usb: usbtmc: Fix erroneous generic_read ioctl return

wait_event_interruptible_timeout returns a long
The return value was being assigned to an int causing an integer overflow
when the remaining jiffies > INT_MAX which resulted in random error
returns.

Use a long return value, converting to the int ioctl return only on error.

Fixes: bb99794a4792 ("usb: usbtmc: Add ioctl for vendor specific read")
Cc: stable@vger.kernel.org
Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://lore.kernel.org/r/20250502070941.31819-4-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 4761a5ecadd6f38b8004810c4f886f9ce8b5a4c6..740d2d2b19fbe0ebb24eb63964f7122af24c05b4 100644 (file)
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -833,6 +833,7 @@ static ssize_t usbtmc_generic_read(struct usbtmc_file_data *file_data,
        unsigned long expire;
        int bufcount = 1;
        int again = 0;
+       long wait_rv;
 
        /* mutex already locked */
 
@@ -945,19 +946,24 @@ static ssize_t usbtmc_generic_read(struct usbtmc_file_data *file_data,
                if (!(flags & USBTMC_FLAG_ASYNC)) {
                        dev_dbg(dev, "%s: before wait time %lu\n",
                                __func__, expire);
-                       retval = wait_event_interruptible_timeout(
+                       wait_rv = wait_event_interruptible_timeout(
                                file_data->wait_bulk_in,
                                usbtmc_do_transfer(file_data),
                                expire);
 
-                       dev_dbg(dev, "%s: wait returned %d\n",
-                               __func__, retval);
+                       dev_dbg(dev, "%s: wait returned %ld\n",
+                               __func__, wait_rv);
+
+                       if (wait_rv < 0) {
+                               retval = wait_rv;
+                               goto error;
+                       }
 
-                       if (retval <= 0) {
-                               if (retval == 0)
-                                       retval = -ETIMEDOUT;
+                       if (wait_rv == 0) {
+                               retval = -ETIMEDOUT;
                                goto error;
                        }
+
                }
 
                urb = usb_get_from_anchor(&file_data->in_anchor);