Here's the latest report. Since it says 20 out of 25, I downloaded a report as well and the 5 not listed here are:
CID 470520, Uninitialized scalar variable,
lib/zstd/decompress/zstd_decompress.c, ZSTD_errorFrameSizeInfo
CID 470520: (#1 of 1): Uninitialized scalar variable (UNINIT)
2. uninit_use: Using uninitialized value frameSizeInfo. Field
frameSizeInfo.nbBlocks is uninitialized.
700 return frameSizeInfo;
CID 661171, Untrusted pointer read, cmd/gpio.c, do_gpio
CID 661171: (#1 of 1): Untrusted pointer read (TAINTED_SCALAR)
16. tainted_data: Using tainted variable offset as an index to pointer
uc_priv->name.
Ensure that tainted values are properly sanitized, by checking that their
values are within a permissible range.
238 printf("gpio: pin %s (gpio %u) already claimed by '%s'\n",
239 str_gpio, gpio, uc_priv->name[offset]);
CID 661172, Overflowed constant, test/boot/fit_cipher.c,
fit_cipher_test_oversized_unciphered_size
info.size_unciphered = sizeof(cipher) + 1;
2. function_return: Function image_aes_decrypt(&info, cipher, 32UL,
&data, &size) returns -22.
3. known_value_assign: ret = image_aes_decrypt(&info, cipher, 32UL,
&data, &size), its value is now -22.
65 ret = image_aes_decrypt(&info, cipher, sizeof(cipher), &data, &size);
CID 661172: (#1 of 1): Overflowed constant (INTEGER_OVERFLOW)
4. overflow_const: Expression _val2, where ret is known to be equal to -22,
overflows the type of _val2, which is type unsigned int.
66 ut_asserteq(-EINVAL, ret);
CID 661173, String not null terminated, boot/bootmeth_bls.c,bls_boot
CID 661173: (#1 of 1): String not null terminated (STRING_NULL)
7. string_null: Passing unterminated string label->name to parse_label_keys,
which expects a null-terminated string.[show details]
309 ret = parse_label_keys(&body, &scratch, label, true);
310 if (ret < 0)
CID 661174, Unchecked return value from library, drivers/fastboot/fb_usb.c,
fastboot_usb_run
CID 661174: (#1 of 1): Unchecked return value from library (CHECKED_RETURN)
7. check_return: Calling getchar() without checking return value. This library
function may fail and return an error code. [Note: The source code
implementation of the function has been overridden by a builtin model.]
48 getchar();
And I can provide more details on those specific issues if someone is
looking at them and doesn't otherwise spot a problem.
---------- Forwarded message ---------
From: <[email protected]>
Date: Mon, Oct 26, 2026 at 6:53 PM
Subject: New Defects reported by Coverity Scan for Das U-Boot
To: <[email protected]>
Hi,
Please find the latest report on new defect(s) introduced to *Das U-Boot*
found with Coverity Scan.
- *New Defects Found:* 25
- 13 defect(s), reported by Coverity Scan earlier, were marked fixed in
the recent build analyzed by Coverity Scan.
- *Defects Shown:* Showing 20 of 25 defect(s)
Defect Details
** CID 661194: (CHECKED_RETURN)
/drivers/video/panel-startek-kd070fhfid015.c: 173 in
stk015_panel_enable_backlight()
/drivers/video/panel-startek-kd070fhfid015.c: 171 in
stk015_panel_enable_backlight()
_____________________________________________________________________________________________
*** CID 661194: (CHECKED_RETURN)
/drivers/video/panel-startek-kd070fhfid015.c: 173 in
stk015_panel_enable_backlight()
167
168 return 0;
169
170 poweroff:
171 regulator_disable(stk->power);
172 iovccoff:
>>> CID 661194: (CHECKED_RETURN)
>>> Calling "regulator_set_enable_if_allowed" without checking return value
>>> (as is done elsewhere 59 out of 71 times).
