From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A47CC433EF for ; Tue, 2 Nov 2021 16:22:22 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 9540060D42 for ; Tue, 2 Nov 2021 16:22:21 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 9540060D42 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 8183382E88; Tue, 2 Nov 2021 17:22:19 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=konsulko.com header.i=@konsulko.com header.b="OE6kkPSJ"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id D437682051; Tue, 2 Nov 2021 17:22:17 +0100 (CET) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id C20A482051 for ; Tue, 2 Nov 2021 17:22:11 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=trini@konsulko.com Received: by mail-qt1-x833.google.com with SMTP id 8so1869082qty.10 for ; Tue, 02 Nov 2021 09:22:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; h=date:from:to:subject:message-id:mime-version:content-disposition; bh=EUMqNqlXa8Dc34P1UEJm2Fskc0fSegP6Kf6JRVH9BwM=; b=OE6kkPSJeLdOA+Xxp6k6Rdsbk2n3Qwl9erc1uwNwjGjv9Xiom4iADqbtKZdybG9Olw ZpP0VbbxcuZDmL8Dv1qcgCsgypXbf/UKG0aPEME+jikExLN6UVCxr2OiQIZ8KR0Aw3Ru zR67IUJ47wPBrcT2EY5NVhOZs8ay6ThXTUWKI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition; bh=EUMqNqlXa8Dc34P1UEJm2Fskc0fSegP6Kf6JRVH9BwM=; b=zEqSwiBvTb/HY5GDcWOTV0fi8kYXZhoO13qUxxbFmIolctk071kGj7nqUkp+/srKGY TF6TYyL0bd4CYkfgrda8BaQTf7rC+nBKE7JMrEIsDd+k42NPl1cLPYbDJNA2YE7d6M1d x+5NB8aggH7KlsfKrNjN41KA0PyIw0metgefEygCFfDgmElPJapoJkygTaAco1DLXVaV JVIlsKLUNtJFxhNMNx7/C2KfjWfY6PIHYcLd0qBxHBgOgp44Qtme3Oz3kAsCPeac/Maj oDZG3G8CFPKA9D8g90um6q/GEtyav6ux9xnzBLk8xEqjRpMUTBifWfE0ubIkQ9y4Q/+m +gVw== X-Gm-Message-State: AOAM53225NDTdAHDGpo6FBg/g6PSlqzYHSzPNdXqZ+wUz4T/D7D6sc6w 16pbtZQXofQLG2Qy0k3pc+Nkmwdm23piTw== X-Google-Smtp-Source: ABdhPJzK+UHHmd3iYR6A1aNjlJmCXDf0Q+HEwxy4nGskANeC8xBAzkqaY/yX8uazNDUuFsI6DkPn/A== X-Received: by 2002:ac8:5706:: with SMTP id 6mr38999832qtw.95.1635870129747; Tue, 02 Nov 2021 09:22:09 -0700 (PDT) Received: from bill-the-cat (2603-6081-7b01-cbda-7d10-4e93-4359-630d.res6.spectrum.com. [2603:6081:7b01:cbda:7d10:4e93:4359:630d]) by smtp.gmail.com with ESMTPSA id g13sm2508126qko.103.2021.11.02.09.22.08 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Nov 2021 09:22:09 -0700 (PDT) Date: Tue, 2 Nov 2021 12:22:07 -0400 From: Tom Rini To: u-boot@lists.denx.de Subject: [scan-admin@coverity.com: New Defects reported by Coverity Scan for Das U-Boot] Message-ID: <20211102162207.GP24579@bill-the-cat> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="74hf9PSALuoWtOh/" Content-Disposition: inline X-Clacks-Overhead: GNU Terry Pratchett X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean --74hf9PSALuoWtOh/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable There's a whole lot of new defects here because I noticed yesterday that there was a new stable version of the scanner, after running yesterdays normal post-RC scan. So here's a new scan done on current master. ----- Forwarded message from scan-admin@coverity.com ----- Date: Tue, 02 Nov 2021 15:55:16 +0000 (UTC) =46rom: scan-admin@coverity.com To: tom.rini@gmail.com Subject: New Defects reported by Coverity Scan for Das U-Boot Hi, Please find the latest report on new defect(s) introduced to Das U-Boot fou= nd with Coverity Scan. 80 new defect(s) introduced to Das U-Boot found with Coverity Scan. 25 defect(s), reported by Coverity Scan earlier, were marked fixed in the r= ecent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 80 defect(s) ** CID 340915: (TAINTED_SCALAR) ___________________________________________________________________________= _____________________________ *** CID 340915: (TAINTED_SCALAR) /drivers/input/key_matrix.c: 166 in key_matrix_decode_fdt() 160 =20 161 prop =3D dev_read_prop(dev, "linux,fn-keymap", &proplen); 162 /* fn keymap is optional */ 163 if (!prop) 164 goto done; 165 =20 >>> CID 340915: (TAINTED_SCALAR) >>> Passing tainted expression "proplen" to "create_keymap", which uses= it as a loop boundary. 