From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 538A4C7EE22 for ; Mon, 8 May 2023 20:20:31 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id BADF684716; Mon, 8 May 2023 22:20:28 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=konsulko.com header.i=@konsulko.com header.b="YneLOdsy"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 4217884725; Mon, 8 May 2023 22:20:27 +0200 (CEST) Received: from mail-yb1-xb34.google.com (mail-yb1-xb34.google.com [IPv6:2607:f8b0:4864:20::b34]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 591D480375 for ; Mon, 8 May 2023 22:20:24 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=trini@konsulko.com Received: by mail-yb1-xb34.google.com with SMTP id 3f1490d57ef6-b9d881ad689so6618028276.2 for ; Mon, 08 May 2023 13:20:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; t=1683577223; x=1686169223; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=MxWr9uDtsMxxczP0a0tePs3WusBMTCju1Uw2SRFq1M0=; b=YneLOdsyE2IWfz3CKb+yMFVwXyKA3xI0N8gL+KKcHzXjdujipwEtd4b/CoKPJ5tar6 zlsGm2AGP/Yun0QTCPaDPX8Q1xyeYVsoYVFR9sOV/YXAHTte6jd0t4ns5AkdPC6izOif mEMeAL/a6lMikLMHPdEpXU0la2+1c/zVQvfUc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683577223; x=1686169223; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=MxWr9uDtsMxxczP0a0tePs3WusBMTCju1Uw2SRFq1M0=; b=OAY0hFCCAwKmL0f9mFU3SCHk1qcukES4vfL6e1Kz7PwOCALn/mV0H84DaRBfYX1NNv 3ebSXRcy1v87ROH3JMM6/sHbvCwJQ3U3j8thjbNMLb5JUqrLBFYhfv5JCXGr8cEeHYI5 0PljviOrEB2H1xsuPgOxkGDxOk3hfXGDDPS6FKsS7HZy0uNRmbqb2W16AQWjtLb7Ih4/ AFnbPzfatTz5AjD9ZR7wkDLLFKNtCDsonlHWZjIjVY4M2Wuu7eBRlyuPtZoweJCXCoOF ylOQOMY8vRV6pC7d6DScUhoBnb7F5t6P3Zy9pT6bc8rvAYW7adgDuW97ooG5FndHEY3y gziA== X-Gm-Message-State: AC+VfDxBULSS8kmN6uL62JOYT1y4SO20Vbm+k+nyIZrS2Xood1ERVNUR C1M1FKGChvAQRH85GAVN7O8i4YY/ne9b+xXQNuUU0Q== X-Google-Smtp-Source: ACHHUZ6Ct9pMn2aMj3IbH37/BPIdGfjy4XZ2RbOir/XPN6ioM9pPet7EBHK1zRk/z76c+d1SNprdxQ== X-Received: by 2002:a25:109:0:b0:b94:bbf2:277a with SMTP id 9-20020a250109000000b00b94bbf2277amr12433520ybb.33.1683577222732; Mon, 08 May 2023 13:20:22 -0700 (PDT) Received: from bill-the-cat (2603-6081-7b00-6400-fad7-408c-ba3e-eed3.res6.spectrum.com. [2603:6081:7b00:6400:fad7:408c:ba3e:eed3]) by smtp.gmail.com with ESMTPSA id s4-20020a259a84000000b00b9dfcc7a1fasm2515108ybo.7.2023.05.08.13.20.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 08 May 2023 13:20:22 -0700 (PDT) Date: Mon, 8 May 2023 16:20:20 -0400 From: Tom Rini To: u-boot@lists.denx.de Cc: Sean Edmond Subject: Fwd: New Defects reported by Coverity Scan for Das U-Boot Message-ID: <20230508202020.GI2398826@bill-the-cat> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Rrxy4BNnLtUNfdeC" Content-Disposition: inline X-Clacks-Overhead: GNU Terry Pratchett X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean --Rrxy4BNnLtUNfdeC Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Here's the latest defect report: ---------- Forwarded message --------- =46rom: Date: Mon, May 8, 2023, 2:29 PM Subject: New Defects reported by Coverity Scan for Das U-Boot To: Hi, Please find the latest report on new defect(s) introduced to Das U-Boot found with Coverity Scan. 5 new defect(s) introduced to Das U-Boot found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 5 of 5 defect(s) ** CID 453851: Memory - corruptions (OVERLAPPING_COPY) /cmd/net.c: 279 in netboot_update_env() ___________________________________________________________________________= _____________________________ *** CID 453851: Memory - corruptions (OVERLAPPING_COPY) /cmd/net.c: 279 in netboot_update_env() 273 274 if (IS_ENABLED(CONFIG_IPV6)) { 275 if (!ip6_is_unspecified_addr(&net_ip6) || 276 net_prefix_length !=3D 0) { 277 sprintf(tmp, "%pI6c", &net_ip6); 278 if (net_prefix_length !