[bug report] wifi: mt76: mt7996: get tx_retries and tx_failed from txfree

[Dan Carpenter]

Hello Yi-Chia Hsieh,

The patch 2461599f835e: "wifi: mt76: mt7996: get tx_retries and
tx_failed from txfree" from Sep 21, 2023 (linux-next), leads to the
following Smatch static checker warning:

	drivers/net/wireless/mediatek/mt76/mt7996/mac.c:1130 mt7996_mac_tx_free()
	error: uninitialized symbol 'wcid'.

drivers/net/wireless/mediatek/mt76/mt7996/mac.c
    1068 static void
    1069 mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
    1070 {
    1071         __le32 *tx_free = (__le32 *)data, *cur_info;
    1072         struct mt76_dev *mdev = &dev->mt76;
    1073         struct mt76_phy *phy2 = mdev->phys[MT_BAND1];
    1074         struct mt76_phy *phy3 = mdev->phys[MT_BAND2];
    1075         struct mt76_txwi_cache *txwi;
    1076         struct ieee80211_sta *sta = NULL;
    1077         struct mt76_wcid *wcid;
    1078         LIST_HEAD(free_list);
    1079         struct sk_buff *skb, *tmp;
    1080         void *end = data + len;
    1081         bool wake = false;
    1082         u16 total, count = 0;
    1083 
    1084         /* clean DMA queues and unmap buffers first */
    1085         mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_PSD], false);
    1086         mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_BE], false);
    1087         if (phy2) {
    1088                 mt76_queue_tx_cleanup(dev, phy2->q_tx[MT_TXQ_PSD], false);
    1089                 mt76_queue_tx_cleanup(dev, phy2->q_tx[MT_TXQ_BE], false);
    1090         }
    1091         if (phy3) {
    1092                 mt76_queue_tx_cleanup(dev, phy3->q_tx[MT_TXQ_PSD], false);
    1093                 mt76_queue_tx_cleanup(dev, phy3->q_tx[MT_TXQ_BE], false);
    1094         }
    1095 
    1096         if (WARN_ON_ONCE(le32_get_bits(tx_free[1], MT_TXFREE1_VER) < 5))
    1097                 return;
    1098 
    1099         total = le32_get_bits(tx_free[0], MT_TXFREE0_MSDU_CNT);
    1100         for (cur_info = &tx_free[2]; count < total; cur_info++) {
    1101                 u32 msdu, info;
    1102                 u8 i;
    1103 
    1104                 if (WARN_ON_ONCE((void *)cur_info >= end))
    1105                         return;
    1106                 /* 1'b1: new wcid pair.
    1107                  * 1'b0: msdu_id with the same 'wcid pair' as above.
    1108                  */
    1109                 info = le32_to_cpu(*cur_info);
    1110                 if (info & MT_TXFREE_INFO_PAIR) {
    1111                         struct mt7996_sta *msta;
    1112                         u16 idx;
    1113 
    1114                         idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
    1115                         wcid = rcu_dereference(dev->mt76.wcid[idx]);

Initialized here

    1116                         sta = wcid_to_sta(wcid);
    1117                         if (!sta)
    1118                                 continue;
    1119 
    1120                         msta = container_of(wcid, struct mt7996_sta, wcid);
    1121                         spin_lock_bh(&mdev->sta_poll_lock);
    1122                         if (list_empty(&msta->wcid.poll_list))
    1123                                 list_add_tail(&msta->wcid.poll_list,
    1124                                               &mdev->sta_poll_list);
    1125                         spin_unlock_bh(&mdev->sta_poll_lock);
    1126                         continue;
    1127                 } else if (info & MT_TXFREE_INFO_HEADER) {
    1128                         u32 tx_retries = 0, tx_failed = 0;
    1129 
--> 1130                         if (!wcid)

Uninitialized on first iteration

    1131                                 continue;
    1132 
    1133                         tx_retries =
    1134                                 FIELD_GET(MT_TXFREE_INFO_COUNT, info) - 1;
    1135                         tx_failed = tx_retries +
    1136                                 !!FIELD_GET(MT_TXFREE_INFO_STAT, info);
    1137 
    1138                         wcid->stats.tx_retries += tx_retries;
    1139                         wcid->stats.tx_failed += tx_failed;
    1140                         continue;
    1141                 }
    1142 
    1143                 for (i = 0; i < 2; i++) {
    1144                         msdu = (info >> (15 * i)) & MT_TXFREE_INFO_MSDU_ID;
    1145                         if (msdu == MT_TXFREE_INFO_MSDU_ID)
    1146                                 continue;
    1147 
    1148                         count++;
    1149                         txwi = mt76_token_release(mdev, msdu, &wake);
    1150                         if (!txwi)
    1151                                 continue;
    1152 
    1153                         mt7996_txwi_free(dev, txwi, sta, &free_list);
    1154                 }
    1155         }
    1156 
    1157         mt7996_mac_sta_poll(dev);
    1158 
    1159         if (wake)
    1160                 mt76_set_tx_blocked(&dev->mt76, false);
    1161 
    1162         mt76_worker_schedule(&dev->mt76.tx_worker);
    1163 
    1164         list_for_each_entry_safe(skb, tmp, &free_list, list) {
    1165                 skb_list_del_init(skb);
    1166                 napi_consume_skb(skb, 1);
    1167         }
    1168 }

regards,
dan carpenter