linux-kernel - [PATCH] Bluetooth: hidp: Fix error checks in hidp_get/set_raw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190906094158.8854-1-streetwalkermc@gmail.com>
Date:   Fri,  6 Sep 2019 12:41:57 +0300
From:   Dan Elkouby <streetwalkermc@...il.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     Dan Elkouby <streetwalkermc@...il.com>,
        Marcel Holtmann <marcel@...tmann.org>,
        Johan Hedberg <johan.hedberg@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        Fabian Henneke <fabian.henneke@...il.com>,
        Brian Norris <computersforpeace@...il.com>,
        Al Viro <viro@...iv.linux.org.uk>,
        Andrea Parri <andrea.parri@...rulasolutions.com>,
        linux-bluetooth@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] Bluetooth: hidp: Fix error checks in hidp_get/set_raw_report

Commit 48d9cc9d85dd ("Bluetooth: hidp: Let hidp_send_message return
number of queued bytes") changed hidp_send_message to return non-zero
values on success, which some other bits did not expect. This caused
spurious errors to be propagated through the stack, breaking some (all?)
drivers, such as hid-sony for the Dualshock 4 in Bluetooth mode.

Signed-off-by: Dan Elkouby <streetwalkermc@...il.com>
---
 net/bluetooth/hidp/core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 8d889969ae7e..bef84b95e2c4 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -267,7 +267,7 @@ static int hidp_get_raw_report(struct hid_device *hid,
 	set_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 	data[0] = report_number;
 	ret = hidp_send_ctrl_message(session, report_type, data, 1);
-	if (ret)
+	if (ret < 0)
 		goto err;
 
 	/* Wait for the return of the report. The returned report
@@ -343,7 +343,7 @@ static int hidp_set_raw_report(struct hid_device *hid, unsigned char reportnum,
 	data[0] = reportnum;
 	set_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
 	ret = hidp_send_ctrl_message(session, report_type, data, count);
-	if (ret)
+	if (ret < 0)
 		goto err;
 
 	/* Wait for the ACK from the device. */
-- 
2.23.0