github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

libnvdimm: Handle negative return from nvdimm_clear_poison() in nsio_rw_bytes()

Browse Source 
When nvdimm_clear_poison() fails, it returns a negative error code.
However, 'cleared' is a signed long while 'size' is size_t.
The comparison 'cleared < size' promotes 'cleared' to an unsigned long.
So the error condition can be bypassed and the function can
incorrectly return success if the subsequent flush succeeds.

Explicitly check for negative error codes before comparing with 'size'.

Fixes: 868f036fee ("libnvdimm: fix mishandled nvdimm_clear_poison() return value")
Assisted-by: LLM
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/all/90d3d353-28e9-4f6d-b141-a9b7157d5514@moroto.mountain/
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261002165641.14479-1-serhatkumral1@gmail.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
This commit is contained in:
Serhat Kumral 2026-10-02 19:56:41 +03:00 committed by Alison Schofield
parent 855a46681e
commit c0962f508e
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/nvdimm/claim.c
View File

@ -263,7 +263,7 @@ static int nsio_rw_bytes(struct nd_namespace_common *ndns,
might_sleep();
cleared = nvdimm_clear_poison(&ndns->dev,
nsio->res.start + offset, size);
if (cleared < size)
if (cleared < 0 || cleared < size)
rc = -EIO;
if (cleared > 0 && cleared / 512) {
cleared /= 512;