129 USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, 130 130 value, index, buf, bufsize, DEFAULT_TIMEOUT); 131 - if (r < bufsize) { 131 + if (r < (int)bufsize) { 132 132 if (r >= 0) { 133 133 dev_err(&dev->dev, 134 134 "short control message received (%d < %u)\n",