flashrom April 2014

flashrom@flashrom.org

32 participants
121 discussions

[PATCH] CID1130007: Resource leak
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130007: Resource leak The system resource will not be reclaimed and reused, reducing the future availability of the resource. In ogp_spi_init: Leak of memory or pointers to system resources Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: ogp_spi.c =================================================================== --- ogp_spi.c (revision 1763) +++ ogp_spi.c (working copy) @@ -120,8 +120,10 @@ ogp_reg_sck = OGA1_XP10_CPROM_SCK; } else { msg_perr("Invalid or missing rom= parameter.\n"); + free(type); return 1; } + free(type); if (rget_io_perms()) return 1;

2 1

[PATCH] CID1130011: Use after free
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130011: Use after free This could cause an immediate crash or incorrect values might be read subsequently resulting in incorrect computations. In dump_file: A pointer to freed memory is dereferenced, used as a function argument, or otherwise used Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: util/ich_descriptors_tool/ich_descriptors_tool.c =================================================================== --- util/ich_descriptors_tool/ich_descriptors_tool.c (revision 1763) +++ util/ich_descriptors_tool/ich_descriptors_tool.c (working copy) @@ -77,12 +77,13 @@ printf("Dumping %u bytes of the %s region from 0x%08x-0x%08x to %s... ", file_len, region_names[i], base, limit, fn); int fh = open(fn, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR); - free(fn); if (fh < 0) { fprintf(stderr, "ERROR: couldn't open(%s): %s\n", fn, strerror(errno)); + free(fn); exit(1); } + free(fn); ret = write(fh, &dump[base >> 2], file_len); if (ret != file_len) {

2 1

[PATCH] CID1130012: Double free
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130012: Double free Depending on the implementation of the deallocator function, the memory may by placed on the free list more than once. In pony_spi_init: Memory is deallocated more than once Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: pony_spi.c =================================================================== --- pony_spi.c (revision 1763) +++ pony_spi.c (working copy) @@ -140,6 +140,7 @@ } else if (arg && !strlen(arg)) { msg_perr("Error: Missing argument for programmer type.\n"); free(arg); + return 1; } else if (arg){ msg_perr("Error: Invalid programmer type specified.\n"); free(arg);

2 1

[PATCH] CID1130004: Nesting level does not match indentation
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130004: Nesting level does not match indentation Code that is meant to be executed conditionally may be executed unconditionally In print_supported_boards_helper: The indentation of this code suggests it is nested when it is not. Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: print.c =================================================================== --- print.c (revision 1763) +++ print.c (working copy) @@ -436,13 +436,14 @@ msg_ginfo("%s", b->name); for (i = 0; i < maxboardlen - strlen(b->name); i++) msg_ginfo(" "); - if (b->working == OK) - msg_ginfo("OK "); - else if (b->working == NT) - msg_ginfo("NT "); - else - msg_ginfo("BAD "); + if (b->working == OK) + msg_ginfo("OK "); + else if (b->working == NT) + msg_ginfo("NT "); + else + msg_ginfo("BAD "); + for (e = board_matches; e->vendor_name != NULL; e++) { if (strcmp(e->vendor_name, b->vendor) || strcmp(e->board_name, b->name))

2 1

[PATCH] CID1129996: Unchecked return value from library
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1129996: Unchecked return value from library The function returns a value that indicates an error condition. If this is not checked, the error condition may not be handled correctly. In sp_opensocket: Value returned from a library function is not checked for errors before being used. This value may indicate an error condition. (CWE-252) Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: serprog.c =================================================================== --- serprog.c (revision 1763) +++ serprog.c (working copy) @@ -114,7 +114,11 @@ } /* We are latency limited, and sometimes do write-write-read * * (write-n) - so enable TCP_NODELAY. */ - setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, &flag, sizeof(int)); + if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, &flag, sizeof(int))) { + close(sock); + msg_perr("Error: serprog cannot set socket options: %s\n", strerror(errno)); + return -1; + } return sock; } #endif

2 1

[PATCH] CID1130000: Unchecked return value
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130000: Unchecked return value If the function returns an error value, the error value may be mistaken for a normal value. In default_spi_write_aai: Value returned from a function is not checked for errors before being used Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: spi25.c =================================================================== --- spi25.c (revision 1763) +++ spi25.c (working copy) @@ -1146,8 +1146,10 @@ while (pos < start + len - 1) { cmd[1] = buf[pos++ - start]; cmd[2] = buf[pos++ - start]; - spi_send_command(flash, JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE, 0, - cmd, NULL); + result = spi_send_command(flash, JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE, + 0, cmd, NULL); + if (result != 0) + msg_cerr("%s failed.\n", __func__); while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(10); }

