Re: [PATCH] IB/core: type promotion bug in rdma_rw_init_one_mr()

[Dan Carpenter <dan.carpenter@oracle.com>]

On Wed, Jul 04, 2018 at 12:41:53PM +0200, Walter Harms wrote:
> 
> Am 04.07.2018 11:32, schrieb Dan Carpenter:
> > "nents" is an unsigned int, so if ib_map_mr_sg() returns a negative
> > error code then it's type promoted to a high unsigned int which is
> > treated as success.
> > 
> > Fixes: a060b5629ab0 ("IB/core: generic RDMA READ/WRITE API")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > 
> > diff --git a/drivers/infiniband/core/rw.c b/drivers/infiniband/core/rw.c
> > index c8963e91f92a..3ee0adfb45e9 100644
> > --- a/drivers/infiniband/core/rw.c
> > +++ b/drivers/infiniband/core/rw.c
> > @@ -87,7 +87,7 @@ static int rdma_rw_init_one_mr(struct ib_qp *qp, u8
> > port_num,
> >  	}
> >  
> >  	ret = ib_map_mr_sg(reg->mr, sg, nents, &offset, PAGE_SIZE);
> > -	if (ret < nents) {
> > +	if (ret < 0 || ret < nents) {
> >  		ib_mr_pool_put(qp, &qp->rdma_mrs, reg->mr);
> >  		return -EINVAL;
> >  	}
> 
> I do not understand the error here.
>  
> ib_map_mr_sg() obviously knows about nents and returns an invalid value ?
> Or is that a special case here ?
> 

ib_map_mr_sg() can return -ENOMEM, -EINVAL, other error codes or a
positive number <= to nents.  If it returns -ENOMEM then that's type
promoted to a high positive value (more than nents for sure) and treated
as success.

regards,
dan carpenter