From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8E1C8C433EF for ; Mon, 1 Nov 2021 20:06:28 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 6A15260E9C for ; Mon, 1 Nov 2021 20:06:27 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 6A15260E9C Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id C611983383; Mon, 1 Nov 2021 21:06:24 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=konsulko.com header.i=@konsulko.com header.b="eEjePYFm"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 377BF8351F; Mon, 1 Nov 2021 21:06:23 +0100 (CET) Received: from mail-qt1-x835.google.com (mail-qt1-x835.google.com [IPv6:2607:f8b0:4864:20::835]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 320518329E for ; Mon, 1 Nov 2021 21:06:18 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=trini@konsulko.com Received: by mail-qt1-x835.google.com with SMTP id h14so16177737qtb.3 for ; Mon, 01 Nov 2021 13:06:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; h=date:from:to:subject:message-id:mime-version:content-disposition; bh=vZJMOpN7jUhwmXuhgAnizHwRTYfI5FI/H4Us7L7KmIk=; b=eEjePYFmoVqYqoHUc9+ArEAKKb3Ho6lYqGuVSiYZt9nz2yTHxobOoSXOcWezASDrTg xOB2YInRNaefy2CJGNA5wVOEAcv599BL2GM2yecFOUAVPC3+yO0qWH35fakuAWRsoGxe rB0+2edzBcMvrrzNsQ/hqNRLEy+jViRTFBLA0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition; bh=vZJMOpN7jUhwmXuhgAnizHwRTYfI5FI/H4Us7L7KmIk=; b=ysZb4mcS+ai+Ic7szpdFgwvGzAC9CYnGsLDsJTk+HMwrx76DGr/5AAhDzrZzx9TMrz Z6/HafyYFUM4ZFDp0m+5OB/uRG272KUI+Kh966kRPdT5otd/Te6HAEKp+9aeVwIOQMAr kqBH6Zxu1lFRgelxYWo3wgZy0cQoQw6BfGnhZqasQ4fDqmpzaAj4RXap4NYGwWLC4z+4 z6QpgWMo1JxyFJIRQKogOgdQHD3yoyjZ/9sHYlBUP1aLMLCY1Hg3jHEgwpTHNKzjxdJX j6X43lDmMFWwA9P1RKer9bxu1qdMnrv47VrPIkGzV1cWovniVxRtPt74gENAvChaMrz/ s3MQ== X-Gm-Message-State: AOAM531vMcPvw3WU8sR6+wnOGhdboFPS2290mT1clCKtl3887+pLGc82 HZ+fFfzTsGhp1ZU+zIk4IPOks7lm0F1TLw== X-Google-Smtp-Source: ABdhPJzo5C6twkVIbdy6cMEgwTOOAZyhtap9ZYQH+aYzH+YnvkURlT0Ep1rjFTyOwonhWhanIm2SIg== X-Received: by 2002:a05:622a:282:: with SMTP id z2mr3806803qtw.131.1635797176647; Mon, 01 Nov 2021 13:06:16 -0700 (PDT) Received: from bill-the-cat (2603-6081-7b01-cbda-7d10-4e93-4359-630d.res6.spectrum.com. [2603:6081:7b01:cbda:7d10:4e93:4359:630d]) by smtp.gmail.com with ESMTPSA id v20sm11072082qtp.44.2021.11.01.13.06.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Nov 2021 13:06:15 -0700 (PDT) Date: Mon, 1 Nov 2021 16:06:14 -0400 From: Tom Rini To: u-boot@lists.denx.de Subject: [scan-admin@coverity.com: New Defects reported by Coverity Scan for Das U-Boot] Message-ID: <20211101200614.GM24579@bill-the-cat> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="CBkz1G+j/QuiWKyF" Content-Disposition: inline X-Clacks-Overhead: GNU Terry Pratchett X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean --CBkz1G+j/QuiWKyF Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Here's the list of new defects from v2022.01-rc1 ----- Forwarded message from scan-admin@coverity.com ----- Date: Mon, 01 Nov 2021 19:29:37 +0000 (UTC) =46rom: scan-admin@coverity.com To: tom.rini@gmail.com Subject: New Defects reported by Coverity Scan for Das U-Boot