New Defects reported by Coverity Scan for ARM-software/arm-trusted-firmware - TF-A

5 Apr 2021


      Hi,
Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
12 new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 12 of 12 defect(s)
** CID 369886:  Uninitialized variables  (UNINIT)
/drivers/nxp/flexspi/nor/fspi.c: 130 in fspi_op_setup()
________________________________________________________________________________________________________
*** CID 369886:  Uninitialized variables  (UNINIT)
/drivers/nxp/flexspi/nor/fspi.c: 130 in fspi_op_setup()
124     		cmd_id2 = FSPI_NOR_CMD_RDSR;
125     		break;
126     	}
127     
128     	x_addr = FSPI_LUTREG_OFFSET + (uint32_t)(0x10 * fspi_op_seq_id);
129     	if ((F_FLASH_SIZE_BYTES <= SZ_16M_BYTES) || (ignore_flash_sz)) {
...
...
...
CID 369886:  Uninitialized variables  (UNINIT)
Using uninitialized value "cmd_id1".

130     		x_instr0 = FSPI_INSTR_OPRND0(cmd_id1);
131     		x_instr1 = FSPI_INSTR_OPRND1(FSPI_LUT_ADDR24BIT);
132     		VERBOSE("CMD_ID = %x offset = 0x%x\n", cmd_id1, x_addr);
133     	} else {
134     		x_instr0 = FSPI_INSTR_OPRND0(cmd_id2);
135     		x_instr1 = FSPI_INSTR_OPRND1(FSPI_LUT_ADDR32BIT);
** CID 369885:  Memory - corruptions  (ARRAY_VS_SINGLETON)
________________________________________________________________________________________________________
*** CID 369885:  Memory - corruptions  (ARRAY_VS_SINGLETON)
/plat/nxp/common/nv_storage/plat_nv_storage.c: 64 in read_nv_app_data()
58     	if (ret != XSPI_SUCCESS) {
59     		ERROR("Failed to initialized driver flexspi-nor.\n");
60     		ERROR("exiting warm-reset request.\n");
61     		return -ENODEV;
62     	}
63
...
...
...
CID 369885:  Memory - corruptions  (ARRAY_VS_SINGLETON)
Passing "(uint32_t *)&nv_app_data" to function "xspi_read" which uses it as an array. This might corrupt or misinterpret adjacent memory locations.

64     	xspi_read(nv_base_addr,
65     		  (uint32_t *)&nv_app_data, sizeof(nv_app_data_t));
66     	xspi_sector_erase((uint32_t) nv_base_addr,
67     				F_SECTOR_ERASE_SZ);
68     #endif
69     	return ret;
** CID 369884:  Memory - corruptions  (ARRAY_VS_SINGLETON)
________________________________________________________________________________________________________
*** CID 369884:  Memory - corruptions  (ARRAY_VS_SINGLETON)
/drivers/brcm/i2c/i2c.c: 669 in i2c_send_byte()
663     	struct iproc_xact_info info;
664     
665     	iproc_i2c_fill_info(&info, bus_id, devaddr, 0U, &value,
666     			    SMBUS_PROT_SEND_BYTE, 0U);
667     
668     	/* Refer to i2c_smbus_write_byte params passed. */
...
...
...
CID 369884:  Memory - corruptions  (ARRAY_VS_SINGLETON)
Passing "info.data" via argument "&info" to function "iproc_i2c_data_send" which uses it as an array. This might corrupt or misinterpret adjacent memory locations.

669     	rc = iproc_i2c_data_send(&info);
670     
671     	if (rc < 0) {
672     		ERROR("%s: %s error accessing device 0x%x\n",
673     		__func__, "Write", devaddr);
674     	}
** CID 369883:  Memory - illegal accesses  (UNINIT)
________________________________________________________________________________________________________
*** CID 369883:  Memory - illegal accesses  (UNINIT)
/drivers/nxp/crypto/caam/src/caam.c: 142 in configure_jr()
136     		return -1;
137     	}
138     
139     	start_jr(num);
140     
141     	/* Do HW configuration of the JR */
...
...
...
CID 369883:  Memory - illegal accesses  (UNINIT)
Using uninitialized value "reg_base_addr" when calling "init_job_ring".

142     	job_ring = init_job_ring(SEC_NOTIFICATION_TYPE_POLL, 0, 0,
143     				 reg_base_addr, 0);
144     
145     	if (job_ring == NULL) {
146     		ERROR("Error in init_job_ring");
147     		return -1;
** CID 369882:    (BAD_SHIFT)
/drivers/nxp/ddr/phy-gen2/phy.c: 2320 in parse_odt()
/drivers/nxp/ddr/phy-gen2/phy.c: 2338 in parse_odt()
/drivers/nxp/ddr/phy-gen2/phy.c: 2308 in parse_odt()
/drivers/nxp/ddr/phy-gen2/phy.c: 2347 in parse_odt()
/drivers/nxp/ddr/phy-gen2/phy.c: 2334 in parse_odt()
/drivers/nxp/ddr/phy-gen2/phy.c: 2329 in parse_odt()
/drivers/nxp/ddr/phy-gen2/phy.c: 2312 in parse_odt()
/drivers/nxp/ddr/phy-gen2/phy.c: 2351 in parse_odt()
/drivers/nxp/ddr/phy-gen2/phy.c: 2298 in parse_odt()
/drivers/nxp/ddr/phy-gen2/phy.c: 2316 in parse_odt()
________________________________________________________________________________________________________
*** CID 369882:    (BAD_SHIFT)
/drivers/nxp/ddr/phy-gen2/phy.c: 2320 in parse_odt()
2314     	case DDR_ODT_OTHER_DIMM:
2315     		for (j = 0; j < DDRC_NUM_CS; j++) {
2316     			if ((((cs_d0 & (1 << i)) != 0) &&
2317     						((cs_d1 & (1 << j)) != 0)) ||
2318     			    (((cs_d1 & (1 << i)) != 0) &&
2319     						((cs_d0 & (1 << j)) != 0))) {
...
...
...
CID 369882:    (BAD_SHIFT)
In expression "1 << i", shifting by a negative amount has undefined behavior.  The shift amount, "i", is no more than -1.

2320     				odt[j] |= (1 << i) << shift;
2321     			}
2322     		}
2323     		break;
2324     	case DDR_ODT_ALL:
2325     		for (j = 0; j < DDRC_NUM_CS; j++) {
/drivers/nxp/ddr/phy-gen2/phy.c: 2338 in parse_odt()
2332     	case DDR_ODT_SAME_DIMM:
2333     		for (j = 0; j < DDRC_NUM_CS; j++) {
2334     			if ((((cs_d0 & (1 << i)) != 0) &&
2335     						((cs_d0 & (1 << j)) != 0)) ||
2336     			    (((cs_d1 & (1 << i)) != 0) &&
2337     						((cs_d1 & (1 << j)) != 0))) {
...
...
...
CID 369882:    (BAD_SHIFT)
In expression "1 << i", shifting by a negative amount has undefined behavior.  The shift amount, "i", is no more than -1.

2338     				odt[j] |= (1 << i) << shift;
2339     			}
2340     		}
2341     		break;
2342     	case DDR_ODT_OTHER_CS_ONSAMEDIMM:
2343     		for (j = 0; j < DDRC_NUM_CS; j++) {
/drivers/nxp/ddr/phy-gen2/phy.c: 2308 in parse_odt()
2302     			if (i == j) {
2303     				continue;
2304     			}
2305     			if (((cs_d0 | cs_d1) & (1 << j)) == 0) {
2306     				continue;
2307     			}
...
...
...
CID 369882:    (BAD_SHIFT)
In expression "1 << i", shifting by a negative amount has undefined behavior.  The shift amount, "i", is no more than -1.

2308     			odt[j] |= (1 << i) << shift;
2309     		}
2310     		break;
2311     	case DDR_ODT_CS_AND_OTHER_DIMM:
2312     		odt[i] |= (1 << i) << 4;
2313     		/* fallthrough */
/drivers/nxp/ddr/phy-gen2/phy.c: 2347 in parse_odt()
2341     		break;
2342     	case DDR_ODT_OTHER_CS_ONSAMEDIMM:
2343     		for (j = 0; j < DDRC_NUM_CS; j++) {
2344     			if (i == j) {
2345     				continue;
2346     			}
...
...
...
CID 369882:    (BAD_SHIFT)
In expression "1 << i", shifting by a negative amount has undefined behavior.  The shift amount, "i", is no more than -1.

