Merge branch '2023-08-08-assorted-code-corrections' into next

- A number of code corrections caught by Smatch and a few others as
  well.

26 files changed, 51 insertions, 53 deletions

diff --git a/board/amlogic/vim3/vim3.c b/board/amlogic/vim3/vim3.c
index fcd60ab1e05..8bdfb302f72 100644
--- a/board/amlogic/vim3/vim3.c
+++ b/board/amlogic/vim3/vim3.c
@@ -104,8 +104,8 @@ int meson_ft_board_setup(void *blob, struct bd_info *bd)
 		}
 
 		/* Update PHY names (mandatory to disable USB3.0) */
-		len = strlcpy(data, "usb2-phy0", 32);
-		len += strlcpy(&data[len], "usb2-phy1", 32 - len);
+		len = strlcpy(data, "usb2-phy0", 32) + 1;
+		len += strlcpy(&data[len], "usb2-phy1", 32 - len) + 1;
 		ret = fdt_setprop(blob, node, "phy-names", data, len);
 		if (ret < 0) {
 			printf("vim3: failed to update usb phy names property (%d)\n", ret);
@@ -132,7 +132,7 @@ int meson_ft_board_setup(void *blob, struct bd_info *bd)
 		}
 
 		/* Enable PCIe */
-		len = strlcpy(data, "okay", 32);
+		len = strlcpy(data, "okay", 32) + 1;
 		ret = fdt_setprop(blob, node, "status", data, len);
 		if (ret < 0) {
 			printf("vim3: failed to enable pcie node (%d)\n", ret);
diff --git a/board/sunxi/board.c b/board/sunxi/board.c
index f321cd58a6e..de0f3505e52 100644
--- a/board/sunxi/board.c
+++ b/board/sunxi/board.c
@@ -33,7 +33,6 @@
 #include <asm/arch/sys_proto.h>
 #include <asm/global_data.h>
 #include <linux/delay.h>
-#include <u-boot/crc.h>
 #ifndef CONFIG_ARM64
 #include <asm/armv7.h>
 #endif
diff --git a/boot/android_ab.c b/boot/android_ab.c
index 73b55c196c4..0f20a34e511 100644
--- a/boot/android_ab.c
+++ b/boot/android_ab.c
@@ -12,7 +12,6 @@
 #include <memalign.h>
 #include <linux/err.h>
 #include <u-boot/crc.h>
-#include <u-boot/crc.h>
 
 /**
  * Compute the CRC-32 of the bootloader control struct.
diff --git a/boot/pxe_utils.c b/boot/pxe_utils.c
index d13c47dd942..ac1414a5f26 100644
--- a/boot/pxe_utils.c
+++ b/boot/pxe_utils.c
@@ -702,8 +702,8 @@ static int label_boot(struct pxe_context *ctx, struct pxe_label *label)
 				}
 			}
 
-		if (label->kaslrseed)
-			label_boot_kaslrseed();
+			if (label->kaslrseed)
+				label_boot_kaslrseed();
 
 #ifdef CONFIG_OF_LIBFDT_OVERLAY
 			if (label->fdtoverlays)
diff --git a/boot/scene_menu.c b/boot/scene_menu.c
index 8a355f838cc..57ffb523ff3 100644
--- a/boot/scene_menu.c
+++ b/boot/scene_menu.c
@@ -416,7 +416,7 @@ int scene_menuitem(struct scene *scn, uint menu_id, const char *name, uint id,
 	if (!scene_obj_find(scn, label_id, SCENEOBJT_TEXT))
 		return log_msg_ret("txt", -EINVAL);
 
-	item = calloc(1, sizeof(struct scene_obj_menu));
+	item = calloc(1, sizeof(struct scene_menitem));
 	if (!item)
 		return log_msg_ret("item", -ENOMEM);
 	item->name = strdup(name);
diff --git a/cmd/mux.c b/cmd/mux.c
index 833266f08b1..c75907af772 100644
--- a/cmd/mux.c
+++ b/cmd/mux.c
@@ -49,7 +49,7 @@ static struct mux_control *cmd_mux_find(char *const argv[])
 
 	chip = dev_get_uclass_priv(dev);
 	if (!chip)
-		return ERR_PTR(ret);
+		return ERR_PTR(-EINVAL);
 
 	if (id >= chip->controllers)
 		return ERR_PTR(-EINVAL);
diff --git a/cmd/nvedit_efi.c b/cmd/nvedit_efi.c
index 24944ab81e2..7a30b5cc8f8 100644
--- a/cmd/nvedit_efi.c
+++ b/cmd/nvedit_efi.c
@@ -262,7 +262,7 @@ static int append_value(char **bufp, size_t *sizep, char *data)
 	char *tmp_buf = NULL, *new_buf = NULL, *value;
 	unsigned long len = 0;
 
