Fwd: New Defects reported by Coverity Scan for Das U-Boot

[Tom Rini <trini@konsulko.com>]

[-- Attachment #1: Type: text/plain, Size: 6006 bytes --]

Hey all,

Here's the scan report for -rc1.

---------- Forwarded message ---------
From: <scan-admin@coverity.com>
Date: Wed, Jul 29, 2026 at 12:06 AM
Subject: New Defects reported by Coverity Scan for Das U-Boot
To: <tom.rini@gmail.com>


Hi,

Please find the latest report on new defect(s) introduced to *Das U-Boot*
found with Coverity Scan.

   - *New Defects Found:* 6
   - 5 defect(s), reported by Coverity Scan earlier, were marked fixed in
   the recent build analyzed by Coverity Scan.
   - *Defects Shown:* Showing 6 of 6 defect(s)

Defect Details

** CID 651722:       Error handling issues  (CHECKED_RETURN)
/drivers/power/regulator/pmbus_helper.c: 48           in
pmbus_regulator_get_value()


_____________________________________________________________________________________________
*** CID 651722:         Error handling issues  (CHECKED_RETURN)
/drivers/power/regulator/pmbus_helper.c: 48             in
pmbus_regulator_get_value()
42     	s64 uv;
43     	int ret;
44
45     	ret = pmbus_regulator_select_page(priv);
46     	if (ret)
47     		return ret;
>>>     CID 651722:         Error handling issues  (CHECKED_RETURN)
>>>     Calling "pmbus_read_byte" without checking return value (as is done elsewhere 17 out of 18 times).
48     	pmbus_read_byte(priv->i2c_dev, PMBUS_VOUT_MODE, &vout_mode);
49     	if (pmbus_read_word(priv->i2c_dev, PMBUS_READ_VOUT, &raw))
50     		return -EIO;
51
52     	if (priv->info)
53     		uv = pmbus_reg2data(priv->info, PSC_VOLTAGE_OUT, raw, vout_mode);

** CID 651721:       Insecure data handling  (TAINTED_SCALAR)


_____________________________________________________________________________________________
*** CID 651721:         Insecure data handling  (TAINTED_SCALAR)
/drivers/core/ofnode.c: 134             in oftree_new()
128     		/* register the new tree with a small size */
129     		fdt = malloc(size);
130     		if (!fdt)
131     			return log_msg_ret("fla", -ENOMEM);
132     		ret = fdt_create_empty_tree(fdt, size);
133     		if (ret) {
>>>     CID 651721:         Insecure data handling  (TAINTED_SCALAR)
>>>     Passing tainted expression "*fdt" to "dlfree", which uses it as an offset.
134     			free(fdt);
135     			return log_msg_ret("fla", -EINVAL);
136     		}
137     		oftree_list[oftree_count++] = fdt;
138     		tree.fdt = fdt;
139     	}

** CID 651720:       Memory - corruptions  (OVERRUN)
/drivers/i3c/master/dw-i3c-master.c: 809           in
dw_i3c_master_attach_i3c_dev()


_____________________________________________________________________________________________
*** CID 651720:         Memory - corruptions  (OVERRUN)
/drivers/i3c/master/dw-i3c-master.c: 809             in
dw_i3c_master_attach_i3c_dev()
803     		return -ENOMEM;
804
805     	data->index = pos;
806     	master->addrs[pos] = dev->info.dyn_addr ? : dev->info.static_addr;
807     	master->free_pos &= ~BIT(pos);
808     	i3c_dev_set_master_data(dev, data);
>>>     CID 651720:         Memory - corruptions  (OVERRUN)
>>>     Overrunning array "master->i3cdev" of 11 8-byte elements at element index 31 (byte offset 255) using index "pos" (which evaluates to 31).
809     	master->i3cdev[pos] = dev;
810
811     	writel(DEV_ADDR_TABLE_DYNAMIC_ADDR(master->addrs[pos]),
812     	       master->regs +
813     	       DEV_ADDR_TABLE_LOC(master->datstartaddr, data->index));
814

** CID 651719:       Insecure data handling  (TAINTED_SCALAR)


_____________________________________________________________________________________________
*** CID 651719:         Insecure data handling  (TAINTED_SCALAR)
/test/boot/vbe_read_fit.c: 136             in build_fit()
130     		return ret;
131
132     	ret = fdt_end_node(buf);	/* root */
133     	if (ret)
134     		return ret;
135
>>>     CID 651719:         Insecure data handling  (TAINTED_SCALAR)
>>>     Passing tainted expression "buf->size_dt_strings" to "fdt_finish", which uses it as an offset.
136     	return fdt_finish(buf);
137     }
138
139     /**
140      * place_fit_on_mmc() - Write a synthetic FIT to mmc1 and
return its blk dev
141      *

** CID 651718:       Memory - illegal accesses  (UNINIT)
/drivers/clk/spacemit/clk_pll.c: 42           in ccu_pll_lookup_best_rate()


_____________________________________________________________________________________________
*** CID 651718:         Memory - illegal accesses  (UNINIT)
/drivers/clk/spacemit/clk_pll.c: 42             in ccu_pll_lookup_best_rate()
36     		if (delta < best_delta) {
37     			best_delta = delta;
38     			best_entry = entry;
39     		}
40     	}
41
>>>     CID 651718:         Memory - illegal accesses  (UNINIT)
>>>     Using uninitialized value "best_entry".
42     	return best_entry;
43     }
44
45     static const struct ccu_pll_rate_tbl
*ccu_pll_lookup_matched_entry(struct ccu_pll *pll)
46     {
47     	struct ccu_pll_config *config = &pll->config;

** CID 651717:       Insecure data handling  (TAINTED_SCALAR)


_____________________________________________________________________________________________
*** CID 651717:         Insecure data handling  (TAINTED_SCALAR)
/drivers/power/regulator/pmbus_helper.c: 285             in
pmbus_regulator_probe_common()
279     	int ret;
280
281     	chip_addr = dev_read_addr(dev);
282     	if (chip_addr < 0)
283     		return -EINVAL;
284
>>>     CID 651717:         Insecure data handling  (TAINTED_SCALAR)
>>>     Passing tainted expression "chip_addr" to "i2c_get_chip", which uses it as an offset.
285     	ret = i2c_get_chip(dev_get_parent(dev), (u32)chip_addr, 1,
&priv->i2c_dev);
286     	if (ret)
287     		return ret;
288
289     	priv->info = info;
290     	priv->page = page;



View Defects in Coverity Scan
<https://scan.coverity.com/projects/das-u-boot?tab=overview>

Best regards,

The Coverity Scan Admin Team

----- End forwarded message -----

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]