Messages in this thread | | | Date | Tue, 14 Jun 2022 17:46:58 +0300 | From | Dan Carpenter <> | Subject | drivers/gpu/drm/mediatek/mtk_dsi.c:951 mtk_dsi_host_transfer() warn: check sign expansion for 'ret' |
| |
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3 commit: 81cc7e51c4f1686b71e30046437056ece6b2cb4d drm/mediatek: Allow commands to be sent during video mode config: arm64-randconfig-m031-20220613 (https://download.01.org/0day-ci/archive/20220614/202206140910.aE0Vlhfq-lkp@intel.com/config) compiler: aarch64-linux-gcc (GCC) 11.3.0
If you fix the issue, kindly add following tag where applicable Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings: drivers/gpu/drm/mediatek/mtk_dsi.c:951 mtk_dsi_host_transfer() warn: check sign expansion for 'ret'
vim +/ret +951 drivers/gpu/drm/mediatek/mtk_dsi.c
21898816831fc6 shaoming chen 2017-03-31 886 static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host, 21898816831fc6 shaoming chen 2017-03-31 887 const struct mipi_dsi_msg *msg) 21898816831fc6 shaoming chen 2017-03-31 888 { 21898816831fc6 shaoming chen 2017-03-31 889 struct mtk_dsi *dsi = host_to_dsi(host); 21898816831fc6 shaoming chen 2017-03-31 890 u32 recv_cnt, i; ^^^^^^^^^^^^
21898816831fc6 shaoming chen 2017-03-31 891 u8 read_data[16]; 21898816831fc6 shaoming chen 2017-03-31 892 void *src_addr; 21898816831fc6 shaoming chen 2017-03-31 893 u8 irq_flag = CMD_DONE_INT_FLAG; 81cc7e51c4f168 Julien STEPHAN 2022-02-14 894 u32 dsi_mode; 81cc7e51c4f168 Julien STEPHAN 2022-02-14 895 int ret; 21898816831fc6 shaoming chen 2017-03-31 896 81cc7e51c4f168 Julien STEPHAN 2022-02-14 897 dsi_mode = readl(dsi->regs + DSI_MODE_CTRL); 81cc7e51c4f168 Julien STEPHAN 2022-02-14 898 if (dsi_mode & MODE) { 81cc7e51c4f168 Julien STEPHAN 2022-02-14 899 mtk_dsi_stop(dsi); 81cc7e51c4f168 Julien STEPHAN 2022-02-14 900 ret = mtk_dsi_switch_to_cmd_mode(dsi, VM_DONE_INT_FLAG, 500); 81cc7e51c4f168 Julien STEPHAN 2022-02-14 901 if (ret) 81cc7e51c4f168 Julien STEPHAN 2022-02-14 902 goto restore_dsi_mode; 21898816831fc6 shaoming chen 2017-03-31 903 } 21898816831fc6 shaoming chen 2017-03-31 904 21898816831fc6 shaoming chen 2017-03-31 905 if (MTK_DSI_HOST_IS_READ(msg->type)) 21898816831fc6 shaoming chen 2017-03-31 906 irq_flag |= LPRX_RD_RDY_INT_FLAG; 21898816831fc6 shaoming chen 2017-03-31 907 81cc7e51c4f168 Julien STEPHAN 2022-02-14 908 ret = mtk_dsi_host_send_cmd(dsi, msg, irq_flag); 81cc7e51c4f168 Julien STEPHAN 2022-02-14 909 if (ret) 81cc7e51c4f168 Julien STEPHAN 2022-02-14 910 goto restore_dsi_mode; 21898816831fc6 shaoming chen 2017-03-31 911 81cc7e51c4f168 Julien STEPHAN 2022-02-14 912 if (!MTK_DSI_HOST_IS_READ(msg->type)) { 81cc7e51c4f168 Julien STEPHAN 2022-02-14 913 recv_cnt = 0; 81cc7e51c4f168 Julien STEPHAN 2022-02-14 914 goto