USB: serial: ssu100: fix control-message error handling

commit 1eac5c244f705182d1552a53e2f74e2775ed95d6 upstream.

Make sure to detect short control-message transfers rather than continue
with zero-initialised data when retrieving modem status and during
device initialisation.

Fixes: 52af95459939 ("USB: add USB serial ssu100 driver")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 24 insertions, 7 deletions

diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
index 70a098de429f..886e1294b120 100644
--- a/drivers/usb/serial/ssu100.c
+++ b/drivers/usb/serial/ssu100.c
@@ -80,9 +80,17 @@ static inline int ssu100_setdevice(struct usb_device *dev, u8 *data)
 
 static inline int ssu100_getdevice(struct usb_device *dev, u8 *data)
 {
-        return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
-                               QT_SET_GET_DEVICE, 0xc0, 0, 0,
-                               data, 3, 300);
+        int ret;
+
+        ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+                              QT_SET_GET_DEVICE, 0xc0, 0, 0,
+                              data, 3, 300);
+        if (ret < 3) {
+                if (ret >= 0)
+                        ret = -EIO;
+        }
+
+        return ret;
 }
 
 static inline int ssu100_getregister(struct usb_device *dev,
@@ -90,10 +98,17 @@ static inline int ssu100_getregister(struct usb_device *dev,
                                      unsigned short reg,
                                      u8 *data)
 {
-        return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
-                               QT_SET_GET_REGISTER, 0xc0, reg,
-                               uart, data, sizeof(*data), 300);
+        int ret;
+
+        ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+                              QT_SET_GET_REGISTER, 0xc0, reg,
+                              uart, data, sizeof(*data), 300);
+        if (ret < sizeof(*data)) {
+                if (ret >= 0)
+                        ret = -EIO;
+        }
 
+        return ret;
 }
 
 
@@ -289,8 +304,10 @@ static int ssu100_open(struct tty_struct *tty, struct usb_serial_port *port)
                                  QT_OPEN_CLOSE_CHANNEL,
                                  QT_TRANSFER_IN, 0x01,
                                  0, data, 2, 300);
-        if (result < 0) {
+        if (result < 2) {
                 dev_dbg(&port->dev, "%s - open failed %i\n", __func__, result);
+                if (result >= 0)
+                        result = -EIO;
                 kfree(data);
                 return result;
         }