-	if (!strncmp(data, "=0x", 2)) { /* hexadecimal number */
+	if (!strncmp(data, "=0x", 3)) { /* hexadecimal number */
 		union {
 			u8 u8;
 			u16 u16;
diff --git a/cmd/tpm_test.c b/cmd/tpm_test.c
index c4ed8e59012..9bdc9c660fd 100644
--- a/cmd/tpm_test.c
+++ b/cmd/tpm_test.c
@@ -294,8 +294,8 @@ static int test_readonly(struct udevice *dev)
 	 */
 	index_0 += 1;
 	if (tpm_nv_write_value(dev, INDEX0, (uint8_t *)&index_0,
-			       sizeof(index_0) !=
-		TPM_SUCCESS)) {
+			       sizeof(index_0)) !=
+		TPM_SUCCESS) {
 		pr_err("\tcould not write index 0\n");
 	}
 	tpm_nv_write_value_lock(dev, INDEX0);
diff --git a/common/board_f.c b/common/board_f.c
index 7d2c380e91e..50edac5b7a8 100644
--- a/common/board_f.c
+++ b/common/board_f.c
@@ -148,11 +148,12 @@ static int print_resetinfo(void)
 	bool status_printed = false;
 	int ret;
 
-	/* Not all boards have sysreset drivers available during early
+	/*
+	 * Not all boards have sysreset drivers available during early
 	 * boot, so don't fail if one can't be found.
 	 */
 	for (ret = uclass_first_device_check(UCLASS_SYSRESET, &dev); dev;
-			ret = uclass_next_device_check(&dev)) {
+	     ret = uclass_next_device_check(&dev)) {
 		if (ret) {
 			debug("%s: %s sysreset device (error: %d)\n",
 			      __func__, dev->name, ret);
diff --git a/common/hash.c b/common/hash.c
index cbffdfd6db3..159179e7f21 100644
--- a/common/hash.c
+++ b/common/hash.c
@@ -21,7 +21,6 @@
 #include <asm/global_data.h>
 #include <asm/io.h>
 #include <linux/errno.h>
-#include <u-boot/crc.h>
 #else
 #include "mkimage.h"
 #include <linux/compiler_attributes.h>
diff --git a/drivers/core/ofnode.c b/drivers/core/ofnode.c
index 8df16e56af5..a4dc9bde085 100644
--- a/drivers/core/ofnode.c
+++ b/drivers/core/ofnode.c
@@ -103,7 +103,7 @@ void *ofnode_lookup_fdt(ofnode node)
 	if (gd->flags & GD_FLG_RELOC) {
 		uint i = OFTREE_TREE_ID(node.of_offset);
 
-		if (i > oftree_count) {
+		if (i >= oftree_count) {
 			log_debug("Invalid tree ID %x\n", i);
 			return NULL;
 		}
diff --git a/drivers/fastboot/fb_getvar.c b/drivers/fastboot/fb_getvar.c
index dd3475e0a8b..d9f0f07b2bc 100644
--- a/drivers/fastboot/fb_getvar.c
+++ b/drivers/fastboot/fb_getvar.c
@@ -183,7 +183,7 @@ static void __maybe_unused getvar_has_slot(char *part_name, char *response)
 
 	/* part_name_wslot = part_name + "_a" */
 	len = strlcpy(part_name_wslot, part_name, PART_NAME_LEN - 3);
-	if (len > PART_NAME_LEN - 3)
+	if (len >= PART_NAME_LEN - 3)
 		goto fail;
 	strcat(part_name_wslot, "_a");
 
diff --git a/drivers/misc/cros_ec.c b/drivers/misc/cros_ec.c
index 621d1752176..9c1e6a5e3e7 100644
--- a/drivers/misc/cros_ec.c
+++ b/drivers/misc/cros_ec.c
@@ -1100,8 +1100,11 @@ int cros_ec_get_sku_id(struct udevice *dev)
 
 	ret = ec_command_inptr(dev, EC_CMD_GET_SKU_ID, 0, NULL, 0,
 			       (uint8_t **)&r, sizeof(*r));
-	if (ret != sizeof(*r))
-		return -ret;
+	if (ret != sizeof(*r)) {
+		if (ret >= 0)
+			ret = -EIO;
+		return ret;
+	}
 
 	return r->sku_id;
 }
diff --git a/drivers/pci/pci-uclass.c b/drivers/pci/pci-uclass.c
index 632c1a63cfc..7f3d6ddf91c 100644
--- a/drivers/pci/pci-uclass.c
+++ b/drivers/pci/pci-uclass.c
@@ -1446,7 +1446,7 @@ phys_addr_t dm_pci_bus_to_phys(struct udevice *dev, pci_addr_t bus_addr,
 		return res->phys_start + offset;
 	}
 
