Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932271AbcJ3Ovr (ORCPT ); Sun, 30 Oct 2016 10:51:47 -0400 Received: from smtpfb2-g21.free.fr ([212.27.42.10]:44360 "EHLO smtpfb2-g21.free.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756284AbcJ3Ovq (ORCPT ); Sun, 30 Oct 2016 10:51:46 -0400 From: Yves-Alexis Perez To: linux-kernel@vger.kernel.org Cc: Yves-Alexis Perez , Yves-Alexis Perez , Ming Lei , "Luis R. Rodriguez" , Greg Kroah-Hartman , stable@vger.kernel.org Subject: [PATCH] firmware: fix async/manual firmware loading Date: Sun, 30 Oct 2016 15:50:48 +0100 Message-Id: <20161030145048.6291-2-corsac@corsac.net> X-Mailer: git-send-email 2.10.1 In-Reply-To: <20161030145048.6291-1-corsac@corsac.net> References: <20161030145048.6291-1-corsac@corsac.net> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1526 Lines: 45 From: Yves-Alexis Perez wait_for_completion_interruptible_timeout() return value is either -ERESTARTSYS (in case it was interrupted), 0 (in case the timeout expired) or the number of jiffies left until timeout. The return value is stored in a long, but in _request_firmware_load() it's silently casted to an int, which can overflow and give a negative value, indicating an error. Fix this by re-using the timeout variable and only set retval when it's safe. Signed-off-by: Yves-Alexis Perez Cc: Ming Lei Cc: "Luis R. Rodriguez" Cc: Greg Kroah-Hartman Cc: stable@vger.kernel.org --- drivers/base/firmware_class.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c index 22d1760..a95e1e5 100644 --- a/drivers/base/firmware_class.c +++ b/drivers/base/firmware_class.c @@ -955,13 +955,14 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, timeout = MAX_JIFFY_OFFSET; } - retval = wait_for_completion_interruptible_timeout(&buf->completion, + timeout = wait_for_completion_interruptible_timeout(&buf->completion, timeout); - if (retval == -ERESTARTSYS || !retval) { + if (timeout == -ERESTARTSYS || !timeout) { + retval = timeout; mutex_lock(&fw_lock); fw_load_abort(fw_priv); mutex_unlock(&fw_lock); - } else if (retval > 0) { + } else if (timeout > 0) { retval = 0; } -- 2.10.1