166 config->fn_keycode =3D create_keymap(config, prop, proplen, -1, NU= LL); 167 /* Conversion error -> fail */ 168 if (!config->fn_keycode) { 169 free(plain_keycode); 170 return -1; 171 } /drivers/input/key_matrix.c: 154 in key_matrix_decode_fdt() 148 /* Basic keymap is required */ 149 if (!prop) { 150 debug("%s: cannot find keycode-plain map\n", __func__); 151 return -1; 152 } 153 =20 >>> CID 340915: (TAINTED_SCALAR) >>> Passing tainted expression "proplen" to "create_keymap", which uses= it as a loop boundary. 154 plain_keycode =3D create_keymap(config, prop, proplen, KEY_FN, 155 &config->fn_pos); 156 config->plain_keycode =3D plain_keycode; 157 /* Conversion error -> fail */ 158 if (!config->plain_keycode) 159 return -1; ** CID 340914: (TAINTED_SCALAR) ___________________________________________________________________________= _____________________________ *** CID 340914: (TAINTED_SCALAR) /arch/sandbox/cpu/state.c: 38 in state_ensure_space() 32 =20 33 size =3D used + extra_size; 34 buf =3D os_malloc(size); 35 if (!buf) 36 return -ENOMEM; 37 =20 >>> CID 340914: (TAINTED_SCALAR) >>> Passing tainted expression "blob->size_dt_strings" to "fdt_open_int= o", which uses it as an offset. 38 ret =3D fdt_open_into(blob, buf, size); 39 if (ret) { 40 os_free(buf); 41 return -EIO; 42 } 43 =20 /arch/sandbox/cpu/state.c: 38 in state_ensure_space() 32 =20 33 size =3D used + extra_size; 34 buf =3D os_malloc(size); 35 if (!buf) 36 return -ENOMEM; 37 =20 >>> CID 340914: (TAINTED_SCALAR) >>> Passing tainted expression "blob->totalsize" to "fdt_open_into", wh= ich uses it as an offset. 38 ret =3D fdt_open_into(blob, buf, size); 39 if (ret) { 40 os_free(buf); 41 return -EIO; 42 } 43 =20 /arch/sandbox/cpu/state.c: 34 in state_ensure_space() 28 size =3D fdt_totalsize(blob); 29 free_bytes =3D size - used; 30 if (free_bytes > extra_size) 31 return 0; 32 =20 33 size =3D used + extra_size; >>> CID 340914: (TAINTED_SCALAR) >>> Passing tainted expression "size" to "os_malloc", which uses it as = an offset. 34 buf =3D os_malloc(size); 35 if (!buf) 36 return -ENOMEM; 37 =20 38 ret =3D fdt_open_into(blob, buf, size); 39 if (ret) { /arch/sandbox/cpu/state.c: 38 in state_ensure_space() 32 =20 33 size =3D used + extra_size; 34 buf =3D os_malloc(size); 35 if (!buf) 36 return -ENOMEM; 37 =20 >>> CID 340914: (TAINTED_SCALAR) >>> Passing tainted expression "blob->size_dt_struct" to "fdt_open_into= ", which uses it as an offset. 38 ret =3D fdt_open_into(blob, buf, size); 39 if (ret) { 40 os_free(buf); 41 return -EIO; 42 } 43 =20 /arch/sandbox/cpu/state.c: 44 in state_ensure_space() 38 ret =3D fdt_open_into(blob, buf, size); 39 if (ret) { 40 os_free(buf); 41 return -EIO; 42 } 43 =20 >>> CID 340914: (TAINTED_SCALAR) >>> Passing tainted expression "*blob" to "os_free", which uses it as a= n offset. 