Hi,
Please find the latest report on new defect(s) introduced to NetBSD-amd64-kernel found with Coverity Scan.
** CID 1654714: (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_dce_v8_0.c: 1558 in dce_v8_0_afmt_setmode()
_____________________________________________________________________________________________
*** CID 1654714: (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_dce_v8_0.c: 1560 in dce_v8_0_afmt_setmode()
1554
1555 WREG32(mmHDMI_VBI_PACKET_CONTROL + offset,
1556 HDMI_VBI_PACKET_CONTROL__HDMI_NULL_SEND_MASK); /* send null packets when required */
1557
1558 WREG32(mmAFMT_AUDIO_CRC_CONTROL + offset, 0x1000);
1559
>>> CID 1654714: (LOCK)
>>> "amdgpu_mm_rreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1560 val = RREG32(mmHDMI_CONTROL + offset);
1561 val &= ~HDMI_CONTROL__HDMI_DEEP_COLOR_ENABLE_MASK;
1562 val &= ~HDMI_CONTROL__HDMI_DEEP_COLOR_DEPTH_MASK;
1563
1564 switch (bpc) {
1565 case 0:
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_dce_v8_0.c: 1560 in dce_v8_0_afmt_setmode()
1554
1555 WREG32(mmHDMI_VBI_PACKET_CONTROL + offset,
1556 HDMI_VBI_PACKET_CONTROL__HDMI_NULL_SEND_MASK); /* send null packets when required */
1557
1558 WREG32(mmAFMT_AUDIO_CRC_CONTROL + offset, 0x1000);
1559
>>> CID 1654714: (LOCK)
>>> "amdgpu_mm_rreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1560 val = RREG32(mmHDMI_CONTROL + offset);
1561 val &= ~HDMI_CONTROL__HDMI_DEEP_COLOR_ENABLE_MASK;
1562 val &= ~HDMI_CONTROL__HDMI_DEEP_COLOR_DEPTH_MASK;
1563
1564 switch (bpc) {
1565 case 0:
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_dce_v8_0.c: 1558 in dce_v8_0_afmt_setmode()
1552
1553 dce_v8_0_audio_set_dto(encoder, mode->clock);
1554
1555 WREG32(mmHDMI_VBI_PACKET_CONTROL + offset,
1556 HDMI_VBI_PACKET_CONTROL__HDMI_NULL_SEND_MASK); /* send null packets when required */
1557
>>> CID 1654714: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1558 WREG32(mmAFMT_AUDIO_CRC_CONTROL + offset, 0x1000);
1559
1560 val = RREG32(mmHDMI_CONTROL + offset);
1561 val &= ~HDMI_CONTROL__HDMI_DEEP_COLOR_ENABLE_MASK;
1562 val &= ~HDMI_CONTROL__HDMI_DEEP_COLOR_DEPTH_MASK;
1563
** CID 1654711: Integer handling issues (SIGN_EXTENSION)
/usr.sbin/makefs/msdos/msdosfs_denode.c: 163 in msdosfs_deget()
_____________________________________________________________________________________________
*** CID 1654711: Integer handling issues (SIGN_EXTENSION)
/usr.sbin/makefs/msdos/msdosfs_denode.c: 163 in msdosfs_deget()
157 &direntptr);
158 if (error) {
159 ldep->de_devvp = NULL;
160 ldep->de_Name[0] = SLOT_DELETED;
161 return (error);
162 }
>>> CID 1654711: Integer handling issues (SIGN_EXTENSION)
>>> Suspicious implicit sign extension: "le16dec(direntptr->deHighClust)" with type "uint16_t" (16 bits, unsigned) is promoted in "le16dec(direntptr->deHighClust) << 16" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "le16dec(direntptr->deHighClust) << 16" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
163 DE_INTERNALIZE(ldep, direntptr);
164 brelse(bp, 0);
165 }
166
167 /*
168 * Fill in a few fields of the vnode and finish filling in the
** CID 1654704: Insecure data handling (TAINTED_SCALAR)
_____________________________________________________________________________________________
*** CID 1654704: Insecure data handling (TAINTED_SCALAR)
/sbin/newfs_udf/udf_core.c: 2930 in udf_create_VAT()
2924
2925 vatlvext->unique_id_chk = fe->unique_id;
2926 vatlvext->num_files = udf_rw32(context.num_files);
2927 vatlvext->num_directories = udf_rw32(context.num_directories);
2928 memcpy(vatlvext->logvol_id, context.logical_vol->logvol_id,128);
2929
>>> CID 1654704: Insecure data handling (TAINTED_SCALAR)
>>> Passing tainted _expression_ "((struct extattr_entry *)extattr)->a_l" to "udf_extattr_insert_internal", which uses it as an offset.
