Commit 6c667ef6 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jiri Kosina

HID: steelseries: Fix signedness bug in steelseries_headset_arctis_1_fetch_battery()

The hid_hw_raw_request() function returns negative error codes or the
number bytes transferred.  The problem is that when it returns negative
error codes and we check if "ret < sizeof(arctis_1_battery_request)",
then the negative values are type promoted from int to high unsigned long
values and treated as success.

This was detected using Smatch:

    drivers/hid/hid-steelseries.c:393 steelseries_headset_arctis_1_fetch_battery()
    warn: error code type promoted to positive: 'ret'

Fixes: a0c76896 ("HID: steelseries: Add support for Arctis 1 XBox")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarBastien Nocera <hadess@hadess.net>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent e1cd4004
...@@ -390,7 +390,7 @@ static int steelseries_headset_arctis_1_fetch_battery(struct hid_device *hdev) ...@@ -390,7 +390,7 @@ static int steelseries_headset_arctis_1_fetch_battery(struct hid_device *hdev)
ret = hid_hw_raw_request(hdev, arctis_1_battery_request[0], ret = hid_hw_raw_request(hdev, arctis_1_battery_request[0],
write_buf, sizeof(arctis_1_battery_request), write_buf, sizeof(arctis_1_battery_request),
HID_OUTPUT_REPORT, HID_REQ_SET_REPORT); HID_OUTPUT_REPORT, HID_REQ_SET_REPORT);
if (ret < sizeof(arctis_1_battery_request)) { if (ret < (int)sizeof(arctis_1_battery_request)) {
hid_err(hdev, "hid_hw_raw_request() failed with %d\n", ret); hid_err(hdev, "hid_hw_raw_request() failed with %d\n", ret);
ret = -ENODATA; ret = -ENODATA;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment