[bug report] soc: qcom: icc-bwmon: Add bandwidth monitoring driver

[bug report] soc: qcom: icc-bwmon: Add bandwidth monitoring driver

[Dan Carpenter]

Hello Krzysztof Kozlowski,

Commit b9c2ae6cac40 ("soc: qcom: icc-bwmon: Add bandwidth monitoring
driver") from Jul 4, 2022 (linux-next), leads to the following Smatch
static checker warning:

	drivers/soc/qcom/icc-bwmon.c:693 bwmon_intr_thread()
	error: 'target_opp' dereferencing possible ERR_PTR()

drivers/soc/qcom/icc-bwmon.c
    645 static irqreturn_t bwmon_intr_thread(int irq, void *dev_id)
    646 {
    647         struct icc_bwmon *bwmon = dev_id;
    648         unsigned int irq_enable = 0;
    649         struct dev_pm_opp *opp, *target_opp;
    650         unsigned int bw_kbps, up_kbps, down_kbps, meas_kbps;
    651 
    652         bw_kbps = bwmon->target_kbps;
    653         meas_kbps = bwmon->target_kbps;
    654 
    655         target_opp = dev_pm_opp_find_bw_ceil(bwmon->dev, &bw_kbps, 0);
    656         if (IS_ERR(target_opp) && PTR_ERR(target_opp) == -ERANGE)
    657                 target_opp = dev_pm_opp_find_bw_floor(bwmon->dev, &bw_kbps, 0);

Smatch thinks both dev_pm_opp_find_bw_ceil() and dev_pm_opp_find_bw_floor()
can return error pointers.

    658 
    659         bwmon->target_kbps = bw_kbps;
    660 
    661         bw_kbps--;
    662         opp = dev_pm_opp_find_bw_floor(bwmon->dev, &bw_kbps, 0);
    663         if (IS_ERR(opp) && PTR_ERR(opp) == -ERANGE)
    664                 down_kbps = bwmon->target_kbps;
    665         else
    666                 down_kbps = bw_kbps;
    667 
    668         up_kbps = bwmon->target_kbps + 1;
    669 
    670         if (bwmon->target_kbps >= bwmon->max_bw_kbps)
    671                 irq_enable = BIT(1);
    672         else if (bwmon->target_kbps <= bwmon->min_bw_kbps)
    673                 irq_enable = BIT(3);
    674         else
    675                 irq_enable = BWMON_IRQ_ENABLE_MASK;
    676 
    677         bwmon_set_threshold(bwmon, bwmon->regs[F_THRESHOLD_HIGH],
    678                             up_kbps);
    679         bwmon_set_threshold(bwmon, bwmon->regs[F_THRESHOLD_MED],
    680                             down_kbps);
    681         bwmon_clear_counters(bwmon, false);
    682         bwmon_clear_irq(bwmon);
    683         bwmon_enable(bwmon, irq_enable);
    684 
    685         trace_qcom_bwmon_update(dev_name(bwmon->dev), meas_kbps, up_kbps, down_kbps);
    686         if (bwmon->target_kbps == bwmon->current_kbps)
    687                 goto out;
    688 
    689         dev_pm_opp_set_opp(bwmon->dev, target_opp);
    690         bwmon->current_kbps = bwmon->target_kbps;
    691 
    692 out:
--> 693         dev_pm_opp_put(target_opp);
    694         if (!IS_ERR(opp))
    695                 dev_pm_opp_put(opp);
    696 
    697         return IRQ_HANDLED;
    698 }

regards,
dan carpenter

Re: [bug report] soc: qcom: icc-bwmon: Add bandwidth monitoring driver

[Krzysztof Kozlowski]

On 07/08/2025 17:58, Dan Carpenter wrote:
> Hello Krzysztof Kozlowski,
> 
> Commit b9c2ae6cac40 ("soc: qcom: icc-bwmon: Add bandwidth monitoring
> driver") from Jul 4, 2022 (linux-next), leads to the following Smatch
> static checker warning:
> 
> 	drivers/soc/qcom/icc-bwmon.c:693 bwmon_intr_thread()
> 	error: 'target_opp' dereferencing possible ERR_PTR()
> 
> drivers/soc/qcom/icc-bwmon.c
>     645 static irqreturn_t bwmon_intr_thread(int irq, void *dev_id)
>     646 {
>     647         struct icc_bwmon *bwmon = dev_id;
>     648         unsigned int irq_enable = 0;
>     649         struct dev_pm_opp *opp, *target_opp;
>     650         unsigned int bw_kbps, up_kbps, down_kbps, meas_kbps;
>     651 
>     652         bw_kbps = bwmon->target_kbps;
>     653         meas_kbps = bwmon->target_kbps;
>     654 
>     655         target_opp = dev_pm_opp_find_bw_ceil(bwmon->dev, &bw_kbps, 0);
>     656         if (IS_ERR(target_opp) && PTR_ERR(target_opp) == -ERANGE)
>     657                 target_opp = dev_pm_opp_find_bw_floor(bwmon->dev, &bw_kbps, 0);
> 
> Smatch thinks both dev_pm_opp_find_bw_ceil() and dev_pm_opp_find_bw_floor()
> can return error pointers.
Indeed, thanks. I'll fix it.

Best regards,
Krzysztof