2930 udf_extattr_insert_internal((union dscrptr *) fe,
2931 (struct extattr_entry *) extattr);
2932
2933 free(extattr);
2934
2935 fe->icbtag.flags = udf_rw16(UDF_ICB_LONG_ALLOC);
** CID 1654702: Memory - illegal accesses (OVERRUN)
/sys/external/bsd/drm2/dist/drm/amd/powerplay/hwmgr/amdgpu_vega20_hwmgr.c: 2564 in vega20_force_clock_level()
_____________________________________________________________________________________________
*** CID 1654702: Memory - illegal accesses (OVERRUN)
/sys/external/bsd/drm2/dist/drm/amd/powerplay/hwmgr/amdgpu_vega20_hwmgr.c: 2564 in vega20_force_clock_level()
2558 data->dpm_table.mem_table.count - 1);
2559 return -EINVAL;
2560 }
2561
2562 data->dpm_table.mem_table.dpm_state.soft_min_level =
2563 data->dpm_table.mem_table.dpm_levels[soft_min_level].value;
>>> CID 1654702: Memory - illegal accesses (OVERRUN)
>>> Overrunning array "data->dpm_table.mem_table.dpm_levels" of 16 12-byte elements at element index 31 (byte offset 383) using index "soft_max_level" (which evaluates to 31).
2564 data->dpm_table.mem_table.dpm_state.soft_max_level =
2565 data->dpm_table.mem_table.dpm_levels[soft_max_level].value;
2566
2567 ret = vega20_upload_dpm_min_level(hwmgr, FEATURE_DPM_UCLK_MASK);
2568 PP_ASSERT_WITH_CODE(!ret,
2569 "Failed to upload boot level to lowest!",
** CID 1654698: Insecure data handling (TAINTED_SCALAR)
_____________________________________________________________________________________________
*** CID 1654698: Insecure data handling (TAINTED_SCALAR)
/sbin/fdisk/fdisk.c: 3019 in read_gpt()
3013 }
3014 (void)memcpy(gptp, buf, GPT_HDR_SIZE);
3015
3016 /* GPT CRC should be calculated with CRC field preset to zero */
3017 hdr->hdr_crc_self = 0;
3018
>>> CID 1654698: Insecure data handling (TAINTED_SCALAR)
>>> Passing tainted _expression_ "gptp->hdr_size" to "crc32", which uses it as a loop boundary.
3019 if (memcmp(gptp->hdr_sig, GPT_HDR_SIG, sizeof(gptp->hdr_sig))
3020 || gptp->hdr_lba_self != (uint64_t)offset
3021 || crc32(0, (void *)hdr, gptp->hdr_size) != gptp->hdr_crc_self) {
3022 /* not a GPT */
3023 (void)memset(gptp, 0, GPT_HDR_SIZE);
3024 }
** CID 1654696: Integer handling issues (INTEGER_OVERFLOW)
/external/lgpl3/mpfr/dist/src/sqrt.c: 480 in mpfr_sqrt2()
_____________________________________________________________________________________________
*** CID 1654696: Integer handling issues (INTEGER_OVERFLOW)
/external/lgpl3/mpfr/dist/src/sqrt.c: 480 in mpfr_sqrt2()
474 MPFR_ASSERTD(exp_r <= __gmpfr_emax);
475 MPFR_RET(-1);
476 }
477 else /* round away from zero */
478 {
479 add_one_ulp:
>>> CID 1654696: Integer handling issues (INTEGER_OVERFLOW)
>>> _expression_ "1UL << sh", where "sh" is known to be equal to 64, overflows the type of "1UL << sh", which is type "mp_limb_t".
480 rp[0] += MPFR_LIMB_ONE << sh;
481 rp[1] += rp[0] == 0;
482 if (rp[1] == 0)
483 {
484 rp[1] = MPFR_LIMB_HIGHBIT;
485 if (MPFR_UNLIKELY(exp_r + 1 > __gmpfr_emax))
** CID 1654695: (LOCK)
_____________________________________________________________________________________________
*** CID 1654695: (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_dce_v11_0.c: 1879 in dce_v11_0_vga_enable()
1873 u32 vga_control;
1874
1875 vga_control = RREG32(vga_control_regs[amdgpu_crtc->crtc_id]) & ~1;
1876 if (enable)
1877 WREG32(vga_control_regs[amdgpu_crtc->crtc_id], vga_control | 1);
1878 else
>>> CID 1654695: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1879 WREG32(vga_control_regs[amdgpu_crtc->crtc_id], vga_control);
1880 }
1881
1882 static void dce_v11_0_grph_enable(struct drm_crtc *crtc, bool enable)
1883 {
1884 struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_dce_v11_0.c: 1877 in dce_v11_0_vga_enable()
1871 struct drm_device *dev = crtc->dev;
1872 struct amdgpu_device *adev = dev->dev_private;
1873 u32 vga_control;
1874
1875 vga_control = RREG32(vga_control_regs[amdgpu_crtc->crtc_id]) & ~1;
1876 if (enable)
>>> CID 1654695: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1877 WREG32(vga_control_regs[amdgpu_crtc->crtc_id], vga_control | 1);
1878 else
1879 WREG32(vga_control_regs[amdgpu_crtc->crtc_id], vga_control);
1880 }
1881
1882 static void dce_v11_0_grph_enable(struct drm_crtc *crtc, bool enable)
** CID 1654693: Insecure data handling (INTEGER_OVERFLOW)
/external/bsd/flex/dist/src/tables.c: 183 in yytbl_hdr_fwrite()
_____________________________________________________________________________________________
*** CID 1654693: Insecure data handling (INTEGER_OVERFLOW)
/external/bsd/flex/dist/src/tables.c: 183 in yytbl_hdr_fwrite()
177 bwritten += rv;
178
179 /* Sanity check */
180 if (bwritten != (int) th->th_hsize)
181 flex_die (_("pad64 failed"));
182
>>> CID 1654693: Insecure data handling (INTEGER_OVERFLOW)
>>> "bwritten", which might have overflowed, is returned from the function.
