Hi,
Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
5 new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan. 4 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan Showing 5 of 5 defect(s)
** CID 373584: (BAD_SHIFT) /lib/gpt_rme/gpt_rme.c: 335 in gpt_validate_l0_params() /lib/gpt_rme/gpt_rme.c: 346 in gpt_validate_l0_params()
________________________________________________________________________________________________________ *** CID 373584: (BAD_SHIFT) /lib/gpt_rme/gpt_rme.c: 335 in gpt_validate_l0_params() 329 } 330 gpt_config.pps = pps; 331 gpt_config.t = gpt_t_lookup[pps]; 332 333 /* Alignment must be the greater of 4k or l0 table size. */ 334 l0_alignment = PAGE_SIZE_4KB;
CID 373584: (BAD_SHIFT) In expression "0xffffffffffffffffUL >> 64U - ((gpt_config.t > (unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) ? gpt_config.t - ((unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) : 0U)", right shifting by more than 63 bits has undefined behavior. The shift amount, "64U - ((gpt_config.t > (unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) ? gpt_config.t - ((unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) : 0U)", is 64.
335 if (l0_alignment < GPT_L0_TABLE_SIZE(gpt_config.t)) { 336 l0_alignment = GPT_L0_TABLE_SIZE(gpt_config.t); 337 } 338 339 /* Check base address. */ 340 if ((l0_mem_base == 0U) || ((l0_mem_base & (l0_alignment - 1)) != 0U)) { /lib/gpt_rme/gpt_rme.c: 346 in gpt_validate_l0_params() 340 if ((l0_mem_base == 0U) || ((l0_mem_base & (l0_alignment - 1)) != 0U)) { 341 ERROR("[GPT] Invalid L0 base address: 0x%lx\n", l0_mem_base); 342 return -EFAULT; 343 } 344 345 /* Check size. */
CID 373584: (BAD_SHIFT) In expression "0xffffffffffffffffUL >> 64U - ((gpt_config.t > (unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) ? gpt_config.t - ((unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) : 0U)", right shifting by more than 63 bits has undefined behavior. The shift amount, "64U - ((gpt_config.t > (unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) ? gpt_config.t - ((unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) : 0U)", is 64.
346 if (l0_mem_size < GPT_L0_TABLE_SIZE(gpt_config.t)) { 347 ERROR("[GPT] Inadequate L0 memory: need 0x%lx, have 0x%lx)\n", 348 GPT_L0_TABLE_SIZE(gpt_config.t), 349 l0_mem_size); 350 return -ENOMEM; 351 }
** CID 373583: Memory - corruptions (OVERRUN)
________________________________________________________________________________________________________ *** CID 373583: Memory - corruptions (OVERRUN) /plat/imx/imx7/warp7/warp7_bl2_el3_setup.c: 110 in warp7_usdhc_setup() 104 105 zeromem(¶ms, sizeof(imx_usdhc_params_t)); 106 params.reg_base = PLAT_WARP7_BOOT_MMC_BASE; 107 params.clk_rate = 25000000; 108 params.bus_width = MMC_BUS_WIDTH_8; 109 mmc_info.mmc_dev_type = MMC_IS_EMMC;
CID 373583: Memory - corruptions (OVERRUN) Overrunning struct type imx_usdhc_params_t of 16 bytes by passing it to a function which accesses it at byte offset 23.
110 imx_usdhc_init(¶ms, &mmc_info); 111 } 112 113 static void warp7_setup_usb_clocks(void) 114 { 115 uint32_t usb_en_bits = (uint32_t)USB_CLK_SELECT;
** CID 373582: Null pointer dereferences (NULL_RETURNS) /plat/intel/soc/common/socfpga_storage.c: 171 in socfpga_io_setup()
________________________________________________________________________________________________________ *** CID 373582: Null pointer dereferences (NULL_RETURNS) /plat/intel/soc/common/socfpga_storage.c: 171 in socfpga_io_setup() 165 166 result = io_dev_open(fip_dev_con, (uintptr_t)NULL, &fip_dev_handle); 167 assert(result == 0); 168 169 if (boot_source == BOOT_SOURCE_SDMMC) { 170 partition_init(GPT_IMAGE_ID);
CID 373582: Null pointer dereferences (NULL_RETURNS) Dereferencing "get_partition_entry(a2)", which is known to be "NULL".