2347     			if ((((cs_d0 & (1 << i)) != 0) &&
2348     						((cs_d0 & (1 << j)) != 0)) ||
2349     			    (((cs_d1 & (1 << i)) != 0) &&
2350     						((cs_d1 & (1 << j)) != 0))) {
2351     				odt[j] |= (1 << i) << shift;
2352     			}
/drivers/nxp/ddr/phy-gen2/phy.c: 2334 in parse_odt()
2328     			}
2329     			odt[j] |= (1 << i) << shift;
2330     		}
2331     		break;
2332     	case DDR_ODT_SAME_DIMM:
2333     		for (j = 0; j < DDRC_NUM_CS; j++) {
...
...
...
CID 369882:    (BAD_SHIFT)
In expression "1 << i", shifting by a negative amount has undefined behavior.  The shift amount, "i", is no more than -1.

2334     			if ((((cs_d0 & (1 << i)) != 0) &&
2335     						((cs_d0 & (1 << j)) != 0)) ||
2336     			    (((cs_d1 & (1 << i)) != 0) &&
2337     						((cs_d1 & (1 << j)) != 0))) {
2338     				odt[j] |= (1 << i) << shift;
2339     			}
/drivers/nxp/ddr/phy-gen2/phy.c: 2329 in parse_odt()
2323     		break;
2324     	case DDR_ODT_ALL:
2325     		for (j = 0; j < DDRC_NUM_CS; j++) {
2326     			if (((cs_d0 | cs_d1) & (1 << j)) == 0) {
2327     				continue;
2328     			}
...
...
...
CID 369882:    (BAD_SHIFT)
In expression "1 << i", shifting by a negative amount has undefined behavior.  The shift amount, "i", is no more than -1.

2329     			odt[j] |= (1 << i) << shift;
2330     		}
2331     		break;
2332     	case DDR_ODT_SAME_DIMM:
2333     		for (j = 0; j < DDRC_NUM_CS; j++) {
2334     			if ((((cs_d0 & (1 << i)) != 0) &&
/drivers/nxp/ddr/phy-gen2/phy.c: 2312 in parse_odt()
2306     				continue;
2307     			}
2308     			odt[j] |= (1 << i) << shift;
2309     		}
2310     		break;
2311     	case DDR_ODT_CS_AND_OTHER_DIMM:
...
...
...
CID 369882:    (BAD_SHIFT)
In expression "1 << i", shifting by a negative amount has undefined behavior.  The shift amount, "i", is no more than -1.

2312     		odt[i] |= (1 << i) << 4;
2313     		/* fallthrough */
2314     	case DDR_ODT_OTHER_DIMM:
2315     		for (j = 0; j < DDRC_NUM_CS; j++) {
2316     			if ((((cs_d0 & (1 << i)) != 0) &&
2317     						((cs_d1 & (1 << j)) != 0)) ||
/drivers/nxp/ddr/phy-gen2/phy.c: 2351 in parse_odt()
2345     				continue;
2346     			}
2347     			if ((((cs_d0 & (1 << i)) != 0) &&
2348     						((cs_d0 & (1 << j)) != 0)) ||
2349     			    (((cs_d1 & (1 << i)) != 0) &&
2350     						((cs_d1 & (1 << j)) != 0))) {
...
...
...
CID 369882:    (BAD_SHIFT)
In expression "1 << i", shifting by a negative amount has undefined behavior.  The shift amount, "i", is no more than -1.

2351     				odt[j] |= (1 << i) << shift;
2352     			}
2353     		}
2354     		break;
2355     	case DDR_ODT_NEVER:
2356     		break;
/drivers/nxp/ddr/phy-gen2/phy.c: 2298 in parse_odt()
2292     
2293     	if (i < 0 || i > 3) {
2294     		printf("Error: invalid chip-select value\n");
2295     	}
2296     	switch (val) {
2297     	case DDR_ODT_CS:
...
...
...
CID 369882:    (BAD_SHIFT)
In expression "1 << i", shifting by a negative amount has undefined behavior.  The shift amount, "i", is no more than -1.

2298     		odt[i] |= (1 << i) << shift;
2299     		break;
2300     	case DDR_ODT_ALL_OTHER_CS:
2301     		for (j = 0; j < DDRC_NUM_CS; j++) {
2302     			if (i == j) {
2303     				continue;
/drivers/nxp/ddr/phy-gen2/phy.c: 2316 in parse_odt()
2310     		break;
2311     	case DDR_ODT_CS_AND_OTHER_DIMM:
2312     		odt[i] |= (1 << i) << 4;
2313     		/* fallthrough */
2314     	case DDR_ODT_OTHER_DIMM:
2315     		for (j = 0; j < DDRC_NUM_CS; j++) {
...
...
...
CID 369882:    (BAD_SHIFT)
In expression "1 << i", shifting by a negative amount has undefined behavior.  The shift amount, "i", is no more than -1.

