Coverity-updates archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

New Defects reported by Coverity Scan for NetBSD-amd64-kernel




To: coverity-updates%netbsd.org@localhost

Subject: New Defects reported by Coverity Scan for NetBSD-amd64-kernel

From: scan-admin%coverity.com@localhost

Date: Fri, 22 Apr 2016 22:20:12 -0700


Hi,

Please find the latest report on new defect(s) introduced to NetBSD-amd64-kernel found with Coverity Scan.

51 new defect(s) introduced to NetBSD-amd64-kernel found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 20 of 51 defect(s)


** CID 143119:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 128 in powerctrl_1_shift()


________________________________________________________________________________________________________
*** CID 143119:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 128 in powerctrl_1_shift()
122      case 0x680520:
123       shift += 4;
124      case 0x680508:
125       shift += 4;
126      case 0x680504:
127       shift += 4;
>>>     CID 143119:  Control flow issues  (MISSING_BREAK)
>>>     The above case falls through to this one.
128      case 0x680500:
129       shift += 4;
130      }
131     
132      /*
133       * the shift for vpll regs is only used for nv3x chips with a single

** CID 143120:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 126 in powerctrl_1_shift()


________________________________________________________________________________________________________
*** CID 143120:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 126 in powerctrl_1_shift()
120     
121      switch (reg) {
122      case 0x680520:
123       shift += 4;
124      case 0x680508:
125       shift += 4;
>>>     CID 143120:  Control flow issues  (MISSING_BREAK)
>>>     The above case falls through to this one.
126      case 0x680504:
127       shift += 4;
128      case 0x680500:
129       shift += 4;
130      }
131     

** CID 143121:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 124 in powerctrl_1_shift()


________________________________________________________________________________________________________
*** CID 143121:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 124 in powerctrl_1_shift()
118      if (chip_version < 0x17 || chip_version == 0x1a || chip_version == 0x20)
119       return shift;
120     
121      switch (reg) {
122      case 0x680520:
123       shift += 4;
>>>     CID 143121:  Control flow issues  (MISSING_BREAK)
>>>     The above case falls through to this one.
124      case 0x680508:
125       shift += 4;
126      case 0x680504:
127       shift += 4;
128      case 0x680500:
129       shift += 4;

** CID 143122:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 250 in setPLL_double_highregs()


________________________________________________________________________________________________________
*** CID 143122:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 250 in setPLL_double_highregs()
244     
245       switch (reg1) {
246       case 0x680504:
247        shift_c040 += 2;
248       case 0x680500:
249        shift_c040 += 2;
>>>     CID 143122:  Control flow issues  (MISSING_BREAK)
>>>     The above case falls through to this one.
250       case 0x680520:
251        shift_c040 += 2;
252       case 0x680508:
253        shift_c040 += 2;
254       }
255     

** CID 143123:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 248 in setPLL_double_highregs()


________________________________________________________________________________________________________
*** CID 143123:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 248 in setPLL_double_highregs()
242      if (chip_version >= 0x40) {
243       int shift_c040 = 14;
244     
245       switch (reg1) {
246       case 0x680504:
247        shift_c040 += 2;
>>>     CID 143123:  Control flow issues  (MISSING_BREAK)
>>>     The above case falls through to this one.
248       case 0x680500:
249        shift_c040 += 2;
250       case 0x680520:
251        shift_c040 += 2;
252       case 0x680508:
253        shift_c040 += 2;

** CID 143124:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 252 in setPLL_double_highregs()


________________________________________________________________________________________________________
*** CID 143124:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/devinit/nouveau_subdev_devinit_nv04.c: 252 in setPLL_double_highregs()
246       case 0x680504:
247        shift_c040 += 2;
248       case 0x680500:
249        shift_c040 += 2;
250       case 0x680520:
251        shift_c040 += 2;
>>>     CID 143124:  Control flow issues  (MISSING_BREAK)
>>>     The above case falls through to this one.
252       case 0x680508:
253        shift_c040 += 2;
254       }
255     
256       savedc040 = nv_rd32(devinit, 0xc040);
257       if (shift_c040 != 14)

** CID 144988:    (TAINTED_SCALAR)
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c: 825 in nouveau_gem_ioctl_pushbuf()
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c: 755 in nouveau_gem_ioctl_pushbuf()