173 regulator_disable(stk->iovcc);
174 dm_gpio_set_value(stk->reset_gpio, 0);
175 dm_gpio_set_value(stk->enable_gpio, 0);
176 detach:
177 mipi_dsi_detach(dsi);
178
/drivers/video/panel-startek-kd070fhfid015.c: 171 in
stk015_panel_enable_backlight()
165 goto poweroff;
166 }
167
168 return 0;
169
170 poweroff:
>>> CID 661194: (CHECKED_RETURN)
>>> Calling "regulator_set_enable_if_allowed" without checking return value
>>> (as is done elsewhere 59 out of 71 times).
171 regulator_disable(stk->power);
172 iovccoff:
173 regulator_disable(stk->iovcc);
174 dm_gpio_set_value(stk->reset_gpio, 0);
175 dm_gpio_set_value(stk->enable_gpio, 0);
176 detach:
** CID 661193: Control flow issues (DEADCODE)
/boot/bootm.c: 741 in bootm_lz4_uncompressed_size()
_____________________________________________________________________________________________
*** CID 661193: Control flow issues (DEADCODE)
/boot/bootm.c: 741 in bootm_lz4_uncompressed_size()
735 if (version != 1 || !indep_blocks || (flg & 3) || (bd & 0x8f) ||
736 !has_content_size)
737 return 0;
738 if (len < 4 + 2 + 8)
739 return 0;
740 cs = get_unaligned_le64(b + 6);
>>> CID 661193: Control flow issues (DEADCODE)
>>> Execution cannot reach the expression "0UL" inside this statement:
>>> "return (cs > 18446744073709...".
741 return cs > ULONG_MAX ? 0 : (ulong)cs;
742 }
743 #endif
744
745 #if CONFIG_IS_ENABLED(ZSTD)
746 /*
** CID 661192: Control flow issues (DEADCODE)
/scripts/dtc/pylibfdt/libfdt_wrap.c: 4889 in _wrap_fdt_get_path()
_____________________________________________________________________________________________
*** CID 661192: Control flow issues (DEADCODE)
/scripts/dtc/pylibfdt/libfdt_wrap.c: 4889 in _wrap_fdt_get_path()
4883 result = (int)fdt_get_path((void const *)arg1,arg2,arg3,arg4);
4884 resultobj = SWIG_From_int((int)(result));
4885 resultobj = SWIG_Python_AppendOutput(resultobj,
SWIG_FromCharPtr(arg3));
4886 if (buff3) free((char*)buff3);
4887 return resultobj;
4888 fail:
>>> CID 661192: Control flow issues (DEADCODE)
>>> Execution cannot reach this statement: "free((char *)buff3);".
4889 if (buff3) free((char*)buff3);
4890 return NULL;
4891 }
4892
4893
4894 SWIGINTERN PyObject *_wrap_fdt_magic(PyObject *self, PyObject *args) {
** CID 661191: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/boot/bootm.c: 709 in bootm_lzma_uncompressed_size()
_____________________________________________________________________________________________
*** CID 661191: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/boot/bootm.c: 709 in bootm_lzma_uncompressed_size()
703 const u8 *b = src;
704 u64 usize;
705
706 if (len < LZMA_PROPS_SIZE + 8)
707 return 0;
708 usize = get_unaligned_le64(b + LZMA_PROPS_SIZE);
>>> CID 661191: Integer handling issues
>>> (CONSTANT_EXPRESSION_RESULT)
>>> "usize > 18446744073709551615ULL /* 9223372036854775807L * 2UL + 1UL
>>> */" is always false regardless of the values of its operands. This occurs
>>> as the logical second operand of "||".
709 if (usize == U64_MAX || usize > ULONG_MAX)
710 return 0;
711 return (ulong)usize;
712 }
713 #endif
714
** CID 661190: Incorrect expression (COPY_PASTE_ERROR)
/lib/efi_selftest/efi_selftest_fmp.c: 139 in test_fmp()
_____________________________________________________________________________________________
*** CID 661190: Incorrect expression (COPY_PASTE_ERROR)
/lib/efi_selftest/efi_selftest_fmp.c: 139 in test_fmp()
133
134 /*
135 * When support for authentication is compiled in, our
updatable
136 * images must require it, both as supported and set.
137 */
138 if (IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE) &&
>>> CID 661190: Incorrect expression (COPY_PASTE_ERROR)
>>> "attr_set" in "attr_set & 1ULL" looks like a copy-paste error.