183 return bwritten;
184 }
185
186
187 /** Write this table.
188 * @param wr the file writer
** CID 1654687: (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1295 in gmc_v7_0_process_interrupt()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1297 in gmc_v7_0_process_interrupt()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1294 in gmc_v7_0_process_interrupt()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1297 in gmc_v7_0_process_interrupt()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1295 in gmc_v7_0_process_interrupt()
_____________________________________________________________________________________________
*** CID 1654687: (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1297 in gmc_v7_0_process_interrupt()
1291 u32 addr, status, mc_client, vmid;
1292
1293 addr = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_ADDR);
1294 status = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_STATUS);
1295 mc_client = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_MCCLIENT);
1296 /* reset addr and status */
>>> CID 1654687: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1297 WREG32_P(mmVM_CONTEXT1_CNTL2, 1, ~1);
1298
1299 if (!addr && !status)
1300 return 0;
1301
1302 if (amdgpu_vm_fault_stop == AMDGPU_VM_FAULT_STOP_FIRST)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1295 in gmc_v7_0_process_interrupt()
1289 struct amdgpu_iv_entry *entry)
1290 {
1291 u32 addr, status, mc_client, vmid;
1292
1293 addr = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_ADDR);
1294 status = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_STATUS);
>>> CID 1654687: (LOCK)
>>> "amdgpu_mm_rreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1295 mc_client = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_MCCLIENT);
1296 /* reset addr and status */
1297 WREG32_P(mmVM_CONTEXT1_CNTL2, 1, ~1);
1298
1299 if (!addr && !status)
1300 return 0;
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1297 in gmc_v7_0_process_interrupt()
1291 u32 addr, status, mc_client, vmid;
1292
1293 addr = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_ADDR);
1294 status = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_STATUS);
1295 mc_client = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_MCCLIENT);
1296 /* reset addr and status */
>>> CID 1654687: (LOCK)
>>> "amdgpu_mm_rreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1297 WREG32_P(mmVM_CONTEXT1_CNTL2, 1, ~1);
1298
1299 if (!addr && !status)
1300 return 0;
1301
1302 if (amdgpu_vm_fault_stop == AMDGPU_VM_FAULT_STOP_FIRST)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1294 in gmc_v7_0_process_interrupt()
1288 struct amdgpu_irq_src *source,
1289 struct amdgpu_iv_entry *entry)
1290 {
1291 u32 addr, status, mc_client, vmid;
1292
1293 addr = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_ADDR);
>>> CID 1654687: (LOCK)
>>> "amdgpu_mm_rreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1294 status = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_STATUS);
1295 mc_client = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_MCCLIENT);
1296 /* reset addr and status */
1297 WREG32_P(mmVM_CONTEXT1_CNTL2, 1, ~1);
1298
1299 if (!addr && !status)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1297 in gmc_v7_0_process_interrupt()
1291 u32 addr, status, mc_client, vmid;
1292
1293 addr = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_ADDR);
1294 status = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_STATUS);
1295 mc_client = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_MCCLIENT);
1296 /* reset addr and status */
>>> CID 1654687: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1297 WREG32_P(mmVM_CONTEXT1_CNTL2, 1, ~1);
1298
1299 if (!addr && !status)
1300 return 0;
1301
1302 if (amdgpu_vm_fault_stop == AMDGPU_VM_FAULT_STOP_FIRST)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1297 in gmc_v7_0_process_interrupt()
1291 u32 addr, status, mc_client, vmid;
1292
1293 addr = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_ADDR);
1294 status = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_STATUS);
1295 mc_client = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_MCCLIENT);
1296 /* reset addr and status */
>>> CID 1654687: (LOCK)
>>> "amdgpu_mm_rreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1297 WREG32_P(mmVM_CONTEXT1_CNTL2, 1, ~1);
1298
1299 if (!addr && !status)
1300 return 0;
1301
1302 if (amdgpu_vm_fault_stop == AMDGPU_VM_FAULT_STOP_FIRST)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1303 in gmc_v7_0_process_interrupt()
1297 WREG32_P(mmVM_CONTEXT1_CNTL2, 1, ~1);
1298
1299 if (!addr && !status)
1300 return 0;
1301
1302 if (amdgpu_vm_fault_stop == AMDGPU_VM_FAULT_STOP_FIRST)
>>> CID 1654687: (LOCK)
>>> "gmc_v7_0_set_fault_enable_default" unlocks "adev->mmio_idx_lock" while it is unlocked.
