Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Coverity CID :189742]Program hangs in /drivers/usb/device/usb_dc_sam.c #11481

Closed
mandarcthorat1 opened this issue Nov 19, 2018 · 1 comment
Closed
Assignees
Labels
area: Drivers bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: medium Medium impact/importance bug

Comments

@mandarcthorat1
Copy link
Contributor

Static code scan issues seen in File: /drivers/usb/device/usb_dc_sam.c
Category: Program hangs
Function: usb_dc_ep_write
Component: Drivers
CID: 189742
Please fix or provide comments to square it off in coverity in the link: https://scan9.coverity.com/reports.htm#v32951/p12996

@mandarcthorat1 mandarcthorat1 added area: Drivers bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix labels Nov 19, 2018
@aurel32
Copy link
Collaborator

aurel32 commented Nov 19, 2018

This is a false positive from Coverity. usb_dc_ep_mps() can indeed return a negative value if the endpoint address is out of range, however the returned value is not used in that case.

Anyway I'll send a patch shuffling the code to get rid of this warning.

aurel32 added a commit to aurel32/zephyr that referenced this issue Nov 20, 2018
Coverity complains that packet_len can get assigned a negative value if
usb_dc_ep_mps() returns an error. This is correct, however it only
happens if the endpoint address is invalid, and in that case the value
is not used as the endpoint address is also validated in
usb_dc_ep_write().

Fix the issue by moving the assignment after the endpoint address
validation and by accessing the value directly instead of getting it
through usb_dc_ep_mps().

Fixes zephyrproject-rtos#11481
Coverity-CID: 189742

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
@galak galak added the priority: medium Medium impact/importance bug label Nov 21, 2018
nashif pushed a commit that referenced this issue Nov 23, 2018
Coverity complains that packet_len can get assigned a negative value if
usb_dc_ep_mps() returns an error. This is correct, however it only
happens if the endpoint address is invalid, and in that case the value
is not used as the endpoint address is also validated in
usb_dc_ep_write().

Fix the issue by moving the assignment after the endpoint address
validation and by accessing the value directly instead of getting it
through usb_dc_ep_mps().

Fixes #11481
Coverity-CID: 189742

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: Drivers bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: medium Medium impact/importance bug
Projects
None yet
Development

No branches or pull requests

3 participants