Skip to contentSkip to conversation

iwlwifi: ACPI: support revision 3 WGDS tables

bug report Dan Carpenter 1 participant 1 message Nov 11, 2021

lore
Share & tools
lore
#0 lore raw

Hello Ayala Barazani,

The patch 97f8a3d1610b: "iwlwifi: ACPI: support revision 3 WGDS tables" from Oct 24, 2021, leads to the following Smatch static checker warning:

	drivers/net/wireless/intel/iwlwifi/fw/acpi.c:801 iwl_sar_get_wgds_table()
	warn: duplicate check 'idx < (12 / 4 + (0))' (previous on line 749)

drivers/net/wireless/intel/iwlwifi/fw/acpi.c
743
744 data = iwl_acpi_get_object(fwrt->dev, ACPI_WGDS_METHOD);
745 if (IS_ERR(data))
746 return PTR_ERR(data);
747
748 /* read the highest revision we understand first */
749 for (idx = 0; idx < ARRAY_SIZE(rev_data); idx++) {

   750                  /* min_profiles != 0 requires num_profiles header */
   751                  u32 hdr_size = 1 + !!rev_data[idx].min_profiles;
   752                  u32 profile_size = ACPI_GEO_PER_CHAIN_SIZE *

753 rev_data[idx].bands;
754 u32 max_size = hdr_size + profile_size * rev_data[idx].profiles;
755 u32 min_size;
756
757 if (!rev_data[idx].min_profiles)
758 min_size = max_size;
759 else
760 min_size = hdr_size +
761 profile_size * rev_data[idx].min_profiles;
762
763 wifi_pkg = iwl_acpi_get_wifi_pkg_range(fwrt->dev, data,
764 min_size, max_size,
765 &tbl_rev);
766 if (!IS_ERR(wifi_pkg)) {

Should this break on error instead of a continue?

767 if (!(BIT(tbl_rev) & rev_data[idx].revisions))
768 continue;
769
770 num_bands = rev_data[idx].bands;
771 num_profiles = rev_data[idx].profiles;
772
773 if (rev_data[idx].min_profiles) {
774 /* read header that says # of profiles */
775 union acpi_object *entry;
776

   777                                  entry = &wifi_pkg->package.elements[entry_idx];
   778                                  entry_idx++;
   779                                  if (entry->type != ACPI_TYPE_INTEGER ||
   780                                      entry->integer.value > num_profiles) {
   781                                          ret = -EINVAL;
   782                                          goto out_free;
   783                                  }
   784                                  num_profiles = entry->integer.value;
   785  
   786                                  /*
   787                                   * this also validates >= min_profiles since we
   788                                   * otherwise wouldn't have gotten the data when
   789                                   * looking up in ACPI
   790                                   */
   791                                  if (wifi_pkg->package.count !=
   792                                      min_size + profile_size * num_profiles) {
   793                                          ret = -EINVAL;
   794                                          goto out_free;
   795                                  }
   796                          }
   797                          goto read_table;
   798                  }
   799          }
   800  
   801          if (idx < ARRAY_SIZE(rev_data))
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^

idx is always == ARRAY_SIZE() at this point.

   802                  ret = PTR_ERR(wifi_pkg);
   803          else
   804                  ret = -ENOENT;
   805          goto out_free;
   806  
   807  read_table:
   808          fwrt->geo_rev = tbl_rev;
   809          for (i = 0; i < num_profiles; i++) {
   810                  for (j = 0; j < ACPI_GEO_NUM_BANDS_REV2; j++) {

regards,
dan carpenter