________________________________________________________________________________________________________
*** CID 144988:    (TAINTED_SCALAR)
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c: 825 in nouveau_gem_ioctl_pushbuf()
819       if (ret) {
820        NV_ERROR(cli, "jmp_space: %d\n", ret);
821        goto out;
822       }
823     
824       for (i = 0; i < req->nr_push; i++) {
>>>     CID 144988:    (TAINTED_SCALAR)
>>>     Assigning: "nvbo" = "(void *)(unsigned long)(bo + (push + i).bo_index).user_priv". Both are now tainted.
825        struct nouveau_bo *nvbo = (void *)(unsigned long)
826         bo[push[i].bo_index].user_priv;
827        uint32_t cmd;
828     
829        cmd = chan->push.vma.offset + ((chan->dma.cur + 2) <<2);
830        cmd |= 0x20000000;
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c: 755 in nouveau_gem_ioctl_pushbuf()
749      }
750     
751      push = u_memcpya(req->push, req->nr_push, sizeof(*push));
752      if (IS_ERR(push))
753       return nouveau_abi16_put(abi16, PTR_ERR(push));
754     
>>>     CID 144988:    (TAINTED_SCALAR)
>>>     Assigning: "bo" = "u_memcpya", which taints "bo".
755      bo = u_memcpya(req->buffers, req->nr_buffers, sizeof(*bo));
756      if (IS_ERR(bo)) {
757       u_free(push);
758       return nouveau_abi16_put(abi16, PTR_ERR(bo));
759      }
760     

** CID 145720:  Null pointer dereferences  (NULL_RETURNS)
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_connector.c: 310 in nouveau_connector_detect()


________________________________________________________________________________________________________
*** CID 145720:  Null pointer dereferences  (NULL_RETURNS)
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_connector.c: 310 in nouveau_connector_detect()
304             nv_partner->dcb->type == DCB_OUTPUT_ANALOG))) {
305        if (nv_connector->edid->input & DRM_EDID_INPUT_DIGITAL)
306         type = DCB_OUTPUT_TMDS;
307        else
308         type = DCB_OUTPUT_ANALOG;
309     
>>>     CID 145720:  Null pointer dereferences  (NULL_RETURNS)
>>>     Assigning: "nv_encoder" = null return value from "find_encoder".
310        nv_encoder = find_encoder(connector, type);
311       }
312     
313       nouveau_connector_set_encoder(connector, nv_encoder);
314       conn_status = connector_status_connected;
315       goto out;

** CID 200513:    (INTEGER_OVERFLOW)
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c: 758 in nouveau_gem_ioctl_pushbuf()
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c: 753 in nouveau_gem_ioctl_pushbuf()


________________________________________________________________________________________________________
*** CID 200513:    (INTEGER_OVERFLOW)
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c: 758 in nouveau_gem_ioctl_pushbuf()
752      if (IS_ERR(push))
753       return nouveau_abi16_put(abi16, PTR_ERR(push));
754     
755      bo = u_memcpya(req->buffers, req->nr_buffers, sizeof(*bo));
756      if (IS_ERR(bo)) {
757       u_free(push);
>>>     CID 200513:    (INTEGER_OVERFLOW)
>>>     Overflowed or truncated value (or a value computed from an overflowed or truncated value) "nouveau_abi16_put(abi16, PTR_ERR(bo))" used as return value.
758       return nouveau_abi16_put(abi16, PTR_ERR(bo));
759      }
760     
761      /* Ensure all push buffers are on validate list */
762      for (i = 0; i < req->nr_push; i++) {
763       if (push[i].bo_index >= req->nr_buffers) {
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c: 753 in nouveau_gem_ioctl_pushbuf()
747         req->nr_relocs, NOUVEAU_GEM_MAX_RELOCS);
748       return nouveau_abi16_put(abi16, -EINVAL);
749      }
750     
751      push = u_memcpya(req->push, req->nr_push, sizeof(*push));
752      if (IS_ERR(push))
>>>     CID 200513:    (INTEGER_OVERFLOW)
>>>     Overflowed or truncated value (or a value computed from an overflowed or truncated value) "nouveau_abi16_put(abi16, PTR_ERR(push))" used as return value.
753       return nouveau_abi16_put(abi16, PTR_ERR(push));
754     
755      bo = u_memcpya(req->buffers, req->nr_buffers, sizeof(*bo));
756      if (IS_ERR(bo)) {
757       u_free(push);
758       return nouveau_abi16_put(abi16, PTR_ERR(bo));