44 os_free(blob); 45 state->state_fdt =3D buf; 46 return 0; 47 } 48 =20 49 static int state_read_file(struct sandbox_state *state, const char *= fname) ** CID 340913: Uninitialized variables (UNINIT) /lib/gunzip.c: 298 in zunzip() ___________________________________________________________________________= _____________________________ *** CID 340913: Uninitialized variables (UNINIT) /lib/gunzip.c: 298 in zunzip() 292 } 293 s.next_in =3D src + offset; 294 s.avail_in =3D *lenp - offset; 295 s.next_out =3D dst; 296 s.avail_out =3D dstlen; 297 do { >>> CID 340913: Uninitialized variables (UNINIT) >>> Using uninitialized value "s.total_out" when calling "inflate". [No= te: The source code implementation of the function has been overridden by a= builtin model.] 298 r =3D inflate(&s, Z_FINISH); 299 if (stoponerr =3D=3D 1 && r !=3D Z_STREAM_END && 300 (s.avail_in =3D=3D 0 || s.avail_out =3D=3D 0 || r !=3D Z_BUF_= ERROR)) { 301 printf("Error: inflate() returned %d\n", r); 302 err =3D -1; 303 break; ** CID 340912: (TAINTED_SCALAR) ___________________________________________________________________________= _____________________________ *** CID 340912: (TAINTED_SCALAR) /lib/efi_loader/efi_variable.c: 191 in efi_variable_authenticate() 185 ret =3D EFI_SUCCESS; 186 =20 187 err: 188 efi_sigstore_free(truststore); 189 efi_sigstore_free(truststore2); 190 pkcs7_free_message(var_sig); >>> CID 340912: (TAINTED_SCALAR) >>> Passing tainted expression "*ebuf" to "dlfree", which uses it as an= offset. 191 free(ebuf); 192 free(regs); 193 =20 194 return ret; 195 } 196 #else /lib/efi_loader/efi_variable.c: 133 in efi_variable_authenticate() 127 =20 128 /* variable's signature list */ 129 if (auth->auth_info.hdr.dwLength < sizeof(auth->auth_info)) 130 goto err; 131 =20 132 /* ebuf should be kept valid during the authentication */ >>> CID 340912: (TAINTED_SCALAR) >>> Passing tainted expression "auth->auth_info.cert_data" to "efi_pars= e_pkcs7_header", which uses it as an offset. 133 var_sig =3D efi_parse_pkcs7_header(auth->auth_info.cert_data, 134 auth->auth_info.hdr.dwLength 135 - sizeof(auth->auth_info), 136 &ebuf); 137 if (!var_sig) { 138 EFI_PRINT("Parsing variable's signature failed\n"); ** CID 340910: (TAINTED_SCALAR) ___________________________________________________________________________= _____________________________ *** CID 340910: (TAINTED_SCALAR) /arch/sandbox/cpu/state.c: 284 in sandbox_write_state() 278 =20 279 if (ret =3D=3D -EIO) { 280 printf("Could not write sandbox state\n"); 281 goto err_create; 282 } 283 =20 >>> CID 340910: (TAINTED_SCALAR) >>> Passing tainted expression "state->state_fdt->size_dt_struct" to "f= dt_pack", which uses it as an offset. 284 ret =3D fdt_pack(state->state_fdt); 285 if (ret < 0) { 286 printf("Cannot pack state FDT: %s\n", fdt_strerror(ret)); 287 ret =3D -EINVAL; 288 goto err_create; 289 } /arch/sandbox/cpu/state.c: 311 in sandbox_write_state() 305 got_err ? " (with errors)" : ""); 306 =20 307 return 0; 308 err_write: 309 os_close(fd); 310 err_create: >>> CID 340910: (TAINTED_SCALAR) >>> Passing tainted expression "*state->state_fdt" to "os_free", which = uses it as an offset. 311 os_free(state->state_fdt); 312 =20 313 return ret; 314 } 315 =20 316 int state_setprop(int node, const char *prop_name, const void *data= , int size) /arch/sandbox/cpu/state.c: 284 in sandbox_write_state() 278 =20 279 if (ret =3D=3D -EIO) { 280 printf("Could not write sandbox state\n"); 281 goto err_create; 282 } 283 =20 >>> CID 340910: (TAINTED_SCALAR) >>> Passing tainted expression "state->state_fdt->size_dt_strings" to "= fdt_pack", which uses it as an offset. 