Bug Summary

File:dev/pci/drm/radeon/atombios_i2c.c
Warning:line 68, column 4
Null pointer passed as 2nd argument to memory copy function

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name atombios_i2c.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -D CONFIG_DRM_AMD_DC_DCN3_0 -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /usr/obj/sys/arch/amd64/compile/GENERIC.MP/scan-build/2022-01-12-131800-47421-1 -x c /usr/src/sys/dev/pci/drm/radeon/atombios_i2c.c
1/*
2 * Copyright 2011 Advanced Micro Devices, Inc.
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining a
5 * copy of this software and associated documentation files (the "Software"),
6 * to deal in the Software without restriction, including without limitation
7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8 * and/or sell copies of the Software, and to permit persons to whom the
9 * Software is furnished to do so, subject to the following conditions:
10 *
11 * The above copyright notice and this permission notice shall be included in
12 * all copies or substantial portions of the Software.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
17 * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
18 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
19 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
20 * OTHER DEALINGS IN THE SOFTWARE.
21 *
22 * Authors: Alex Deucher
23 *
24 */
25
26#include <drm/radeon_drm.h>
27#include "radeon.h"
28#include "atom.h"
29
30#define TARGET_HW_I2C_CLOCK50 50
31
32/* these are a limitation of ProcessI2cChannelTransaction not the hw */
33#define ATOM_MAX_HW_I2C_WRITE3 3
34#define ATOM_MAX_HW_I2C_READ255 255
35
36static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
37 u8 slave_addr, u8 flags,
38 u8 *buf, int num)
39{
40 struct drm_device *dev = chan->dev;
41 struct radeon_device *rdev = dev->dev_private;
42 PROCESS_I2C_CHANNEL_TRANSACTION_PS_ALLOCATIONPROCESS_I2C_CHANNEL_TRANSACTION_PARAMETERS args;
43 int index = GetIndexIntoMasterTable(COMMAND, ProcessI2cChannelTransaction)(((char*)(&((ATOM_MASTER_LIST_OF_COMMAND_TABLES*)0)->ProcessI2cChannelTransaction
)-(char*)0)/sizeof(USHORT));
44 unsigned char *base;
45 u16 out = cpu_to_le16(0)((__uint16_t)(0));
46 int r = 0;
47
48 memset(&args, 0, sizeof(args))__builtin_memset((&args), (0), (sizeof(args)));
49
50 mutex_lock(&chan->mutex)rw_enter_write(&chan->mutex);
51 mutex_lock(&rdev->mode_info.atom_context->scratch_mutex)rw_enter_write(&rdev->mode_info.atom_context->scratch_mutex
);
52
53 base = (unsigned char *)rdev->mode_info.atom_context->scratch;
54
55 if (flags & HW_I2C_WRITE1) {
11
←
Taking true branch
→
56 if (num
11.1
'num' is <= ATOM_MAX_HW_I2C_WRITE
 > ATOM_MAX_HW_I2C_WRITE3) {
12
←
Taking false branch
→
57 DRM_ERROR("hw i2c: tried to write too many bytes (%d vs 3)\n", num)__drm_err("hw i2c: tried to write too many bytes (%d vs 3)\n"
, num);
58 r = -EINVAL22;
59 goto done;
60 }
61 if (buf == NULL((void *)0))
13
←
Assuming 'buf' is equal to NULL
→
14
←
Taking true branch
→
62 args.ucRegIndex = 0;
63 else
64 args.ucRegIndex = buf[0];
65 if (num
14.1
'num' is 3
)
15
←
Taking true branch
→
66 num--;
67 if (num
15.1
'num' is 2
)
16
←
Taking true branch
→
68 memcpy(&out, &buf[1], num)__builtin_memcpy((&out), (&buf[1]), (num));
17
←
Null pointer passed as 2nd argument to memory copy function
69 args.lpI2CDataOut = cpu_to_le16(out)((__uint16_t)(out));
70 } else {
71 args.ucRegIndex = 0;
72 args.lpI2CDataOut = 0;
73 }
74
75 args.ucFlag = flags;
76 args.ucI2CSpeed = TARGET_HW_I2C_CLOCK50;
77 args.ucTransBytes = num;
78 args.ucSlaveAddr = slave_addr << 1;
79 args.ucLineNumber = chan->rec.i2c_id;
80
81 atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args);
82
83 /* error */
84 if (args.ucStatus != HW_ASSISTED_I2C_STATUS_SUCCESS1) {
85 DRM_DEBUG_KMS("hw_i2c error\n")__drm_dbg(DRM_UT_KMS, "hw_i2c error\n");
86 r = -EIO5;
87 goto done;
88 }
89
90 if (!(flags & HW_I2C_WRITE1))
91 radeon_atom_copy_swap(buf, base, num, false0);
92
93done:
94 mutex_unlock(&rdev->mode_info.atom_context->scratch_mutex)rw_exit_write(&rdev->mode_info.atom_context->scratch_mutex
);
95 mutex_unlock(&chan->mutex)rw_exit_write(&chan->mutex);
96
97 return r;
98}
99
100int radeon_atom_hw_i2c_xfer(struct i2c_adapter *i2c_adap,
101 struct i2c_msg *msgs, int num)
102{
103 struct radeon_i2c_chan *i2c = i2c_get_adapdata(i2c_adap);
104 struct i2c_msg *p;
105 int i, remaining, current_count, buffer_offset, max_bytes, ret;
106 u8 flags;
107
108 /* check for bus probe */
109 p = &msgs[0];
110 if ((num == 1) && (p->len == 0)) {
1
Assuming 'num' is not equal to 1
→
111 ret = radeon_process_i2c_ch(i2c,
112 p->addr, HW_I2C_WRITE1,
113 NULL((void *)0), 0);
114 if (ret)
115 return ret;
116 else
117 return num;
118 }
119
120 for (i = 0; i < num; i++) {
2
←
Assuming 'i' is < 'num'
→
3
←
Loop condition is true. Entering loop body
→
121 p = &msgs[i];
122 remaining = p->len;
123 buffer_offset = 0;
124 /* max_bytes are a limitation of ProcessI2cChannelTransaction not the hw */
125 if (p->flags & I2C_M_RD0x0001) {
4
←
Assuming the condition is false
→
5
←
Taking false branch
→
126 max_bytes = ATOM_MAX_HW_I2C_READ255;
127 flags = HW_I2C_READ0;
128 } else {
129 max_bytes = ATOM_MAX_HW_I2C_WRITE3;
130 flags = HW_I2C_WRITE1;
131 }
132 while (remaining) {
6
←
Loop condition is true. Entering loop body
→
133 if (remaining > max_bytes)
7
←
Assuming 'remaining' is > 'max_bytes'
→
8
←
Taking true branch
→
134 current_count = max_bytes;
135 else
136 current_count = remaining;
137 ret = radeon_process_i2c_ch(i2c,
10
←
Calling 'radeon_process_i2c_ch'
→
138 p->addr, flags,
139 &p->buf[buffer_offset], current_count);
9
←
Passing value via 4th parameter 'buf'
→
140 if (ret)
141 return ret;
142 remaining -= current_count;
143 buffer_offset += current_count;
144 }
145 }
146
147 return num;
148}
149
150u32 radeon_atom_hw_i2c_func(struct i2c_adapter *adap)
151{
152 return I2C_FUNC_I2C0 | I2C_FUNC_SMBUS_EMUL0;
153}
154