HID: u2fzero: properly handle timeouts in usb_submit_urb

[ Upstream commit 43775e62c4b784f44a159e13ba80e6146a42d502 ]

The wait_for_completion_timeout function returns 0 if timed out or a
positive value if completed. Hence, "less than zero" comparison always
misses timeouts and doesn't kill the URB as it should, leading to
re-sending it while it is active.

Fixes: 42337b9d4d95 ("HID: add driver for U2F Zero built-in LED and RNG")
Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c
index 94f78ffb76d0434c815e0b8b9209c1607a3e053a..67ae2b18e33ac46c3bec2a640a72e708b88cfeb3 100644 (file)
--- a/drivers/hid/hid-u2fzero.c
+++ b/drivers/hid/hid-u2fzero.c
@@ -132,7 +132,7 @@ static int u2fzero_recv(struct u2fzero_device *dev,
 
        ret = (wait_for_completion_timeout(
                &ctx.done, msecs_to_jiffies(USB_CTRL_SET_TIMEOUT)));
-       if (ret < 0) {
+       if (ret == 0) {
                usb_kill_urb(dev->urb);
                hid_err(hdev, "urb submission timed out");
        } else {