drivers/net/dsa/qca8k.c:944 qca8k_parse_port_config() error: testing array offset 'cpu_port_index' after use.
8:12 p.m.
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: debe436e77c72fcee804fb867f275e6d31aa999c
commit: 5654ec78dd7e64b1e04777b24007344329e6a63b net: dsa: qca8k: rework rgmii delay logic
and scan for cpu port 6
config: i386-randconfig-m021-20211025 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com>
smatch warnings:
drivers/net/dsa/qca8k.c:944 qca8k_parse_port_config() error: testing array offset
'cpu_port_index' after use.
vim +/cpu_port_index +944 drivers/net/dsa/qca8k.c
6c43809bf1bee7 Ansuel Smith 2021-10-14 934 static int
6c43809bf1bee7 Ansuel Smith 2021-10-14 935 qca8k_parse_port_config(struct qca8k_priv
*priv)
6c43809bf1bee7 Ansuel Smith 2021-10-14 936 {
5654ec78dd7e64 Ansuel Smith 2021-10-14 937 int port, cpu_port_index = 0, ret;
6c43809bf1bee7 Ansuel Smith 2021-10-14 938 struct device_node *port_dn;
6c43809bf1bee7 Ansuel Smith 2021-10-14 939 phy_interface_t mode;
6c43809bf1bee7 Ansuel Smith 2021-10-14 940 struct dsa_port *dp;
5654ec78dd7e64 Ansuel Smith 2021-10-14 941 u32 delay;
6c43809bf1bee7 Ansuel Smith 2021-10-14 942
6c43809bf1bee7 Ansuel Smith 2021-10-14 943 /* We have 2 CPU port. Check them */
5654ec78dd7e64 Ansuel Smith 2021-10-14 @944 for (port = 0; port < QCA8K_NUM_PORTS
&& cpu_port_index < QCA8K_NUM_CPU_PORTS; port++) {
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Assume cpu_port_index = QCA8K_NUM_CPU_PORTS - 1;
6c43809bf1bee7 Ansuel Smith 2021-10-14 945 /* Skip every other port */
6c43809bf1bee7 Ansuel Smith 2021-10-14 946 if (port != 0 && port != 6)
6c43809bf1bee7 Ansuel Smith 2021-10-14 947 continue;
6c43809bf1bee7 Ansuel Smith 2021-10-14 948
6c43809bf1bee7 Ansuel Smith 2021-10-14 949 dp = dsa_to_port(priv->ds, port);
6c43809bf1bee7 Ansuel Smith 2021-10-14 950 port_dn = dp->dn;
5654ec78dd7e64 Ansuel Smith 2021-10-14 951 cpu_port_index++;
^^^^^^^^^^^^^^^^^
cpu_port_index is now out of bounds.
6c43809bf1bee7 Ansuel Smith 2021-10-14 952
6c43809bf1bee7 Ansuel Smith 2021-10-14 953 if (!of_device_is_available(port_dn))
6c43809bf1bee7 Ansuel Smith 2021-10-14 954 continue;
6c43809bf1bee7 Ansuel Smith 2021-10-14 955
6c43809bf1bee7 Ansuel Smith 2021-10-14 956 ret = of_get_phy_mode(port_dn,
&mode);
6c43809bf1bee7 Ansuel Smith 2021-10-14 957 if (ret)
6c43809bf1bee7 Ansuel Smith 2021-10-14 958 continue;
6c43809bf1bee7 Ansuel Smith 2021-10-14 959
5654ec78dd7e64 Ansuel Smith 2021-10-14 960 switch (mode) {
5654ec78dd7e64 Ansuel Smith 2021-10-14 961 case PHY_INTERFACE_MODE_RGMII:
5654ec78dd7e64 Ansuel Smith 2021-10-14 962 case PHY_INTERFACE_MODE_RGMII_ID:
5654ec78dd7e64 Ansuel Smith 2021-10-14 963 case PHY_INTERFACE_MODE_RGMII_TXID:
5654ec78dd7e64 Ansuel Smith 2021-10-14 964 case PHY_INTERFACE_MODE_RGMII_RXID:
5654ec78dd7e64 Ansuel Smith 2021-10-14 965 delay = 0;
