diff mbox series

[v2,1/1] raw/ifpga/base: check size before assigning

Message ID 20210408085151.54996-2-wei.huang@intel.com (mailing list archive)
State New
Delegated to: Qi Zhang
Headers show
Series Fix coverity issues reported in DPDK-26381 | expand

Checks

Context Check Description
ci/iol-testing success Testing PASS
ci/iol-abi-testing success Testing PASS
ci/intel-Testing success Testing PASS
ci/iol-mellanox-Performance success Performance Testing PASS
ci/Intel-compilation success Compilation OK
ci/iol-intel-Performance success Performance Testing PASS
ci/github-robot success github build: passed
ci/travis-robot success travis build: passed
ci/checkpatch success coding style OK

Commit Message

Wei Huang April 8, 2021, 8:51 a.m. UTC
In max10_staging_area_init(), variable "size" from fdt_get_reg() may
be invalid, it should be checked before assigning to member variable
"staging_area_size" of structure "intel_max10_device".

Coverity issue: 367480, 367482
Fixes: 96ebfcf8125c ("raw/ifpga/base: add SPI and MAX10 device driver")

Signed-off-by: Wei Huang <wei.huang@intel.com>
---
v2: check size before assigning to staging_area_size
---
 drivers/raw/ifpga/base/opae_intel_max10.c | 2 +-
 drivers/raw/ifpga/base/opae_intel_max10.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

Comments

Ferruh Yigit April 8, 2021, 9:38 a.m. UTC | #1
On 4/8/2021 9:51 AM, Wei Huang wrote:
> In max10_staging_area_init(), variable "size" from fdt_get_reg() may
> be invalid, it should be checked before assigning to member variable
> "staging_area_size" of structure "intel_max10_device".
> 
> Coverity issue: 367480, 367482
> Fixes: 96ebfcf8125c ("raw/ifpga/base: add SPI and MAX10 device driver")
> 
> Signed-off-by: Wei Huang <wei.huang@intel.com>
> ---
> v2: check size before assigning to staging_area_size
> ---
>   drivers/raw/ifpga/base/opae_intel_max10.c | 2 +-
>   drivers/raw/ifpga/base/opae_intel_max10.h | 1 +
>   2 files changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/raw/ifpga/base/opae_intel_max10.c b/drivers/raw/ifpga/base/opae_intel_max10.c
> index 443e248fb3..c223fafa03 100644
> --- a/drivers/raw/ifpga/base/opae_intel_max10.c
> +++ b/drivers/raw/ifpga/base/opae_intel_max10.c
> @@ -593,7 +593,7 @@ static int max10_staging_area_init(struct intel_max10_device *dev)
>   			continue;
>   
>   		ret = fdt_get_reg(fdt_root, offset, 0, &start, &size);
> -		if (!ret) {
> +		if (!ret && (size <= MAX_STAGING_AREA_SIZE)) {
>   			dev->staging_area_base = start;
>   			dev->staging_area_size = size;
>   		}
> diff --git a/drivers/raw/ifpga/base/opae_intel_max10.h b/drivers/raw/ifpga/base/opae_intel_max10.h
> index 670683f017..e7142d6f0d 100644
> --- a/drivers/raw/ifpga/base/opae_intel_max10.h
> +++ b/drivers/raw/ifpga/base/opae_intel_max10.h
> @@ -182,6 +182,7 @@ struct opae_retimer_status {
>   #define   SBUS_VERSION			GENMASK(31, 16)
>   
>   #define DFT_MAX_SIZE		0x7e0000
> +#define MAX_STAGING_AREA_SIZE	0x3800000
>   
>   int max10_reg_read(struct intel_max10_device *dev,
>   	unsigned int reg, unsigned int *val);
> 

Hi Aaron, David,

The data flow is complex for this coverity issues [1], at least I can't confirm 
that change fixes the issue.

Are you aware of any way to confirm this coverity issue before merging it?

