diff mbox series

drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map()

Message ID 2bfa28b5-145d-4b9e-a18a-98819dd686ce@moroto.mountain (mailing list archive)
State New, archived
Headers show
Series drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map() | expand

Commit Message

Dan Carpenter Oct. 11, 2023, 8:01 a.m. UTC
The "ret" variable is declared as ssize_t and it can hold negative error
codes but the "rk_obj->base.size" variable is type size_t.  This means
that when we compare them, they are both type promoted to size_t and the
negative error code becomes a high unsigned value and is treated as
success.  Add a cast to fix this.

Fixes: 38f993b7c59e ("drm/rockchip: Do not use DMA mapping API if attached to IOMMU domain")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
 drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Heiko Stuebner Oct. 16, 2023, 2:11 p.m. UTC | #1
On Wed, 11 Oct 2023 11:01:48 +0300, Dan Carpenter wrote:
> The "ret" variable is declared as ssize_t and it can hold negative error
> codes but the "rk_obj->base.size" variable is type size_t.  This means
> that when we compare them, they are both type promoted to size_t and the
> negative error code becomes a high unsigned value and is treated as
> success.  Add a cast to fix this.
> 
> 
> [...]

Applied, thanks!

[1/1] drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map()
      commit: 6471da5ee311d53ef46eebcb7725bc94266cc0cf

Best regards,
diff mbox series

Patch

diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
index b8f8b45ebf59..93ed841f5dce 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
@@ -40,7 +40,7 @@  static int rockchip_gem_iommu_map(struct rockchip_gem_object *rk_obj)
 
 	ret = iommu_map_sgtable(private->domain, rk_obj->dma_addr, rk_obj->sgt,
 				prot);
-	if (ret < rk_obj->base.size) {
+	if (ret < (ssize_t)rk_obj->base.size) {
 		DRM_ERROR("failed to map buffer: size=%zd request_size=%zd\n",
 			  ret, rk_obj->base.size);
 		ret = -ENOMEM;