5654ec78dd7e64 Ansuel Smith 2021-10-14 966
5654ec78dd7e64 Ansuel Smith 2021-10-14 967 if (!of_property_read_u32(port_dn,
"tx-internal-delay-ps", &delay))
5654ec78dd7e64 Ansuel Smith 2021-10-14 968 /* Switch regs accept value in ns,
convert ps to ns */
5654ec78dd7e64 Ansuel Smith 2021-10-14 969 delay = delay / 1000;
5654ec78dd7e64 Ansuel Smith 2021-10-14 970 else if (mode ==
PHY_INTERFACE_MODE_RGMII_ID ||
5654ec78dd7e64 Ansuel Smith 2021-10-14 971 mode == PHY_INTERFACE_MODE_RGMII_TXID)
5654ec78dd7e64 Ansuel Smith 2021-10-14 972 delay = 1;
5654ec78dd7e64 Ansuel Smith 2021-10-14 973
5654ec78dd7e64 Ansuel Smith 2021-10-14 974 if (delay > QCA8K_MAX_DELAY) {
5654ec78dd7e64 Ansuel Smith 2021-10-14 975 dev_err(priv->dev, "rgmii tx
delay is limited to a max value of 3ns, setting to the max value");
5654ec78dd7e64 Ansuel Smith 2021-10-14 976 delay = 3;
5654ec78dd7e64 Ansuel Smith 2021-10-14 977 }
5654ec78dd7e64 Ansuel Smith 2021-10-14 978
5654ec78dd7e64 Ansuel Smith 2021-10-14 979 priv->rgmii_tx_delay[cpu_port_index] =
delay;
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Out of bounds
5654ec78dd7e64 Ansuel Smith 2021-10-14 980
5654ec78dd7e64 Ansuel Smith 2021-10-14 981 delay = 0;
5654ec78dd7e64 Ansuel Smith 2021-10-14 982
5654ec78dd7e64 Ansuel Smith 2021-10-14 983 if (!of_property_read_u32(port_dn,
"rx-internal-delay-ps", &delay))
5654ec78dd7e64 Ansuel Smith 2021-10-14 984 /* Switch regs accept value in ns,
convert ps to ns */
5654ec78dd7e64 Ansuel Smith 2021-10-14 985 delay = delay / 1000;
5654ec78dd7e64 Ansuel Smith 2021-10-14 986 else if (mode ==
PHY_INTERFACE_MODE_RGMII_ID ||
5654ec78dd7e64 Ansuel Smith 2021-10-14 987 mode == PHY_INTERFACE_MODE_RGMII_RXID)
5654ec78dd7e64 Ansuel Smith 2021-10-14 988 delay = 2;
5654ec78dd7e64 Ansuel Smith 2021-10-14 989
5654ec78dd7e64 Ansuel Smith 2021-10-14 990 if (delay > QCA8K_MAX_DELAY) {
5654ec78dd7e64 Ansuel Smith 2021-10-14 991 dev_err(priv->dev, "rgmii rx
delay is limited to a max value of 3ns, setting to the max value");
5654ec78dd7e64 Ansuel Smith 2021-10-14 992 delay = 3;
5654ec78dd7e64 Ansuel Smith 2021-10-14 993 }
5654ec78dd7e64 Ansuel Smith 2021-10-14 994
5654ec78dd7e64 Ansuel Smith 2021-10-14 995 priv->rgmii_rx_delay[cpu_port_index] =
delay;
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Out of bounds
5654ec78dd7e64 Ansuel Smith 2021-10-14 996
5654ec78dd7e64 Ansuel Smith 2021-10-14 997 break;
5654ec78dd7e64 Ansuel Smith 2021-10-14 998 case PHY_INTERFACE_MODE_SGMII:
6c43809bf1bee7 Ansuel Smith 2021-10-14 999 if (of_property_read_bool(port_dn,
"qca,sgmii-txclk-falling-edge"))
6c43809bf1bee7 Ansuel Smith 2021-10-14 1000 priv->sgmii_tx_clk_falling_edge =
true;
6c43809bf1bee7 Ansuel Smith 2021-10-14 1001
6c43809bf1bee7 Ansuel Smith 2021-10-14 1002 if (of_property_read_bool(port_dn,
"qca,sgmii-rxclk-falling-edge"))
