linux-kernel - [PATCH] HID: wiimote: check completion in wiimod_battery_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230320153419.9185-1-n.zhandarovich@fintech.ru>
Date:   Mon, 20 Mar 2023 08:34:19 -0700
From:   Nikita Zhandarovich <n.zhandarovich@...tech.ru>
To:     David Rheinsberg <david.rheinsberg@...il.com>
CC:     Nikita Zhandarovich <n.zhandarovich@...tech.ru>,
        Jiri Kosina <jikos@...nel.org>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        "David Herrmann" <dh.herrmann@...il.com>,
        <linux-input@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <lvc-project@...uxtesting.org>
Subject: [PATCH] HID: wiimote: check completion in wiimod_battery_get_property

wiimote_cmd_wait() in wiimod_battery_get_property() may signal that the
task of getting specific battery property was interrupted or timed out.
There is no need to do any further computation in such cases, so just
return the error.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: dcf392313817 ("HID: wiimote: convert BATTERY to module")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
---
 drivers/hid/hid-wiimote-modules.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-wiimote-modules.c b/drivers/hid/hid-wiimote-modules.c
index dbccdfa63916..9755718d9856 100644
--- a/drivers/hid/hid-wiimote-modules.c
+++ b/drivers/hid/hid-wiimote-modules.c
@@ -220,8 +220,10 @@ static int wiimod_battery_get_property(struct power_supply *psy,
 	wiiproto_req_status(wdata);
 	spin_unlock_irqrestore(&wdata->state.lock, flags);
 
-	wiimote_cmd_wait(wdata);
+	ret = wiimote_cmd_wait(wdata);
 	wiimote_cmd_release(wdata);
+	if (ret)
+		return ret;
 
 	spin_lock_irqsave(&wdata->state.lock, flags);
 	state = wdata->state.cmd_battery;
-- 
2.25.1