When nvdimm_clear_poison() fails, it returns a negative error code.
However, 'cleared' is a signed long while 'size' is size_t.
The comparison 'cleared < size' promotes 'cleared' to an unsigned long.
So the error condition can be bypassed and the function can
incorrectly return success if the subsequent flush succeeds.
Explicitly check for negative error codes before comparing with 'size'.
Fixes: 868f036fee4b ("libnvdimm: fix mishandled nvdimm_clear_poison() return
value")
Assisted-by: LLM
Reported-by: Dan Carpenter <[email protected]>
Closes:
https://lore.kernel.org/all/[email protected]/
Signed-off-by: Serhat Kumral <[email protected]>
---
drivers/nvdimm/claim.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvdimm/claim.c b/drivers/nvdimm/claim.c
index 309cd2cddb0e..2725dceaf938 100644
--- a/drivers/nvdimm/claim.c
+++ b/drivers/nvdimm/claim.c
@@ -263,7 +263,7 @@ static int nsio_rw_bytes(struct nd_namespace_common *ndns,
might_sleep();
cleared = nvdimm_clear_poison(&ndns->dev,
nsio->res.start + offset, size);
- if (cleared < size)
+ if (cleared < 0 || cleared < size)
rc = -EIO;
if (cleared > 0 && cleared / 512) {
cleared /= 512;
--
2.53.0
