drivers/gpu/drm/mediatek/mtk_dsi.c:951 mtk_dsi_host_transfer() warn: check sign expansion for 'ret'

[Dan Carpenter <dan.carpenter@oracle.com>]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3
commit: 81cc7e51c4f1686b71e30046437056ece6b2cb4d drm/mediatek: Allow commands to be sent during video mode
config: arm64-randconfig-m031-20220613 (https://download.01.org/0day-ci/archive/20220614/202206140910.aE0Vlhfq-lkp@intel.com/config)
compiler: aarch64-linux-gcc (GCC) 11.3.0

If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
drivers/gpu/drm/mediatek/mtk_dsi.c:951 mtk_dsi_host_transfer() warn: check sign expansion for 'ret'

vim +/ret +951 drivers/gpu/drm/mediatek/mtk_dsi.c

21898816831fc6 shaoming chen  2017-03-31  886  static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host,
21898816831fc6 shaoming chen  2017-03-31  887  				     const struct mipi_dsi_msg *msg)
21898816831fc6 shaoming chen  2017-03-31  888  {
21898816831fc6 shaoming chen  2017-03-31  889  	struct mtk_dsi *dsi = host_to_dsi(host);
21898816831fc6 shaoming chen  2017-03-31  890  	u32 recv_cnt, i;
                                                ^^^^^^^^^^^^