284 ret =3D fdt_pack(state->state_fdt); 285 if (ret < 0) { 286 printf("Cannot pack state FDT: %s\n", fdt_strerror(ret)); 287 ret =3D -EINVAL; 288 goto err_create; 289 } /arch/sandbox/cpu/state.c: 311 in sandbox_write_state() 305 got_err ? " (with errors)" : ""); 306 =20 307 return 0; 308 err_write: 309 os_close(fd); 310 err_create: >>> CID 340910: (TAINTED_SCALAR) >>> Passing tainted expression "*state->state_fdt" to "os_free", which = uses it as an offset. 311 os_free(state->state_fdt); 312 =20 313 return ret; 314 } 315 =20 316 int state_setprop(int node, const char *prop_name, const void *data= , int size) ** CID 340909: Uninitialized variables (UNINIT) /lib/gunzip.c: 226 in gzwrite() ___________________________________________________________________________= _____________________________ *** CID 340909: Uninitialized variables (UNINIT) /lib/gunzip.c: 226 in gzwrite() 220 unsigned long blocks_written; 221 int numfilled; 222 lbaint_t writeblocks; 223 =20 224 s.avail_out =3D szwritebuf; 225 s.next_out =3D writebuf; >>> CID 340909: Uninitialized variables (UNINIT) >>> Using uninitialized value "s.total_out" when calling "inflate". [No= te: The source code implementation of the function has been overridden by a= builtin model.] 226 r =3D inflate(&s, Z_SYNC_FLUSH); 227 if ((r !=3D Z_OK) && 228 (r !=3D Z_STREAM_END)) { 229 printf("Error: inflate() returned %d\n", r); 230 goto out; 231 } ** CID 340908: Insecure data handling (TAINTED_SCALAR) /common/board_f.c: 627 in reloc_fdt() ___________________________________________________________________________= _____________________________ *** CID 340908: Insecure data handling (TAINTED_SCALAR) /common/board_f.c: 627 in reloc_fdt() 621 static int reloc_fdt(void) 622 { 623 if (!IS_ENABLED(CONFIG_OF_EMBED)) { 624 if (gd->flags & GD_FLG_SKIP_RELOC) 625 return 0; 626 if (gd->new_fdt) { >>> CID 340908: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "__fswab32((__u32)(__be32)((struct fdt_h= eader const *)gd->fdt_blob)->totalsize)" to "memcpy", which uses it as an o= ffset. [Note: The source code implementation of the function has been overr= idden by a builtin model.] 627 memcpy(gd->new_fdt, gd->fdt_blob, 628 fdt_totalsize(gd->fdt_blob)); 629 gd->fdt_blob =3D gd->new_fdt; 630 } 631 } 632 =20 ** CID 340907: Insecure data handling (TAINTED_SCALAR) ___________________________________________________________________________= _____________________________ *** CID 340907: Insecure data handling (TAINTED_SCALAR) /cmd/fdt.c: 59 in fdt_value_env_set() 53 if (is_printable_string(nodep, len)) 54 env_set(var, (void *)nodep); 55 else if (len =3D=3D 4) { 56 char buf[11]; 57 =20 58 sprintf(buf, "0x%08X", fdt32_to_cpu(*(fdt32_t *)nodep)); >>> CID 340907: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "buf" to "env_set", which uses it as an = offset. 59 env_set(var, buf); 60 } else if (len%4 =3D=3D 0 && len <=3D 20) { 61 /* Needed to print things like sha1 hashes. */ 62 char buf[41]; 63 int i; 64 =20 ** CID 340906: (TAINTED_SCALAR) /fs/squashfs/sqfs.c: 1059 in sqfs_readdir() /fs/squashfs/sqfs.c: 1060 in sqfs_readdir() /fs/squashfs/sqfs.c: 1060 in sqfs_readdir() /fs/squashfs/sqfs.c: 1059 in sqfs_readdir() ___________________________________________________________________________= _____________________________ *** CID 340906: (TAINTED_SCALAR) /fs/squashfs/sqfs.c: 1059 in sqfs_readdir() 1053 break; 1054 default: 1055 return -SQFS_STOP_READDIR; 1056 } 1057 =20 1058 /* Set entry name */ >>> CID 340906: (TAINTED_SCALAR) >>> Passing tainted expression "dirs->entry->name_size + 1" to "strncpy= ", which uses it as an offset. [Note: The source code implementation of the= function has been overridden by a builtin model.] 