Re: [bug report] phy: qcom: qmp-usbc: Add QCS615 USB/DP PHY config and DP mode support

[Konrad Dybcio]

On 2/6/26 2:39 PM, Dan Carpenter wrote:
> [ Smatch checking is paused while we raise funding.  #SadFace
>   https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]
> 
> Hello Xiangxu Yin,
> 
> Commit 81791c45c8e0 ("phy: qcom: qmp-usbc: Add QCS615 USB/DP PHY
> config and DP mode support") from Dec 15, 2025 (linux-next), leads to
> the following Smatch static checker warning:
> 
> 	drivers/phy/qualcomm/phy-qcom-qmp-usbc.c:803 qmp_v2_configure_dp_swing()
> 	index hardmax out of bounds '(*cfg->swing_tbl)[v_level]' size=4 max='4' rl='0-4'
> 
> drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
>     777 static int qmp_v2_configure_dp_swing(struct qmp_usbc *qmp)
>     778 {
>     779         const struct qmp_phy_cfg *cfg = qmp->cfg;
>     780         const struct phy_configure_opts_dp *dp_opts = &qmp->dp_opts;
>     781         void __iomem *tx = qmp->dp_tx;
>     782         void __iomem *tx2 = qmp->dp_tx2;
>     783         unsigned int v_level = 0, p_level = 0;
>     784         u8 voltage_swing_cfg, pre_emphasis_cfg;
>     785         int i;
>     786 
>     787         if (dp_opts->lanes > 4) {
>     788                 dev_err(qmp->dev, "Invalid lane_num(%d)\n", dp_opts->lanes);
>     789                 return -EINVAL;
>     790         }
>     791 
>     792         for (i = 0; i < dp_opts->lanes; i++) {
>     793                 v_level = max(v_level, dp_opts->voltage[i]);
>     794                 p_level = max(p_level, dp_opts->pre[i]);
>     795         }
>     796 
>     797         if (v_level > 4 || p_level > 4) {
> 
> These should be >= 4 instead of >.
> 
>     798                 dev_err(qmp->dev, "Invalid v(%d) | p(%d) level)\n",
>     799                         v_level, p_level);
>     800                 return -EINVAL;
>     801         }
>     802 
> --> 803         voltage_swing_cfg = (*cfg->swing_tbl)[v_level][p_level];
>                                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> This is a 4x4 array.

Thanks Dan for the report

Xiangxu, are you planning to send a patch to address that?

Konrad