[dpdk-dev] DPDK Coverity issue 127559

[Rahul Lakkireddy]

Hi all,

On Monday, July 07/04/16, 2016 at 08:29:49 -0700, john.mcnamara at intel.com wrote:
> Hi Rahul,
> 
> This is an automated email in relation to a new Coverity static code analysis
> issue in DPDK. Details of the issue are below.
> 
[...]

> Git commit data and Coverity defect information below.
> 
> Commit data
> ===========
> 
> Commit: net/cxgbe: support EEPROM access
> Id:     fe0bd9ee5da3fd52766458a5d0fa9a8728182be1
> Author: Rahul Lakkireddy
> Email:  rahul.lakkireddy at chelsio.com
> Date:   Fri May  6 08:43:18 2016 +0530
> 
> Defect information
> ==================
> 
> /drivers/net/cxgbe/cxgbe_ethdev.c: 919 in cxgbe_set_eeprom()
> *** CID 127559:    (TAINTED_SCALAR)
> 913     	}
> 914
> 915     	if (!err)
> 916     		err = t4_seeprom_wp(adapter, true);
> 917     out:
> 918     	if (buf != eeprom->data)
> >>>     CID 127559:    (TAINTED_SCALAR)
> >>>     Passing tainted variable "buf" to a tainted sink.
> 919     		rte_free(buf);
> 920     	return err;
> 921     }
> 922
> 923     static int cxgbe_get_regs_len(struct rte_eth_dev *eth_dev)
> 924     {
> /drivers/net/cxgbe/cxgbe_ethdev.c: 910 in cxgbe_set_eeprom()
> 904     	}
> 905
> 906     	err = t4_seeprom_wp(adapter, false);
> 907     	if (err)
> 908     		goto out;
> 909
> >>>     CID 127559:    (TAINTED_SCALAR)
> >>>     Assigning: "p" = "(u32 *)buf". Both are now tainted.
> 910     	for (p = (u32 *)buf; !err && aligned_len; aligned_len -= 4, p++) {
> 911     		err = eeprom_wr_phys(adapter, aligned_offset, *p);
> 912     		aligned_offset += 4;
> 913     	}
> 914
> 915     	if (!err)
> 

I'm not an expert in Coverity and am having trouble understanding what
the defect is and need some clarification.  Is it telling me that "buf"
is being used without doing lower and upper bounds check?

Thanks,
Rahul