On Fri, 15 Sep 2023, Dan Carpenter wrote:
> The hid_hw_raw_request() function returns negative error codes or the
> number bytes transferred. The problem is that when it returns negative
> error codes and we check if "ret < sizeof(arctis_1_battery_request)",
> then the negative values are type promoted from int to high unsigned long
> values and treated as success.
>
> This was detected using Smatch:
>
> drivers/hid/hid-steelseries.c:393 steelseries_headset_arctis_1_fetch_battery()
> warn: error code type promoted to positive: 'ret'
>
> Fixes: a0c76896c3fb ("HID: steelseries: Add support for Arctis 1 XBox")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> ---
> v2: Re-word the commit message. Add the Smatch warning. Use a cast
> instead of an explicit check for negatives.
>
> drivers/hid/hid-steelseries.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
> index 43d2cf7153d7..b3edadf42d6d 100644
> --- a/drivers/hid/hid-steelseries.c
> +++ b/drivers/hid/hid-steelseries.c
> @@ -390,7 +390,7 @@ static int steelseries_headset_arctis_1_fetch_battery(struct hid_device *hdev)
> ret = hid_hw_raw_request(hdev, arctis_1_battery_request[0],
> write_buf, sizeof(arctis_1_battery_request),
> HID_OUTPUT_REPORT, HID_REQ_SET_REPORT);
> - if (ret < sizeof(arctis_1_battery_request)) {
> + if (ret < (int)sizeof(arctis_1_battery_request)) {
> hid_err(hdev, "hid_hw_raw_request() failed with %d\n", ret);
> ret = -ENODATA;
> }
Applied, thanks.
--
Jiri Kosina
SUSE Labs
