Fwd: New Defects reported by Coverity Scan for Das U-Boot

Tom Rini
2025-07-14T23:29:12Z

[-- Attachment #1: Type: text/plain, Size: 3887 bytes --]

Here's the latest report from Coverity. Good news is closing 5 existing
issues (overlap with smatch I think) but 3 new ones. Or maybe it's
related to Rasmus' cleanup series? I can only run one report a day I
think so I don't have granular breakdown on which changes today brought
these up.

---------- Forwarded message ---------
From: <scan-admin@coverity.com>
Date: Mon, Jul 14, 2025 at 5:23 PM
Subject: New Defects reported by Coverity Scan for Das U-Boot
To: <tom.rini@gmail.com>

Hi,

Please find the latest report on new defect(s) introduced to *Das U-Boot*
found with Coverity Scan.

- *New Defects Found:* 3
- 5 defect(s), reported by Coverity Scan earlier, were marked fixed in
the recent build analyzed by Coverity Scan.
- *Defects Shown:* Showing 3 of 3 defect(s)

Defect Details

** CID 573150: Integer handling issues (INTEGER_OVERFLOW)
/drivers/pci/pci-uclass.c: 1531 in dm_pci_map_ea_virt()

_____________________________________________________________________________________________
*** CID 573150: Integer handling issues (INTEGER_OVERFLOW)
/drivers/pci/pci-uclass.c: 1531 in dm_pci_map_ea_virt()
1525 if (ea_entry & PCI_EA_IS_64) {
1526 /* MaxOffset 2nd DW */
1527 dm_pci_read_config32(dev, ea_off + 16, &ea_entry);
1528 sz |= ((u64)ea_entry) << 32;
1529 }
1530
>>> CID 573150: Integer handling issues (INTEGER_OVERFLOW)
>>> Expression "sz + 1UL", where "sz" is known to be equal to 18446744073709551615, overflows the type of "sz + 1UL", which is type "unsigned long".
1531 addr = (pdata->virtid - 1) * (sz + 1);
1532 }
1533
1534 return addr;
1535 }
1536

** CID 573149: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/lib/efi_loader/efi_file.c: 594 in efi_file_read_int()

_____________________________________________________________________________________________
*** CID 573149: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/lib/efi_loader/efi_file.c: 594 in efi_file_read_int()
588
589 bs = *buffer_size;
590 if (fh->isdir)
591 ret = dir_read(fh, &bs, buffer);
592 else
593 ret = file_read(fh, &bs, buffer);
>>> CID 573149: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
>>> "bs <= 18446744073709551615ULL /* 9223372036854775807LL * 2ULL + 1ULL */" is always true regardless of the values of its operands. This occurs as the logical operand of "if".
594 if (bs <= SIZE_MAX)
595 *buffer_size = bs;
596 else
597 *buffer_size = SIZE_MAX;
598
599 return ret;

** CID 573148: Integer handling issues (INTEGER_OVERFLOW)
/drivers/pci/pci-uclass.c: 1581 in dm_pci_map_ea_bar()

_____________________________________________________________________________________________
*** CID 573148: Integer handling issues (INTEGER_OVERFLOW)
/drivers/pci/pci-uclass.c: 1581 in dm_pci_map_ea_bar()
1575 addr |= ((u64)ea_entry) << 32;
1576 }
1577
1578 if (IS_ENABLED(CONFIG_PCI_SRIOV))
1579 addr += dm_pci_map_ea_virt(dev, ea_off, pdata);
1580
>>> CID 573148: Integer handling issues (INTEGER_OVERFLOW)
>>> Expression "4294967295U - addr", where "addr" is known to be equal to 4294967292, underflows the type of "4294967295U - addr", which is type "unsigned int".
1581 if (~((phys_addr_t)0) - addr < offset)
1582 return NULL;
1583
1584 /* size ignored for now */
1585 return map_physmem(addr + offset, len, MAP_NOCACHE);
1586 }

View Defects in Coverity Scan
<https://scan.coverity.com/projects/das-u-boot?tab=overview>

Best regards,

The Coverity Scan Admin Team

----- End forwarded message -----

--
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]