flashrom

flashrom@flashrom.org

6 participants
9186 discussions

[PATCH] CID1129996: Unchecked return value from library
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1129996: Unchecked return value from library The function returns a value that indicates an error condition. If this is not checked, the error condition may not be handled correctly. In sp_opensocket: Value returned from a library function is not checked for errors before being used. This value may indicate an error condition. (CWE-252) Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: serprog.c =================================================================== --- serprog.c (revision 1763) +++ serprog.c (working copy) @@ -114,7 +114,11 @@ } /* We are latency limited, and sometimes do write-write-read * * (write-n) - so enable TCP_NODELAY. */ - setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, &flag, sizeof(int)); + if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, &flag, sizeof(int))) { + close(sock); + msg_perr("Error: serprog cannot set socket options: %s\n", strerror(errno)); + return -1; + } return sock; } #endif

2 1

[PATCH] CID1130000: Unchecked return value
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130000: Unchecked return value If the function returns an error value, the error value may be mistaken for a normal value. In default_spi_write_aai: Value returned from a function is not checked for errors before being used Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: spi25.c =================================================================== --- spi25.c (revision 1763) +++ spi25.c (working copy) @@ -1146,8 +1146,10 @@ while (pos < start + len - 1) { cmd[1] = buf[pos++ - start]; cmd[2] = buf[pos++ - start]; - spi_send_command(flash, JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE, 0, - cmd, NULL); + result = spi_send_command(flash, JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE, + 0, cmd, NULL); + if (result != 0) + msg_cerr("%s failed.\n", __func__); while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(10); }

2 1

Can I get some help?
by Jonathan B. Horen 26 Apr '14

26 Apr '14

$ flashrom -L|grep SST49LF004A/B SST SST49LF004A/B P R E W 512 FWH $ sudo flashrom -w IN2202.ROM flashrom v0.9.2-r1141 on Linux 2.6.38-16-generic (i686), built with libpci 3.1.7, GCC 4.5.1, little endian flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. No coreboot table found. Found ITE Super I/O, id 8712 Found chipset "Intel ICH5/ICH5R", enabling flash write... OK. This chipset supports the following protocols: FWH. Found chip "SST SST49LF004A/B" (512 KB, FWH) at physical address 0xfff80000. Flash image seems to be a legacy BIOS. Disabling checks. Writing flash chip... Erasing flash chip... ERASE FAILED at 0x00000000! Expected=0xff, Read=0x49, failed byte count from 0x00000000-0x00000fff: 0x584 ERASE FAILED! ERASE FAILED at 0x00000000! Expected=0xff, Read=0x49, failed byte count from 0x00000000-0x0000ffff: 0xd7f ERASE FAILED! FAILED! ERASE FAILED! FAILED! Your flash chip is in an unknown state. Get help on IRC at irc.freenode.net (channel #flashrom) or mail flashrom(a)flashrom.org! ------------------------------------------------------------------------------- DO NOT REBOOT OR POWEROFF!

2 2

[PATCH] CID1130006: Resource leak
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130006: Resource leak The system resource will not be reclaimed and reused, reducing the future availability of the resource. In buspirate_spi_init: Leak of memory or pointers to system resources Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: buspirate_spi.c =================================================================== --- buspirate_spi.c (revision 1763) +++ buspirate_spi.c (working copy) @@ -250,6 +250,7 @@ if (!bp_commbuf) { bp_commbufsize = 0; msg_perr("Out of memory!\n"); + free(dev); return ERROR_OOM; } bp_commbufsize = DEFAULT_BUFSIZE;

2 1

[PATCH] CID1130002: Logically dead code
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130002: Logically dead code The indicated dead code may have performed some action; that action will never occur. In satamv_init: Code can never be reached because of a logical contradiction What we really want to do is check whether PCI_BASE_ADDRESS_2 is valid at this point, and not PCI_BASE_ADDRESS_0. Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: satamv.c =================================================================== --- satamv.c (revision 1763) +++ satamv.c (working copy) @@ -139,7 +139,7 @@ /* Get I/O BAR location. */ tmp = pcidev_readbar(dev, PCI_BASE_ADDRESS_2); - if (!addr) + if (!tmp) return 1; /* Truncate to reachable range.

2 1

[commit] r1780 - trunk
by repository service 26 Apr '14

26 Apr '14

Author: stefanct Date: Sat Apr 26 18:13:09 2014 New Revision: 1780 URL: http://flashrom.org/trac/flashrom/changeset/1780 Log: Report if we are not able to disable AAI mode again. Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Acked-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Modified: trunk/spi25.c Modified: trunk/spi25.c ============================================================================== --- trunk/spi25.c Sat Apr 26 18:12:55 2014 (r1779) +++ trunk/spi25.c Sat Apr 26 18:13:09 2014 (r1780) @@ -1151,10 +1151,12 @@ programmer_delay(10); } - /* Use WRDI to exit AAI mode. This needs to be done before issuing any - * other non-AAI command. - */ - spi_write_disable(flash); + /* Use WRDI to exit AAI mode. This needs to be done before issuing any other non-AAI command. */ + result = spi_write_disable(flash); + if (result != 0) { + msg_cerr("%s failed to disable AAI mode.\n", __func__); + return SPI_GENERIC_ERROR; + } /* Write remaining byte (if any). */ if (pos < start + len) { @@ -1166,6 +1168,8 @@ return 0; bailout: - spi_write_disable(flash); + result = spi_write_disable(flash); + if (result != 0) + msg_cerr("%s failed to disable AAI mode.\n", __func__); return SPI_GENERIC_ERROR; }

