]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
usb: gadget: prevent a ternary sign expansion bug
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 22 Apr 2021 09:00:54 +0000 (12:00 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 22 Apr 2021 11:17:29 +0000 (13:17 +0200)
commit3343f376d4bae98ec11fd104e0e211b275e754b8
treea328b67d7604209cc343ae8dc0b9296e5cab8131
parentf88359e1588b85cf0e8209ab7d6620085f3441d9
usb: gadget: prevent a ternary sign expansion bug

The problem is that "req->actual" is a u32, "req->status" is an int, and
iocb->ki_complete() takes a long.  We would expect that a negative error
code in "req->status" would translate to a negative long value.

But what actually happens is that because "req->actual" is a u32, the
error codes is type promoted to a high positive value and then remains
a positive value when it is cast to long.  (No sign expansion).

We can fix this by casting "req->status" to long.

Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YIE7RrBPLWc3XtMg@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/legacy/inode.c