1303 gmc_v7_0_set_fault_enable_default(adev, false);
1304
1305 if (printk_ratelimit()) {
1306 dev_err(adev->dev, "GPU fault detected: %d 0x%08x\n",
1307 entry->src_id, entry->src_data[0]);
1308 dev_err(adev->dev, " VM_CONTEXT1_PROTECTION_FAULT_ADDR 0x%08X\n",
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_gmc_v7_0.c: 1295 in gmc_v7_0_process_interrupt()
1289 struct amdgpu_iv_entry *entry)
1290 {
1291 u32 addr, status, mc_client, vmid;
1292
1293 addr = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_ADDR);
1294 status = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_STATUS);
>>> CID 1654687: (LOCK)
>>> "amdgpu_mm_rreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1295 mc_client = RREG32(mmVM_CONTEXT1_PROTECTION_FAULT_MCCLIENT);
1296 /* reset addr and status */
1297 WREG32_P(mmVM_CONTEXT1_CNTL2, 1, ~1);
1298
1299 if (!addr && !status)
1300 return 0;
** CID 1654685: Null pointer dereferences (FORWARD_NULL)
/sys/dev/raidframe/rf_paritylogging.c: 934 in rf_ParityLoggingDagSelect()
_____________________________________________________________________________________________
*** CID 1654685: Null pointer dereferences (FORWARD_NULL)
/sys/dev/raidframe/rf_paritylogging.c: 934 in rf_ParityLoggingDagSelect()
928 } else
929 *createFunc = (RF_VoidFuncPtr) rf_CreateParityLoggingLargeWriteDAG;
930 } else
931 if (asmp->numParityFailed == 1)
932 *createFunc = (RF_VoidFuncPtr) rf_CreateNonRedundantWriteDAG;
933 else
>>> CID 1654685: Null pointer dereferences (FORWARD_NULL)
>>> Dereferencing null pointer "failedPDA".
934 if (asmp->numStripeUnitsAccessed != 1 && failedPDA->numSector != layoutPtr->sectorsPerStripeUnit)
935 *createFunc = NULL;
936 else
937 *createFunc = (RF_VoidFuncPtr) rf_CreateDegradedWriteDAG;
938 }
939 }
** CID 1654680: Uninitialized members (UNINIT_CTOR)
/external/gpl2/groff/dist/src/roff/troff/node.cpp: 234 in font_info::font_info(symbol, int, symbol, font *)()
_____________________________________________________________________________________________
*** CID 1654680: Uninitialized members (UNINIT_CTOR)
/external/gpl2/groff/dist/src/roff/troff/node.cpp: 234 in font_info::font_info(symbol, int, symbol, font *)()
228 font_info::font_info(symbol nm, int n, symbol enm, font *f)
229 : last_tfont(0), number(n), last_size(0),
230 internal_name(nm), external_name(enm), fm(f),
231 is_bold(0), is_constant_spaced(CONSTANT_SPACE_NONE), last_ligature_mode(1),
232 last_kern_mode(1), cond_bold_list(0), sf(0)
233 {
>>> CID 1654680: Uninitialized members (UNINIT_CTOR)
>>> Non-static class member "constant_space" is not initialized in this constructor nor in any functions that it calls.
234 }
235
236 inline int font_info::contains(charinfo *ci)
237 {
238 return fm != 0 && fm->contains(ci->get_index());
239 }
** CID 1654679: API usage errors (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/powerplay/amdgpu_smu_v11_0.c: 88 in smu_v11_0_wait_for_response()
_____________________________________________________________________________________________
*** CID 1654679: API usage errors (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/powerplay/amdgpu_smu_v11_0.c: 88 in smu_v11_0_wait_for_response()
82 static int smu_v11_0_wait_for_response(struct smu_context *smu)
83 {
84 struct amdgpu_device *adev = smu->adev;
85 uint32_t cur_value, i, timeout = adev->usec_timeout * 10;
86
87 for (i = 0; i < timeout; i++) {
>>> CID 1654679: API usage errors (LOCK)
>>> "amdgpu_mm_rreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
88 cur_value = RREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_90);
89 if ((cur_value & MP1_C2PMSG_90__CONTENT_MASK) != 0)
90 return cur_value == 0x1 ? 0 : -EIO;
91
92 udelay(1);
93 }
** CID 1654677: API usage errors (LOCK)
_____________________________________________________________________________________________
*** CID 1654677: API usage errors (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_dce_v10_0.c: 2313 in dce_v10_0_hide_cursor()
2307 struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
2308 struct amdgpu_device *adev = crtc->dev->dev_private;
2309 u32 tmp;
2310
2311 tmp = RREG32_IDX(mmCUR_CONTROL + amdgpu_crtc->crtc_offset);
2312 tmp = REG_SET_FIELD(tmp, CUR_CONTROL, CURSOR_EN, 0);
>>> CID 1654677: API usage errors (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
2313 WREG32_IDX(mmCUR_CONTROL + amdgpu_crtc->crtc_offset, tmp);
2314 }
2315
2316 static void dce_v10_0_show_cursor(struct drm_crtc *crtc)
2317 {
2318 struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
** CID 1654675: API usage errors (LOCK)
_____________________________________________________________________________________________
*** CID 1654675: API usage errors (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_iceland_ih.c: 212 in iceland_ih_get_wptr()
206 */
207 dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
208 wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
209 ih->rptr = (wptr + 16) & ih->ptr_mask;
210 tmp = RREG32(mmIH_RB_CNTL);
211 tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
>>> CID 1654675: API usage errors (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
212 WREG32(mmIH_RB_CNTL, tmp);
213 }
214 return (wptr & ih->ptr_mask);
215 }
216
217 /**
** CID 1654673: Insecure data handling (TAINTED_SCALAR)
_____________________________________________________________________________________________
*** CID 1654673: Insecure data handling (TAINTED_SCALAR)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_connectors.c: 1171 in amdgpu_connector_dvi_mode_valid()
1165
1166 if (amdgpu_connector->use_digital && (mode->clock > 165000)) {
1167 if ((amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I) ||
1168 (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D) ||
1169 (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B)) {
1170 return MODE_OK;
>>> CID 1654673: Insecure data handling (TAINTED_SCALAR)
>>> Passing tainted _expression_ "amdgpu_connector_edid(connector)->extensions" to "drm_detect_hdmi_monitor", which uses it as a loop boundary.
