On 10/2/26 9:56 AM, Serhat Kumral wrote:
> When nvdimm_clear_poison() fails, it returns a negative error code.
> However, 'cleared' is a signed long while 'size' is size_t.
> The comparison 'cleared < size' promotes 'cleared' to an unsigned long.
> So the error condition can be bypassed and the function can
> incorrectly return success if the subsequent flush succeeds.
>
> Explicitly check for negative error codes before comparing with 'size'.
>
> Fixes: 868f036fee4b ("libnvdimm: fix mishandled nvdimm_clear_poison() return
> value")
> Assisted-by: LLM
> Reported-by: Dan Carpenter <[email protected]>
> Closes:
> https://lore.kernel.org/all/[email protected]/
> Signed-off-by: Serhat Kumral <[email protected]>
Makes sense
Reviewed-by: Dave Jiang <[email protected]>
> ---
> drivers/nvdimm/claim.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/nvdimm/claim.c b/drivers/nvdimm/claim.c
> index 309cd2cddb0e..2725dceaf938 100644
> --- a/drivers/nvdimm/claim.c
> +++ b/drivers/nvdimm/claim.c
> @@ -263,7 +263,7 @@ static int nsio_rw_bytes(struct nd_namespace_common *ndns,
> might_sleep();
> cleared = nvdimm_clear_poison(&ndns->dev,
> nsio->res.start + offset, size);
> - if (cleared < size)
> + if (cleared < 0 || cleared < size)
> rc = -EIO;
> if (cleared > 0 && cleared / 512) {
> cleared /= 512;
