[PATCH 3/3] drm/msm/dsi: fix signedness bug in msm_dsi_host_cmd_rx()

[Dmitry Baryshkov]

On 01/10/2021 15:36, Dan Carpenter wrote:
> The "msg->tx_len" variable is type size_t so if dsi_cmds2buf_tx()
> returns a negative error code that it type promoted to a high positive
> value and treat as a success.  The second problem with this code is
> that it can return meaningless positive values on error.

It looks to me that this piece of code is not fully correct at all.
dsi_cmds2bus_tx would return the size of DSI packet, not the size of the 
DSI buffer.

Could you please be more specific, which 'meaningless positive values' 
were you receiving?

> 
> Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support")
> Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
> ---
>   drivers/gpu/drm/msm/dsi/dsi_host.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
> index c86b5090fae6..42073a562072 100644
> --- a/drivers/gpu/drm/msm/dsi/dsi_host.c
> +++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
> @@ -2133,8 +2133,10 @@ int msm_dsi_host_cmd_rx(struct mipi_dsi_host *host,
>   		}
>   
>   		ret = dsi_cmds2buf_tx(msm_host, msg);
> -		if (ret < msg->tx_len) {
> +		if (ret < 0 || ret < msg->tx_len) {
>   			pr_err("%s: Read cmd Tx failed, %d\n", __func__, ret);
> +			if (ret >= 0)
> +				ret = -EIO;
>   			return ret;
>   		}
>   
> 


-- 
With best wishes
Dmitry