Hi, Please find the latest report on new defect(s) introduced to Das U-Boot fou= nd with Coverity Scan. 10 new defect(s) introduced to Das U-Boot found with Coverity Scan. 10 defect(s), reported by Coverity Scan earlier, were marked fixed in the r= ecent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 10 of 10 defect(s) ** CID 340850: Control flow issues (UNREACHABLE) /test/lib/abuf.c: 81 in lib_test_abuf_realloc() ___________________________________________________________________________= _____________________________ *** CID 340850: Control flow issues (UNREACHABLE) /test/lib/abuf.c: 81 in lib_test_abuf_realloc() 75 /* 76 * TODO: crashes on sandbox sometimes due to an apparent bug in 77 * realloc(). 78 */ 79 return 0; 80 =20 >>> CID 340850: Control flow issues (UNREACHABLE) >>> This code cannot be reached: "start =3D ut_check_free();". 81 start =3D ut_check_free(); 82 =20 83 abuf_init(&buf); 84 =20 85 /* Allocate an empty buffer */ 86 ut_asserteq(true, abuf_realloc(&buf, 0)); ** CID 340849: Uninitialized variables (UNINIT) /lib/efi_loader/efi_boottime.c: 1991 in efi_load_image_from_path() ___________________________________________________________________________= _____________________________ *** CID 340849: Uninitialized variables (UNINIT) /lib/efi_loader/efi_boottime.c: 1991 in efi_load_image_from_path() 1985 &buffer_size, (void *)(uintptr_t)addr)); 1986 if (ret !=3D EFI_SUCCESS) 1987 efi_free_pages(addr, pages); 1988 out: 1989 EFI_CALL(efi_close_protocol(device, guid, efi_root, NULL)); 1990 if (ret =3D=3D EFI_SUCCESS) { >>> CID 340849: Uninitialized variables (UNINIT) >>> Using uninitialized value "addr". 1991 *buffer =3D (void *)(uintptr_t)addr; 1992 *size =3D buffer_size; 1993 } 1994 =20 1995 return ret; 1996 } ** CID 340848: Control flow issues (DEADCODE) /lib/rsa/rsa-sign.c: 255 in rsa_engine_get_priv_key() ___________________________________________________________________________= _____________________________ *** CID 340848: Control flow issues (DEADCODE) /lib/rsa/rsa-sign.c: 255 in rsa_engine_get_priv_key() 249 } else if (engine_id) { 250 if (keydir && name) 251 snprintf(key_id, sizeof(key_id), 252 "%s%s", 253 keydir, name); 254 else if (name) >>> CID 340848: Control flow issues (DEADCODE) >>> Execution cannot reach the expression """" inside this statement: "= snprintf(key_id, 1024UL, "%...". 255 snprintf(key_id, sizeof(key_id), 256 "%s", 257 name ? name : ""); 258 else if (keyfile) 259 snprintf(key_id, sizeof(key_id), "%s", keyfile); 260 else ** CID 340847: (TAINTED_SCALAR) ___________________________________________________________________________= _____________________________ *** CID 340847: (TAINTED_SCALAR) /lib/zstd/zstd.c: 49 in zstd_decompress() 43 out_buf.pos =3D 0; 44 out_buf.size =3D abuf_size(out); 45 =20 46 while (1) { 47 size_t res; 48 =20 >>> CID 340847: (TAINTED_SCALAR) >>> Passing tainted variable "dstream->inBuff" to a tainted sink. 49 res =3D ZSTD_decompressStream(dstream, &out_buf, &in_buf); 50 if (ZSTD_isError(res)) { 51 ret =3D ZSTD_getErrorCode(res); 52 log_err("ZSTD_decompressStream error %d\n", ret); 53 goto