Hello Kalle Valo, The patch bdcd81707973: "Add ath6kl cleaned up driver" from Jul 18, 2011, leads to the following static checker warning: "drivers/net/wireless/ath/ath6kl/txrx.c:1327 ath6kl_rx() warn: what are we testing here?" [ This is from a failed experiment with Smatch that I won't release. ] 1301 void ath6kl_rx(struct htc_target *target, struct htc_packet *packet) 1302 { 1303 struct ath6kl *ar = target->dev->ar; 1304 struct sk_buff *skb = packet->pkt_cntxt; 1305 struct wmi_rx_meta_v2 *meta; 1306 struct wmi_data_hdr *dhdr; 1307 int min_hdr_len; 1308 u8 meta_type, dot11_hdr = 0; 1309 u8 pad_before_data_start; 1310 int status = packet->status; 1311 enum htc_endpoint_id ept = packet->endpoint; 1312 bool is_amsdu, prev_ps, ps_state = false; 1313 bool trig_state = false; 1314 struct ath6kl_sta *conn = NULL; 1315 struct sk_buff *skb1 = NULL; 1316 struct ethhdr *datap = NULL; 1317 struct ath6kl_vif *vif; 1318 struct aggr_info_conn *aggr_conn; 1319 u16 seq_no, offset; 1320 u8 tid, if_idx; 1321 1322 ath6kl_dbg(ATH6KL_DBG_WLAN_RX, 1323 "%s: ar=0x%p eid=%d, skb=0x%p, data=0x%p, len=0x%x status:%d", 1324 __func__, ar, ept, skb, packet->buf, 1325 packet->act_len, status); 1326 1327 if (status || !(skb->data + HTC_HDR_LENGTH)) { ^^^^^^^^^^^^^^^^^^^^^^^^^^ skb->data is a pointer. This pointer math is always going to be false. Should it be testing "packet->act_len < HTC_HDR_LENGTH" or something? 1328 dev_kfree_skb(skb); 1329 return; 1330 } 1331 1332 skb_put(skb, packet->act_len + HTC_HDR_LENGTH); regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html