[1]
https://scan4.coverity.com/reports.htm#v26325/p10075/fileInstanceId=100181086&defectInstanceId=14238477&mergedDefectId=367480
Aaron Conole April 9, 2021, 2:56 p.m. UTC | #2
Ferruh Yigit <ferruh.yigit@intel.com> writes:

> On 4/8/2021 9:51 AM, Wei Huang wrote:
>> In max10_staging_area_init(), variable "size" from fdt_get_reg() may
>> be invalid, it should be checked before assigning to member variable
>> "staging_area_size" of structure "intel_max10_device".
>>
>> Coverity issue: 367480, 367482
>> Fixes: 96ebfcf8125c ("raw/ifpga/base: add SPI and MAX10 device driver")
>>
>> Signed-off-by: Wei Huang <wei.huang@intel.com>
>> ---
>> v2: check size before assigning to staging_area_size
>> ---
>>   drivers/raw/ifpga/base/opae_intel_max10.c | 2 +-
>>   drivers/raw/ifpga/base/opae_intel_max10.h | 1 +
>>   2 files changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/raw/ifpga/base/opae_intel_max10.c b/drivers/raw/ifpga/base/opae_intel_max10.c
>> index 443e248fb3..c223fafa03 100644
>> --- a/drivers/raw/ifpga/base/opae_intel_max10.c
>> +++ b/drivers/raw/ifpga/base/opae_intel_max10.c
>> @@ -593,7 +593,7 @@ static int max10_staging_area_init(struct intel_max10_device *dev)
>>   			continue;
>>     		ret = fdt_get_reg(fdt_root, offset, 0, &start, &size);
>> -		if (!ret) {
>> +		if (!ret && (size <= MAX_STAGING_AREA_SIZE)) {
>>   			dev->staging_area_base = start;
>>   			dev->staging_area_size = size;
>>   		}
>> diff --git a/drivers/raw/ifpga/base/opae_intel_max10.h b/drivers/raw/ifpga/base/opae_intel_max10.h
>> index 670683f017..e7142d6f0d 100644
>> --- a/drivers/raw/ifpga/base/opae_intel_max10.h
>> +++ b/drivers/raw/ifpga/base/opae_intel_max10.h
>> @@ -182,6 +182,7 @@ struct opae_retimer_status {
>>   #define   SBUS_VERSION			GENMASK(31, 16)
>>     #define DFT_MAX_SIZE		0x7e0000
>> +#define MAX_STAGING_AREA_SIZE	0x3800000
>>     int max10_reg_read(struct intel_max10_device *dev,
>>   	unsigned int reg, unsigned int *val);
>>
>
> Hi Aaron, David,
>
> The data flow is complex for this coverity issues [1], at least I
> can't confirm that change fixes the issue.
>
> Are you aware of any way to confirm this coverity issue before merging it?

Not generically.  :-/

We need someone that understands the data flow and the coverity splat to
know that the fix is correct.  Coverity even ratelimits how many
outstanding submissions we can post, iirc, so we don't get to push patch
sets (unless we pay?  I don't recall if there's an option for that).

> [1]
> https://scan4.coverity.com/reports.htm#v26325/p10075/fileInstanceId=100181086&defectInstanceId=14238477&mergedDefectId=367480
diff mbox series

Patch

diff --git a/drivers/raw/ifpga/base/opae_intel_max10.c b/drivers/raw/ifpga/base/opae_intel_max10.c
index 443e248fb3..c223fafa03 100644
--- a/drivers/raw/ifpga/base/opae_intel_max10.c
+++ b/drivers/raw/ifpga/base/opae_intel_max10.c
@@ -593,7 +593,7 @@  static int max10_staging_area_init(struct intel_max10_device *dev)
 			continue;
 
 		ret = fdt_get_reg(fdt_root, offset, 0, &start, &size);
-		if (!ret) {
+		if (!ret && (size <= MAX_STAGING_AREA_SIZE)) {
 			dev->staging_area_base = start;
 			dev->staging_area_size = size;
 		}
diff --git a/drivers/raw/ifpga/base/opae_intel_max10.h b/drivers/raw/ifpga/base/opae_intel_max10.h
index 670683f017..e7142d6f0d 100644
--- a/drivers/raw/ifpga/base/opae_intel_max10.h
+++ b/drivers/raw/ifpga/base/opae_intel_max10.h
@@ -182,6 +182,7 @@  struct opae_retimer_status {
 #define   SBUS_VERSION			GENMASK(31, 16)
 
 #define DFT_MAX_SIZE		0x7e0000
+#define MAX_STAGING_AREA_SIZE	0x3800000
 
 int max10_reg_read(struct intel_max10_device *dev,
 	unsigned int reg, unsigned int *val);