1171 } else if (drm_detect_hdmi_monitor(amdgpu_connector_edid(connector))) {
1172 /* HDMI 1.3+ supports max clock of 340 Mhz */
1173 if (mode->clock > 340000)
1174 return MODE_CLOCK_HIGH;
1175 else
1176 return MODE_OK;
** CID 1654665: Integer handling issues (INTEGER_OVERFLOW)
/lib/libc/db/btree/bt_split.c: 679 in bt_psplit()
_____________________________________________________________________________________________
*** CID 1654665: Integer handling issues (INTEGER_OVERFLOW)
/lib/libc/db/btree/bt_split.c: 679 in bt_psplit()
673 * possible size for the page, it's possible to get situations
674 * where we decide to try and copy too much onto the left page.
675 * Make sure that doesn't happen.
676 */
677 if ((skip <= off && used + nbytes + sizeof(indx_t) >= full) ||
678 nxt == top - 1) {
>>> CID 1654665: Integer handling issues (INTEGER_OVERFLOW)
>>> _expression_ "--off", where "off" is known to be equal to 0, underflows the type of "--off", which is type "indx_t".
679 --off;
680 break;
681 }
682
683 /* Copy the key/data pair, if not the skipped index. */
684 if (skip != off) {
** CID 1654662: (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 670 in sdma_v3_0_gfx_resume()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 690 in sdma_v3_0_gfx_resume()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 696 in sdma_v3_0_gfx_resume()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 676 in sdma_v3_0_gfx_resume()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 702 in sdma_v3_0_gfx_resume()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 670 in sdma_v3_0_gfx_resume()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 700 in sdma_v3_0_gfx_resume()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 679 in sdma_v3_0_gfx_resume()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 671 in sdma_v3_0_gfx_resume()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 671 in sdma_v3_0_gfx_resume()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 697 in sdma_v3_0_gfx_resume()
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 694 in sdma_v3_0_gfx_resume()
_____________________________________________________________________________________________
*** CID 1654662: (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 670 in sdma_v3_0_gfx_resume()
664 wb_offset = (ring->rptr_offs * 4);
665
666 mutex_lock(&adev->srbm_mutex);
667 for (j = 0; j < 16; j++) {
668 vi_srbm_select(adev, 0, 0, 0, j);
669 /* SDMA GFX */
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
670 WREG32(mmSDMA0_GFX_VIRTUAL_ADDR + sdma_offsets[i], 0);
671 WREG32(mmSDMA0_GFX_APE1_CNTL + sdma_offsets[i], 0);
672 }
673 vi_srbm_select(adev, 0, 0, 0, 0);
674 mutex_unlock(&adev->srbm_mutex);
675
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 673 in sdma_v3_0_gfx_resume()
667 for (j = 0; j < 16; j++) {
668 vi_srbm_select(adev, 0, 0, 0, j);
669 /* SDMA GFX */
670 WREG32(mmSDMA0_GFX_VIRTUAL_ADDR + sdma_offsets[i], 0);
671 WREG32(mmSDMA0_GFX_APE1_CNTL + sdma_offsets[i], 0);
672 }
>>> CID 1654662: (LOCK)
>>> "vi_srbm_select" unlocks "adev->mmio_idx_lock" while it is unlocked.