do_free; 54 } /lib/zstd/zstd.c: 49 in zstd_decompress() 43 out_buf.pos =3D 0; 44 out_buf.size =3D abuf_size(out); 45 =20 46 while (1) { 47 size_t res; 48 =20 >>> CID 340847: (TAINTED_SCALAR) >>> Passing tainted variable "in_buf.src" to a tainted sink. 49 res =3D ZSTD_decompressStream(dstream, &out_buf, &in_buf); 50 if (ZSTD_isError(res)) { 51 ret =3D ZSTD_getErrorCode(res); 52 log_err("ZSTD_decompressStream error %d\n", ret); 53 goto do_free; 54 } ** CID 340846: Control flow issues (UNREACHABLE) /test/lib/abuf.c: 144 in lib_test_abuf_large() ___________________________________________________________________________= _____________________________ *** CID 340846: Control flow issues (UNREACHABLE) /test/lib/abuf.c: 144 in lib_test_abuf_large() 138 /* 139 * This crashes at present due to trying to allocate more memory t= han 140 * available, which breaks something on sandbox. 141 */ 142 return 0; 143 =20 >>> CID 340846: Control flow issues (UNREACHABLE) >>> This code cannot be reached: "start =3D ut_check_free();". 144 start =3D ut_check_free(); 145 =20 146 /* Try an impossible size */ 147 abuf_init(&buf); 148 ut_asserteq(false, abuf_realloc(&buf, CONFIG_SYS_MALLOC_LEN)); 149 ut_assertnull(buf.data); ** CID 340845: Control flow issues (UNREACHABLE) /test/lib/abuf.c: 211 in lib_test_abuf_uninit_move() ___________________________________________________________________________= _____________________________ *** CID 340845: Control flow issues (UNREACHABLE) /test/lib/abuf.c: 211 in lib_test_abuf_uninit_move() 205 * TODO: crashes on sandbox sometimes due to an apparent bug in 206 * realloc(). 207 */ 208 return 0; 209 =20 210 /* Move an empty buffer */ >>> CID 340845: Control flow issues (UNREACHABLE) >>> This code cannot be reached: "abuf_init(&buf);". 211 abuf_init(&buf); 212 ut_assertnull(abuf_uninit_move(&buf, &size)); 213 ut_asserteq(0, size); 214 ut_assertnull(abuf_uninit_move(&buf, NULL)); 215 =20 216 /* Move an unallocated buffer */ ** CID 340844: (DEADCODE) /drivers/usb/gadget/ether.c: 2078 in eth_bind() /drivers/usb/gadget/ether.c: 2178 in eth_bind() /drivers/usb/gadget/ether.c: 2174 in eth_bind() /drivers/usb/gadget/ether.c: 2310 in eth_bind() /drivers/usb/gadget/ether.c: 2246 in eth_bind() ___________________________________________________________________________= _____________________________ *** CID 340844: (DEADCODE) /drivers/usb/gadget/ether.c: 2078 in eth_bind() 2072 * needed to install MSFT drivers. Current Linux kernels will use 2073 * the second configuration if it's CDC Ethernet, and need some h= elp 2074 * to choose the right configuration otherwise. 2075 */ 2076 if (rndis) { 2077 #if defined(CONFIG_USB_GADGET_VENDOR_NUM) && defined(CONFIG_USB_GA= DGET_PRODUCT_NUM) >>> CID 340844: (DEADCODE) >>> Execution cannot reach this statement: "device_desc.idVendor =3D 0;= ". 2078 device_desc.idVendor =3D 2079 __constant_cpu_to_le16(CONFIG_USB_GADGET_VENDOR_NUM); 2080 device_desc.idProduct =3D 2081 __constant_cpu_to_le16(CONFIG_USB_GADGET_PRODUCT_NUM); 2082 #else 2083 device_desc.idVendor =3D /drivers/usb/gadget/ether.c: 2178 in eth_bind() 2172 /* For now RNDIS is always a second config */ 2173 if (rndis) 2174 device_desc.bNumConfigurations =3D 2; 2175 =20 2176 if (gadget_is_dualspeed(gadget)) { 2177 if (rndis) >>> CID 340844: (DEADCODE) >>> Execution cannot reach this statement: "dev_qualifier.bNumConfigura= =2E..". 