Hey all, Here's the scan report for -rc1.
---------- Forwarded message --------- From: <[email protected]> Date: Wed, Jul 29, 2026 at 12:06 AM Subject: New Defects reported by Coverity Scan for Das U-Boot To: <[email protected]> Hi, Please find the latest report on new defect(s) introduced to *Das U-Boot* found with Coverity Scan. - *New Defects Found:* 6 - 5 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. - *Defects Shown:* Showing 6 of 6 defect(s) Defect Details ** CID 651722: Error handling issues (CHECKED_RETURN) /drivers/power/regulator/pmbus_helper.c: 48 in pmbus_regulator_get_value() _____________________________________________________________________________________________ *** CID 651722: Error handling issues (CHECKED_RETURN) /drivers/power/regulator/pmbus_helper.c: 48 in pmbus_regulator_get_value() 42 s64 uv; 43 int ret; 44 45 ret = pmbus_regulator_select_page(priv); 46 if (ret) 47 return ret; >>> CID 651722: Error handling issues (CHECKED_RETURN) >>> Calling "pmbus_read_byte" without checking return value (as is done >>> elsewhere 17 out of 18 times). 48 pmbus_read_byte(priv->i2c_dev, PMBUS_VOUT_MODE, &vout_mode); 49 if (pmbus_read_word(priv->i2c_dev, PMBUS_READ_VOUT, &raw)) 50 return -EIO; 51 52 if (priv->info) 53 uv = pmbus_reg2data(priv->info, PSC_VOLTAGE_OUT, raw, vout_mode); ** CID 651721: Insecure data handling (TAINTED_SCALAR) _____________________________________________________________________________________________ *** CID 651721: Insecure data handling (TAINTED_SCALAR) /drivers/core/ofnode.c: 134 in oftree_new() 128 /* register the new tree with a small size */ 129 fdt = malloc(size); 130 if (!fdt) 131 return log_msg_ret("fla", -ENOMEM); 132 ret = fdt_create_empty_tree(fdt, size); 133 if (ret) { >>> CID 651721: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "*fdt" to "dlfree", which uses it as an >>> offset. 134 free(fdt); 135 return log_msg_ret("fla", -EINVAL); 136 } 137 oftree_list[oftree_count++] = fdt; 138 tree.fdt = fdt; 139 } ** CID 651720: Memory - corruptions (OVERRUN) /drivers/i3c/master/dw-i3c-master.c: 809 in dw_i3c_master_attach_i3c_dev() _____________________________________________________________________________________________ *** CID 651720: Memory - corruptions (OVERRUN) /drivers/i3c/master/dw-i3c-master.c: 809 in dw_i3c_master_attach_i3c_dev() 803 return -ENOMEM; 804 805 data->index = pos; 806 master->addrs[pos] = dev->info.dyn_addr ? : dev->info.static_addr; 807 master->free_pos &= ~BIT(pos); 808 i3c_dev_set_master_data(dev, data); >>> CID 651720: Memory - corruptions (OVERRUN) >>> Overrunning array "master->i3cdev" of 11 8-byte elements at element >>> index 31 (byte offset 255) using index "pos" (which evaluates to 31). 809 master->i3cdev[pos] = dev; 810 811 writel(DEV_ADDR_TABLE_DYNAMIC_ADDR(master->addrs[pos]), 812 master->regs + 813 DEV_ADDR_TABLE_LOC(master->datstartaddr, data->index)); 814 ** CID 651719: Insecure data handling (TAINTED_SCALAR) _____________________________________________________________________________________________ *** CID 651719: Insecure data handling (TAINTED_SCALAR) /test/boot/vbe_read_fit.c: 136 in build_fit() 130 return ret; 131 132 ret = fdt_end_node(buf); /* root */ 133 if (ret) 134 return ret; 135 >>> CID 651719: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "buf->size_dt_strings" to "fdt_finish", >>> which uses it as an offset. 136 return fdt_finish(buf); 137 } 138 139 /** 140 * place_fit_on_mmc() - Write a synthetic FIT to mmc1 and return its blk dev 141 * ** CID 651718: Memory - illegal accesses (UNINIT) /drivers/clk/spacemit/clk_pll.c: 42 in ccu_pll_lookup_best_rate() _____________________________________________________________________________________________ *** CID 651718: Memory - illegal accesses (UNINIT) /drivers/clk/spacemit/clk_pll.c: 42 in ccu_pll_lookup_best_rate() 36 if (delta < best_delta) { 37 best_delta = delta; 38 best_entry = entry; 39 } 40 } 41 >>> CID 651718: Memory - illegal accesses (UNINIT) >>> Using uninitialized value "best_entry". 42 return best_entry; 43 } 44 45 static const struct ccu_pll_rate_tbl *ccu_pll_lookup_matched_entry(struct ccu_pll *pll) 46 { 47 struct ccu_pll_config *config = &pll->config; ** CID 651717: Insecure data handling (TAINTED_SCALAR) _____________________________________________________________________________________________ *** CID 651717: Insecure data handling (TAINTED_SCALAR) /drivers/power/regulator/pmbus_helper.c: 285 in pmbus_regulator_probe_common() 279 int ret; 280 281 chip_addr = dev_read_addr(dev); 282 if (chip_addr < 0) 283 return -EINVAL; 284 >>> CID 651717: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "chip_addr" to "i2c_get_chip", which uses it >>> as an offset. 285 ret = i2c_get_chip(dev_get_parent(dev), (u32)chip_addr, 1, &priv->i2c_dev); 286 if (ret) 287 return ret; 288 289 priv->info = info; 290 priv->page = page; View Defects in Coverity Scan <https://scan.coverity.com/projects/das-u-boot?tab=overview> Best regards, The Coverity Scan Admin Team ----- End forwarded message ----- -- Tom
signature.asc
Description: PGP signature