6c43809bf1bee7 Ansuel Smith 2021-10-14 1003 priv->sgmii_rx_clk_falling_edge =
true;
5654ec78dd7e64 Ansuel Smith 2021-10-14 1004
5654ec78dd7e64 Ansuel Smith 2021-10-14 1005 break;
5654ec78dd7e64 Ansuel Smith 2021-10-14 1006 default:
5654ec78dd7e64 Ansuel Smith 2021-10-14 1007 continue;
6c43809bf1bee7 Ansuel Smith 2021-10-14 1008 }
6c43809bf1bee7 Ansuel Smith 2021-10-14 1009 }
6c43809bf1bee7 Ansuel Smith 2021-10-14 1010
6c43809bf1bee7 Ansuel Smith 2021-10-14 1011 return 0;
6c43809bf1bee7 Ansuel Smith 2021-10-14 1012 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
5:08 a.m.
tree:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: debe436e77c72fcee804fb867f275e6d31aa999c
commit: 5654ec78dd7e64b1e04777b24007344329e6a63b net: dsa: qca8k: rework rgmii delay
logic and scan for cpu port 6
config: i386-randconfig-m021-20211025 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com>
This should already be fixed by 06dd34a628ae5b6a839b757e746de165d6789ca8
Can you confirm this?
> smatch warnings:
> drivers/net/dsa/qca8k.c:944 qca8k_parse_port_config() error: testing array offset
'cpu_port_index' after use.
>
> vim +/cpu_port_index +944 drivers/net/dsa/qca8k.c
>
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 934 static int
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 935 qca8k_parse_port_config(struct
qca8k_priv *priv)
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 936 {
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 937 int port, cpu_port_index = 0, ret;
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 938 struct device_node *port_dn;
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 939 phy_interface_t mode;
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 940 struct dsa_port *dp;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 941 u32 delay;
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 942
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 943 /* We have 2 CPU port. Check them */
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 @944 for (port = 0; port <
QCA8K_NUM_PORTS && cpu_port_index < QCA8K_NUM_CPU_PORTS; port++) {
>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Assume cpu_port_index = QCA8K_NUM_CPU_PORTS - 1;
>
>
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 945 /* Skip every other port */
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 946 if (port != 0 && port
!= 6)
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 947 continue;
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 948
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 949 dp = dsa_to_port(priv->ds,
port);
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 950 port_dn = dp->dn;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 951 cpu_port_index++;
> ^^^^^^^^^^^^^^^^^
> cpu_port_index is now out of bounds.
