* [bug report] media: rockchip: rkcif: add support for rk3568 vicap mipi capture
[not found] <caa37f28-a2e8-4e0a-a9ce-a365ce805e4b@stanley.mountain>
@ 2026-02-06 13:39 ` Dan Carpenter
2026-02-16 13:33 ` Michael Riesch
2026-02-06 13:41 ` [bug report] soc: rockchip: grf: Support multiple grf to be handled Dan Carpenter
1 sibling, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2026-02-06 13:39 UTC (permalink / raw)
To: Michael Riesch; +Cc: linux-media, linux-rockchip, linux-kernel
[ Smatch checking is paused while we raise funding. #SadFace
https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]
Hello Michael Riesch,
Commit 1f2353f5a1af ("media: rockchip: rkcif: add support for rk3568
vicap mipi capture") from Nov 14, 2025 (linux-next), leads to the
following Smatch static checker warning:
drivers/media/platform/rockchip/rkcif/rkcif-capture-mipi.c:519 rkcif_mipi_id_get_reg()
index hardmax out of bounds 'rkcif->match_data->mipi->regs_id[id]' size=4 max='4' rl='0-u32max'
drivers/media/platform/rockchip/rkcif/rkcif-capture-mipi.c:519 rkcif_mipi_id_get_reg()
index hardmax out of bounds 'rkcif->match_data->mipi->regs_id[id][index]' size=11 max='11' rl='0-11'
drivers/media/platform/rockchip/rkcif/rkcif-capture-mipi.c
504 static inline unsigned int rkcif_mipi_id_get_reg(struct rkcif_stream *stream,
505 unsigned int index)
506 {
507 struct rkcif_device *rkcif = stream->rkcif;
508 unsigned int block, id, offset, reg;
509
510 block = stream->interface->index - RKCIF_MIPI_BASE;
511 id = stream->id;
512
513 if (WARN_ON_ONCE(block > RKCIF_MIPI_MAX - RKCIF_MIPI_BASE) ||
514 WARN_ON_ONCE(id > RKCIF_ID_MAX) ||
515 WARN_ON_ONCE(index > RKCIF_MIPI_ID_REGISTER_MAX))
The id and index checks should be >=. Not sure about block but I assume
it's off by one as well.
516 return RKCIF_REGISTER_NOTSUPPORTED;
517
518 offset = rkcif->match_data->mipi->blocks[block].offset;
--> 519 reg = rkcif->match_data->mipi->regs_id[id][index];
520 if (reg == RKCIF_REGISTER_NOTSUPPORTED)
521 return reg;
522
523 return offset + reg;
524 }
regards,
dan carpenter
_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip
^ permalink raw reply [flat|nested] 3+ messages in thread* [bug report] soc: rockchip: grf: Support multiple grf to be handled
[not found] <caa37f28-a2e8-4e0a-a9ce-a365ce805e4b@stanley.mountain>
2026-02-06 13:39 ` [bug report] media: rockchip: rkcif: add support for rk3568 vicap mipi capture Dan Carpenter
@ 2026-02-06 13:41 ` Dan Carpenter
1 sibling, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2026-02-06 13:41 UTC (permalink / raw)
To: Shawn Lin; +Cc: linux-arm-kernel, linux-rockchip, linux-kernel
[ Smatch checking is paused while we raise funding. #SadFace
https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]
Hello Shawn Lin,
Commit 75fb63ae0312 ("soc: rockchip: grf: Support multiple grf to be
handled") from Jan 16, 2026 (linux-next), leads to the following
Smatch static checker warning:
drivers/soc/rockchip/grf.c:249 rockchip_grf_init()
warn: inconsistent refcounting 'np->kobj.kref.refcount.refs.counter':
drivers/soc/rockchip/grf.c
212 static int __init rockchip_grf_init(void)
213 {
214 const struct rockchip_grf_info *grf_info;
215 const struct of_device_id *match;
216 struct device_node *np;
217 struct regmap *grf;
218 int ret, i;
219
220 for_each_matching_node_and_match(np, rockchip_grf_dt_match, &match) {
221 if (!of_device_is_available(np))
222 continue;
223 if (!match || !match->data) {
224 pr_err("%s: missing grf data\n", __func__);
225 of_node_put(np);
226 return -EINVAL;
227 }
228
229 grf_info = match->data;
230
231 grf = syscon_node_to_regmap(np);
232 if (IS_ERR(grf)) {
233 pr_err("%s: could not get grf syscon\n", __func__);
234 return PTR_ERR(grf);
Missing of_node_put(np) before returning.
235 }
236
237 for (i = 0; i < grf_info->num_values; i++) {
238 const struct rockchip_grf_value *val = &grf_info->values[i];
239
240 pr_debug("%s: adjusting %s in %#6x to %#10x\n", __func__,
241 val->desc, val->reg, val->val);
242 ret = regmap_write(grf, val->reg, val->val);
243 if (ret < 0)
244 pr_err("%s: write to %#6x failed with %d\n",
245 __func__, val->reg, ret);
246 }
247 }
248
249 return 0;
250 }
regards,
dan carpenter
_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip
^ permalink raw reply [flat|nested] 3+ messages in thread