motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-09 02:24:58 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

hw/ufs: Fix code coverity issues

Browse source 
Fixed four ufs-related coverity issues.

The coverity issues and fixes are as follows

1. CID 1519042: Security issue with the rand() function
Changed to use a fixed value (0xab) instead of rand() as
the value for testing

2. CID 1519043: Dereference after null check
Removed useless (redundant) null checks

3. CID 1519050: Out-of-bounds access issue
Fix to pass an array type variable to find_first_bit and
find_next_bit using DECLARE_BITMAP()

4. CID 1519051: Out-of-bounds read issue
Fix incorrect range check for lun

Fix coverity CID: 1519042 1519043 1519050 1519051

Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
This commit is contained in:
Jeuk Kim 2023-09-18 10:02:36 +09:00
parent 63011373ad
commit 97970dae53
3 changed files with 13 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hw/ufs/ufs.c
View file

@ -258,7 +258,7 @@ static void ufs_irq_check(UfsHc *u)
static void ufs_process_db(UfsHc *u, uint32_t val)
{
unsigned long doorbell;
DECLARE_BITMAP(doorbell, UFS_MAX_NUTRS);
uint32_t slot;
uint32_t nutrs = u->params.nutrs;
UfsRequest *req;
@ -268,8 +268,8 @@ static void ufs_process_db(UfsHc *u, uint32_t val)
return;
}
doorbell = val;
slot = find_first_bit(&doorbell, nutrs);
doorbell[0] = val;
slot = find_first_bit(doorbell, nutrs);
while (slot < nutrs) {
req = &u->req_list[slot];
@ -285,7 +285,7 @@ static void ufs_process_db(UfsHc *u, uint32_t val)
trace_ufs_process_db(slot);
req->state = UFS_REQUEST_READY;
slot = find_next_bit(&doorbell, nutrs, slot + 1);
slot = find_next_bit(doorbell, nutrs, slot + 1);
}
qemu_bh_schedule(u->doorbell_bh);
@ -838,7 +838,7 @@ static QueryRespCode ufs_read_unit_desc(UfsRequest *req)
uint8_t lun = req->req_upiu.qr.index;
if (lun != UFS_UPIU_RPMB_WLUN &&
(lun > UFS_MAX_LUS || u->lus[lun] == NULL)) {
(lun >= UFS_MAX_LUS || u->lus[lun] == NULL)) {
trace_ufs_err_query_invalid_index(req->req_upiu.qr.opcode, lun);
return UFS_QUERY_RESULT_INVALID_INDEX;
}