=3D 0) >>> CID 453851: Memory - corruptions (OVERLAPPING_COPY) >>> In the call to function "sprintf", the arguments "tmp" and "tmp" may point to the same object. 279 sprintf(tmp, "%s/%d", tmp, net_prefix_length); 280 281 env_set("ip6addr", tmp); 282 } 283 284 if (!ip6_is_unspecified_addr(&net_server_ip6)) { ** CID 450971: Insecure data handling (TAINTED_SCALAR) /net/ndisc.c: 391 in process_ra() ___________________________________________________________________________= _____________________________ *** CID 450971: Insecure data handling (TAINTED_SCALAR) /net/ndisc.c: 391 in process_ra() 385 /* Ignore the packet if router lifetime is 0. */ 386 if (!icmp->icmp6_rt_lifetime) 387 return -EOPNOTSUPP; 388 389 /* Processing the options */ 390 option =3D msg->opt; >>> CID 450971: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "remaining_option_len" as a loop boundary. 391 while (remaining_option_len > 0) { 392 /* The 2nd byte of the option is its length. */ 393 option_len =3D option[1]; 394 /* All included options should have a positive length. */ 395 if (option_len =3D=3D 0) 396 return -EINVAL; ** CID 450969: Security best practices violations (DC.WEAK_CRYPTO) /net/ndisc.c: 209 in ip6_send_rs() ___________________________________________________________________________= _____________________________ *** CID 450969: Security best practices violations (DC.WEAK_CRYPTO) /net/ndisc.c: 209 in ip6_send_rs() 203 icmp_len, PROT_ICMPV6, pcsum); 204 msg->icmph.icmp6_cksum =3D csum; 205 pkt +=3D icmp_len; 206 207 /* Wait up to 1 second if it is the first try to get the RA */ 208 if (retry_count =3D=3D 0) >>> CID 450969: Security best practices violations (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 209 udelay(((unsigned int)rand() % 1000000) * MAX_SOLICITATION_DELAY); 210 211 /* send it! */ 212 net_send_packet(net_tx_packet, (pkt - net_tx_packet)); 213 214 retry_count++; ** CID 436282: (DC.WEAK_CRYPTO) /net/dhcpv6.c: 621 in dhcp6_state_machine() /net/dhcpv6.c: 627 in dhcp6_state_machine() /net/dhcpv6.c: 628 in dhcp6_state_machine() /net/dhcpv6.c: 662 in dhcp6_state_machine() /net/dhcpv6.c: 613 in dhcp6_state_machine() ___________________________________________________________________________= _____________________________ *** CID 436282: (DC.WEAK_CRYPTO) /net/dhcpv6.c: 621 in dhcp6_state_machine() 615 /* handle state machine entry conditions */ 616 if (sm_params.curr_state !=3D sm_params.next_state) { 617 sm_params.retry_cnt =3D 0; 618 619 if (sm_params.next_state =3D=3D DHCP6_SOLICIT) { 620 /* delay a random ammount (special for SOLICIT) */ >>> CID 436282: (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 621 udelay((rand() % SOL_MAX_DELAY_MS) * 1000); 622 /* init timestamp variables after SOLICIT delay */ 623 sm_params.dhcp6_start_ms =3D get_timer(0); 624 sm_params.dhcp6_retry_start_ms =3D sm_params.dhcp6_start_ms; 625 sm_params.dhcp6_retry_ms =3D sm_params.dhcp6_start_ms; 626 /* init transaction and ia_id */ /net/dhcpv6.c: 627 in dhcp6_state_machine() 621 udelay((rand() % SOL_MAX_DELAY_MS) * 1000); 622 /* init timestamp variables after SOLICIT delay */ 623 sm_params.dhcp6_start_ms =3D get_timer(0); 624 sm_params.dhcp6_retry_start_ms =3D sm_params.dhcp6_start_ms; 625 sm_params.dhcp6_retry_ms =3D sm_params.dhcp6_start_ms; 626 /* init transaction and ia_id */ >>> CID 436282: (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 627 sm_params.trans_id =3D rand() & 0xFFFFFF; 628 sm_params.ia_id =3D rand(); 629 /* initialize retransmission parameters */ 630 sm_params.irt_ms =3D SOL_TIMEOUT_MS; 631 sm_params.mrt_ms =3D updated_sol_max_rt_ms; 632 /* RFCs default MRC is be 0 (try infinitely) /net/dhcpv6.c: 628 in dhcp6_state_machine() 622 /* init timestamp variables after SOLICIT delay */ 623 sm_params.dhcp6_start_ms =3D get_timer(0); 624 sm_params.dhcp6_retry_start_ms =3D sm_params.dhcp6_start_ms; 625 sm_params.dhcp6_retry_ms =3D sm_params.dhcp6_start_ms; 626 /* init transaction and ia_id */ 627 sm_params.trans_id =3D rand() & 0xFFFFFF; >>> CID 436282: (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 628 sm_params.ia_id =3D rand(); 629 /* initialize retransmission parameters */ 630 sm_params.irt_ms =3D SOL_TIMEOUT_MS; 631 sm_params.mrt_ms =3D updated_sol_max_rt_ms; 632 /* RFCs default MRC is be 0 (try infinitely) 633 * give up after CONFIG_NET_RETRY_COUNT number of tries (same as DHCPv4) /net/dhcpv6.c: 662 in dhcp6_state_machine() 656 (sm_params.mrd_ms !