Re: [PATCH 10/14] dmaengine: dma350: Alloc command[] from dma pool
From: Dan Carpenter
Date: Mon Sep 01 2025 - 06:27:18 EST
Hi Jisheng,
kernel test robot noticed the following build warnings:
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Jisheng-Zhang/dmaengine-dma350-Fix-CH_CTRL_USESRCTRIGIN-definition/20250824-000425
base: https://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine.git next
patch link: https://lore.kernel.org/r/20250823154009.25992-11-jszhang%40kernel.org
patch subject: [PATCH 10/14] dmaengine: dma350: Alloc command[] from dma pool
config: arm-randconfig-r073-20250829 (https://download.01.org/0day-ci/archive/20250829/202508291556.kjNumYgR-lkp@xxxxxxxxx/config)
compiler: arm-linux-gnueabi-gcc (GCC) 13.4.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
| Closes: https://lore.kernel.org/r/202508291556.kjNumYgR-lkp@xxxxxxxxx/
smatch warnings:
drivers/dma/arm-dma350.c:387 d350_get_residue() error: uninitialized symbol 'sgcur'.
vim +/sgcur +387 drivers/dma/arm-dma350.c
5d099706449d54 Robin Murphy 2025-03-12 360 static u32 d350_get_residue(struct d350_chan *dch)
5d099706449d54 Robin Murphy 2025-03-12 361 {
eae79fde2ff50c Jisheng Zhang 2025-08-23 362 u32 res, xsize, xsizehi, linkaddr, linkaddrhi, hi_new;
eae79fde2ff50c Jisheng Zhang 2025-08-23 363 int i, sgcur, retries = 3; /* 1st time unlucky, 2nd improbable, 3rd just broken */
eae79fde2ff50c Jisheng Zhang 2025-08-23 364 struct d350_desc *desc = dch->desc;
5d099706449d54 Robin Murphy 2025-03-12 365
5d099706449d54 Robin Murphy 2025-03-12 366 hi_new = readl_relaxed(dch->base + CH_XSIZEHI);
5d099706449d54 Robin Murphy 2025-03-12 367 do {
5d099706449d54 Robin Murphy 2025-03-12 368 xsizehi = hi_new;
5d099706449d54 Robin Murphy 2025-03-12 369 xsize = readl_relaxed(dch->base + CH_XSIZE);
5d099706449d54 Robin Murphy 2025-03-12 370 hi_new = readl_relaxed(dch->base + CH_XSIZEHI);
5d099706449d54 Robin Murphy 2025-03-12 371 } while (xsizehi != hi_new && --retries);
5d099706449d54 Robin Murphy 2025-03-12 372
eae79fde2ff50c Jisheng Zhang 2025-08-23 373 hi_new = readl_relaxed(dch->base + CH_LINKADDRHI);
eae79fde2ff50c Jisheng Zhang 2025-08-23 374 do {
eae79fde2ff50c Jisheng Zhang 2025-08-23 375 linkaddrhi = hi_new;
eae79fde2ff50c Jisheng Zhang 2025-08-23 376 linkaddr = readl_relaxed(dch->base + CH_LINKADDR);
eae79fde2ff50c Jisheng Zhang 2025-08-23 377 hi_new = readl_relaxed(dch->base + CH_LINKADDRHI);
eae79fde2ff50c Jisheng Zhang 2025-08-23 378 } while (linkaddrhi != hi_new && --retries);
eae79fde2ff50c Jisheng Zhang 2025-08-23 379
eae79fde2ff50c Jisheng Zhang 2025-08-23 380 for (i = 0; i < desc->sglen; i++) {
eae79fde2ff50c Jisheng Zhang 2025-08-23 381 if (desc->sg[i].phys == (((u64)linkaddrhi << 32) | (linkaddr & ~CH_LINKADDR_EN)))
eae79fde2ff50c Jisheng Zhang 2025-08-23 382 sgcur = i;
I'm suprised there isn't a break statement after this assignment.
What if we exit the loop with i == desc->sglen?
eae79fde2ff50c Jisheng Zhang 2025-08-23 383 }
eae79fde2ff50c Jisheng Zhang 2025-08-23 384
5d099706449d54 Robin Murphy 2025-03-12 385 res = FIELD_GET(CH_XY_DES, xsize);
5d099706449d54 Robin Murphy 2025-03-12 386 res |= FIELD_GET(CH_XY_DES, xsizehi) << 16;
eae79fde2ff50c Jisheng Zhang 2025-08-23 @387 res <<= desc->sg[sgcur].tsz;
^^^^^
Uninitialized.
eae79fde2ff50c Jisheng Zhang 2025-08-23 388
eae79fde2ff50c Jisheng Zhang 2025-08-23 389 for (i = sgcur + 1; i < desc->sglen; i++)
eae79fde2ff50c Jisheng Zhang 2025-08-23 390 res += (((u32)desc->sg[i].xsizehi << 16 | desc->sg[i].xsize) << desc->sg[i].tsz);
5d099706449d54 Robin Murphy 2025-03-12 391
eae79fde2ff50c Jisheng Zhang 2025-08-23 392 return res;
5d099706449d54 Robin Murphy 2025-03-12 393 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki