From a75c8a4b883108edf19127fca3e6c6c590f9ba8c Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Wed, 6 Aug 2025 17:43:24 +0100 Subject: phy: marvell: Fix off by 1 limit checks The limit checks in get_speed_string and get_type_string are off by 1 as they do not account for the maximum index into an array that can be used is 1 less than the number of elements in that array. Adjust the limit checks to allow for this. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Reviewed-by: Stefan Roese --- drivers/phy/marvell/comphy_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/phy') diff --git a/drivers/phy/marvell/comphy_core.c b/drivers/phy/marvell/comphy_core.c index a666a4e794e..a4121423873 100644 --- a/drivers/phy/marvell/comphy_core.c +++ b/drivers/phy/marvell/comphy_core.c @@ -28,7 +28,7 @@ static const char *get_speed_string(u32 speed) "10.3125 Gbps" }; - if (speed < 0 || speed > COMPHY_SPEED_MAX) + if (speed < 0 || speed >= COMPHY_SPEED_MAX) return "invalid"; return speed_strings[speed]; @@ -44,7 +44,7 @@ static const char *get_type_string(u32 type) "IGNORE" }; - if (type < 0 || type > COMPHY_TYPE_MAX) + if (type < 0 || type >= COMPHY_TYPE_MAX) return "invalid"; return type_strings[type]; -- cgit v1.2.3 From 2e9155cb9f366a6b9191af0850efad1948b4c785 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Wed, 6 Aug 2025 17:43:25 +0100 Subject: phy: marvell: Cannot test unsigned field to be negative In comphy_cp110_init_serdes_map in comphy_cp110.c there are two fields in cfg, comphy_lanes_count and comphy_mux_bitcount, which are fetched from the FDT blob with fdtdec_get_int which returns an int. These two fields are then tested for being negative. However the fields are declared as unsigned so those tests must always fail. Change the declaration of those fields to be int instead of u32 and the code will work as expected. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Reviewed-by: Stefan Roese --- drivers/phy/marvell/comphy_core.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/phy') diff --git a/drivers/phy/marvell/comphy_core.h b/drivers/phy/marvell/comphy_core.h index f3d04939387..086a4d82f26 100644 --- a/drivers/phy/marvell/comphy_core.h +++ b/drivers/phy/marvell/comphy_core.h @@ -47,8 +47,8 @@ struct chip_serdes_phy_config { int (*rx_training)(struct chip_serdes_phy_config *, u32); void __iomem *comphy_base_addr; void __iomem *hpipe3_base_addr; - u32 comphy_lanes_count; - u32 comphy_mux_bitcount; + int comphy_lanes_count; + int comphy_mux_bitcount; const fdt32_t *comphy_mux_lane_order; u32 cp_index; struct comphy_map comphy_map_data[MAX_LANE_OPTIONS]; -- cgit v1.2.3 From 783ea37c7b52ae088e8c64581fbe412b5dc9a878 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 18 Aug 2025 11:44:28 +0100 Subject: phy: cadence: sierra: Remove variable that is not assigned to In cdns_sierra_pll_bind_of_clocks the variable 'i' is declared but never assigned to before its value is used in a dev_err. Replace clk_names[i] by the name passed to device_bind(), i.e., "pll_mux_clk". With that, the clk_names[] array is unused and can therefore be removed. This issue was found by Smatch. Signed-off-by: Andrew Goodbody [jf: update description] Signed-off-by: Jerome Forissier --- drivers/phy/cadence/phy-cadence-sierra.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) (limited to 'drivers/phy') diff --git a/drivers/phy/cadence/phy-cadence-sierra.c b/drivers/phy/cadence/phy-cadence-sierra.c index 2c9d5a12127..bd7ab9d1b77 100644 --- a/drivers/phy/cadence/phy-cadence-sierra.c +++ b/drivers/phy/cadence/phy-cadence-sierra.c @@ -225,11 +225,6 @@ static const struct reg_field pllctrl_lock = static const struct reg_field phy_iso_link_ctrl_1 = REG_FIELD(SIERRA_PHY_ISO_LINK_CTRL, 1, 1); -static const char * const clk_names[] = { - [CDNS_SIERRA_PLL_CMNLC] = "pll_cmnlc", - [CDNS_SIERRA_PLL_CMNLC1] = "pll_cmnlc1", -}; - enum cdns_sierra_cmn_plllc { CMN_PLLLC, CMN_PLLLC1, @@ -602,7 +597,7 @@ static int cdns_sierra_pll_bind_of_clocks(struct cdns_sierra_phy *sp) struct udevice *dev = sp->dev; struct driver *cdns_sierra_clk_drv; struct cdns_sierra_pll_mux_sel *data = pll_clk_mux_sel; - int i, rc; + int rc; cdns_sierra_clk_drv = lists_driver_lookup_name("cdns_sierra_mux_clk"); if (!cdns_sierra_clk_drv) { @@ -612,10 +607,8 @@ static int cdns_sierra_pll_bind_of_clocks(struct cdns_sierra_phy *sp) rc = device_bind(dev, cdns_sierra_clk_drv, "pll_mux_clk", data, dev_ofnode(dev), NULL); - if (rc) { - dev_err(dev, "cannot bind driver for clock %s\n", - clk_names[i]); - } + if (rc) + dev_err(dev, "cannot bind driver for clock pll_mux_clk\n"); return 0; } -- cgit v1.2.3 From c4526c390a3c4ea1c4f244b6436ebbb74902769a Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 18 Aug 2025 11:44:29 +0100 Subject: phy: cadence: torrent: Set an error code for return In cdns_torrent_phy_probe the test for too many lanes configured does not set an error code before taking the error path. This could lead to a silent failure if the calling code does not detect the error. Add the code to return -EINVAL in this case. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/phy/cadence/phy-cadence-torrent.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/phy') diff --git a/drivers/phy/cadence/phy-cadence-torrent.c b/drivers/phy/cadence/phy-cadence-torrent.c index 1f566d082f9..28fe026223c 100644 --- a/drivers/phy/cadence/phy-cadence-torrent.c +++ b/drivers/phy/cadence/phy-cadence-torrent.c @@ -719,6 +719,7 @@ static int cdns_torrent_phy_probe(struct udevice *dev) if (total_num_lanes > MAX_NUM_LANES) { dev_err(dev, "Invalid lane configuration\n"); + ret = -EINVAL; goto put_lnk_rst; } -- cgit v1.2.3