-	puts("pci_hose_bus_to_phys: invalid physical address\n");
+	puts("dm_pci_bus_to_phys: invalid physical address\n");
 	return 0;
 }
 
@@ -1486,7 +1486,7 @@ pci_addr_t dm_pci_phys_to_bus(struct udevice *dev, phys_addr_t phys_addr,
 		return res->bus_start + offset;
 	}
 
-	puts("pci_hose_phys_to_bus: invalid physical address\n");
+	puts("dm_pci_phys_to_bus: invalid physical address\n");
 	return 0;
 }
 
diff --git a/drivers/remoteproc/rproc-uclass.c b/drivers/remoteproc/rproc-uclass.c
index 50bcc9030e9..19fe4053be8 100644
--- a/drivers/remoteproc/rproc-uclass.c
+++ b/drivers/remoteproc/rproc-uclass.c
@@ -689,7 +689,7 @@ static int alloc_vring(struct udevice *dev, struct fw_rsc_vdev *rsc, int i)
 	debug("alloc_mem(%#x, %d): %p\n", size, order, pa);
 	vring->da = (uintptr_t)pa;
 
-	return !pa;
+	return 0;
 }
 
 static int handle_vdev(struct udevice *dev, struct fw_rsc_vdev *rsc,
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 38e285bf94b..4691612eda3 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -390,7 +390,7 @@ int btrfs_read_extent_inline(struct btrfs_path *path,
 			   csize);
 	ret = btrfs_decompress(btrfs_file_extent_compression(leaf, fi),
 			       cbuf, csize, dbuf, dsize);
-	if (ret == (u32)-1) {
+	if (ret < 0) {
 		ret = -EIO;
 		goto out;
 	}
@@ -500,7 +500,7 @@ int btrfs_read_extent_reg(struct btrfs_path *path,
 
 	ret = btrfs_decompress(btrfs_file_extent_compression(leaf, fi), cbuf,
 			       csize, dbuf, dsize);
-	if (ret == (u32)-1) {
+	if (ret < 0) {
 		ret = -EIO;
 		goto out;
 	}
diff --git a/fs/btrfs/subvolume.c b/fs/btrfs/subvolume.c
index d446e7a2c41..68ca7e48e48 100644
--- a/fs/btrfs/subvolume.c
+++ b/fs/btrfs/subvolume.c
@@ -199,6 +199,7 @@ static int list_subvolums(struct btrfs_fs_info *fs_info)
 			ret = PTR_ERR(root);
 			if (ret == -ENOENT)
 				goto next;
+			goto out;
 		}
 		ret = list_one_subvol(root, result);
 		if (ret < 0)
diff --git a/fs/cramfs/cramfs.c b/fs/cramfs/cramfs.c
index 6c017cebc50..abb2de34eb0 100644
--- a/fs/cramfs/cramfs.c
+++ b/fs/cramfs/cramfs.c
@@ -166,8 +166,7 @@ static unsigned long cramfs_resolve (unsigned long begin, unsigned long offset,
 				unsigned long ret;
 				char *link;
 				if (p && strlen(p)) {
-					printf ("unsupported symlink to \
-						 non-terminal path\n");
+					printf ("unsupported symlink to non-terminal path\n");
 					return 0;
 				}
 				link = cramfs_uncompress_link (begin,
@@ -177,8 +176,7 @@ static unsigned long cramfs_resolve (unsigned long begin, unsigned long offset,
 						namelen, namelen, name);
 					return 0;
 				} else if (link[0] == '/') {
-					printf ("unsupported symlink to \
-						 absolute path\n");
+					printf ("unsupported symlink to absolute path\n");
 					free (link);
 					return 0;
 				}
diff --git a/include/video.h b/include/video.h
index 269915160b4..66d109ca5da 100644
--- a/include/video.h
+++ b/include/video.h
@@ -58,7 +58,7 @@ enum video_log2_bpp {
  * Convert enum video_log2_bpp to bytes and bits. Note we omit the outer
  * brackets to allow multiplication by fractional pixels.
  */
-#define VNBYTES(bpix)	(1 << (bpix)) / 8
+#define VNBYTES(bpix)	((1 << (bpix)) / 8)
 
