Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754185AbcKIUjZ (ORCPT ); Wed, 9 Nov 2016 15:39:25 -0500 Received: from mx2.suse.de ([195.135.220.15]:49285 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751674AbcKIUjX (ORCPT ); Wed, 9 Nov 2016 15:39:23 -0500 Date: Wed, 9 Nov 2016 21:39:21 +0100 From: "Luis R. Rodriguez" To: Yves-Alexis Perez Cc: linux-kernel@vger.kernel.org, Yves-Alexis Perez , Ming Lei , "Luis R. Rodriguez" , Greg Kroah-Hartman , Johannes Berg , Jouni Malinen , Kees Cook , Jiri Kosina , Jiri Slaby , Tom Gundersen , Kay Sievers , Josh Boyer , Dmitry Torokhov , Andy Lutomirski , Harald Hoyer , Seth Forshee , Bjorn Andersson , Daniel Wagner , stable@vger.kernel.org Subject: Re: [PATCH] firmware: fix async/manual firmware loading Message-ID: <20161109203921.GH13978@wotan.suse.de> References: <20161030145048.6291-1-corsac@corsac.net> <20161030145048.6291-2-corsac@corsac.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20161030145048.6291-2-corsac@corsac.net> User-Agent: Mutt/1.6.0 (2016-04-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2018 Lines: 65 On Sun, Oct 30, 2016 at 03:50:48PM +0100, Yves-Alexis Perez wrote: > From: Yves-Alexis Perez > > wait_for_completion_interruptible_timeout() return value is either > -ERESTARTSYS (in case it was interrupted), 0 (in case the timeout expired) > or the number of jiffies left until timeout. The return value is stored in > a long, but in _request_firmware_load() it's silently casted to an int, > which can overflow and give a negative value, indicating an error. > > Fix this by re-using the timeout variable and only set retval when it's > safe. Please amend the commit log as I noted in the previous response, and resend. > Signed-off-by: Yves-Alexis Perez > Cc: Ming Lei > Cc: "Luis R. Rodriguez" > Cc: Greg Kroah-Hartman Other than the commit log you can add on you resend: Acked-by: Luis R. Rodriguez. Modulo I don't personally thing this this is sable material but I'll let Greg decide. Luis > Cc: stable@vger.kernel.org > > --- > drivers/base/firmware_class.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c > index 22d1760..a95e1e5 100644 > --- a/drivers/base/firmware_class.c > +++ b/drivers/base/firmware_class.c > @@ -955,13 +955,14 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, > timeout = MAX_JIFFY_OFFSET; > } > > - retval = wait_for_completion_interruptible_timeout(&buf->completion, > + timeout = wait_for_completion_interruptible_timeout(&buf->completion, > timeout); > - if (retval == -ERESTARTSYS || !retval) { > + if (timeout == -ERESTARTSYS || !timeout) { > + retval = timeout; > mutex_lock(&fw_lock); > fw_load_abort(fw_priv); > mutex_unlock(&fw_lock); > - } else if (retval > 0) { > + } else if (timeout > 0) { > retval = 0; > } > > -- > 2.10.1 > > -- Luis Rodriguez, SUSE LINUX GmbH Maxfeldstrasse 5; D-90409 Nuernberg