** CID 200514:  Insecure data handling  (INTEGER_OVERFLOW)
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c: 627 in nouveau_gem_pushbuf_reloc_apply()


________________________________________________________________________________________________________
*** CID 200514:  Insecure data handling  (INTEGER_OVERFLOW)
/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c: 627 in nouveau_gem_pushbuf_reloc_apply()
621      struct drm_nouveau_gem_pushbuf_reloc *reloc = NULL;
622      int ret = 0;
623      unsigned i;
624     
625      reloc = u_memcpya(req->relocs, req->nr_relocs, sizeof(*reloc));
626      if (IS_ERR(reloc))
>>>     CID 200514:  Insecure data handling  (INTEGER_OVERFLOW)
>>>     Overflowed or truncated value (or a value computed from an overflowed or truncated value) "PTR_ERR(reloc)" used as return value.
627       return PTR_ERR(reloc);
628     
629      for (i = 0; i < req->nr_relocs; i++) {
630       struct drm_nouveau_gem_pushbuf_reloc *r = &reloc[i];
631       struct drm_nouveau_gem_pushbuf_bo *b;
632       struct nouveau_bo *nvbo;

** CID 201378:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/mxm/nouveau_subdev_mxm_nv50.c: 173 in mxm_dcb_sanitise_entry()


________________________________________________________________________________________________________
*** CID 201378:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/mxm/nouveau_subdev_mxm_nv50.c: 173 in mxm_dcb_sanitise_entry()
167       break;
168      case 0x03: /* DVI-D */
169       type = DCB_CONNECTOR_DVI_D;
170       break;
171      case 0x0e: /* eDP, falls through to DPint */
172       ctx.outp[1] |= 0x00010000;
>>>     CID 201378:  Control flow issues  (MISSING_BREAK)
>>>     The above case falls through to this one.
173      case 0x07: /* DP internal, wtf is this?? HP8670w */
174       ctx.outp[1] |= 0x00000004; /* use_power_scripts? */
175       type = DCB_CONNECTOR_eDP;
176       break;
177      default:
178       break;

** CID 703385:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/fifo/nouveau_engine_fifo_nv40.c: 318 in nv40_fifo_init()


________________________________________________________________________________________________________
*** CID 703385:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/fifo/nouveau_engine_fifo_nv40.c: 318 in nv40_fifo_init()
312     
313      switch (nv_device(priv)->chipset) {
314      case 0x47:
315      case 0x49:
316      case 0x4b:
317       nv_wr32(priv, 0x002230, 0x00000001);
>>>     CID 703385:  Control flow issues  (MISSING_BREAK)
>>>     The above case falls through to this one.
318      case 0x40:
319      case 0x41:
320      case 0x42:
321      case 0x43:
322      case 0x45:
323      case 0x48:

** CID 709895:  Null pointer dereferences  (FORWARD_NULL)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/mxm/nouveau_subdev_mxm_mxms.c: 177 in mxms_foreach()


________________________________________________________________________________________________________
*** CID 709895:  Null pointer dereferences  (FORWARD_NULL)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/mxm/nouveau_subdev_mxm_mxms.c: 177 in mxms_foreach()
171          pr_cont("%02x", dump[j]);
172         pr_cont("\n");
173        }
174       }
175     
176       if (types & (1 << type)) {
>>>     CID 709895:  Null pointer dereferences  (FORWARD_NULL)
>>>     Dereferencing null pointer "exec".
177        if (!exec(mxm, desc, info))
178         return false;
179       }
180     
181       desc += headerlen + (entries * recordlen);
182      }

** CID 731489:  Incorrect expression  (NO_EFFECT)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bios/nouveau_subdev_bios_i2c.c: 53 in dcb_i2c_table()


