Hi Tom,
On Mon, Oct 26, 2026 at 19:27, Tom Rini <[email protected]> wrote:
> Here's the latest report. Since it says 20 out of 25, I downloaded a
> report as well and the 5 not listed here are:
>
> CID 470520, Uninitialized scalar variable,
> lib/zstd/decompress/zstd_decompress.c, ZSTD_errorFrameSizeInfo
> CID 470520: (#1 of 1): Uninitialized scalar variable (UNINIT)
> 2. uninit_use: Using uninitialized value frameSizeInfo. Field
> frameSizeInfo.nbBlocks is uninitialized.
> 700 return frameSizeInfo;
>
> CID 661171, Untrusted pointer read, cmd/gpio.c, do_gpio
> CID 661171: (#1 of 1): Untrusted pointer read (TAINTED_SCALAR)
> 16. tainted_data: Using tainted variable offset as an index to pointer
> uc_priv->name.
> Ensure that tainted values are properly sanitized, by checking that
> their values are within a permissible range.
> 238 printf("gpio: pin %s (gpio %u) already claimed by '%s'\n",
> 239 str_gpio, gpio, uc_priv->name[offset]);
>
> CID 661172, Overflowed constant, test/boot/fit_cipher.c,
> fit_cipher_test_oversized_unciphered_size
> info.size_unciphered = sizeof(cipher) + 1;
> 2. function_return: Function image_aes_decrypt(&info, cipher, 32UL,
> &data, &size) returns -22.
> 3. known_value_assign: ret = image_aes_decrypt(&info, cipher, 32UL,
> &data, &size), its value is now -22.
> 65 ret = image_aes_decrypt(&info, cipher, sizeof(cipher), &data,
> &size);
>
> CID 661172: (#1 of 1): Overflowed constant (INTEGER_OVERFLOW)
> 4. overflow_const: Expression _val2, where ret is known to be equal to -22,
> overflows the type of _val2, which is type unsigned int.
> 66 ut_asserteq(-EINVAL, ret);
>
> CID 661173, String not null terminated, boot/bootmeth_bls.c,bls_boot
>
> CID 661173: (#1 of 1): String not null terminated (STRING_NULL)
> 7. string_null: Passing unterminated string label->name to parse_label_keys,
> which expects a null-terminated string.[show details]
> 309 ret = parse_label_keys(&body, &scratch, label, true);
> 310 if (ret < 0)
>
> CID 661174, Unchecked return value from library, drivers/fastboot/fb_usb.c,
> fastboot_usb_run
> CID 661174: (#1 of 1): Unchecked return value from library (CHECKED_RETURN)
> 7. check_return: Calling getchar() without checking return value. This
> library function may fail and return an error code. [Note: The source code
> implementation of the function has been overridden by a builtin model.]
> 48 getchar();
It's harmless to ignore the return code of getchar() here. In this code
path, we want the fastboot session to be aborted on *any* key press.
The tstc() call just before the getchar() ensures that a character is
available.
To me, we can mark this as a 'false positive' in Coverity.
>
> And I can provide more details on those specific issues if someone is
> looking at them and doesn't otherwise spot a problem.
>
> ---------- Forwarded message ---------
> From: <[email protected]>
> Date: Mon, Oct 26, 2026 at 6:53 PM
> Subject: New Defects reported by Coverity Scan for Das U-Boot
> To: <[email protected]>
>
>
> Hi,
>
> Please find the latest report on new defect(s) introduced to *Das U-Boot*
> found with Coverity Scan.
>
> - *New Defects Found:* 25
> - 13 defect(s), reported by Coverity Scan earlier, were marked fixed in
> the recent build analyzed by Coverity Scan.
> - *Defects Shown:* Showing 20 of 25 defect(s)
>
> Defect Details
[...]
> _____________________________________________________________________________________________
> *** CID 661187: (TAINTED_SCALAR)
> /drivers/fastboot/fb_command.c: 952 in flashing_unlock_allowed()
> 946 sha256_update(&ctx, buf, cnt * info.blksz);
> 947 last = buf[cnt * info.blksz - 1];
> 948 }
> 949 sha256_finish(&ctx, digest);
> 950 allowed = !memcmp(stored, digest, SHA256_SUM_LEN) && last;
> 951 out:
>>>> CID 661187: (TAINTED_SCALAR)
>>>> Passing tainted expression "*buf" to "dlfree", which uses it as an
>>>> offset.
> 952 free(buf);
False positive: buf is allocated by malloc_cache_aligned() of a known size
(FLASHING_FRP_CHUNK * info.blksz)
The data read by blk_dread is never bigger than the buffer size since we
have a cnt check just before.
> 953
> 954 return allowed;
> 955 }
> 956
> 957 /**
> /drivers/fastboot/fb_command.c: 940 in flashing_unlock_allowed()
> 934
> 935 sha256_starts(&ctx);
> 936 for (blk = 0; blk < info.size; blk += cnt) {
> 937 cnt = info.size - blk;
> 938 if (cnt > FLASHING_FRP_CHUNK)
> 939 cnt = FLASHING_FRP_CHUNK;
>>>> CID 661187: (TAINTED_SCALAR)
>>>> Passing tainted expression "*buf" to "blk_dread", which uses it as an
>>>> offset.
False positive, same explanation as before. buf is used as destination
buffer but has a known size allocated by malloc_cache_aligned()
> 940 if (blk_dread(desc, info.start + blk, cnt, buf) != cnt)
> 941 goto out;
> 942 if (!blk) {
> 943 memcpy(stored, buf, SHA256_SUM_LEN);
> 944 memset(buf, 0, SHA256_SUM_LEN);
> 945 }
> /drivers/fastboot/fb_command.c: 952 in flashing_unlock_allowed()
> 946 sha256_update(&ctx, buf, cnt * info.blksz);
> 947 last = buf[cnt * info.blksz - 1];
> 948 }
> 949 sha256_finish(&ctx, digest);
> 950 allowed = !memcmp(stored, digest, SHA256_SUM_LEN) && last;
> 951 out:
>>>> CID 661187: (TAINTED_SCALAR)
>>>> Passing tainted expression "*buf" to "dlfree", which uses it as an
>>>> offset.
> 952 free(buf);
False positive, same as previous one.
> 953
> 954 return allowed;
> 955 }
> 956
> 957 /**
> /drivers/fastboot/fb_command.c: 940 in flashing_unlock_allowed()
> 934
> 935 sha256_starts(&ctx);
> 936 for (blk = 0; blk < info.size; blk += cnt) {
> 937 cnt = info.size - blk;
> 938 if (cnt > FLASHING_FRP_CHUNK)
> 939 cnt = FLASHING_FRP_CHUNK;
>>>> CID 661187: (TAINTED_SCALAR)
>>>> Passing tainted expression "*buf" to "blk_dread", which uses it as an
>>>> offset.
False positive, same as previous one.
> 940 if (blk_dread(desc, info.start + blk, cnt, buf) != cnt)
> 941 goto out;
> 942 if (!blk) {
> 943 memcpy(stored, buf, SHA256_SUM_LEN);
> 944 memset(buf, 0, SHA256_SUM_LEN);
[...]
Thanks,
Mattijs