139 (attr_set & IMAGE_ATTRIBUTE_IMAGE_UPDATABLE) &&
140 !(attr_supp &
IMAGE_ATTRIBUTE_AUTHENTICATION_REQUIRED)) {
141 efi_st_error("Bad AttributesSupported %u\n",
142 (unsigned int)attr_supp);
143 goto out;
144 }
** CID 661189: (CHECKED_RETURN)
/drivers/video/panel-startek-kd070fhfid078.c: 277 in
stk078_panel_enable_backlight()
/drivers/video/panel-startek-kd070fhfid078.c: 282 in
stk078_panel_enable_backlight()
/drivers/video/panel-startek-kd070fhfid078.c: 279 in
stk078_panel_enable_backlight()
_____________________________________________________________________________________________
*** CID 661189: (CHECKED_RETURN)
/drivers/video/panel-startek-kd070fhfid078.c: 277 in
stk078_panel_enable_backlight()
271
272 out_vdd:
273 dm_gpio_set_value(stk->reset_gpio, 0);
274 udelay(100);
275 if (stk->enable_gpio)
276 dm_gpio_set_value(stk->enable_gpio, 0);
>>> CID 661189: (CHECKED_RETURN)
>>> Calling "regulator_set_enable_if_allowed" without checking return value
>>> (as is done elsewhere 59 out of 71 times).
277 regulator_disable(stk->vdd);
278 out_iovcc:
279 regulator_disable(stk->iovcc);
280 out_vddp:
281 if (stk->vddp)
282 regulator_disable(stk->vddp);
/drivers/video/panel-startek-kd070fhfid078.c: 282 in
stk078_panel_enable_backlight()
276 dm_gpio_set_value(stk->enable_gpio, 0);
277 regulator_disable(stk->vdd);
278 out_iovcc:
279 regulator_disable(stk->iovcc);
280 out_vddp:
281 if (stk->vddp)
>>> CID 661189: (CHECKED_RETURN)
>>> Calling "regulator_set_enable_if_allowed" without checking return value
>>> (as is done elsewhere 59 out of 71 times).
282 regulator_disable(stk->vddp);
283 out_detach:
284 mipi_dsi_detach(dsi);
285
286 return ret;
287 }
/drivers/video/panel-startek-kd070fhfid078.c: 279 in
stk078_panel_enable_backlight()
273 dm_gpio_set_value(stk->reset_gpio, 0);
274 udelay(100);
275 if (stk->enable_gpio)
276 dm_gpio_set_value(stk->enable_gpio, 0);
277 regulator_disable(stk->vdd);
278 out_iovcc:
>>> CID 661189: (CHECKED_RETURN)
>>> Calling "regulator_set_enable_if_allowed" without checking return value
>>> (as is done elsewhere 59 out of 71 times).
279 regulator_disable(stk->iovcc);
280 out_vddp:
281 if (stk->vddp)
282 regulator_disable(stk->vddp);
283 out_detach:
284 mipi_dsi_detach(dsi);
** CID 661188: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/boot/bootm.c: 741 in bootm_lz4_uncompressed_size()
_____________________________________________________________________________________________
*** CID 661188: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/boot/bootm.c: 741 in bootm_lz4_uncompressed_size()
735 if (version != 1 || !indep_blocks || (flg & 3) || (bd & 0x8f) ||
736 !has_content_size)
737 return 0;
738 if (len < 4 + 2 + 8)
739 return 0;
740 cs = get_unaligned_le64(b + 6);
>>> CID 661188: Integer handling issues
>>> (CONSTANT_EXPRESSION_RESULT)
>>> "cs > 18446744073709551615ULL /* 9223372036854775807L * 2UL + 1UL */"
>>> is always false regardless of the values of its operands. This occurs as
>>> the logical first operand of "?:".