________________________________________________________________________________________________________
*** CID 731489:  Incorrect expression  (NO_EFFECT)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bios/nouveau_subdev_bios_i2c.c: 53 in dcb_i2c_table()
47      if (i2c && *ver >= 0x30) {
48       *ver = nv_ro08(bios, i2c + 0);
49       *hdr = nv_ro08(bios, i2c + 1);
50       *cnt = nv_ro08(bios, i2c + 2);
51       *len = nv_ro08(bios, i2c + 3);
52      } else {
>>>     CID 731489:  Incorrect expression  (NO_EFFECT)
>>>     Assignment operation "*ver = *ver" has no effect.
53       *ver = *ver; /* use DCB version */
54       *hdr = 0;
55       *cnt = 16;
56       *len = 4;
57      }
58     

** CID 731510:    (USE_AFTER_FREE)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bios/nouveau_subdev_bios_base.c: 414 in nouveau_bios_shadow()
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bios/nouveau_subdev_bios_base.c: 422 in nouveau_bios_shadow()


________________________________________________________________________________________________________
*** CID 731510:    (USE_AFTER_FREE)
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bios/nouveau_subdev_bios_base.c: 414 in nouveau_bios_shadow()
408      } while (mthd->score != 3 && (++mthd)->shadow);
409     
410      mthd = shadow_methods;
411      best = mthd;
412      do {
413       if (mthd->score > best->score) {
>>>     CID 731510:    (USE_AFTER_FREE)
>>>     Calling "kfree" frees pointer "best->data" which has already been freed. [Note: The source code implementation of the function has been overridden by a builtin model.]
414        kfree(best->data);
415        best = mthd;
416       }
417      } while ((++mthd)->shadow);
418     
419      if (best->score) {
/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bios/nouveau_subdev_bios_base.c: 422 in nouveau_bios_shadow()
416       }
417      } while ((++mthd)->shadow);
418     
419      if (best->score) {
420       nv_info(bios, "using image from %s\n", best->desc);
421       bios->size = best->size;
>>>     CID 731510:    (USE_AFTER_FREE)
>>>     Using freed pointer "best->data".
422       bios->data = best->data;
423       return 0;
424      }
425     
426      nv_error(bios, "unable to locate usable image\n");
427      return -EINVAL;

** CID 741236:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/dmaobj/nouveau_engine_dmaobj_nv04.c: 102 in nv04_dmaobj_bind()


________________________________________________________________________________________________________
*** CID 741236:  Control flow issues  (MISSING_BREAK)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/dmaobj/nouveau_engine_dmaobj_nv04.c: 102 in nv04_dmaobj_bind()
96      switch (dmaobj->access) {
97      case NV_MEM_ACCESS_RO:
98       flags0 |= 0x00004000;
99       break;
100      case NV_MEM_ACCESS_WO:
101       flags0 |= 0x00008000;
>>>     CID 741236:  Control flow issues  (MISSING_BREAK)
>>>     The above case falls through to this one.
102      case NV_MEM_ACCESS_RW:
103       flags2 |= 0x00000002;
104       break;
105      default:
106       return -EINVAL;
107      }

** CID 989067:    (OVERRUN)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/disp/nouveau_engine_disp_nvd0.c: 1046 in exec_clkcmp()
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/disp/nouveau_engine_disp_nv50.c: 1307 in exec_clkcmp()


________________________________________________________________________________________________________
*** CID 989067:    (OVERRUN)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/disp/nouveau_engine_disp_nvd0.c: 1046 in exec_clkcmp()
1040       conf = 0x00ff;
1041       break;
1042      }
1043     
1044      data = nvbios_ocfg_match(bios, data, conf, &ver, &hdr, &cnt, &len, &info2);
1045      if (data && id < 0xff) {
>>>     CID 989067:    (OVERRUN)
>>>     Overrunning array "info2.clkcmp" of 2 2-byte elements at element index 254 (byte offset 508) using index "id" (which evaluates to 254).
1046       data = nvbios_oclk_match(bios, info2.clkcmp[id], pclk);
1047       if (data) {
1048        struct nvbios_init init = {
1049         .subdev = nv_subdev(priv),
1050         .bios = bios,
1051         .offset = data,
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/disp/nouveau_engine_disp_nv50.c: 1307 in exec_clkcmp()
1301       conf = (ctrl & 0x00000f00) >> 8;
1302       pclk = pclk / 2;
1303      }
1304     
1305      data = nvbios_ocfg_match(bios, data, conf, &ver, &hdr, &cnt, &len, &info2);
1306      if (data && id < 0xff) {
>>>     CID 989067:    (OVERRUN)
>>>     Overrunning array "info2.clkcmp" of 2 2-byte elements at element index 254 (byte offset 508) using index "id" (which evaluates to 254).
1307       data = nvbios_oclk_match(bios, info2.clkcmp[id], pclk);
1308       if (data) {
1309        struct nvbios_init init = {
1310         .subdev = nv_subdev(priv),
1311         .bios = bios,
1312         .offset = data,