1059 strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1= ); 1060 dent->name[dirs->entry->name_size + 1] =3D '\0'; 1061 =20 1062 offset =3D dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; 1063 dirs->entry_count--; 1064 =20 /fs/squashfs/sqfs.c: 1060 in sqfs_readdir() 1054 default: 1055 return -SQFS_STOP_READDIR; 1056 } 1057 =20 1058 /* Set entry name */ 1059 strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1= ); >>> CID 340906: (TAINTED_SCALAR) >>> Using tainted variable "dirs->entry->name_size + 1" as an index int= o an array "dent->name". 1060 dent->name[dirs->entry->name_size + 1] =3D '\0'; 1061 =20 1062 offset =3D dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; 1063 dirs->entry_count--; 1064 =20 1065 /* Decrement size to be read */ /fs/squashfs/sqfs.c: 1060 in sqfs_readdir() 1054 default: 1055 return -SQFS_STOP_READDIR; 1056 } 1057 =20 1058 /* Set entry name */ 1059 strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1= ); >>> CID 340906: (TAINTED_SCALAR) >>> Using tainted variable "dirs->entry->name_size + 1" as an index int= o an array "dent->name". 1060 dent->name[dirs->entry->name_size + 1] =3D '\0'; 1061 =20 1062 offset =3D dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; 1063 dirs->entry_count--; 1064 =20 1065 /* Decrement size to be read */ /fs/squashfs/sqfs.c: 1059 in sqfs_readdir() 1053 break; 1054 default: 1055 return -SQFS_STOP_READDIR; 1056 } 1057 =20 1058 /* Set entry name */ >>> CID 340906: (TAINTED_SCALAR) >>> Passing tainted expression "dirs->entry->name_size + 1" to "strncpy= ", which uses it as an offset. [Note: The source code implementation of the= function has been overridden by a builtin model.] 1059 strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1= ); 1060 dent->name[dirs->entry->name_size + 1] =3D '\0'; 1061 =20 1062 offset =3D dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; 1063 dirs->entry_count--; 1064 =20 ** CID 340905: Insecure data handling (TAINTED_SCALAR) /scripts/dtc/checks.c: 1163 in check_property_phandle_args() ___________________________________________________________________________= _____________________________ *** CID 340905: Insecure data handling (TAINTED_SCALAR) /scripts/dtc/checks.c: 1163 in check_property_phandle_args() 1157 FAIL_PROP(c, dti, node, prop, 1158 "property size (%d) is invalid, expected multiple of %zu", 1159 prop->val.len, sizeof(cell_t)); 1160 return; 1161 } 1162 =20 >>> CID 340905: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "cell" as a loop boundary. 1163 for (cell =3D 0; cell < prop->val.len / sizeof(cell_t); cell +=3D= cellsize + 1) { 1164 struct node *provider_node; 1165 struct property *cellprop; 1166 int phandle; 1167 =20 1168 phandle =3D propval_cell_n(prop, cell); ** CID 340904: (TAINTED_SCALAR) ___________________________________________________________________________= _____________________________ *** CID 340904: (TAINTED_SCALAR) /fs/ext4/ext4_journal.c: 580 in update_descriptor_block() 574 =20 575 jdb.h_blocktype =3D cpu_to_be32(EXT3_JOURNAL_DESCRIPTOR_BLOCK); 576 jdb.h_magic =3D cpu_to_be32(EXT3_JOURNAL_MAGIC_NUMBER); 577 jdb.h_sequence =3D jsb->s_sequence; 578 buf =3D zalloc(fs->blksz); 579 if (!buf) { >>> CID 340904: (TAINTED_SCALAR) >>> Passing tainted expression "*temp_buff" to "dlfree", which uses it = as an offset. 