741 return cs > ULONG_MAX ? 0 : (ulong)cs;
742 }
743 #endif
744
745 #if CONFIG_IS_ENABLED(ZSTD)
746 /*
** CID 661187: (TAINTED_SCALAR)
_____________________________________________________________________________________________
*** CID 661187: (TAINTED_SCALAR)
/drivers/fastboot/fb_command.c: 952 in flashing_unlock_allowed()
946 sha256_update(&ctx, buf, cnt * info.blksz);
947 last = buf[cnt * info.blksz - 1];
948 }
949 sha256_finish(&ctx, digest);
950 allowed = !memcmp(stored, digest, SHA256_SUM_LEN) && last;
951 out:
>>> CID 661187: (TAINTED_SCALAR)
>>> Passing tainted expression "*buf" to "dlfree", which uses it as an
>>> offset.
952 free(buf);
953
954 return allowed;
955 }
956
957 /**
/drivers/fastboot/fb_command.c: 940 in flashing_unlock_allowed()
934
935 sha256_starts(&ctx);
936 for (blk = 0; blk < info.size; blk += cnt) {
937 cnt = info.size - blk;
938 if (cnt > FLASHING_FRP_CHUNK)
939 cnt = FLASHING_FRP_CHUNK;
>>> CID 661187: (TAINTED_SCALAR)
>>> Passing tainted expression "*buf" to "blk_dread", which uses it as an
>>> offset.
940 if (blk_dread(desc, info.start + blk, cnt, buf) != cnt)
941 goto out;
942 if (!blk) {
943 memcpy(stored, buf, SHA256_SUM_LEN);
944 memset(buf, 0, SHA256_SUM_LEN);
945 }
/drivers/fastboot/fb_command.c: 952 in flashing_unlock_allowed()
946 sha256_update(&ctx, buf, cnt * info.blksz);
947 last = buf[cnt * info.blksz - 1];
948 }
949 sha256_finish(&ctx, digest);
950 allowed = !memcmp(stored, digest, SHA256_SUM_LEN) && last;
951 out:
>>> CID 661187: (TAINTED_SCALAR)
>>> Passing tainted expression "*buf" to "dlfree", which uses it as an
>>> offset.
952 free(buf);
953
954 return allowed;
955 }
956
957 /**
/drivers/fastboot/fb_command.c: 940 in flashing_unlock_allowed()
934
935 sha256_starts(&ctx);
936 for (blk = 0; blk < info.size; blk += cnt) {
937 cnt = info.size - blk;
938 if (cnt > FLASHING_FRP_CHUNK)
939 cnt = FLASHING_FRP_CHUNK;
>>> CID 661187: (TAINTED_SCALAR)
>>> Passing tainted expression "*buf" to "blk_dread", which uses it as an
>>> offset.
940 if (blk_dread(desc, info.start + blk, cnt, buf) != cnt)
941 goto out;
942 if (!blk) {
943 memcpy(stored, buf, SHA256_SUM_LEN);
944 memset(buf, 0, SHA256_SUM_LEN);
945 }
** CID 661186: Insecure data handling (INTEGER_OVERFLOW)
/boot/imagemap.c: 409 in imagemap_blk_reader()
_____________________________________________________________________________________________
*** CID 661186: Insecure data handling (INTEGER_OVERFLOW)
/boot/imagemap.c: 409 in imagemap_blk_reader()
403 */
404 if (desc->hwpart != bp->hwpart) {
405 blk_dselect_hwpart(desc, bp->hwpart);
406 desc->hwpart = bp->hwpart;
407 }
408
>>> CID 661186: Insecure data handling (INTEGER_OVERFLOW)
>>> "blk_dread(desc, bp->part_start + blk_off, count, buf) <<
>>> desc->log2blksz", which might have overflowed, is returned from the
>>> function.
409 return blk_dread(desc, bp->part_start + blk_off, count, buf)
410 << desc->log2blksz;
411 }
412
413 static int imagemap_probe(struct udevice *dev)
414 {
** CID 661185: (DEADCODE)
/lib/zstd/decompress/zstd_decompress_block.c: 2123 in
ZSTD_decompressBlock_internal()
/lib/zstd/decompress/zstd_decompress_block.c: 2133 in
ZSTD_decompressBlock_internal()
_____________________________________________________________________________________________
*** CID 661185: (DEADCODE)
/lib/zstd/decompress/zstd_decompress_block.c: 2123 in
ZSTD_decompressBlock_internal()
2117 "invalid dst");
2118
2119 /* If we could potentially have long offsets, or we
might want to use the prefetch decoder,
2120 * compute information about the share of long
offsets, and the maximum nbAdditionalBits.
