On Fri, Oct 02, 2026 at 07:56:41PM +0300, Serhat Kumral wrote:
> When nvdimm_clear_poison() fails, it returns a negative error code.
> However, 'cleared' is a signed long while 'size' is size_t.
> The comparison 'cleared < size' promotes 'cleared' to an unsigned long.
> So the error condition can be bypassed and the function can
> incorrectly return success if the subsequent flush succeeds.
> 
> Explicitly check for negative error codes before comparing with 'size'.


Applied to libnvdimm-for-next:
https://git.kernel.org/nvdimm/nvdimm/c/c0962f508e80

Reply via email to