171 fip_spec.offset = get_partition_entry(a2)->start; 172 } 173 174 (void)result; 175 } 176
** CID 373581: (BAD_SHIFT) /lib/gpt_rme/gpt_rme.c: 780 in gpt_init_l0_tables() /lib/gpt_rme/gpt_rme.c: 775 in gpt_init_l0_tables()
________________________________________________________________________________________________________ *** CID 373581: (BAD_SHIFT) /lib/gpt_rme/gpt_rme.c: 780 in gpt_init_l0_tables() 774 /* Iterate through all L0 entries */ 775 for (unsigned int i = 0U; i < GPT_L0_REGION_COUNT(gpt_config.t); i++) { 776 ((uint64_t *)l0_mem_base)[i] = gpt_desc; 777 } 778 779 /* Flush updated L0 tables to memory. */
CID 373581: (BAD_SHIFT) In expression "0xffffffffffffffffUL >> 64U - ((gpt_config.t > (unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) ? gpt_config.t - ((unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) : 0U)", right shifting by more than 63 bits has undefined behavior. The shift amount, "64U - ((gpt_config.t > (unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) ? gpt_config.t - ((unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) : 0U)", is 64.
780 flush_dcache_range((uintptr_t)l0_mem_base, 781 (size_t)GPT_L0_TABLE_SIZE(gpt_config.t)); 782 783 /* Stash the L0 base address once initial setup is complete. */ 784 gpt_config.plat_gpt_l0_base = l0_mem_base; 785 /lib/gpt_rme/gpt_rme.c: 775 in gpt_init_l0_tables() 769 } 770 771 /* Create the descriptor to initialize L0 entries with. */ 772 gpt_desc = GPT_L0_BLK_DESC(GPT_GPI_ANY); 773 774 /* Iterate through all L0 entries */
CID 373581: (BAD_SHIFT) In expression "0xffffffffffffffffUL >> 64U - ((gpt_config.t > (unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) ? gpt_config.t - ((unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) : 0U)", right shifting by more than 63 bits has undefined behavior. The shift amount, "64U - ((gpt_config.t > (unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) ? gpt_config.t - ((unsigned int)((read_gpccr_el3() >> 20U) & 0xfUL) + 30U) : 0U)", is 64.
775 for (unsigned int i = 0U; i < GPT_L0_REGION_COUNT(gpt_config.t); i++) { 776 ((uint64_t *)l0_mem_base)[i] = gpt_desc; 777 } 778 779 /* Flush updated L0 tables to memory. */ 780 flush_dcache_range((uintptr_t)l0_mem_base,
** CID 373580: Memory - corruptions (OVERRUN)
________________________________________________________________________________________________________ *** CID 373580: Memory - corruptions (OVERRUN) /plat/imx/imx7/picopi/picopi_bl2_el3_setup.c: 104 in picopi_usdhc_setup() 98 99 zeromem(¶ms, sizeof(imx_usdhc_params_t)); 100 params.reg_base = PLAT_PICOPI_BOOT_MMC_BASE; 101 params.clk_rate = 25000000; 102 params.bus_width = MMC_BUS_WIDTH_8; 103 mmc_info.mmc_dev_type = MMC_IS_EMMC;
CID 373580: Memory - corruptions (OVERRUN) Overrunning struct type imx_usdhc_params_t of 16 bytes by passing it to a function which accesses it at byte offset 23.
104 imx_usdhc_init(¶ms, &mmc_info); 105 } 106 107 static void picopi_setup_usb_clocks(void) 108 { 109 uint32_t usb_en_bits = (uint32_t)USB_CLK_SELECT;
________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0...
tf-a@lists.trustedfirmware.org
-
scan-admin＠coverity.com