2316     			if ((((cs_d0 & (1 << i)) != 0) &&
2317     						((cs_d1 & (1 << j)) != 0)) ||
2318     			    (((cs_d1 & (1 << i)) != 0) &&
2319     						((cs_d0 & (1 << j)) != 0))) {
2320     				odt[j] |= (1 << i) << shift;
2321     			}
** CID 369881:  Memory - corruptions  (OVERRUN)
________________________________________________________________________________________________________
*** CID 369881:  Memory - corruptions  (OVERRUN)
/drivers/brcm/i2c/i2c.c: 556 in i2c_init()
550     {
551     	if (bus_id > MAX_I2C) {
552     		WARN("%s: Invalid Bus %u\n", __func__, bus_id);
553     		return -1;
554     	}
555
...
...
...
CID 369881:  Memory - corruptions  (OVERRUN)
Overrunning callee's array of size 2 by passing argument "bus_id" (which evaluates to 2) in call to "iproc_i2c_init".

556     	iproc_i2c_init(bus_id, speed);
557     	return 0U;
558     }
559     
560     /*
561      * Function Name:    i2c_probe
** CID 369880:  Error handling issues  (CHECKED_RETURN)
/drivers/nxp/ddr/nxp-ddr/utility.c: 43 in get_ddr_freq()
________________________________________________________________________________________________________
*** CID 369880:  Error handling issues  (CHECKED_RETURN)
/drivers/nxp/ddr/nxp-ddr/utility.c: 43 in get_ddr_freq()
37     #define CCN_HN_F_SAM_NODEID_DDR1	0x18
38     #endif
39     
40     unsigned long get_ddr_freq(struct sysinfo *sys, int ctrl_num)
41     {
42     	if (sys->freq_ddr_pll0 == 0) {
...
...
...
CID 369880:  Error handling issues  (CHECKED_RETURN)
Calling "get_clocks" without checking return value (as is done elsewhere 4 out of 5 times).

43     		get_clocks(sys);
44     	}
45     
46     	switch (ctrl_num) {
47     	case 0:
48     		return sys->freq_ddr_pll0;
** CID 369879:  Memory - corruptions  (ARRAY_VS_SINGLETON)
________________________________________________________________________________________________________
*** CID 369879:  Memory - corruptions  (ARRAY_VS_SINGLETON)
/drivers/brcm/i2c/i2c.c: 763 in i2c_write_byte()
757     	struct iproc_xact_info info;
758     
759     	iproc_i2c_fill_info(&info, bus_id, devaddr, regoffset, &value,
760     			    SMBUS_PROT_WR_BYTE, 1U);
761     
762     	/* Refer to i2c_smbus_write_byte params passed. */
...
...
...
CID 369879:  Memory - corruptions  (ARRAY_VS_SINGLETON)
Passing "info.data" via argument "&info" to function "iproc_i2c_data_send" which uses it as an array. This might corrupt or misinterpret adjacent memory locations.

763     	rc = iproc_i2c_data_send(&info);
764     
765     	if (rc < 0) {
766     		ERROR("%s: %s error accessing device 0x%x\n",
767     		       __func__, "Write", devaddr);
768     		return -1;
** CID 369878:  Control flow issues  (DEADCODE)
/drivers/nxp/ddr/nxp-ddr/utility.c: 169 in disable_unused_ddrc()
________________________________________________________________________________________________________
*** CID 369878:  Control flow issues  (DEADCODE)
/drivers/nxp/ddr/nxp-ddr/utility.c: 169 in disable_unused_ddrc()
163     		debug("Both controllers in use.\n");
164     		return 0;
165     	}
166     
167     	for (i = 0; i < num_hnf_nodes; i++) {
168     		val = mmio_read_64((uintptr_t)hnf_sam_ctrl);
...
...
...
CID 369878:  Control flow issues  (DEADCODE)
Execution cannot reach the expression "i < 4" inside this statement: "nodeid = ((disable_ddrc == ...".