>
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 952
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 953 if
(!of_device_is_available(port_dn))
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 954 continue;
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 955
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 956 ret =
of_get_phy_mode(port_dn, &mode);
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 957 if (ret)
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 958 continue;
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 959
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 960 switch (mode) {
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 961 case
PHY_INTERFACE_MODE_RGMII:
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 962 case
PHY_INTERFACE_MODE_RGMII_ID:
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 963 case
PHY_INTERFACE_MODE_RGMII_TXID:
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 964 case
PHY_INTERFACE_MODE_RGMII_RXID:
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 965 delay = 0;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 966
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 967 if
(!of_property_read_u32(port_dn, "tx-internal-delay-ps", &delay))
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 968 /* Switch
regs accept value in ns, convert ps to ns */
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 969 delay = delay
/ 1000;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 970 else if (mode ==
PHY_INTERFACE_MODE_RGMII_ID ||
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 971 mode ==
PHY_INTERFACE_MODE_RGMII_TXID)
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 972 delay = 1;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 973
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 974 if (delay >
QCA8K_MAX_DELAY) {
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 975
dev_err(priv->dev, "rgmii tx delay is limited to a max value of 3ns, setting to
the max value");
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 976 delay = 3;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 977 }
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 978
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 979
priv->rgmii_tx_delay[cpu_port_index] = delay;
>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Out of bounds
>
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 980
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 981 delay = 0;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 982
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 983 if
(!of_property_read_u32(port_dn, "rx-internal-delay-ps", &delay))
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 984 /* Switch
regs accept value in ns, convert ps to ns */
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 985 delay = delay
/ 1000;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 986 else if (mode ==
PHY_INTERFACE_MODE_RGMII_ID ||
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 987 mode ==
PHY_INTERFACE_MODE_RGMII_RXID)
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 988 delay = 2;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 989
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 990 if (delay >
QCA8K_MAX_DELAY) {
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 991
dev_err(priv->dev, "rgmii rx delay is limited to a max value of 3ns, setting to
the max value");
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 992 delay = 3;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 993 }
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 994
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 995
priv->rgmii_rx_delay[cpu_port_index] = delay;
>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Out of bounds
>
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 996
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 997 break;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 998 case
PHY_INTERFACE_MODE_SGMII:
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 999 if
(of_property_read_bool(port_dn, "qca,sgmii-txclk-falling-edge"))
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 1000
priv->sgmii_tx_clk_falling_edge = true;
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 1001
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 1002 if
(of_property_read_bool(port_dn, "qca,sgmii-rxclk-falling-edge"))
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 1003
priv->sgmii_rx_clk_falling_edge = true;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 1004
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 1005 break;
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 1006 default:
> 5654ec78dd7e64 Ansuel Smith 2021-10-14 1007 continue;
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 1008 }
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 1009 }
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 1010
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 1011 return 0;
> 6c43809bf1bee7 Ansuel Smith 2021-10-14 1012 }
>
> ---
> 0-DAY CI Kernel Test Service, Intel Corporation
> https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
>
5:30 p.m.
On Mon, Nov 15, 2021 at 07:08:30PM +0100, Ansuel Smith wrote:
> tree:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head: debe436e77c72fcee804fb867f275e6d31aa999c
> commit: 5654ec78dd7e64b1e04777b24007344329e6a63b net: dsa: qca8k: rework rgmii delay
logic and scan for cpu port 6
> config: i386-randconfig-m021-20211025 (attached as .config)
> compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
>
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp(a)intel.com>
> Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com>
>
This should already be fixed by 06dd34a628ae5b6a839b757e746de165d6789ca8
Can you confirm this?
No, it doesn't fix the problem. The check is either useless and should
be removed or there is an out of bounds bug. Checking for an out of
bounds *after* you've already written to the memory is *never* useful.
regards,
dan carpenter
> > smatch warnings:
> > drivers/net/dsa/qca8k.c:944 qca8k_parse_port_config() error: testing array
offset 'cpu_port_index' after use.
> >
> > vim +/cpu_port_index +944 drivers/net/dsa/qca8k.c
> >
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 934 static int
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 935 qca8k_parse_port_config(struct
qca8k_priv *priv)
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 936 {
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 937 int port, cpu_port_index = 0,
ret;
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 938 struct device_node *port_dn;
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 939 phy_interface_t mode;
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 940 struct dsa_port *dp;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 941 u32 delay;
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 942
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 943 /* We have 2 CPU port. Check
them */
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 @944 for (port = 0; port <
QCA8K_NUM_PORTS && cpu_port_index < QCA8K_NUM_CPU_PORTS; port++) {
> >
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > Assume cpu_port_index = QCA8K_NUM_CPU_PORTS - 1;
> >
> >
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 945 /* Skip every other port
*/
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 946 if (port != 0 &&
port != 6)
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 947 continue;
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 948
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 949 dp =
dsa_to_port(priv->ds, port);
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 950 port_dn = dp->dn;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 951 cpu_port_index++;
> > ^^^^^^^^^^^^^^^^^
> > cpu_port_index is now out of bounds.
