Hello Ayala Barazani, The patch 97f8a3d1610b: "iwlwifi: ACPI: support revision 3 WGDS tables" from Oct 24, 2021, leads to the following Smatch static checker warning: drivers/net/wireless/intel/iwlwifi/fw/acpi.c:801 iwl_sar_get_wgds_table() warn: duplicate check 'idx < (12 / 4 + (0))' (previous on line 749) drivers/net/wireless/intel/iwlwifi/fw/acpi.c 743 744 data = iwl_acpi_get_object(fwrt->dev, ACPI_WGDS_METHOD); 745 if (IS_ERR(data)) 746 return PTR_ERR(data); 747 748 /* read the highest revision we understand first */ 749 for (idx = 0; idx < ARRAY_SIZE(rev_data); idx++) { 750 /* min_profiles != 0 requires num_profiles header */ 751 u32 hdr_size = 1 + !!rev_data[idx].min_profiles; 752 u32 profile_size = ACPI_GEO_PER_CHAIN_SIZE * 753 rev_data[idx].bands; 754 u32 max_size = hdr_size + profile_size * rev_data[idx].profiles; 755 u32 min_size; 756 757 if (!rev_data[idx].min_profiles) 758 min_size = max_size; 759 else 760 min_size = hdr_size + 761 profile_size * rev_data[idx].min_profiles; 762 763 wifi_pkg = iwl_acpi_get_wifi_pkg_range(fwrt->dev, data, 764 min_size, max_size, 765 &tbl_rev); 766 if (!IS_ERR(wifi_pkg)) { Should this break on error instead of a continue? 767 if (!(BIT(tbl_rev) & rev_data[idx].revisions)) 768 continue; 769 770 num_bands = rev_data[idx].bands; 771 num_profiles = rev_data[idx].profiles; 772 773 if (rev_data[idx].min_profiles) { 774 /* read header that says # of profiles */ 775 union acpi_object *entry; 776 777 entry = &wifi_pkg->package.elements[entry_idx]; 778 entry_idx++; 779 if (entry->type != ACPI_TYPE_INTEGER || 780 entry->integer.value > num_profiles) { 781 ret = -EINVAL; 782 goto out_free; 783 } 784 num_profiles = entry->integer.value; 785 786 /* 787 * this also validates >= min_profiles since we 788 * otherwise wouldn't have gotten the data when 789 * looking up in ACPI 790 */ 791 if (wifi_pkg->package.count != 792 min_size + profile_size * num_profiles) { 793 ret = -EINVAL; 794 goto out_free; 795 } 796 } 797 goto read_table; 798 } 799 } 800 801 if (idx < ARRAY_SIZE(rev_data)) ^^^^^^^^^^^^^^^^^^^^^^^^^^ idx is always == ARRAY_SIZE() at this point. 802 ret = PTR_ERR(wifi_pkg); 803 else 804 ret = -ENOENT; 805 goto out_free; 806 807 read_table: 808 fwrt->geo_rev = tbl_rev; 809 for (i = 0; i < num_profiles; i++) { 810 for (j = 0; j < ACPI_GEO_NUM_BANDS_REV2; j++) { regards, dan carpenter