2121 * NOTE: could probably use a larger nbSeq limit
2122 */
>>> CID 661185: (DEADCODE)
>>> Execution cannot reach the expression "totalHistorySize > 16777216UL"
>>> inside this statement: "if (isLongOffset || (!usePr...".
2123 if (isLongOffset || (!usePrefetchDecoder &&
(totalHistorySize > (1u << 24)) && (nbSeq > 8))) {
2124 ZSTD_OffsetInfo const info =
ZSTD_getOffsetInfo(dctx->OFTptr, nbSeq);
2125 if (isLongOffset && info.maxNbAdditionalBits <=
STREAM_ACCUMULATOR_MIN) {
2126 /* If isLongOffset, but the maximum number of
additional bits that we see in our table is small
2127 * enough, then we know it is impossible to
have too long an offset in this block, so we can
2128 * use the regular offset decoder.
/lib/zstd/decompress/zstd_decompress_block.c: 2133 in
ZSTD_decompressBlock_internal()
2127 * enough, then we know it is impossible to
have too long an offset in this block, so we can
2128 * use the regular offset decoder.
2129 */
2130 isLongOffset = ZSTD_lo_isRegularOffset;
2131 }
2132 if (!usePrefetchDecoder) {
>>> CID 661185: (DEADCODE)
>>> Execution cannot reach the expression "minShare" inside this statement:
>>> "minShare = (MEM_64bits() ? ...".
2133 U32 const minShare = MEM_64bits() ? 7 : 20;
/* heuristic values, correspond to 2.73% and 7.81% */
2134 usePrefetchDecoder = (info.longOffsetShare >=
minShare);
2135 }
2136 }
2137
2138 dctx->ddictIsCold = 0;
** CID 661184: Error handling issues (CHECKED_RETURN)
/lib/zstd/common/fse.h: 509 in FSE_initDState()
_____________________________________________________________________________________________
*** CID 661184: Error handling issues (CHECKED_RETURN)
/lib/zstd/common/fse.h: 509 in FSE_initDState()
503
504 MEM_STATIC void FSE_initDState(FSE_DState_t* DStatePtr,
BIT_DStream_t* bitD, const FSE_DTable* dt)
505 {
506 const void* ptr = dt;
507 const FSE_DTableHeader* const DTableH = (const
FSE_DTableHeader*)ptr;
508 DStatePtr->state = BIT_readBits(bitD, DTableH->tableLog);
>>> CID 661184: Error handling issues (CHECKED_RETURN)
>>> Calling "BIT_reloadDStream" without checking return value (as is done
>>> elsewhere 4 out of 5 times).
509 BIT_reloadDStream(bitD);
510 DStatePtr->table = dt + 1;
511 }
512
513 MEM_STATIC BYTE FSE_peekSymbol(const FSE_DState_t* DStatePtr)
514 {
** CID 661183: Error handling issues (CHECKED_RETURN)
/drivers/serial/ns16550.c: 525 in ns16550_serial_probe()
_____________________________________________________________________________________________
*** CID 661183: Error handling issues (CHECKED_RETURN)
/drivers/serial/ns16550.c: 525 in ns16550_serial_probe()
519 if (IS_ENABLED(CONFIG_NS16550_CLK_ENABLE) &&
520 CONFIG_IS_ENABLED(CLK)) {
521 struct clk_bulk clk_bulk;
522
523 ret = clk_get_bulk(dev, &clk_bulk);
524 if (!ret)
>>> CID 661183: Error handling issues (CHECKED_RETURN)
>>> Calling "clk_enable_bulk" without checking return value (as is done
>>> elsewhere 16 out of 20 times).
525 clk_enable_bulk(&clk_bulk);
526 }
527
528 com_port->plat = dev_get_plat(dev);
529 ns16550_init(com_port, -1);
530
** CID 661182: Control flow issues (DEADCODE)
/lib/qrcodegen_gzip.c: 28 in qrcodegen_encodeBinaryCompressed()
_____________________________________________________________________________________________
*** CID 661182: Control flow issues (DEADCODE)
/lib/qrcodegen_gzip.c: 28 in qrcodegen_encodeBinaryCompressed()
22 if (qrcodegen_encodeBinary(dataAndTemp, dataLen, qrcode, ecl,
23 qrcodegen_VERSION_MIN, qrcodegen_VERSION_MAX,
24 qrcodegen_Mask_AUTO, true))
25 return true;
26
27 if (buf_max < QRGZ_MAGIC_LEN)
>>> CID 661182: Control flow issues (DEADCODE)
>>> Execution cannot reach this statement: "return false;".