> >
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 952
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 953 if
(!of_device_is_available(port_dn))
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 954 continue;
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 955
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 956 ret =
of_get_phy_mode(port_dn, &mode);
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 957 if (ret)
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 958 continue;
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 959
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 960 switch (mode) {
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 961 case
PHY_INTERFACE_MODE_RGMII:
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 962 case
PHY_INTERFACE_MODE_RGMII_ID:
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 963 case
PHY_INTERFACE_MODE_RGMII_TXID:
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 964 case
PHY_INTERFACE_MODE_RGMII_RXID:
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 965 delay = 0;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 966
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 967 if
(!of_property_read_u32(port_dn, "tx-internal-delay-ps", &delay))
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 968 /*
Switch regs accept value in ns, convert ps to ns */
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 969 delay =
delay / 1000;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 970 else if (mode ==
PHY_INTERFACE_MODE_RGMII_ID ||
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 971 mode ==
PHY_INTERFACE_MODE_RGMII_TXID)
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 972 delay =
1;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 973
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 974 if (delay >
QCA8K_MAX_DELAY) {
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 975
dev_err(priv->dev, "rgmii tx delay is limited to a max value of 3ns, setting to
the max value");
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 976 delay =
3;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 977 }
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 978
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 979
priv->rgmii_tx_delay[cpu_port_index] = delay;
> >
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > Out of bounds
> >
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 980
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 981 delay = 0;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 982
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 983 if
(!of_property_read_u32(port_dn, "rx-internal-delay-ps", &delay))
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 984 /*
Switch regs accept value in ns, convert ps to ns */
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 985 delay =
delay / 1000;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 986 else if (mode ==
PHY_INTERFACE_MODE_RGMII_ID ||
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 987 mode ==
PHY_INTERFACE_MODE_RGMII_RXID)
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 988 delay =
2;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 989
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 990 if (delay >
QCA8K_MAX_DELAY) {
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 991
dev_err(priv->dev, "rgmii rx delay is limited to a max value of 3ns, setting to
the max value");
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 992 delay =
3;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 993 }
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 994
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 995
priv->rgmii_rx_delay[cpu_port_index] = delay;
> >
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > Out of bounds
> >
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 996
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 997 break;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 998 case
PHY_INTERFACE_MODE_SGMII:
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 999 if
(of_property_read_bool(port_dn, "qca,sgmii-txclk-falling-edge"))
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1000
priv->sgmii_tx_clk_falling_edge = true;
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1001
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1002 if
(of_property_read_bool(port_dn, "qca,sgmii-rxclk-falling-edge"))
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1003
priv->sgmii_rx_clk_falling_edge = true;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 1004
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 1005 break;
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 1006 default:
> > 5654ec78dd7e64 Ansuel Smith 2021-10-14 1007 continue;
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1008 }
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1009 }
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1010
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1011 return 0;
> > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1012 }
> >
> > ---
> > 0-DAY CI Kernel Test Service, Intel Corporation
> > https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
> >
12:30 a.m.
On Mon, Nov 15, 2021 at 07:08:30PM +0100, Ansuel Smith wrote:
> > tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
> > head: debe436e77c72fcee804fb867f275e6d31aa999c
> > commit: 5654ec78dd7e64b1e04777b24007344329e6a63b net: dsa: qca8k: rework rgmii
delay logic and scan for cpu port 6
> > config: i386-randconfig-m021-20211025 (attached as .config)
> > compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
> >
> > If you fix the issue, kindly add following tag as appropriate
> > Reported-by: kernel test robot <lkp(a)intel.com>
> > Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com>
> >
>
> This should already be fixed by 06dd34a628ae5b6a839b757e746de165d6789ca8
> Can you confirm this?