=3D 0 && 657 ((sm_params.dhcp6_retry_ms - sm_params.dhcp6_retry_start_ms) >=3D sm_params.mrd_ms))) { 658 sm_params.next_state =3D DHCP6_FAIL; 659 } 660 661 /* calculate retransmission timeout (RT) */ >>> CID 436282: (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 662 rand_minus_plus_100 =3D ((rand() % 200) - 100); 663 if (sm_params.retry_cnt =3D=3D 0) { 664 sm_params.rt_ms =3D sm_params.irt_ms + 665 ((sm_params.irt_ms * rand_minus_plus_100) / 1000); 666 } else { 667 sm_params.rt_ms =3D (2 * sm_params.rt_prev_ms) + /net/dhcpv6.c: 613 in dhcp6_state_machine() 607 * Proceed anyway to proceed DONE/FAIL actions 608 */ 609 debug("Unexpected DHCP6 state : %d\n", sm_params.curr_state); 610 break; 611 } 612 /* re-seed the RNG */ >>> CID 436282: (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 613 srand(get_ticks() + rand()); 614 615 /* handle state machine entry conditions */ 616 if (sm_params.curr_state !=3D sm_params.next_state) { 617 sm_params.retry_cnt =3D 0; 618 ** CID 436278: (TAINTED_SCALAR) /net/dhcpv6.c: 321 in dhcp6_parse_options() ___________________________________________________________________________= _____________________________ *** CID 436278: (TAINTED_SCALAR) /net/dhcpv6.c: 376 in dhcp6_parse_options() 370 if (sm_params.curr_state =3D=3D DHCP6_SOLICIT) 371 sm_params.mrt_ms =3D updated_sol_max_rt_ms; 372 } 373 break; 374 case DHCP6_OPTION_OPT_BOOTFILE_URL: 375 debug("DHCP6_OPTION_OPT_BOOTFILE_URL FOUND\n"); >>> CID 436278: (TAINTED_SCALAR) >>> Passing tainted expression "option_len + 1" to "copy_filename", which uses it as a loop boundary. 376 copy_filename(net_boot_file_name, option_ptr, option_len + 1); 377 debug("net_boot_file_name: %s\n", net_boot_file_name); 378 379 /* copy server_ip6 (required for PXE) */ 380 s =3D strchr(net_boot_file_name, '['); 381 e =3D strchr(net_boot_file_name, ']'); /net/dhcpv6.c: 321 in dhcp6_parse_options() 315 while (option_hdr < (struct dhcp6_option_hdr *)(rx_pkt + len)) { 316 option_ptr =3D ((uchar *)option_hdr) + sizeof(struct dhcp6_hdr); 317 option_len =3D ntohs(option_hdr->option_len); 318 319 switch (ntohs(option_hdr->option_id)) { 320 case DHCP6_OPTION_CLIENTID: >>> CID 436278: (TAINTED_SCALAR) >>> Passing tainted expression "option_len" to "memcmp", which uses it as an offset. [Note: The source code implementation of the function has been overridden by a builtin model.] 321 if (memcmp(option_ptr, sm_params.duid, option_len) 322 !=3D 0) { 323 debug("CLIENT ID DOESN'T MATCH\n"); 324 } else { 325 debug("CLIENT ID FOUND and MATCHES\n"); 326 sm_params.rx_status.client_id_match =3D true; --=20 Tom --Rrxy4BNnLtUNfdeC Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmRZWX4ACgkQFHw5/5Y0 tywgcQv9HYPKpYXIhmzoxwFgKQqGWy0JJJgPQAhfMKKvlLNgNyzdP1VwrxsWAyBI Tn7dH6IUiPcZEVHws8lyFDZizFj06EEpC2F7g1X+QH4aCSfTmWQgP5fWtBaHVHiV 5HoHNuuK2LyVwpau401wJh/iU8Bmzb73mXz94Ug0QK7Q5wWcSNSxY/EOB+qCI8pM WETV5P+7KA5YP0yDbM5odHAfoyqwwdeYtjFcI90KcCNxaFA7NHtlPudARYIBYc6X wgDHGVnkj1Ru9ySaxqvLReIzK4EN+VVMMxvDmN+5tDRXkD2cFqVRvD2h6n2FgIv7 sQpQPksQWZo6MfC/jnycb/erGCmOqbUDfAkhI4zh/NQbEvowIOhh9PsMLNMdGXe1 NRky5MwIh3bXI9Z22WZJAy/9EDXWIQy1t+gvm5Jvu3aK8DJn3C5Gki5Yx6sCXQ1z nIo4+j2y2Asz/8z4mHKnvVkkgl4HINZzzGtZGTIsbW39rFgYneoMyXhAyoHVTTjn N/r0N3ux =u4in -----END PGP SIGNATURE----- --Rrxy4BNnLtUNfdeC--