2178 dev_qualifier.bNumConfigurations =3D 2; 2179 else if (!cdc) 2180 dev_qualifier.bDeviceClass =3D USB_CLASS_VENDOR_SPEC; 2181 =20 2182 /* assumes ep0 uses the same value for both speeds ... */ 2183 dev_qualifier.bMaxPacketSize0 =3D device_desc.bMaxPacketSize0; /drivers/usb/gadget/ether.c: 2174 in eth_bind() 2168 } 2169 =20 2170 usb_gadget_set_selfpowered(gadget); 2171 =20 2172 /* For now RNDIS is always a second config */ 2173 if (rndis) >>> CID 340844: (DEADCODE) >>> Execution cannot reach this statement: "device_desc.bNumConfigurati= =2E..". 2174 device_desc.bNumConfigurations =3D 2; 2175 =20 2176 if (gadget_is_dualspeed(gadget)) { 2177 if (rndis) 2178 dev_qualifier.bNumConfigurations =3D 2; 2179 else if (!cdc) /drivers/usb/gadget/ether.c: 2310 in eth_bind() 2304 printf("HOST MAC %02x:%02x:%02x:%02x:%02x:%02x\n", 2305 dev->host_mac[0], dev->host_mac[1], 2306 dev->host_mac[2], dev->host_mac[3], 2307 dev->host_mac[4], dev->host_mac[5]); 2308 =20 2309 if (rndis) { >>> CID 340844: (DEADCODE) >>> Execution cannot reach this statement: "vendorID =3D 0U;". 2310 u32 vendorID =3D 0; 2311 =20 2312 /* FIXME RNDIS vendor id =3D=3D "vendor NIC code" =3D=3D ? */ 2313 =20 2314 dev->rndis_config =3D rndis_register(rndis_control_ack); 2315 if (dev->rndis_config < 0) { /drivers/usb/gadget/ether.c: 2246 in eth_bind() 2240 sprintf(ethaddr, "%02X%02X%02X%02X%02X%02X", 2241 dev->host_mac[0], dev->host_mac[1], 2242 dev->host_mac[2], dev->host_mac[3], 2243 dev->host_mac[4], dev->host_mac[5]); 2244 =20 2245 if (rndis) { >>> CID 340844: (DEADCODE) >>> Execution cannot reach this statement: "status =3D rndis_init();". 2246 status =3D rndis_init(); 2247 if (status < 0) { 2248 pr_err("can't init RNDIS, %d", status); 2249 goto fail; 2250 } 2251 } ** CID 340843: Control flow issues (UNREACHABLE) /test/lib/abuf.c: 315 in lib_test_abuf_init_move() ___________________________________________________________________________= _____________________________ *** CID 340843: Control flow issues (UNREACHABLE) /test/lib/abuf.c: 315 in lib_test_abuf_init_move() 309 /* 310 * TODO: crashes on sandbox sometimes due to an apparent bug in 311 * realloc(). 312 */ 313 return 0; 314 =20 >>> CID 340843: Control flow issues (UNREACHABLE) >>> This code cannot be reached: "ptr =3D sandbox_strdup(test_d...". 315 ptr =3D strdup(test_data); 316 ut_assertnonnull(ptr); 317 =20 318 free(ptr); 319 =20 320 abuf_init_move(&buf, ptr, TEST_DATA_LEN); ** CID 312933: Error handling issues (CHECKED_RETURN) /net/mdio-uclass.c: 33 in dm_mdio_probe_devices() ___________________________________________________________________________= _____________________________ *** CID 312933: Error handling issues (CHECKED_RETURN) /net/mdio-uclass.c: 33 in dm_mdio_probe_devices() 27 =20 28 void dm_mdio_probe_devices(void) 29 { 30 struct udevice *it; 31 struct uclass *uc; 32 =20 >>> CID 312933: Error handling issues (CHECKED_RETURN) >>> Calling "uclass_get" without checking return value (as is done else= where 58 out of 72 times). 