Hi all,
On Monday, July 07/04/16, 2016 at 08:29:49 -0700, john.mcnamara at intel.com
wrote:
> Hi Rahul,
>
> This is an automated email in relation to a new Coverity static code analysis
> issue in DPDK. Details of the issue are below.
>
[...]
> Git commit data and Coverity defect information below.
>
> Commit data
> ===========
>
> Commit: net/cxgbe: support EEPROM access
> Id: fe0bd9ee5da3fd52766458a5d0fa9a8728182be1
> Author: Rahul Lakkireddy
> Email: rahul.lakkireddy at chelsio.com
> Date: Fri May 6 08:43:18 2016 +0530
>
> Defect information
> ==================
>
> /drivers/net/cxgbe/cxgbe_ethdev.c: 919 in cxgbe_set_eeprom()
> *** CID 127559: (TAINTED_SCALAR)
> 913 }
> 914
> 915 if (!err)
> 916 err = t4_seeprom_wp(adapter, true);
> 917 out:
> 918 if (buf != eeprom->data)
> >>> CID 127559: (TAINTED_SCALAR)
> >>> Passing tainted variable "buf" to a tainted sink.
> 919 rte_free(buf);
> 920 return err;
> 921 }
> 922
> 923 static int cxgbe_get_regs_len(struct rte_eth_dev *eth_dev)
> 924 {
> /drivers/net/cxgbe/cxgbe_ethdev.c: 910 in cxgbe_set_eeprom()
> 904 }
> 905
> 906 err = t4_seeprom_wp(adapter, false);
> 907 if (err)
> 908 goto out;
> 909
> >>> CID 127559: (TAINTED_SCALAR)
> >>> Assigning: "p" = "(u32 *)buf". Both are now tainted.
> 910 for (p = (u32 *)buf; !err && aligned_len; aligned_len -= 4,
> p++) {
> 911 err = eeprom_wr_phys(adapter, aligned_offset, *p);
> 912 aligned_offset += 4;
> 913 }
> 914
> 915 if (!err)
>
I'm not an expert in Coverity and am having trouble understanding what
the defect is and need some clarification. Is it telling me that "buf"
is being used without doing lower and upper bounds check?
Thanks,
Rahul