2 1

Can I get some help?
by Jonathan B. Horen 26 Apr '14

26 Apr '14

$ flashrom -L|grep SST49LF004A/B SST SST49LF004A/B P R E W 512 FWH $ sudo flashrom -w IN2202.ROM flashrom v0.9.2-r1141 on Linux 2.6.38-16-generic (i686), built with libpci 3.1.7, GCC 4.5.1, little endian flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. No coreboot table found. Found ITE Super I/O, id 8712 Found chipset "Intel ICH5/ICH5R", enabling flash write... OK. This chipset supports the following protocols: FWH. Found chip "SST SST49LF004A/B" (512 KB, FWH) at physical address 0xfff80000. Flash image seems to be a legacy BIOS. Disabling checks. Writing flash chip... Erasing flash chip... ERASE FAILED at 0x00000000! Expected=0xff, Read=0x49, failed byte count from 0x00000000-0x00000fff: 0x584 ERASE FAILED! ERASE FAILED at 0x00000000! Expected=0xff, Read=0x49, failed byte count from 0x00000000-0x0000ffff: 0xd7f ERASE FAILED! FAILED! ERASE FAILED! FAILED! Your flash chip is in an unknown state. Get help on IRC at irc.freenode.net (channel #flashrom) or mail flashrom(a)flashrom.org! ------------------------------------------------------------------------------- DO NOT REBOOT OR POWEROFF!

2 2

[PATCH] CID1130006: Resource leak
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130006: Resource leak The system resource will not be reclaimed and reused, reducing the future availability of the resource. In buspirate_spi_init: Leak of memory or pointers to system resources Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: buspirate_spi.c =================================================================== --- buspirate_spi.c (revision 1763) +++ buspirate_spi.c (working copy) @@ -250,6 +250,7 @@ if (!bp_commbuf) { bp_commbufsize = 0; msg_perr("Out of memory!\n"); + free(dev); return ERROR_OOM; } bp_commbufsize = DEFAULT_BUFSIZE;

2 1

[PATCH] CID1130002: Logically dead code
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130002: Logically dead code The indicated dead code may have performed some action; that action will never occur. In satamv_init: Code can never be reached because of a logical contradiction What we really want to do is check whether PCI_BASE_ADDRESS_2 is valid at this point, and not PCI_BASE_ADDRESS_0. Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: satamv.c =================================================================== --- satamv.c (revision 1763) +++ satamv.c (working copy) @@ -139,7 +139,7 @@ /* Get I/O BAR location. */ tmp = pcidev_readbar(dev, PCI_BASE_ADDRESS_2); - if (!addr) + if (!tmp) return 1; /* Truncate to reachable range.

2 1

[commit] r1780 - trunk
by repository service 26 Apr '14

26 Apr '14

Author: stefanct Date: Sat Apr 26 18:13:09 2014 New Revision: 1780 URL: http://flashrom.org/trac/flashrom/changeset/1780 Log: Report if we are not able to disable AAI mode again. Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Acked-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Modified: trunk/spi25.c Modified: trunk/spi25.c ============================================================================== --- trunk/spi25.c Sat Apr 26 18:12:55 2014 (r1779) +++ trunk/spi25.c Sat Apr 26 18:13:09 2014 (r1780) @@ -1151,10 +1151,12 @@ programmer_delay(10); } - /* Use WRDI to exit AAI mode. This needs to be done before issuing any - * other non-AAI command. - */ - spi_write_disable(flash); + /* Use WRDI to exit AAI mode. This needs to be done before issuing any other non-AAI command. */ + result = spi_write_disable(flash); + if (result != 0) { + msg_cerr("%s failed to disable AAI mode.\n", __func__); + return SPI_GENERIC_ERROR; + } /* Write remaining byte (if any). */ if (pos < start + len) { @@ -1166,6 +1168,8 @@ return 0; bailout: - spi_write_disable(flash); + result = spi_write_disable(flash); + if (result != 0) + msg_cerr("%s failed to disable AAI mode.\n", __func__); return SPI_GENERIC_ERROR; }

1 0

← Newer
1
...
6
7
8
9
10
11
12
13
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom April 2014