673 vi_srbm_select(adev, 0, 0, 0, 0);
674 mutex_unlock(&adev->srbm_mutex);
675
676 WREG32(mmSDMA0_TILING_CONFIG + sdma_offsets[i],
677 adev->gfx.config.gb_addr_config & 0x70);
678
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 690 in sdma_v3_0_gfx_resume()
684 rb_cntl = REG_SET_FIELD(rb_cntl, SDMA0_GFX_RB_CNTL, RB_SIZE, rb_bufsz);
685 #ifdef __BIG_ENDIAN
686 rb_cntl = REG_SET_FIELD(rb_cntl, SDMA0_GFX_RB_CNTL, RB_SWAP_ENABLE, 1);
687 rb_cntl = REG_SET_FIELD(rb_cntl, SDMA0_GFX_RB_CNTL,
688 RPTR_WRITEBACK_SWAP_ENABLE, 1);
689 #endif
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
690 WREG32(mmSDMA0_GFX_RB_CNTL + sdma_offsets[i], rb_cntl);
691
692 /* Initialize the ring buffer's read and write pointers */
693 ring->wptr = 0;
694 WREG32(mmSDMA0_GFX_RB_RPTR + sdma_offsets[i], 0);
695 sdma_v3_0_ring_set_wptr(ring);
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 696 in sdma_v3_0_gfx_resume()
690 WREG32(mmSDMA0_GFX_RB_CNTL + sdma_offsets[i], rb_cntl);
691
692 /* Initialize the ring buffer's read and write pointers */
693 ring->wptr = 0;
694 WREG32(mmSDMA0_GFX_RB_RPTR + sdma_offsets[i], 0);
695 sdma_v3_0_ring_set_wptr(ring);
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
696 WREG32(mmSDMA0_GFX_IB_RPTR + sdma_offsets[i], 0);
697 WREG32(mmSDMA0_GFX_IB_OFFSET + sdma_offsets[i], 0);
698
699 /* set the wb address whether it's enabled or not */
700 WREG32(mmSDMA0_GFX_RB_RPTR_ADDR_HI + sdma_offsets[i],
701 upper_32_bits(adev->wb.gpu_addr + wb_offset) & 0xFFFFFFFF);
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 676 in sdma_v3_0_gfx_resume()
670 WREG32(mmSDMA0_GFX_VIRTUAL_ADDR + sdma_offsets[i], 0);
671 WREG32(mmSDMA0_GFX_APE1_CNTL + sdma_offsets[i], 0);
672 }
673 vi_srbm_select(adev, 0, 0, 0, 0);
674 mutex_unlock(&adev->srbm_mutex);
675
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
676 WREG32(mmSDMA0_TILING_CONFIG + sdma_offsets[i],
677 adev->gfx.config.gb_addr_config & 0x70);
678
679 WREG32(mmSDMA0_SEM_WAIT_FAIL_TIMER_CNTL + sdma_offsets[i], 0);
680
681 /* Set ring buffer size in dwords */
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 702 in sdma_v3_0_gfx_resume()
696 WREG32(mmSDMA0_GFX_IB_RPTR + sdma_offsets[i], 0);
697 WREG32(mmSDMA0_GFX_IB_OFFSET + sdma_offsets[i], 0);
698
699 /* set the wb address whether it's enabled or not */
700 WREG32(mmSDMA0_GFX_RB_RPTR_ADDR_HI + sdma_offsets[i],
701 upper_32_bits(adev->wb.gpu_addr + wb_offset) & 0xFFFFFFFF);
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
702 WREG32(mmSDMA0_GFX_RB_RPTR_ADDR_LO + sdma_offsets[i],
703 lower_32_bits(adev->wb.gpu_addr + wb_offset) & 0xFFFFFFFC);
704
705 rb_cntl = REG_SET_FIELD(rb_cntl, SDMA0_GFX_RB_CNTL, RPTR_WRITEBACK_ENABLE, 1);
706
707 WREG32(mmSDMA0_GFX_RB_BASE + sdma_offsets[i], ring->gpu_addr >> 8);
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 670 in sdma_v3_0_gfx_resume()
664 wb_offset = (ring->rptr_offs * 4);
665
666 mutex_lock(&adev->srbm_mutex);
667 for (j = 0; j < 16; j++) {
668 vi_srbm_select(adev, 0, 0, 0, j);
669 /* SDMA GFX */
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
670 WREG32(mmSDMA0_GFX_VIRTUAL_ADDR + sdma_offsets[i], 0);
671 WREG32(mmSDMA0_GFX_APE1_CNTL + sdma_offsets[i], 0);
672 }
673 vi_srbm_select(adev, 0, 0, 0, 0);
674 mutex_unlock(&adev->srbm_mutex);
675
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 668 in sdma_v3_0_gfx_resume()
662 ring = &adev->sdma.instance[i].ring;
663 amdgpu_ring_clear_ring(ring);
664 wb_offset = (ring->rptr_offs * 4);
665
666 mutex_lock(&adev->srbm_mutex);
667 for (j = 0; j < 16; j++) {
>>> CID 1654662: (LOCK)
>>> "vi_srbm_select" unlocks "adev->mmio_idx_lock" while it is unlocked.
668 vi_srbm_select(adev, 0, 0, 0, j);
669 /* SDMA GFX */
670 WREG32(mmSDMA0_GFX_VIRTUAL_ADDR + sdma_offsets[i], 0);
671 WREG32(mmSDMA0_GFX_APE1_CNTL + sdma_offsets[i], 0);
672 }
673 vi_srbm_select(adev, 0, 0, 0, 0);
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 700 in sdma_v3_0_gfx_resume()
694 WREG32(mmSDMA0_GFX_RB_RPTR + sdma_offsets[i], 0);
695 sdma_v3_0_ring_set_wptr(ring);
696 WREG32(mmSDMA0_GFX_IB_RPTR + sdma_offsets[i], 0);
697 WREG32(mmSDMA0_GFX_IB_OFFSET + sdma_offsets[i], 0);
698
699 /* set the wb address whether it's enabled or not */
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
700 WREG32(mmSDMA0_GFX_RB_RPTR_ADDR_HI + sdma_offsets[i],
701 upper_32_bits(adev->wb.gpu_addr + wb_offset) & 0xFFFFFFFF);
702 WREG32(mmSDMA0_GFX_RB_RPTR_ADDR_LO + sdma_offsets[i],
703 lower_32_bits(adev->wb.gpu_addr + wb_offset) & 0xFFFFFFFC);
704
705 rb_cntl = REG_SET_FIELD(rb_cntl, SDMA0_GFX_RB_CNTL, RPTR_WRITEBACK_ENABLE, 1);
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 679 in sdma_v3_0_gfx_resume()
673 vi_srbm_select(adev, 0, 0, 0, 0);
674 mutex_unlock(&adev->srbm_mutex);
675
676 WREG32(mmSDMA0_TILING_CONFIG + sdma_offsets[i],
677 adev->gfx.config.gb_addr_config & 0x70);
678
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
679 WREG32(mmSDMA0_SEM_WAIT_FAIL_TIMER_CNTL + sdma_offsets[i], 0);
680
681 /* Set ring buffer size in dwords */
682 rb_bufsz = order_base_2(ring->ring_size / 4);
683 rb_cntl = RREG32(mmSDMA0_GFX_RB_CNTL + sdma_offsets[i]);
684 rb_cntl = REG_SET_FIELD(rb_cntl, SDMA0_GFX_RB_CNTL, RB_SIZE, rb_bufsz);
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 683 in sdma_v3_0_gfx_resume()
677 adev->gfx.config.gb_addr_config & 0x70);
678
679 WREG32(mmSDMA0_SEM_WAIT_FAIL_TIMER_CNTL + sdma_offsets[i], 0);
680
681 /* Set ring buffer size in dwords */
682 rb_bufsz = order_base_2(ring->ring_size / 4);
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_rreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
683 rb_cntl = RREG32(mmSDMA0_GFX_RB_CNTL + sdma_offsets[i]);
684 rb_cntl = REG_SET_FIELD(rb_cntl, SDMA0_GFX_RB_CNTL, RB_SIZE, rb_bufsz);
685 #ifdef __BIG_ENDIAN
686 rb_cntl = REG_SET_FIELD(rb_cntl, SDMA0_GFX_RB_CNTL, RB_SWAP_ENABLE, 1);
687 rb_cntl = REG_SET_FIELD(rb_cntl, SDMA0_GFX_RB_CNTL,
688 RPTR_WRITEBACK_SWAP_ENABLE, 1);
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 671 in sdma_v3_0_gfx_resume()
665
666 mutex_lock(&adev->srbm_mutex);
667 for (j = 0; j < 16; j++) {
668 vi_srbm_select(adev, 0, 0, 0, j);
669 /* SDMA GFX */
670 WREG32(mmSDMA0_GFX_VIRTUAL_ADDR + sdma_offsets[i], 0);
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
671 WREG32(mmSDMA0_GFX_APE1_CNTL + sdma_offsets[i], 0);
672 }
673 vi_srbm_select(adev, 0, 0, 0, 0);
674 mutex_unlock(&adev->srbm_mutex);
675
676 WREG32(mmSDMA0_TILING_CONFIG + sdma_offsets[i],
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 671 in sdma_v3_0_gfx_resume()
665
666 mutex_lock(&adev->srbm_mutex);
667 for (j = 0; j < 16; j++) {
668 vi_srbm_select(adev, 0, 0, 0, j);
669 /* SDMA GFX */
670 WREG32(mmSDMA0_GFX_VIRTUAL_ADDR + sdma_offsets[i], 0);
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
671 WREG32(mmSDMA0_GFX_APE1_CNTL + sdma_offsets[i], 0);
672 }
673 vi_srbm_select(adev, 0, 0, 0, 0);
674 mutex_unlock(&adev->srbm_mutex);
675
676 WREG32(mmSDMA0_TILING_CONFIG + sdma_offsets[i],
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 697 in sdma_v3_0_gfx_resume()
691
692 /* Initialize the ring buffer's read and write pointers */
693 ring->wptr = 0;
694 WREG32(mmSDMA0_GFX_RB_RPTR + sdma_offsets[i], 0);
695 sdma_v3_0_ring_set_wptr(ring);
696 WREG32(mmSDMA0_GFX_IB_RPTR + sdma_offsets[i], 0);
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
697 WREG32(mmSDMA0_GFX_IB_OFFSET + sdma_offsets[i], 0);
698