28 return false;
29
30 scratch = qrcode;
31 out_len = buf_max;
32 if (gzip(scratch, &out_len, dataAndTemp, dataLen) != 0)
33 return false;
** CID 661181: Insecure data handling (TAINTED_SCALAR)
/tools/fit_image.c: 1295 in fit_props_equal()
_____________________________________________________________________________________________
*** CID 661181: Insecure data handling (TAINTED_SCALAR)
/tools/fit_image.c: 1295 in fit_props_equal()
1289 const void *a, *b;
1290 int len_a, len_b;
1291
1292 a = fdt_getprop(fdt, node_a, prop, &len_a);
1293 b = fdt_getprop(fdt, node_b, prop, &len_b);
1294
>>> CID 661181: Insecure data handling (TAINTED_SCALAR)
>>> Passing tainted expression "len_a" to "memcmp", which uses it as an
>>> offset. [Note: The source code implementation of the function has been
>>> overridden by a builtin model.]
1295 return a && b && len_a == len_b && !memcmp(a, b, len_a);
1296 }
1297
1298 /**
1299 * fit_check_shared_cipher() - Check cipher settings of
images sharing data
1300 *
** CID 661180: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/boot/bootm.c: 764 in bootm_zstd_uncompressed_size()
_____________________________________________________________________________________________
*** CID 661180: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/boot/bootm.c: 764 in bootm_zstd_uncompressed_size()
758
759 ret = zstd_get_frame_header(&hdr, src, len);
760 if (zstd_is_error(ret) || ret > 0)
761 return 0;
762 if (hdr.frameContentSize == ZSTD_CONTENTSIZE_UNKNOWN ||
763 hdr.frameContentSize == ZSTD_CONTENTSIZE_ERROR ||
>>> CID 661180: Integer handling issues
>>> (CONSTANT_EXPRESSION_RESULT)
>>> "hdr.frameContentSize > 18446744073709551615ULL /* 9223372036854775807L
>>> * 2UL + 1UL */" is always false regardless of the values of its operands.
>>> This occurs as the logical second operand of "||".
764 hdr.frameContentSize > ULONG_MAX)
765 return 0;
766 return (ulong)hdr.frameContentSize;
767 }
768 #endif
769
** CID 661179: Integer handling issues (INTEGER_OVERFLOW)
/test/lib/part_efi.c: 261 in lib_test_gpt_blkmap()
_____________________________________________________________________________________________
*** CID 661179: Integer handling issues (INTEGER_OVERFLOW)
/test/lib/part_efi.c: 261 in lib_test_gpt_blkmap()
255 gpt_head =
malloc_cache_aligned(roundup(sizeof(gpt_header),
256 blksz));
257 ret = gpt_head ? blkmap_create(GPT_TEST_LABEL, &dev) :
-ENOMEM;
258 if (ret) {
259 free(gpt_head);
260 free(buf);
>>> CID 661179: Integer handling issues (INTEGER_OVERFLOW)
>>> Expression "_val2", where "ret" is known to be equal to -12, overflows
>>> the type of "_val2", which is type "unsigned int".
261 ut_assertok(ret);
262 }
263
264 /*
265 * A failed check returns early, so clean up here
rather than
266 * in the helper. The device lives under the real
dm_root, and
** CID 661178: Control flow issues (NO_EFFECT)
/drivers/mmc/spacemit_sdhci.c: 476 in spacemit_sdhci_execute_tuning()
_____________________________________________________________________________________________
*** CID 661178: Control flow issues (NO_EFFECT)
/drivers/mmc/spacemit_sdhci.c: 476 in
spacemit_sdhci_execute_tuning()
470 int retry_count = ARRAY_SIZE(retry_delays);
471
472 log_warning("Primary delay %d failed, trying
alternatives\n",
473 final_delay);
474
475 for (i = 0; i < retry_count; i++) {
>>> CID 661178: Control flow issues (NO_EFFECT)
>>> This greater-than-or-equal-to-zero comparison of an unsigned value is
>>> always true. "retry_delays[i] >= 0".