>
No, it doesn't fix the problem. The check is either useless and should
be removed or there is an out of bounds bug. Checking for an out of
bounds *after* you've already written to the memory is *never* useful.
regards,
dan carpenter
Again sorry if I insist and I'm 99% missing something.
There was an out of bounds bug.
It was fixed by 06dd34a628ae5b6a839b757e746de165d6789ca8 by
starting the counter to -1.
The extra check is useless, yes.
> > > smatch warnings:
> > > drivers/net/dsa/qca8k.c:944 qca8k_parse_port_config() error: testing array
offset 'cpu_port_index' after use.
> > >
> > > vim +/cpu_port_index +944 drivers/net/dsa/qca8k.c
> > >
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 934 static int
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 935
qca8k_parse_port_config(struct qca8k_priv *priv)
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 936 {
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 937 int port, cpu_port_index =
0, ret;
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 938 struct device_node
*port_dn;
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 939 phy_interface_t mode;
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 940 struct dsa_port *dp;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 941 u32 delay;
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 942
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 943 /* We have 2 CPU port.
Check them */
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 @944 for (port = 0; port <
QCA8K_NUM_PORTS && cpu_port_index < QCA8K_NUM_CPU_PORTS; port++) {
> > >
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > Assume cpu_port_index = QCA8K_NUM_CPU_PORTS - 1;
> > >
> > >
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 945 /* Skip every other
port */
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 946 if (port != 0
&& port != 6)
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 947 continue;
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 948
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 949 dp =
dsa_to_port(priv->ds, port);
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 950 port_dn =
dp->dn;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 951 cpu_port_index++;
> > > ^^^^^^^^^^^^^^^^^
> > > cpu_port_index is now out of bounds.
> > >
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 952
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 953 if
(!of_device_is_available(port_dn))
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 954 continue;
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 955
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 956 ret =
of_get_phy_mode(port_dn, &mode);
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 957 if (ret)
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 958 continue;
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 959
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 960 switch (mode) {
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 961 case
PHY_INTERFACE_MODE_RGMII:
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 962 case
PHY_INTERFACE_MODE_RGMII_ID:
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 963 case
PHY_INTERFACE_MODE_RGMII_TXID:
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 964 case
PHY_INTERFACE_MODE_RGMII_RXID:
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 965 delay = 0;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 966
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 967 if
(!of_property_read_u32(port_dn, "tx-internal-delay-ps", &delay))
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 968 /*
Switch regs accept value in ns, convert ps to ns */
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 969
delay = delay / 1000;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 970 else if
(mode == PHY_INTERFACE_MODE_RGMII_ID ||
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 971
mode == PHY_INTERFACE_MODE_RGMII_TXID)
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 972
delay = 1;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 973
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 974 if (delay
> QCA8K_MAX_DELAY) {
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 975
dev_err(priv->dev, "rgmii tx delay is limited to a max value of 3ns, setting to
the max value");
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 976
delay = 3;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 977 }
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 978
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 979
priv->rgmii_tx_delay[cpu_port_index] = delay;
> > >
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > Out of bounds
> > >
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 980
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 981 delay = 0;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 982
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 983 if
(!of_property_read_u32(port_dn, "rx-internal-delay-ps", &delay))
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 984 /*
Switch regs accept value in ns, convert ps to ns */
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 985
delay = delay / 1000;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 986 else if
(mode == PHY_INTERFACE_MODE_RGMII_ID ||
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 987
mode == PHY_INTERFACE_MODE_RGMII_RXID)
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 988
delay = 2;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 989
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 990 if (delay
> QCA8K_MAX_DELAY) {
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 991
dev_err(priv->dev, "rgmii rx delay is limited to a max value of 3ns, setting to
the max value");
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 992
delay = 3;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 993 }
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 994
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 995
priv->rgmii_rx_delay[cpu_port_index] = delay;
> > >
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > Out of bounds
> > >
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 996
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 997 break;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 998 case
PHY_INTERFACE_MODE_SGMII:
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 999 if
(of_property_read_bool(port_dn, "qca,sgmii-txclk-falling-edge"))
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1000
priv->sgmii_tx_clk_falling_edge = true;
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1001
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1002 if
(of_property_read_bool(port_dn, "qca,sgmii-rxclk-falling-edge"))
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1003
priv->sgmii_rx_clk_falling_edge = true;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 1004
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 1005 break;
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 1006 default:
> > > 5654ec78dd7e64 Ansuel Smith 2021-10-14 1007 continue;
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1008 }
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1009 }
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1010
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1011 return 0;
> > > 6c43809bf1bee7 Ansuel Smith 2021-10-14 1012 }
> > >
> > > ---
> > > 0-DAY CI Kernel Test Service, Intel Corporation
> > > https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
> > >
12:37 a.m.