169     		nodeid = disable_ddrc == 1 ? CCN_HN_F_SAM_NODEID_DDR1 :
170     			 (disable_ddrc == 2 ? CCN_HN_F_SAM_NODEID_DDR0 :
171     			  (i < 4 ? CCN_HN_F_SAM_NODEID_DDR0
172     				 : CCN_HN_F_SAM_NODEID_DDR1));
173     		if (nodeid != (val & CCN_HN_F_SAM_NODEID_MASK)) {
174     			debug("Setting HN-F node %d\n", i);
** CID 369877:  Incorrect expression  (NO_EFFECT)
/drivers/nxp/ddr/nxp-ddr/utility.c: 145 in disable_unused_ddrc()
________________________________________________________________________________________________________
*** CID 369877:  Incorrect expression  (NO_EFFECT)
/drivers/nxp/ddr/nxp-ddr/utility.c: 145 in disable_unused_ddrc()
139     	switch (disable_ddrc) {
140     	case 1:
141     		priv->num_ctlrs = 1;
142     		priv->spd_addr = &priv->spd_addr[priv->dimm_on_ctlr];
143     		priv->ddr[0] = priv->ddr[1];
144     		priv->ddr[1] = NULL;
...
...
...
CID 369877:  Incorrect expression  (NO_EFFECT)
Assigning "priv->phy[0]" to itself has no effect.

145     		priv->phy[0] = priv->phy[0];
146     		priv->phy[1] = NULL;
147     		debug("Disable first DDR controller\n");
148     		break;
149     	case 2:
150     		priv->num_ctlrs = 1;
** CID 369876:  Incorrect expression  (UNUSED_VALUE)
/plat/nxp/soc-lx2160a/lx2160aqds/ddr_init.c: 333 in init_ddr()
________________________________________________________________________________________________________
*** CID 369876:  Incorrect expression  (UNUSED_VALUE)
/plat/nxp/soc-lx2160a/lx2160aqds/ddr_init.c: 333 in init_ddr()
327     	info.phy_gen2_fw_img_buf = PHY_GEN2_FW_IMAGE_BUFFER;
328     	if (info.clk == 0) {
329     		info.clk = get_ddr_freq(&sys, 1);
330     	}
331     	info.dimm_on_ctlr = DDRC_NUM_DIMM;
332
...
...
...
CID 369876:  Incorrect expression  (UNUSED_VALUE)
Assigning value "DDR_WRM_BOOT_NT_SUPPORTED" to "info.warm_boot_flag" here, but that stored value is overwritten before it can be used.

333     	info.warm_boot_flag = DDR_WRM_BOOT_NT_SUPPORTED;
334     #ifdef NXP_WARM_BOOT
335     	info.warm_boot_flag = DDR_COLD_BOOT;
336     	if (wrm_bt_flg != 0U) {
337     		info.warm_boot_flag = DDR_WARM_BOOT;
338     	} else {
** CID 369875:  Uninitialized variables  (UNINIT)
/drivers/nxp/flexspi/nor/fspi.c: 134 in fspi_op_setup()
________________________________________________________________________________________________________
*** CID 369875:  Uninitialized variables  (UNINIT)
/drivers/nxp/flexspi/nor/fspi.c: 134 in fspi_op_setup()
128     	x_addr = FSPI_LUTREG_OFFSET + (uint32_t)(0x10 * fspi_op_seq_id);
129     	if ((F_FLASH_SIZE_BYTES <= SZ_16M_BYTES) || (ignore_flash_sz)) {
130     		x_instr0 = FSPI_INSTR_OPRND0(cmd_id1);
131     		x_instr1 = FSPI_INSTR_OPRND1(FSPI_LUT_ADDR24BIT);
132     		VERBOSE("CMD_ID = %x offset = 0x%x\n", cmd_id1, x_addr);
133     	} else {
...
...
...
CID 369875:  Uninitialized variables  (UNINIT)
Using uninitialized value "cmd_id2".

134     		x_instr0 = FSPI_INSTR_OPRND0(cmd_id2);
135     		x_instr1 = FSPI_INSTR_OPRND1(FSPI_LUT_ADDR32BIT);
136     		VERBOSE("CMD_ID = %x offset = 0x%x\n", cmd_id2, x_addr);
137     	}
138     	x_instr0 |= FSPI_INSTR_PAD0(FSPI_LUT_PAD1)
139     		| FSPI_INSTR_OPCODE0(FSPI_LUT_CMD);
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0...