476 if (retry_delays[i] >=
SPACEMIT_RX_TUNE_DELAY_MIN &&
477 retry_delays[i] <=
SPACEMIT_RX_TUNE_DELAY_MAX) {
478 spacemit_sdhci_set_rx_delay(host,
retry_delays[i]);
479 ret = mmc_send_tuning(host->mmc,
opcode);
480 if (!ret) {
481 final_delay = retry_delays[i];
** CID 661177: Insecure data handling (TAINTED_SCALAR)
/drivers/misc/spi_eeprom_emul.c: 98 in sandbox_spi_eeprom_probe()
_____________________________________________________________________________________________
*** CID 661177: Insecure data handling (TAINTED_SCALAR)
/drivers/misc/spi_eeprom_emul.c: 98 in sandbox_spi_eeprom_probe()
92 SANDBOX_SPI_EEPROM_SIZE);
93 priv->data = calloc(1, priv->size);
94 if (!priv->data)
95 return -ENOMEM;
96
97 /* Fill with a known pattern so reads can be verified */
>>> CID 661177: Insecure data handling (TAINTED_SCALAR)
>>> Using tainted variable "priv->size" as a loop boundary.
98 for (i = 0; i < priv->size; i++)
99 priv->data[i] = i & 0xff;
100
101 return 0;
102 }
103
** CID 661176: Error handling issues (CHECKED_RETURN)
/drivers/mmc/axiado_sdhci.c: 138 in axiado_sdhci_execute_tuning()
_____________________________________________________________________________________________
*** CID 661176: Error handling issues (CHECKED_RETURN)
/drivers/mmc/axiado_sdhci.c: 138 in axiado_sdhci_execute_tuning()
132 sdhci_writew(host,
133
SDHCI_MAKE_BLKSZ(SDHCI_DEFAULT_BOUNDARY_ARG, data.blocksize),
134 SDHCI_BLOCK_SIZE);
135 sdhci_writew(host, data.blocks, SDHCI_BLOCK_COUNT);
136 sdhci_writew(host, SDHCI_TRNS_READ,
SDHCI_TRANSFER_MODE);
137
>>> CID 661176: Error handling issues (CHECKED_RETURN)
>>> Calling "mmc_send_cmd" without checking return value (as is done
>>> elsewhere 37 out of 46 times).
138 mmc_send_cmd(mmc, &cmd, NULL);
139
140 ctrl = sdhci_readw(host, SDHCI_HOST_CTRL2);
141
142 if (cmd.cmdidx == MMC_CMD_SEND_TUNING_BLOCK)
143 udelay(1);
** CID 661175: Integer handling issues (INTEGER_OVERFLOW)
/test/boot/fit_cipher.c: 37 in fit_cipher_test_unaligned_len()
_____________________________________________________________________________________________
*** CID 661175: Integer handling issues (INTEGER_OVERFLOW)
/test/boot/fit_cipher.c: 37 in fit_cipher_test_unaligned_len()
31 info.cipher = image_get_cipher_algo("aes128");
32 ut_assertnonnull(info.cipher);
33 info.key = key;
34 info.iv = iv;
35
36 ret = image_aes_decrypt(&info, cipher, sizeof(cipher), &data, &size);
>>> CID 661175: Integer handling issues (INTEGER_OVERFLOW)
>>> Expression "_val2", where "ret" is known to be equal to -22, overflows
>>> the type of "_val2", which is type "unsigned int".
37 ut_asserteq(-EINVAL, ret);
38 ut_assertnull(data);
39
40 return 0;
41 }
42 FIT_CIPHER_TEST(fit_cipher_test_unaligned_len, 0);
View Defects in Coverity Scan
<https://scan.coverity.com/projects/das-u-boot?tab=overview>
Best regards,
The Coverity Scan Admin Team
----- End forwarded message -----
--
Tom
signature.asc
Description: PGP signature
