All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: pkshih@realtek.com
Cc: linux-wireless@vger.kernel.org
Subject: [bug report] rtw89: add Realtek 802.11ax driver
Date: Mon, 8 Nov 2021 17:47:11 +0300	[thread overview]
Message-ID: <20211108144711.GA9468@kili> (raw)

Hello Ping-Ke Shih,

The patch e3ec7017f6a2: "rtw89: add Realtek 802.11ax driver" from Oct
11, 2021, leads to the following Smatch static checker warning:

	drivers/net/wireless/realtek/rtw89/mac.c:586 hfc_ch_ctrl()
	warn: array off by one? 'cfg[ch]'

drivers/net/wireless/realtek/rtw89/mac.c
    568 static int hfc_ch_ctrl(struct rtw89_dev *rtwdev, u8 ch)
    569 {
    570         struct rtw89_hfc_param *param = &rtwdev->mac.hfc_param;
    571         const struct rtw89_hfc_ch_cfg *cfg = param->ch_cfg;
    572         int ret = 0;
    573         u32 val = 0;
    574 
    575         ret = rtw89_mac_check_mac_en(rtwdev, RTW89_MAC_0, RTW89_DMAC_SEL);
    576         if (ret)
    577                 return ret;
    578 
    579         ret = hfc_ch_cfg_chk(rtwdev, ch);
    580         if (ret)
    581                 return ret;
    582 
    583         if (ch > RTW89_DMA_B1HI)
                    ^^^^^^^^^^^^^^^^^^^

    584                 return -EINVAL;
    585 
--> 586         val = u32_encode_bits(cfg[ch].min, B_AX_MIN_PG_MASK) |
    587               u32_encode_bits(cfg[ch].max, B_AX_MAX_PG_MASK) |
    588               (cfg[ch].grp ? B_AX_GRP : 0);

This is an unpublished Smatch warning which uses an "assume every >
comparison should be >= wrong until proven otherwise" approach.  In
this case, Smatch can't tell the size of the cfg[] array.

Manually it looks like cfg can only be rtw8852a_hfc_chcfg_pcie[] which
has RTW89_DMA_CH_NUM (13) elements.  Is there a reason why we don't use
the last element?  Also it's puzzling that the last element is
FWCMDQ instead of H2C.  So maybe that's the reason?

    589         rtw89_write32(rtwdev, R_AX_ACH0_PAGE_CTRL + ch * 4, val);
    590 
    591         return 0;
    592 }

regards,
dan carpenter

             reply	other threads:[~2021-11-08 14:47 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-08 14:47 Dan Carpenter [this message]
2021-11-09  1:04 ` [bug report] rtw89: add Realtek 802.11ax driver Pkshih
  -- strict thread matches above, loose matches on Subject: below --
2021-11-12  7:51 Dan Carpenter
2021-11-15  7:33 ` Pkshih
2021-11-19  6:01   ` Pkshih
2021-11-30 10:42 Dan Carpenter
2021-12-01  1:57 ` Pkshih
2022-12-12 15:33 Dan Carpenter
2022-12-13  0:46 ` Ping-Ke Shih
2022-12-13  4:21   ` Dan Carpenter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211108144711.GA9468@kili \
    --to=dan.carpenter@oracle.com \
    --cc=linux-wireless@vger.kernel.org \
    --cc=pkshih@realtek.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.