21898816831fc6 shaoming chen  2017-03-31  891  	u8 read_data[16];
21898816831fc6 shaoming chen  2017-03-31  892  	void *src_addr;
21898816831fc6 shaoming chen  2017-03-31  893  	u8 irq_flag = CMD_DONE_INT_FLAG;
81cc7e51c4f168 Julien STEPHAN 2022-02-14  894  	u32 dsi_mode;
81cc7e51c4f168 Julien STEPHAN 2022-02-14  895  	int ret;
21898816831fc6 shaoming chen  2017-03-31  896  
81cc7e51c4f168 Julien STEPHAN 2022-02-14  897  	dsi_mode = readl(dsi->regs + DSI_MODE_CTRL);
81cc7e51c4f168 Julien STEPHAN 2022-02-14  898  	if (dsi_mode & MODE) {
81cc7e51c4f168 Julien STEPHAN 2022-02-14  899  		mtk_dsi_stop(dsi);
81cc7e51c4f168 Julien STEPHAN 2022-02-14  900  		ret = mtk_dsi_switch_to_cmd_mode(dsi, VM_DONE_INT_FLAG, 500);
81cc7e51c4f168 Julien STEPHAN 2022-02-14  901  		if (ret)
81cc7e51c4f168 Julien STEPHAN 2022-02-14  902  			goto restore_dsi_mode;
21898816831fc6 shaoming chen  2017-03-31  903  	}
21898816831fc6 shaoming chen  2017-03-31  904  
21898816831fc6 shaoming chen  2017-03-31  905  	if (MTK_DSI_HOST_IS_READ(msg->type))
21898816831fc6 shaoming chen  2017-03-31  906  		irq_flag |= LPRX_RD_RDY_INT_FLAG;
21898816831fc6 shaoming chen  2017-03-31  907  
81cc7e51c4f168 Julien STEPHAN 2022-02-14  908  	ret = mtk_dsi_host_send_cmd(dsi, msg, irq_flag);
81cc7e51c4f168 Julien STEPHAN 2022-02-14  909  	if (ret)
81cc7e51c4f168 Julien STEPHAN 2022-02-14  910  		goto restore_dsi_mode;
21898816831fc6 shaoming chen  2017-03-31  911  
81cc7e51c4f168 Julien STEPHAN 2022-02-14  912  	if (!MTK_DSI_HOST_IS_READ(msg->type)) {
81cc7e51c4f168 Julien STEPHAN 2022-02-14  913  		recv_cnt = 0;
81cc7e51c4f168 Julien STEPHAN 2022-02-14  914  		goto restore_dsi_mode;
81cc7e51c4f168 Julien STEPHAN 2022-02-14  915  	}
21898816831fc6 shaoming chen  2017-03-31  916  
21898816831fc6 shaoming chen  2017-03-31  917  	if (!msg->rx_buf) {
21898816831fc6 shaoming chen  2017-03-31  918  		DRM_ERROR("dsi receive buffer size may be NULL\n");
81cc7e51c4f168 Julien STEPHAN 2022-02-14  919  		ret = -EINVAL;
81cc7e51c4f168 Julien STEPHAN 2022-02-14  920  		goto restore_dsi_mode;
21898816831fc6 shaoming chen  2017-03-31  921  	}
21898816831fc6 shaoming chen  2017-03-31  922  
21898816831fc6 shaoming chen  2017-03-31  923  	for (i = 0; i < 16; i++)
21898816831fc6 shaoming chen  2017-03-31  924  		*(read_data + i) = readb(dsi->regs + DSI_RX_DATA0 + i);
21898816831fc6 shaoming chen  2017-03-31  925  
21898816831fc6 shaoming chen  2017-03-31  926  	recv_cnt = mtk_dsi_recv_cnt(read_data[0], read_data);
21898816831fc6 shaoming chen  2017-03-31  927  
21898816831fc6 shaoming chen  2017-03-31  928  	if (recv_cnt > 2)
21898816831fc6 shaoming chen  2017-03-31  929  		src_addr = &read_data[4];
21898816831fc6 shaoming chen  2017-03-31  930  	else
21898816831fc6 shaoming chen  2017-03-31  931  		src_addr = &read_data[1];
21898816831fc6 shaoming chen  2017-03-31  932  
21898816831fc6 shaoming chen  2017-03-31  933  	if (recv_cnt > 10)
21898816831fc6 shaoming chen  2017-03-31  934  		recv_cnt = 10;
21898816831fc6 shaoming chen  2017-03-31  935  
21898816831fc6 shaoming chen  2017-03-31  936  	if (recv_cnt > msg->rx_len)
21898816831fc6 shaoming chen  2017-03-31  937  		recv_cnt = msg->rx_len;
21898816831fc6 shaoming chen  2017-03-31  938  
21898816831fc6 shaoming chen  2017-03-31  939  	if (recv_cnt)
21898816831fc6 shaoming chen  2017-03-31  940  		memcpy(msg->rx_buf, src_addr, recv_cnt);
21898816831fc6 shaoming chen  2017-03-31  941  
21898816831fc6 shaoming chen  2017-03-31  942  	DRM_INFO("dsi get %d byte data from the panel address(0x%x)\n",
21898816831fc6 shaoming chen  2017-03-31  943  		 recv_cnt, *((u8 *)(msg->tx_buf)));
21898816831fc6 shaoming chen  2017-03-31  944  
81cc7e51c4f168 Julien STEPHAN 2022-02-14  945  restore_dsi_mode:
81cc7e51c4f168 Julien STEPHAN 2022-02-14  946  	if (dsi_mode & MODE) {
81cc7e51c4f168 Julien STEPHAN 2022-02-14  947  		mtk_dsi_set_mode(dsi);
81cc7e51c4f168 Julien STEPHAN 2022-02-14  948  		mtk_dsi_start(dsi);
81cc7e51c4f168 Julien STEPHAN 2022-02-14  949  	}
81cc7e51c4f168 Julien STEPHAN 2022-02-14  950  
81cc7e51c4f168 Julien STEPHAN 2022-02-14 @951  	return ret < 0 ? ret : recv_cnt;

This is buggy.  ret is int and recv_cnt is u32.  So negative values
for int will be type promoted to -22U, or whatever, which is a high
positive value in the U32 range.  So it's still a high positive value
when casted to ssize_t/long and not a negative value as expected.

The way to write this is:

	if (ret < 0)
		return ret;

	return recv_cnt;

21898816831fc6 shaoming chen  2017-03-31  952  }

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp