[PATCH -next] firmware: imx: se_ctrl: preserve ioctl error across cleanup

[pankaj . gupta]

From: Pankaj Gupta <pankaj.gupta@xxxxxxx>

se_ioctl_cmd_snd_rcv_rsp_handler() can set err to -EFAULT when copying
the response payload to userspace fails, but then immediately overwrites
that error with the return value of se_ioctl_cmd_snd_rcv_cleanup().

If cleanup succeeds, the function returns 0 and falsely reports success
to userspace even though the response copy failed.

Preserve the original operation error and only use the cleanup return
value when no earlier error was set.

Fixes: b87b30bbdfb2 ("firmware: drivers: imx: adds miscdev")
Reported-by: sashiko-bot <sashiko-bot@xxxxxxxxxx>
Closes: https://sashiko.dev/#/patchset/20260528091446.3331006-1-pankaj.gupta@xxxxxxx?part=1
Signed-off-by: Pankaj Gupta <pankaj.gupta@xxxxxxx>
---
 drivers/firmware/imx/se_ctrl.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/imx/se_ctrl.c b/drivers/firmware/imx/se_ctrl.c
index c9e270288c3b..f44bffd58ef0 100644
--- a/drivers/firmware/imx/se_ctrl.c
+++ b/drivers/firmware/imx/se_ctrl.c
@@ -513,6 +513,7 @@ static int se_ioctl_cmd_snd_rcv_rsp_handler(struct se_if_device_ctx *dev_ctx,
 	struct se_ioctl_cmd_snd_rcv_rsp_info cmd_snd_rcv_rsp_info = {0};
 	struct se_if_priv *priv = dev_ctx->priv;
 	int err = 0;
+	int cleanup_err = 0;
 
 	if (copy_from_user(&cmd_snd_rcv_rsp_info, uarg,
 			   sizeof(cmd_snd_rcv_rsp_info))) {
@@ -603,7 +604,10 @@ static int se_ioctl_cmd_snd_rcv_rsp_handler(struct se_if_device_ctx *dev_ctx,
 		err = -EFAULT;
 	}
 
-	err = se_ioctl_cmd_snd_rcv_cleanup(dev_ctx, uarg, &cmd_snd_rcv_rsp_info);
+	cleanup_err = se_ioctl_cmd_snd_rcv_cleanup(dev_ctx, uarg, &cmd_snd_rcv_rsp_info);
+
+	if (!err)
+		err = cleanup_err;
 
 	return err;
 }
-- 
2.43.0