On Jul 10, 2026 at 2:50 AM, Dan Carpenter error27@gmail.com wrote:
The bug is not hard to understand, the issue is that this changes the function completely... Was nothing checking the return before?
It gets checked. The value flows unchanged through __hid_hw_raw_request() to the callers, and they look at it two ways:
- hidraw returns it straight to userspace (write(), HIDIOCSFEATURE), where it is the number of bytes transferred.
- in-kernel SET_REPORT callers, some testing "ret < 0" (hid-multitouch, hid-sony), some testing "ret != size" (hid-gt683r, hid-lenovo, hid-razer).
So the old return 0 was wrong both ways: the first group had a failed SET_REPORT masked as success, and the second saw every SET_REPORT as a failure. Returning the count or a negative errno is what GET already does in this driver and what usbhid/i2c-hid/uhid return, so nothing working with those relied on the 0.
Thanks, Hao-Qun