Issue in Recent Beagle Patch was Fwd: New Defects reported by Coverity Scan for RTEMS

[Joel Sherrill]

---------- Forwarded message ---------
From: <scan-admin at coverity.com>
Date: Tue, Mar 23, 2021 at 12:22 AM
Subject: New Defects reported by Coverity Scan for RTEMS
To: <build at rtems.org>


Hi,

Please find the latest report on new defect(s) introduced to RTEMS found
with Coverity Scan.

3 new defect(s) introduced to RTEMS found with Coverity Scan.


New defect(s) Reported-by: Coverity Scan
Showing 3 of 3 defect(s)


** CID 1474437:  Memory - corruptions  (ARRAY_VS_SINGLETON)


________________________________________________________________________________________________________
*** CID 1474437:  Memory - corruptions  (ARRAY_VS_SINGLETON)
/bsps/shared/freebsd/sys/arm/ti/ti_pinmux.c: 480 in
beagle_pinctrl_configure_children()
474             int len;
475             uint32_t phandle;
476
477             for (node = OF_child(parent); node != 0; node =
OF_peer(node)) {
478                     if (rtems_ofw_node_status(node)) {
479                             beagle_pinctrl_configure_children(sc, node);
>>>     CID 1474437:  Memory - corruptions  (ARRAY_VS_SINGLETON)
>>>     Passing "&phandle" to function "rtems_ofw_get_enc_prop" which uses
it as an array. This might corrupt or misinterpret adjacent memory
locations.
480                             len = OF_getencprop(node, "pinctrl-0",
&phandle, sizeof(phandle));
481                             if (len == sizeof(phandle)) {
482                                     ti_pinmux_configure_pins(sc,
phandle);
483                             }
484                     }
485             }

** CID 1474436:  Memory - corruptions  (ARRAY_VS_SINGLETON)


________________________________________________________________________________________________________
*** CID 1474436:  Memory - corruptions  (ARRAY_VS_SINGLETON)
/bsps/shared/freebsd/sys/arm/ti/ti_pinmux.c: 545 in beagle_pinmux_init()
539                     break;
540             default:
541                     printk("Unknown CPU in pinmux\n");
542                     return ;
543             }
544
>>>     CID 1474436:  Memory - corruptions  (ARRAY_VS_SINGLETON)
>>>     Passing "&reg" to function "rtems_ofw_get_reg" which uses it as an
array. This might corrupt or misinterpret adjacent memory locations.
545             rv = rtems_ofw_get_reg(node, &reg, sizeof(reg));
546             if (rv == -1) {
547                     printk("pinmux_init: rtems_ofw_get_reg failed
%d\n", rv);
548                     return ;
549             }
550             pinmux_softc.sc_bsh = reg.start;

** CID 1474435:    (RESOURCE_LEAK)
/bsps/shared/freebsd/sys/arm/ti/ti_pinmux.c: 408 in
ti_pinmux_configure_pins()
/bsps/shared/freebsd/sys/arm/ti/ti_pinmux.c: 405 in
ti_pinmux_configure_pins()


________________________________________________________________________________________________________
*** CID 1474435:    (RESOURCE_LEAK)
/bsps/shared/freebsd/sys/arm/ti/ti_pinmux.c: 408 in
ti_pinmux_configure_pins()
402                 sizeof(*cfgtuples), (void **)&cfgtuples);
403
404             if (ntuples < 0)
405                     return (ENOENT);
406
407             if (ntuples == 0)
>>>     CID 1474435:    (RESOURCE_LEAK)
>>>     Variable "cfgtuples" going out of scope leaks the storage it points
to.
408                     return (0); /* Empty property is not an error. */
409
410             for (i = 0, cfg = cfgtuples; i < ntuples; i++, cfg++) {
411     #ifndef __rtems__
412                     if (bootverbose) {
413                             char name[32];
/bsps/shared/freebsd/sys/arm/ti/ti_pinmux.c: 405 in
ti_pinmux_configure_pins()
399     #endif /* __rtems__ */
400             cfgnode = OF_node_from_xref(cfgxref);
401             ntuples = OF_getencprop_alloc_multi(cfgnode,
"pinctrl-single,pins",
402                 sizeof(*cfgtuples), (void **)&cfgtuples);
403
404             if (ntuples < 0)
>>>     CID 1474435:    (RESOURCE_LEAK)
>>>     Variable "cfgtuples" going out of scope leaks the storage it points
to.
405                     return (ENOENT);
406
407             if (ntuples == 0)
408                     return (0); /* Empty property is not an error. */
409
410             for (i = 0, cfg = cfgtuples; i < ntuples; i++, cfg++) {


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit,
https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50ypUUzi-2FdSNmuyRB7BEFT8xQ4-2B8hpujh0hTgQljRGId4Dg-3D-3DZ9JC_EU3W9teASMK00lBXX9WT4lsogDrkCcNZLvg-2FVxwAXMrRpCRwRnwhWe3mGbZhfe5TEhVIZWqvzu-2BkK7GzWu18aemlzIGVqBnjE1VG1WYYnqAUylIIGsDE-2BbTTVBzIJdmJneUsK-2BEaTP8-2FdYkzR0L3nGksetaEs-2BWFiyM7otFz-2B3Jlvd7kkQjkZQhm78Hs6VA2e-2BgdMc6t9S3bFnOSaz2HAgqXpiOSsmtmoifKj8QLZB0-3D

_______________________________________________
build mailing list
build at rtems.org
http://lists.rtems.org/mailman/listinfo/build
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rtems.org/pipermail/devel/attachments/20210323/1ff82486/attachment.html>