On Tue, Nov 16, 2021 at 02:30:59PM +0100, Ansuel Smith wrote:
> On Mon, Nov 15, 2021 at 07:08:30PM +0100, Ansuel Smith wrote:
> > > tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
> > > head: debe436e77c72fcee804fb867f275e6d31aa999c
> > > commit: 5654ec78dd7e64b1e04777b24007344329e6a63b net: dsa: qca8k: rework
rgmii delay logic and scan for cpu port 6
> > > config: i386-randconfig-m021-20211025 (attached as .config)
> > > compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
> > >
> > > If you fix the issue, kindly add following tag as appropriate
> > > Reported-by: kernel test robot <lkp(a)intel.com>
> > > Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com>
> > >
> >
> > This should already be fixed by 06dd34a628ae5b6a839b757e746de165d6789ca8
> > Can you confirm this?
> >
>
> No, it doesn't fix the problem. The check is either useless and should
> be removed or there is an out of bounds bug. Checking for an out of
> bounds *after* you've already written to the memory is *never* useful.
>
> regards,
> dan carpenter
>
Again sorry if I insist and I'm 99% missing something.
There was an out of bounds bug.
It was fixed by 06dd34a628ae5b6a839b757e746de165d6789ca8 by
starting the counter to -1.
The extra check is useless, yes.
Then just delete it. We don't want code which is illogical even if it
has no effect on run time.
regards,
dan carpenter
12:40 a.m.
On Tue, Nov 16, 2021 at 02:30:59PM +0100, Ansuel Smith wrote:
> > On Mon, Nov 15, 2021 at 07:08:30PM +0100, Ansuel Smith wrote:
> > > > tree:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> > > > head: debe436e77c72fcee804fb867f275e6d31aa999c
> > > > commit: 5654ec78dd7e64b1e04777b24007344329e6a63b net: dsa: qca8k:
rework rgmii delay logic and scan for cpu port 6
> > > > config: i386-randconfig-m021-20211025 (attached as .config)
> > > > compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
> > > >
> > > > If you fix the issue, kindly add following tag as appropriate
> > > > Reported-by: kernel test robot <lkp(a)intel.com>
> > > > Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com>
> > > >
> > >
> > > This should already be fixed by 06dd34a628ae5b6a839b757e746de165d6789ca8
> > > Can you confirm this?
> > >
> >
> > No, it doesn't fix the problem. The check is either useless and should
> > be removed or there is an out of bounds bug. Checking for an out of
> > bounds *after* you've already written to the memory is *never* useful.
> >
> > regards,
> > dan carpenter
> >
>
> Again sorry if I insist and I'm 99% missing something.
> There was an out of bounds bug.
> It was fixed by 06dd34a628ae5b6a839b757e746de165d6789ca8 by
> starting the counter to -1.
> The extra check is useless, yes.
Then just delete it. We don't want code which is illogical even if it
has no effect on run time.
regards,
dan carpenter
Ok, will include this in the next series with your reported-by tag.
309
days inactive
310
days old
5 comments
2 participants
participants (2)
-
Ansuel Smith -
Dan Carpenter