From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-sn1nam01on0097.outbound.protection.outlook.com ([104.47.32.97]:53808 "EHLO NAM01-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1730063AbeIOGxE (ORCPT ); Sat, 15 Sep 2018 02:53:04 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Dan Carpenter , Thierry Reding , Sasha Levin Subject: [PATCH AUTOSEL 3.18 10/11] drm/panel: type promotion bug in s6e8aa0_read_mtp_id() Date: Sat, 15 Sep 2018 01:35:30 +0000 Message-ID: <20180915013521.180178-10-alexander.levin@microsoft.com> References: <20180915013521.180178-1-alexander.levin@microsoft.com> In-Reply-To: <20180915013521.180178-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Dan Carpenter [ Upstream commit cd0e0ca69109d025b1a1b6609f70682db62138b0 ] The ARRAY_SIZE() macro is type size_t. If s6e8aa0_dcs_read() returns a negative error code, then "ret < ARRAY_SIZE(id)" is false because the negative error code is type promoted to a high positive value. Fixes: 02051ca06371 ("drm/panel: add S6E8AA0 driver") Signed-off-by: Dan Carpenter Reviewed-by: Andrzej Hajda Signed-off-by: Thierry Reding Link: https://patchwork.freedesktop.org/patch/msgid/20180704093807.s3lqsb2v= 6dg2k43d@kili.mountain Signed-off-by: Sasha Levin --- drivers/gpu/drm/panel/panel-s6e8aa0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/panel/panel-s6e8aa0.c b/drivers/gpu/drm/panel/= panel-s6e8aa0.c index b5217fe37f02..0e46b6762cf0 100644 --- a/drivers/gpu/drm/panel/panel-s6e8aa0.c +++ b/drivers/gpu/drm/panel/panel-s6e8aa0.c @@ -835,7 +835,7 @@ static void s6e8aa0_read_mtp_id(struct s6e8aa0 *ctx) int ret, i; =20 ret =3D s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id)); - if (ret < ARRAY_SIZE(id) || id[0] =3D=3D 0x00) { + if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] =3D=3D 0x00) { dev_err(ctx->dev, "read id failed\n"); ctx->error =3D -EIO; return; --=20 2.17.1