33 uclass_get(UCLASS_MDIO, &uc); 34 uclass_foreach_dev(it, uc) { 35 device_probe(it); 36 } 37 } 38 =20 ** CID 166730: Integer handling issues (SIGN_EXTENSION) /drivers/nvme/nvme.c: 786 in nvme_blk_rw() ___________________________________________________________________________= _____________________________ *** CID 166730: Integer handling issues (SIGN_EXTENSION) /drivers/nvme/nvme.c: 786 in nvme_blk_rw() 780 c.rw.prp2 =3D cpu_to_le64(prp2); 781 status =3D nvme_submit_sync_cmd(dev->queues[NVME_IO_Q], 782 &c, NULL, IO_TIMEOUT); 783 if (status) 784 break; 785 temp_len -=3D (u32)lbas << ns->lba_shift; >>> CID 166730: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "lbas" with type "u16" (16 bits= , unsigned) is promoted in "lbas << ns->lba_shift" to type "int" (32 bits, = signed), then sign-extended to type "unsigned long" (64 bits, unsigned). I= f "lbas << ns->lba_shift" is greater than 0x7FFFFFFF, the upper bits of the= result will all be 1. 786 temp_buffer +=3D lbas << ns->lba_shift; 787 } 788 =20 789 if (read) 790 invalidate_dcache_range((unsigned long)buffer, 791 (unsigned long)buffer + total_len); ___________________________________________________________________________= _____________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.n= et/ls/click?upn=3DHRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoA22WlOQ-2By3= ieUvdbKmOyw68TMVT4Kip-2BBzfOGWXJ5yIiYplmPF9KAnKIja4Zd7tU-3DK7Ur_EEm8SbLgSDs= aDZif-2Bv7ch8WqhKpLoKErHi4nXpwDNTv2MEevk0ukd8spynR-2FdwIfCJVVOYA1tleqY-2BXa= L0cBMwJ1IN62SlBYZTWeyGVfETq6dQU5Z757a9RpEHNUetHBLhP7WTf2pUXtpaHKgIB-2BJJRnC= YvASPy63SZJeEuGhZMbVagadPofKk4H4PHfCFB4dVqyklahj-2B1P0DPRbe8B-2FA-3D-3D To manage Coverity Scan email notifications for "tom.rini@gmail.com", cli= ck https://u15810271.ct.sendgrid.net/ls/click?upn=3DHRESupC-2F2Czv4BOaCWWCy= 7my0P0qcxCbhZ31OYv50yped04pjJnmXOsUBtKYNIXxWeIHzDeopm-2BEWQ6S6K-2FtUHv9ZTk8= qZbuzkkz9sa-2BJFw4elYDyedRVZOC-2ButxjBZdouVmTGuWB6Aj6G7lm7t25-2Biv1B-2B9082= pHzCCex2kqMs-3Df7A0_EEm8SbLgSDsaDZif-2Bv7ch8WqhKpLoKErHi4nXpwDNTv2MEevk0ukd= 8spynR-2FdwIfZbk3JZAsjphuB5i-2F95GC4r6B5TgK6GVnvqd9jOzi-2FEfG49B6RT8uHLKl7e= UBwzIhiQw7Of4LExH3CBUAOZ-2FoJWB0qOI-2BfaE7KqJUeo7jWelN0MfiQxJASUMfn4ddaknmL= 09WtkO5D1OelUIYvbTZ2w-3D-3D ----- End forwarded message ----- --=20 Tom --CBkz1G+j/QuiWKyF Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmGASLIACgkQFHw5/5Y0 tyw62QwAkWAHtMByH/afRJVDaAMJ3hB1XHmZr/dL+GdPQsLA6aoEQpJHUI0zxl92 Dmb9qxEeAnNlQpUIdGOTQt2YAwV5njVE3iLBolbFKOJXf1j7gAKR94DJeD3oFeNi RpUjhChwn5Cli3KS/+v9iiugcJR0mAyEN1AxYQ4fCqidiV8bJLjwnwS2UhxHnBti LkcZOs+mSQgwb4AGTg39jlUOJFzIpg/YL/gC1tKACLWVxgGOFgWdFvfit3BdfRUT pZKZae2ofA18KK4c+urCCGGDYB5Rc6Fw5LUsbg1cO+b8qwN1XeRCz0aCW95A3Taz fQuo5bICdARf1BdforHcXw+AJUtYo3Y9ETnt9mta4SXHsUVEdWrz94dcO2iKBOO+ dI+4qkMMuZExiotXGFJgp3daA3GT27bio1Woyyup/QWxHCpxYIHa+BKFGs9Pl8QH 9OyQXb+++Mk10y1O5pQP6Avpz7Q/kCzigrSjqNiXR146DVn2i2SSS++DWOX+nbOw zyo+m75A =Otn8 -----END PGP SIGNATURE----- --CBkz1G+j/QuiWKyF--