[bug report] mmc: dw_mmc: Remove struct dw_mci_slot

[bug report] mmc: dw_mmc: Remove struct dw_mci_slot

[Dan Carpenter]

Hello Shawn Lin,

Commit 926311cf3361 ("mmc: dw_mmc: Remove struct dw_mci_slot") from
Dec 16, 2025 (linux-next), leads to the following Smatch static
checker warning:

	drivers/mmc/host/dw_mmc.c:3467 dw_mci_remove()
	error: we previously assumed 'host' could be null (see line 3464)

drivers/mmc/host/dw_mmc.c
    3457         return ret;
    3458 }
    3459 EXPORT_SYMBOL(dw_mci_probe);
    3460 
    3461 void dw_mci_remove(struct dw_mci *host)
    3462 {
    3463         dev_dbg(host->dev, "remove host\n");
                         ^^^^^^^^^
Host is dereferenced

    3464         if (host)

Then checked for NULL.

    3465                 dw_mci_cleanup_host(host);

The dw_mci_cleanup_host() function gives up our claim to host which
allows it to be re-used.

    3466 
--> 3467         mci_writel(host, RINTSTS, 0xFFFFFFFF);

So it's surprising to me that we keep on using it throughout the
rest of the function.

    3468         mci_writel(host, INTMASK, 0); /* disable all mmc interrupt first */
    3469 
    3470         /* disable clock to CIU */
    3471         mci_writel(host, CLKENA, 0);
    3472         mci_writel(host, CLKSRC, 0);
    3473 
    3474         if (host->use_dma && host->dma_ops->exit)
    3475                 host->dma_ops->exit(host);
    3476 
    3477         reset_control_assert(host->pdata->rstc);
    3478 
    3479         clk_disable_unprepare(host->ciu_clk);
    3480         clk_disable_unprepare(host->biu_clk);
    3481 }

regards,
dan carpenter

Re: [bug report] mmc: dw_mmc: Remove struct dw_mci_slot

[Shawn Lin]

在 2025/12/19 星期五 16:17, Dan Carpenter 写道:
> Hello Shawn Lin,
> 
> Commit 926311cf3361 ("mmc: dw_mmc: Remove struct dw_mci_slot") from
> Dec 16, 2025 (linux-next), leads to the following Smatch static
> checker warning:
> 
> 	drivers/mmc/host/dw_mmc.c:3467 dw_mci_remove()
> 	error: we previously assumed 'host' could be null (see line 3464)
> 
> drivers/mmc/host/dw_mmc.c
>      3457         return ret;
>      3458 }
>      3459 EXPORT_SYMBOL(dw_mci_probe);
>      3460
>      3461 void dw_mci_remove(struct dw_mci *host)
>      3462 {
>      3463         dev_dbg(host->dev, "remove host\n");
>                           ^^^^^^^^^
> Host is dereferenced
> 
>      3464         if (host)
> 
> Then checked for NULL.
> 
>      3465                 dw_mci_cleanup_host(host);
> 
> The dw_mci_cleanup_host() function gives up our claim to host which
> allows it to be re-used.
> 
>      3466
> --> 3467         mci_writel(host, RINTSTS, 0xFFFFFFFF);
> 
> So it's surprising to me that we keep on using it throughout the
> rest of the function.
> 

Thanks Dan. Smatch is so smart! Yes, this check is redundant, could be
removed. Will fix it later.

>      3468         mci_writel(host, INTMASK, 0); /* disable all mmc interrupt first */
>      3469
>      3470         /* disable clock to CIU */
>      3471         mci_writel(host, CLKENA, 0);
>      3472         mci_writel(host, CLKSRC, 0);
>      3473
>      3474         if (host->use_dma && host->dma_ops->exit)
>      3475                 host->dma_ops->exit(host);
>      3476
>      3477         reset_control_assert(host->pdata->rstc);
>      3478
>      3479         clk_disable_unprepare(host->ciu_clk);
>      3480         clk_disable_unprepare(host->biu_clk);
>      3481 }
> 
> regards,
> dan carpenter
> 

[bug report] mmc: dw_mmc: Remove struct dw_mci_slot

[Dan Carpenter]

[ Sorry, a couple more.  I should have included these in the same email ]

Hello Shawn Lin,

This is a semi-automatic email about new static checker warnings.

Commit 926311cf3361 ("mmc: dw_mmc: Remove struct dw_mci_slot") from
Dec 16, 2025, leads to the following Smatch complaint:

drivers/mmc/host/dw_mmc.c:3494 dw_mci_runtime_suspend() warn: variable dereferenced before check 'host' (see line 3489)
drivers/mmc/host/dw_mmc.c:3546 dw_mci_runtime_resume() warn: variable dereferenced before check 'host' (see line 3516)
drivers/mmc/host/dw_mmc.c:3562 dw_mci_runtime_resume() warn: variable dereferenced before check 'host' (see line 3516)

drivers/mmc/host/dw_mmc.c
  3488	
  3489		if (host->use_dma && host->dma_ops->exit)
                    ^^^^^^
The host pointer is dereferenced

  3490			host->dma_ops->exit(host);
  3491	
  3492		clk_disable_unprepare(host->ciu_clk);
  3493	
  3494		if (host &&
                    ^^^^
So this check is too late.

  3495		    (mmc_host_can_gpio_cd(host->mmc) ||
  3496		     !mmc_card_is_removable(host->mmc)))

regards,
dan carpenter

Re: [bug report] mmc: dw_mmc: Remove struct dw_mci_slot

[Ulf Hansson]

On Fri, 19 Dec 2025 at 11:38, Dan Carpenter <dan.carpenter@linaro.org> wrote:
>
> [ Sorry, a couple more.  I should have included these in the same email ]
>
> Hello Shawn Lin,
>
> This is a semi-automatic email about new static checker warnings.
>
> Commit 926311cf3361 ("mmc: dw_mmc: Remove struct dw_mci_slot") from
> Dec 16, 2025, leads to the following Smatch complaint:
>
> drivers/mmc/host/dw_mmc.c:3494 dw_mci_runtime_suspend() warn: variable dereferenced before check 'host' (see line 3489)
> drivers/mmc/host/dw_mmc.c:3546 dw_mci_runtime_resume() warn: variable dereferenced before check 'host' (see line 3516)
> drivers/mmc/host/dw_mmc.c:3562 dw_mci_runtime_resume() warn: variable dereferenced before check 'host' (see line 3516)
>
> drivers/mmc/host/dw_mmc.c
>   3488
>   3489          if (host->use_dma && host->dma_ops->exit)
>                     ^^^^^^
> The host pointer is dereferenced
>
>   3490                  host->dma_ops->exit(host);
>   3491
>   3492          clk_disable_unprepare(host->ciu_clk);
>   3493
>   3494          if (host &&
>                     ^^^^
> So this check is too late.
>
>   3495              (mmc_host_can_gpio_cd(host->mmc) ||
>   3496               !mmc_card_is_removable(host->mmc)))
>
> regards,
> dan carpenter
>

Thanks for reporting Dan, the offending commit has just been dropped
from my next branch.

Kind regards
Uffe