580 free(temp_buff); 581 return; 582 } 583 temp =3D buf; 584 memcpy(buf, &jdb, sizeof(struct journal_header_t)); 585 temp +=3D sizeof(struct journal_header_t); /fs/ext4/ext4_journal.c: 603 in update_descriptor_block() 597 tag.block =3D cpu_to_be32(journal_ptr[--i]->blknr); 598 tag.flags =3D cpu_to_be32(EXT3_JOURNAL_FLAG_LAST_TAG); 599 memcpy(temp - sizeof(struct ext3_journal_block_tag), &tag, 600 sizeof(struct ext3_journal_block_tag)); 601 put_ext4((uint64_t) ((uint64_t)blknr * (uint64_t)fs->blksz), buf, = (uint32_t) fs->blksz); 602 =20 >>> CID 340904: (TAINTED_SCALAR) >>> Passing tainted expression "*temp_buff" to "dlfree", which uses it = as an offset. 603 free(temp_buff); 604 free(buf); 605 } 606 =20 607 static void update_commit_block(long int blknr) 608 { ** CID 340903: Insecure data handling (TAINTED_SCALAR) ___________________________________________________________________________= _____________________________ *** CID 340903: Insecure data handling (TAINTED_SCALAR) /fs/btrfs/disk-io.c: 1036 in open_ctree_fs_info() 1030 fs_info->stripesize =3D btrfs_super_stripesize(disk_super); 1031 =20 1032 ret =3D btrfs_check_fs_compatibility(fs_info->super_copy); 1033 if (ret) 1034 goto out_devices; 1035 =20 >>> CID 340903: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "fs_info->nodesize" to "btrfs_setup_chun= k_tree_and_device_map", which uses it as an offset. 1036 ret =3D btrfs_setup_chunk_tree_and_device_map(fs_info); 1037 if (ret) 1038 goto out_chunk; 1039 =20 1040 /* Chunk tree root is unable to read, return directly */ 1041 if (!fs_info->chunk_root) ** CID 340902: (TAINTED_SCALAR) ___________________________________________________________________________= _____________________________ *** CID 340902: (TAINTED_SCALAR) /common/fdt_support.c: 1784 in fdt_read_range() 1778 =20 1779 /* Jump to the n'th entry */ 1780 cell =3D n * (pacells + acells + scells); 1781 =20 1782 /* Read */ 1783 if (child_addr) { >>> CID 340902: (TAINTED_SCALAR) >>> Passing tainted expression "cell" to "fdt_read_prop", which uses it= as an offset. 1784 r =3D fdt_read_prop(ranges, ranges_len, cell, child_addr, 1785 acells); 1786 if (r) 1787 return r; 1788 } 1789 cell +=3D acells; /common/fdt_support.c: 1784 in fdt_read_range() 1778 =20 1779 /* Jump to the n'th entry */ 1780 cell =3D n * (pacells + acells + scells); 1781 =20 1782 /* Read */ 1783 if (child_addr) { >>> CID 340902: (TAINTED_SCALAR) >>> Passing tainted expression "cell" to "fdt_read_prop", which uses it= as an offset. 1784 r =3D fdt_read_prop(ranges, ranges_len, cell, child_addr, 1785 acells); 1786 if (r) 1787 return r; 1788 } 1789 cell +=3D acells; /common/fdt_support.c: 1798 in fdt_read_range() 1792 if (addr) 1793 *addr =3D fdt_translate_address(fdt, node, ranges + cell); 1794 cell +=3D pacells; 1795 =20 1796 /* Read */ 1797 if (len) { >>> CID 340902: (TAINTED_SCALAR) >>> Passing tainted expression "cell" to "fdt_read_prop", which uses it= as an offset. 1798 r =3D fdt_read_prop(ranges, ranges_len, cell, len, scells); 1799 if (r) 1800 return r; 1801 } 1802 =20 1803 return 0; ** CID 340901: Insecure data handling (TAINTED_SCALAR) ___________________________________________________________________________= _____________________________ *** CID 340901: Insecure data handling (TAINTED_SCALAR) /scripts/dtc/libfdt/fdt_overlay.c: 643 in overlay_merge() 637 return overlay; 638 =20 639 target =3D overlay_get_target(fdt, fdto, fragment, NULL); 640 if (target < 0) 641 return target; 642 =20 >>> CID 340901: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "target" to "overlay_apply_node", which = uses it as a loop boundary. 