1 0

[commit] r1779 - trunk
by repository service 26 Apr '14

26 Apr '14

Author: stefanct Date: Sat Apr 26 18:12:55 2014 New Revision: 1779 URL: http://flashrom.org/trac/flashrom/changeset/1779 Log: CID1130000: Unchecked return value in default_spi_write_aai(). Also, try to always disable WRDI because else the user is stuck with a chip in AAI mode that won't return by itself w/o a reset. Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Acked-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Modified: trunk/spi25.c Modified: trunk/spi25.c ============================================================================== --- trunk/spi25.c Sat Apr 26 18:12:45 2014 (r1778) +++ trunk/spi25.c Sat Apr 26 18:12:55 2014 (r1779) @@ -1128,13 +1128,9 @@ result = spi_send_multicommand(flash, cmds); - if (result) { - msg_cerr("%s failed during start command execution\n", - __func__); - /* FIXME: Should we send WRDI here as well to make sure the chip - * is not in AAI mode? - */ - return result; + if (result != 0) { + msg_cerr("%s failed during start command execution: %d\n", __func__, result); + goto bailout; } while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(10); @@ -1146,8 +1142,11 @@ while (pos < start + len - 1) { cmd[1] = buf[pos++ - start]; cmd[2] = buf[pos++ - start]; - spi_send_command(flash, JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE, 0, - cmd, NULL); + result = spi_send_command(flash, JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE, 0, cmd, NULL); + if (result != 0) { + msg_cerr("%s failed during followup AAI command execution: %d\n", __func__, result); + goto bailout; + } while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(10); } @@ -1165,4 +1164,8 @@ } return 0; + +bailout: + spi_write_disable(flash); + return SPI_GENERIC_ERROR; }

1 0

[commit] r1778 - trunk
by repository service 26 Apr '14

26 Apr '14

Author: stefanct Date: Sat Apr 26 18:12:45 2014 New Revision: 1778 URL: http://flashrom.org/trac/flashrom/changeset/1778 Log: CID1130006: Memory leaks in buspirate_spi_init(). The one in the error case of register_shutdown() was discovered while reviewing the other one found by Coverity and fixed by Stefan Reinauer. Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Acked-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Modified: trunk/buspirate_spi.c Modified: trunk/buspirate_spi.c ============================================================================== --- trunk/buspirate_spi.c Sat Apr 26 18:12:31 2014 (r1777) +++ trunk/buspirate_spi.c Sat Apr 26 18:12:45 2014 (r1778) @@ -250,6 +250,7 @@ if (!bp_commbuf) { bp_commbufsize = 0; msg_perr("Out of memory!\n"); + free(dev); return ERROR_OOM; } bp_commbufsize = DEFAULT_BUFSIZE; @@ -263,8 +264,12 @@ return ret; } - if (register_shutdown(buspirate_spi_shutdown, NULL)) + if (register_shutdown(buspirate_spi_shutdown, NULL) != 0) { + bp_commbufsize = 0; + free(bp_commbuf); + bp_commbuf = NULL; return 1; + } /* This is the brute force version, but it should work. * It is likely to fail if a previous flashrom run was aborted during a write with the new SPI commands

1 0

[commit] r1777 - trunk
by repository service 26 Apr '14

26 Apr '14

Author: stefanct Date: Sat Apr 26 18:12:31 2014 New Revision: 1777 URL: http://flashrom.org/trac/flashrom/changeset/1777 Log: CID1129996: Unchecked return value from setsockopt() in serprog. Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Acked-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Modified: trunk/serprog.c Modified: trunk/serprog.c ============================================================================== --- trunk/serprog.c Sat Apr 26 18:12:15 2014 (r1776) +++ trunk/serprog.c Sat Apr 26 18:12:31 2014 (r1777) @@ -115,7 +115,11 @@ } /* We are latency limited, and sometimes do write-write-read * * (write-n) - so enable TCP_NODELAY. */ - setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, &flag, sizeof(int)); + if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, &flag, sizeof(int))) { + close(sock); + msg_perr("Error: serprog cannot set socket options: %s\n", strerror(errno)); + return -1; + } return sock; } #endif

1 0

[commit] r1776 - trunk
by repository service 26 Apr '14

26 Apr '14

Author: stefanct Date: Sat Apr 26 18:12:15 2014 New Revision: 1776 URL: http://flashrom.org/trac/flashrom/changeset/1776 Log: CID1130002: Logically dead code due to copy and paste error. What we really want to do is check whether PCI_BASE_ADDRESS_2 is valid at this point, and not PCI_BASE_ADDRESS_0. Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Acked-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Modified: trunk/satamv.c Modified: trunk/satamv.c ============================================================================== --- trunk/satamv.c Sat Apr 26 18:12:03 2014 (r1775) +++ trunk/satamv.c Sat Apr 26 18:12:15 2014 (r1776) @@ -138,7 +138,7 @@ pci_rmmio_writel(tmp, mv_bar + GPIO_PORT_CONTROL); /* Get I/O BAR location. */ - tmp = pcidev_readbar(dev, PCI_BASE_ADDRESS_2); + addr = pcidev_readbar(dev, PCI_BASE_ADDRESS_2); if (!addr) return 1; @@ -146,7 +146,7 @@ * FIXME: Check if the I/O BAR is actually reachable. * This is an arch specific check. */ - mv_iobar = tmp & 0xffff; + mv_iobar = addr & 0xffff; msg_pspew("Activating I/O BAR at 0x%04x\n", mv_iobar); /* 512 kByte with two 8-bit latches, and

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom