RDMA/mlx5: issue with error checking

["Colin King (gmail)" <colin.i.king@gmail.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 1266 bytes --]

Hi

Static analysis detected an issue with the following commit:

commit e73242aa14d2ec7f4a1a13688366bb36dc0fe5b7
Author: Edward Srouji <edwards@nvidia.com>
Date:   Wed Jul 9 09:42:11 2025 +0300

     RDMA/mlx5: Optimize DMABUF mkey page size


The issue is as follows:

int mlx5r_umr_dmabuf_update_pgsz(struct mlx5_ib_mr *mr, u32 xlt_flags,
                                  unsigned int page_shift)
{
         unsigned int old_page_shift = mr->page_shift;
         size_t zapped_blocks;
         size_t total_blocks;
         int err;

         zapped_blocks = _mlx5r_umr_zap_mkey(mr, xlt_flags, page_shift,
                                             mr->data_direct);
         if (zapped_blocks < 0)
                 return zapped_blocks;

The variable zapped_blocks is a size_t type and is being assigned a int 
return value from the call to _mlx5r_umr_zap_mkey. Since zapped_blocks 
is an unsigned type, the error check for zapped_blocks < 0 will never be 
true.  I suspect total_blocks should be a ssize_t type, but that 
probably also means total_blocks should be ssize_t too, but don't have 
the hardware to test this fix and I'm concerned that this change may 
break the code. Hence I'm reporting this issue.

Colin



[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 4901 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]