643 ret =3D overlay_apply_node(fdt, target, fdto, overlay); 644 if (ret) 645 return ret; 646 } 647 =20 648 return 0; ** CID 340900: Error handling issues (NEGATIVE_RETURNS) /fs/btrfs/inode.c: 644 in read_and_truncate_page() ___________________________________________________________________________= _____________________________ *** CID 340900: Error handling issues (NEGATIVE_RETURNS) /fs/btrfs/inode.c: 644 in read_and_truncate_page() 638 if (!buf) 639 return -ENOMEM; 640 =20 641 extent_type =3D btrfs_file_extent_type(leaf, fi); 642 if (extent_type =3D=3D BTRFS_FILE_EXTENT_INLINE) { 643 ret =3D btrfs_read_extent_inline(path, fi, buf); >>> CID 340900: Error handling issues (NEGATIVE_RETURNS) >>> "({...; (_min1 < _min2) ? _min1 : _min2;})" is passed to a paramete= r that cannot be negative. [Note: The source code implementation of the fun= ction has been overridden by a builtin model.] 644 memcpy(dest, buf + page_off, min(page_len, ret)); 645 free(buf); 646 return len; 647 } 648 =20 649 ret =3D btrfs_read_extent_reg(path, fi, ** CID 340899: Insecure data handling (TAINTED_SCALAR) /fs/ext4/ext4_journal.c: 219 in print_revoke_blks() ___________________________________________________________________________= _____________________________ *** CID 340899: Insecure data handling (TAINTED_SCALAR) /fs/ext4/ext4_journal.c: 219 in print_revoke_blks() 213 =20 214 header =3D (struct journal_revoke_header_t *) revk_blk; 215 offset =3D sizeof(struct journal_revoke_header_t); 216 max =3D be32_to_cpu(header->r_count); 217 printf("total bytes %d\n", max); 218 =20 >>> CID 340899: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "max" as a loop boundary. 219 while (offset < max) { 220 blocknr =3D be32_to_cpu(*((__be32 *)(revk_blk + offset))); 221 printf("revoke blknr is %ld\n", blocknr); 222 offset +=3D 4; 223 } 224 } ** CID 340898: Memory - illegal accesses (UNINIT) /lib/efi_loader/efi_boottime.c: 2667 in efi_uninstall_multiple_protocol_int= erfaces() ___________________________________________________________________________= _____________________________ *** CID 340898: Memory - illegal accesses (UNINIT) /lib/efi_loader/efi_boottime.c: 2667 in efi_uninstall_multiple_protocol_int= erfaces() 2661 efi_status_t r =3D EFI_SUCCESS; 2662 size_t i =3D 0; 2663 =20 2664 if (!handle) 2665 return EFI_EXIT(EFI_INVALID_PARAMETER); 2666 =20 >>> CID 340898: Memory - illegal accesses (UNINIT) >>> Using uninitialized value "argptr" when calling "__builtin_ms_va_st= art". 2667 efi_va_start(argptr, handle); 2668 for (;;) { 2669 protocol =3D efi_va_arg(argptr, efi_guid_t*); 2670 if (!protocol) 2671 break; 2672 protocol_interface =3D efi_va_arg(argptr, void*); ** CID 340897: Memory - illegal accesses (UNINIT) /lib/efi_loader/efi_boottime.c: 2594 in efi_install_multiple_protocol_inter= faces() ___________________________________________________________________________= _____________________________ *** CID 340897: Memory - illegal accesses (UNINIT) /lib/efi_loader/efi_boottime.c: 2594 in efi_install_multiple_protocol_inter= faces() 2588 efi_status_t r =3D EFI_SUCCESS; 2589 int i =3D 0; 2590 =20 2591 if (!handle) 2592 return EFI_EXIT(EFI_INVALID_PARAMETER); 2593 =20 >>> CID 340897: Memory - illegal accesses (UNINIT) >>> Using uninitialized value "argptr" when calling "__builtin_ms_va_st= art". 