restore_dsi_mode; 81cc7e51c4f168 Julien STEPHAN 2022-02-14 915 } 21898816831fc6 shaoming chen 2017-03-31 916 21898816831fc6 shaoming chen 2017-03-31 917 if (!msg->rx_buf) { 21898816831fc6 shaoming chen 2017-03-31 918 DRM_ERROR("dsi receive buffer size may be NULL\n"); 81cc7e51c4f168 Julien STEPHAN 2022-02-14 919 ret = -EINVAL; 81cc7e51c4f168 Julien STEPHAN 2022-02-14 920 goto restore_dsi_mode; 21898816831fc6 shaoming chen 2017-03-31 921 } 21898816831fc6 shaoming chen 2017-03-31 922 21898816831fc6 shaoming chen 2017-03-31 923 for (i = 0; i < 16; i++) 21898816831fc6 shaoming chen 2017-03-31 924 *(read_data + i) = readb(dsi->regs + DSI_RX_DATA0 + i); 21898816831fc6 shaoming chen 2017-03-31 925 21898816831fc6 shaoming chen 2017-03-31 926 recv_cnt = mtk_dsi_recv_cnt(read_data[0], read_data); 21898816831fc6 shaoming chen 2017-03-31 927 21898816831fc6 shaoming chen 2017-03-31 928 if (recv_cnt > 2) 21898816831fc6 shaoming chen 2017-03-31 929 src_addr = &read_data[4]; 21898816831fc6 shaoming chen 2017-03-31 930 else 21898816831fc6 shaoming chen 2017-03-31 931 src_addr = &read_data[1]; 21898816831fc6 shaoming chen 2017-03-31 932 21898816831fc6 shaoming chen 2017-03-31 933 if (recv_cnt > 10) 21898816831fc6 shaoming chen 2017-03-31 934 recv_cnt = 10; 21898816831fc6 shaoming chen 2017-03-31 935 21898816831fc6 shaoming chen 2017-03-31 936 if (recv_cnt > msg->rx_len) 21898816831fc6 shaoming chen 2017-03-31 937 recv_cnt = msg->rx_len; 21898816831fc6 shaoming chen 2017-03-31 938 21898816831fc6 shaoming chen 2017-03-31 939 if (recv_cnt) 21898816831fc6 shaoming chen 2017-03-31 940 memcpy(msg->rx_buf, src_addr, recv_cnt); 21898816831fc6 shaoming chen 2017-03-31 941 21898816831fc6 shaoming chen 2017-03-31 942 DRM_INFO("dsi get %d byte data from the panel address(0x%x)\n", 21898816831fc6 shaoming chen 2017-03-31 943 recv_cnt, *((u8 *)(msg->tx_buf))); 21898816831fc6 shaoming chen 2017-03-31 944 81cc7e51c4f168 Julien STEPHAN 2022-02-14 945 restore_dsi_mode: 81cc7e51c4f168 Julien STEPHAN 2022-02-14 946 if (dsi_mode & MODE) { 81cc7e51c4f168 Julien STEPHAN 2022-02-14 947 mtk_dsi_set_mode(dsi); 81cc7e51c4f168 Julien STEPHAN 2022-02-14 948 mtk_dsi_start(dsi); 81cc7e51c4f168 Julien STEPHAN 2022-02-14 949 } 81cc7e51c4f168 Julien STEPHAN 2022-02-14 950 81cc7e51c4f168 Julien STEPHAN 2022-02-14 @951 return ret < 0 ? ret : recv_cnt;
This is buggy. ret is int and recv_cnt is u32. So negative values for int will be type promoted to -22U, or whatever, which is a high positive value in the U32 range. So it's still a high positive value when casted to ssize_t/long and not a negative value as expected.
The way to write this is:
if (ret < 0) return ret;
return recv_cnt;
21898816831fc6 shaoming chen 2017-03-31 952 }
-- 0-DAY CI Kernel Test Service https://01.org/lkp
| |