699 /* set the wb address whether it's enabled or not */
700 WREG32(mmSDMA0_GFX_RB_RPTR_ADDR_HI + sdma_offsets[i],
701 upper_32_bits(adev->wb.gpu_addr + wb_offset) & 0xFFFFFFFF);
702 WREG32(mmSDMA0_GFX_RB_RPTR_ADDR_LO + sdma_offsets[i],
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_sdma_v3_0.c: 694 in sdma_v3_0_gfx_resume()
688 RPTR_WRITEBACK_SWAP_ENABLE, 1);
689 #endif
690 WREG32(mmSDMA0_GFX_RB_CNTL + sdma_offsets[i], rb_cntl);
691
692 /* Initialize the ring buffer's read and write pointers */
693 ring->wptr = 0;
>>> CID 1654662: (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
694 WREG32(mmSDMA0_GFX_RB_RPTR + sdma_offsets[i], 0);
695 sdma_v3_0_ring_set_wptr(ring);
696 WREG32(mmSDMA0_GFX_IB_RPTR + sdma_offsets[i], 0);
697 WREG32(mmSDMA0_GFX_IB_OFFSET + sdma_offsets[i], 0);
698
699 /* set the wb address whether it's enabled or not */
** CID 1654661: API usage errors (LOCK)
_____________________________________________________________________________________________
*** CID 1654661: API usage errors (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_nbio_v7_4.c: 423 in nbio_v7_4_set_ras_err_event_athub_irq_state()
417 if (state == AMDGPU_IRQ_STATE_ENABLE) {
418 /* set interrupt vector select bit to 0 to select
419 * vetcor 1 for bare metal case */
420 bif_intr_cntl = REG_SET_FIELD(bif_intr_cntl,
421 BIF_INTR_CNTL,
422 RAS_INTR_VEC_SEL, 0);
>>> CID 1654661: API usage errors (LOCK)
>>> "amdgpu_mm_wreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
423 WREG32_SOC15(NBIO, 0, mmBIF_INTR_CNTL, bif_intr_cntl);
424 }
425
426 return 0;
427 }
428
** CID 1654660: (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_uvd_v7_0.c: 1248 in uvd_v7_0_ring_test_ring()
_____________________________________________________________________________________________
*** CID 1654660: (LOCK)
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_uvd_v7_0.c: 1248 in uvd_v7_0_ring_test_ring()
1242
1243 amdgpu_ring_write(ring,
1244 PACKET0(SOC15_REG_OFFSET(UVD, ring->me, mmUVD_CONTEXT_ID), 0));
1245 amdgpu_ring_write(ring, 0xDEADBEEF);
1246 amdgpu_ring_commit(ring);
1247 for (i = 0; i < adev->usec_timeout; i++) {
>>> CID 1654660: (LOCK)
>>> "amdgpu_mm_rreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1248 tmp = RREG32_SOC15(UVD, ring->me, mmUVD_CONTEXT_ID);
1249 if (tmp == 0xDEADBEEF)
1250 break;
1251 udelay(1);
1252 }
1253
/sys/external/bsd/drm2/dist/drm/amd/amdgpu/amdgpu_uvd_v7_0.c: 1248 in uvd_v7_0_ring_test_ring()
1242
1243 amdgpu_ring_write(ring,
1244 PACKET0(SOC15_REG_OFFSET(UVD, ring->me, mmUVD_CONTEXT_ID), 0));
1245 amdgpu_ring_write(ring, 0xDEADBEEF);
1246 amdgpu_ring_commit(ring);
1247 for (i = 0; i < adev->usec_timeout; i++) {
>>> CID 1654660: (LOCK)
>>> "amdgpu_mm_rreg" unlocks "adev->mmio_idx_lock" while it is unlocked.
1248 tmp = RREG32_SOC15(UVD, ring->me, mmUVD_CONTEXT_ID);
1249 if (tmp == 0xDEADBEEF)
1250 break;
1251 udelay(1);
1252 }
1253
** CID 1654656: Null pointer dereferences (REVERSE_INULL)
/external/bsd/mdocml/dist/mdoc_validate.c: 2717 in post_dd()
_____________________________________________________________________________________________
*** CID 1654656: Null pointer dereferences (REVERSE_INULL)
/external/bsd/mdocml/dist/mdoc_validate.c: 2717 in post_dd()
2711 mandoc_msg(MANDOCERR_PROLOG_ORDER,
2712 n->line, n->pos, "Dd after Dt");
2713 else if (mdoc->meta.os != NULL)
2714 mandoc_msg(MANDOCERR_PROLOG_ORDER,
2715 n->line, n->pos, "Dd after Os");
2716
>>> CID 1654656: Null pointer dereferences (REVERSE_INULL)
>>> Null-checking "n" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
2717 if (mdoc->quick && n != NULL)
2718 mdoc->meta.date = mandoc_strdup("");
2719 else
2720 mdoc->meta.date = mandoc_normdate(n->child, n);
2721 }
2722
Best regards,
The Coverity Scan Admin Team