2594 efi_va_start(argptr, handle); 2595 for (;;) { 2596 protocol =3D efi_va_arg(argptr, efi_guid_t*); 2597 if (!protocol) 2598 break; 2599 protocol_interface =3D efi_va_arg(argptr, void*); ** CID 340896: Insecure data handling (TAINTED_SCALAR) ___________________________________________________________________________= _____________________________ *** CID 340896: Insecure data handling (TAINTED_SCALAR) /common/image-fdt.c: 510 in boot_get_fdt() 504 ulong fdt_data, fdt_len; 505 u32 fdt_size, dtb_idx; 506 /* 507 * Firstly check if this android boot image has dtb field. 508 */ 509 dtb_idx =3D (u32)env_get_ulong("adtb_idx", 10, 0); >>> CID 340896: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "hdr" to "android_image_get_dtb_by_index= ", which uses it as a loop boundary. 510 if (android_image_get_dtb_by_index((ulong)hdr, dtb_idx, &fdt_addr= , &fdt_size)) { 511 fdt_blob =3D (char *)map_sysmem(fdt_addr, 0); 512 if (fdt_check_header(fdt_blob)) 513 goto no_fdt; 514 =20 515 debug("## Using FDT in Android image dtb area with idx %u\n", dt= b_idx); ** CID 340895: Insecure data handling (TAINTED_SCALAR) /common/image-android-dt.c: 128 in android_dt_print_contents() ___________________________________________________________________________= _____________________________ *** CID 340895: Insecure data handling (TAINTED_SCALAR) /common/image-android-dt.c: 128 in android_dt_print_contents() 122 printf(" page_size =3D %d\n", fdt32_to_cpu(hdr->page_siz= e)); 123 printf(" version =3D %d\n", fdt32_to_cpu(hdr->version)= ); 124 =20 125 unmap_sysmem(hdr); 126 =20 127 /* Print image entries info */ >>> CID 340895: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "entry_count" as a loop boundary. 128 for (i =3D 0; i < entry_count; ++i) { 129 const ulong e_addr =3D hdr_addr + entries_offset + i * entry_size; 130 const struct dt_table_entry *e; 131 const struct fdt_header *fdt; 132 u32 dt_offset, dt_size; 133 u32 j; ___________________________________________________________________________= _____________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.n= et/ls/click?upn=3DHRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoA22WlOQ-2By3= ieUvdbKmOyw68TMVT4Kip-2BBzfOGWXJ5yIiYplmPF9KAnKIja4Zd7tU-3D9GGA_EEm8SbLgSDs= aDZif-2Bv7ch8WqhKpLoKErHi4nXpwDNTs3pBU8vxliBOfH1-2FBt0vqbdIx1mP6FC3-2FQe-2F= w-2F-2FDBEhKG26IbQfiRoX0gqXB9Wm6CFQKvUL203el0Uwq3R00CKZgVFh0pACrzKTpfyuRUH7= ZMXL834xWtjRvq7oWINAt-2FvvOwfqgX9iTtocxbsR7P736LnIQHB4GthdbQG8xFv4Q-3D-3D To manage Coverity Scan email notifications for "tom.rini@gmail.com", cli= ck https://u15810271.ct.sendgrid.net/ls/click?upn=3DHRESupC-2F2Czv4BOaCWWCy= 7my0P0qcxCbhZ31OYv50yped04pjJnmXOsUBtKYNIXxWeIHzDeopm-2BEWQ6S6K-2FtUHv9ZTk8= qZbuzkkz9sa-2BJFw4elYDyedRVZOC-2ButxjBZdouVmTGuWB6Aj6G7lm7t25-2Biv1B-2B9082= pHzCCex2kqMs-3Dp1U4_EEm8SbLgSDsaDZif-2Bv7ch8WqhKpLoKErHi4nXpwDNTs3pBU8vxliB= OfH1-2FBt0vqbclVGnJdJ2jYQpaLHmC-2BWaiKYUmh5-2BWRNQHXgL0tqPDBr5zJNId2seKKN81= 9S3BkxgDCXMchYRh-2BH6W8WhXwQjsEAGX5MWx-2FVvnCjUsyybd-2FX8yAQGOFpUWS11iICkcO= GU8IXKIHrICdOOFVa3O8-2BPw-3D-3D ----- End forwarded message ----- --=20 Tom --74hf9PSALuoWtOh/ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmGBZagACgkQFHw5/5Y0 tywSgQv+P3V8R5iFxTUi0jPNqIuzcTqF136s2LPUNBlDJWpzZagNefYxUkhdwdj5 K4sHUTNY+b96nxb6JFWBfWZXMKfuDSaN/bOTgWgYaZVFy1aY7h4RZMdnZ9k1s5j5 771MXyUbitZn2TnwOg3fJ8zo61wUY2uWmKfswtyZpv3dkBeKh+fkO9hwAKdywsDw z9Y1kl4YaHuVTtxAfxLSSh+kc4FG/dFLufb27iIpLXxe1oZv4XYJ8zySUJ34J+pI DRq1s0wur1ec31QFb5Y7wBJJsUCb9X5E2AZxWb+rG+aTGdGHLK6O6qYuH33rUa/B gnyC5hO3gu3fYwb0ab+0JnpNd2vACdxjYA2VKfTp3iV88brg/7zFGwRnFfSWgAaD tUTAZppYrmH89RE1e4STGJC/WJXCBMCSZj8f7l+Zh55lARsVbafh5BN8Jv4enni8 dVHokwGriBzZPRMmoDKRRGJmRg6ICpS1cLWg/vOKCfgKLDMBIPqIFBMpHXH1cDRR fZahDYCf =EOQG -----END PGP SIGNATURE----- --74hf9PSALuoWtOh/--