** CID 1056793:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/graph/nouveau_engine_graph_ctxnv50.c: 790 in dd_emit()


________________________________________________________________________________________________________
*** CID 1056793:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/graph/nouveau_engine_graph_ctxnv50.c: 790 in dd_emit()
784     
785     static void
786     dd_emit(struct nouveau_grctx *ctx, int num, u32 val) {
787      int i;
788      if (val && ctx->mode == NOUVEAU_GRCTX_VALS)
789       for (i = 0; i < num; i++)
>>>     CID 1056793:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
>>>     Potentially overflowing expression "4U * (ctx->ctxvals_pos + i)" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "u64" (64 bits, unsigned).
790        nv_wo32(ctx->data, 4 * (ctx->ctxvals_pos + i), val);
791      ctx->ctxvals_pos += num;
792     }
793     
794     static void
795     nv50_graph_construct_mmio_ddata(struct nouveau_grctx *ctx)

** CID 1056794:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/graph/nouveau_engine_graph_ctxnv50.c: 1162 in xf_emit()


________________________________________________________________________________________________________
*** CID 1056794:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/graph/nouveau_engine_graph_ctxnv50.c: 1162 in xf_emit()
1156     
1157     static void
1158     xf_emit(struct nouveau_grctx *ctx, int num, u32 val) {
1159      int i;
1160      if (val && ctx->mode == NOUVEAU_GRCTX_VALS)
1161       for (i = 0; i < num; i++)
>>>     CID 1056794:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
>>>     Potentially overflowing expression "4U * (ctx->ctxvals_pos + (i <<3))" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "u64" (64 bits, unsigned).
1162        nv_wo32(ctx->data, 4 * (ctx->ctxvals_pos + (i <<3)), val);
1163      ctx->ctxvals_pos += num << 3;
1164     }
1165     
1166     /* Gene declarations... */
1167     

** CID 1056795:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/graph/nouveau_engine_graph_nv20.c: 149 in nv20_graph_context_fini()


________________________________________________________________________________________________________
*** CID 1056795:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/graph/nouveau_engine_graph_nv20.c: 149 in nv20_graph_context_fini()
143       nv_wait(priv, 0x400700, 0xffffffff, 0x00000000);
144       nv_wr32(priv, 0x400144, 0x10000000);
145       nv_mask(priv, 0x400148, 0xff000000, 0x1f000000);
146      }
147      nv_mask(priv, 0x400720, 0x00000001, 0x00000001);
148     
>>>     CID 1056795:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
>>>     Potentially overflowing expression "chan->chid * 4" with type "int" (32 bits, signed) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "u64" (64 bits, unsigned).
149      nv_wo32(priv->ctxtab, chan->chid * 4, 0x00000000);
150      return nouveau_graph_context_fini(&chan->base, suspend);
151     }
152     
153     static struct nouveau_oclass
154     nv20_graph_cclass = {


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/netbsd-amd64-kernel?tab=overview

To manage Coverity Scan email notifications for "coverity-updates%netbsd.org@localhost", click https://scan.coverity.com/subscriptions/edit?email=coverity-updates%40netbsd.org&token=487286ca1a9a4f4bd485d16f66b5e782





Prev by Date: New Defects reported by Coverity Scan for NetBSD-i386-user

Next by Date: New Defects reported by Coverity Scan for NetBSD-amd64-user

Previous by Thread: New Defects reported by Coverity Scan for NetBSD-amd64-kernel

Next by Thread: New Defects reported by Coverity Scan for NetBSD-amd64-kernel

Indexes:

reverse Date

reverse Thread

Old Index



Home | Main Index | Thread Index | Old Index