 #define VNBITS(bpix)	(1 << (bpix))
 
diff --git a/lib/charset.c b/lib/charset.c
index b1842755eb1..5e4c4f948a4 100644
--- a/lib/charset.c
+++ b/lib/charset.c
@@ -444,14 +444,14 @@ u16 *u16_strdup(const void *src)
 
 size_t u16_strlcat(u16 *dest, const u16 *src, size_t count)
 {
-	size_t destlen = u16_strlen(dest);
+	size_t destlen = u16_strnlen(dest, count);
 	size_t srclen = u16_strlen(src);
-	size_t ret = destlen + srclen + 1;
+	size_t ret = destlen + srclen;
 
 	if (destlen >= count)
 		return ret;
-	if (ret > count)
-		srclen -= ret - count;
+	if (ret >= count)
+		srclen -= (ret - count + 1);
 	memcpy(&dest[destlen], src, 2 * srclen);
 	dest[destlen + srclen] = 0x0000;
 
diff --git a/lib/crc32.c b/lib/crc32.c
index aa94d70ef3e..f6fad8c15df 100644
--- a/lib/crc32.c
+++ b/lib/crc32.c
@@ -10,7 +10,6 @@
 
 #ifdef USE_HOSTCC
 #include <arpa/inet.h>
-#include <u-boot/crc.h>
 #else
 #include <common.h>
 #include <efi_loader.h>
diff --git a/lib/string.c b/lib/string.c
index ecea755f405..f2c61471288 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -116,20 +116,18 @@ char * strncpy(char * dest,const char *src,size_t count)
  * of course, the buffer size is zero). It does not pad
  * out the result like strncpy() does.
  *
- * Return: the number of bytes copied
+ * Return: strlen(src)
  */
 size_t strlcpy(char *dest, const char *src, size_t size)
 {
-	if (size) {
-		size_t srclen = strlen(src);
-		size_t len = (srclen >= size) ? size - 1 : srclen;
+	size_t ret = strlen(src);
 
+	if (size) {
+		size_t len = (ret >= size) ? size - 1 : ret;
 		memcpy(dest, src, len);
 		dest[len] = '\0';
-		return len + 1;
 	}
-
-	return 0;
+	return ret;
 }
 #endif
 
@@ -191,6 +189,8 @@ char * strncat(char *dest, const char *src, size_t count)
  * Compatible with *BSD: the result is always a valid NUL-terminated string that
  * fits in the buffer (unless, of course, the buffer size is zero). It does not
  * write past @size like strncat() does.
+ *
+ * Return: min(strlen(dest), size) + strlen(src)
  */
 size_t strlcat(char *dest, const char *src, size_t size)
 {
diff --git a/test/lib/asn1.c b/test/lib/asn1.c
index 8661fdd3068..a66cdd77df0 100644
--- a/test/lib/asn1.c
+++ b/test/lib/asn1.c
@@ -120,7 +120,7 @@ static int lib_asn1_x509(struct unit_test_state *uts)
 
 	cert = x509_cert_parse(cert_data, cert_data_len);
 
-	ut_assertf(cert != NULL, "decoding failed\n");
+	ut_assertf(!IS_ERR(cert), "decoding failed\n");
 	ut_assertf(!strcmp(cert->subject, "Linaro: Tester"),
 		   "subject doesn't match\n");
 	ut_assertf(!strcmp(cert->issuer, "Linaro: Tester"),
@@ -313,7 +313,7 @@ static int lib_asn1_pkcs7(struct unit_test_state *uts)
 
 	pkcs7 = pkcs7_parse_message(image_pk7, image_pk7_len);
 
-	ut_assertf(pkcs7 != NULL, "decoding failed\n");
+	ut_assertf(!IS_ERR(pkcs7), "decoding failed\n");
 	ut_assertf(pkcs7->data_len == 104, "signature size doesn't match\n");
 	ut_assertf(pkcs7->signed_infos != NULL, "sign-info doesn't exist\n");
 	ut_assertf(pkcs7->signed_infos->msgdigest_len == 32,
diff --git a/test/lib/strlcat.c b/test/lib/strlcat.c
index a0ec037388b..d8453fe78e2 100644
--- a/test/lib/strlcat.c
+++ b/test/lib/strlcat.c
@@ -43,11 +43,11 @@ static int do_test_strlcat(struct unit_test_state *uts, int line, size_t align1,
 		s2[i] = 32 + 23 * i % (127 - 32);
 	s2[len2 - 1] = '\0';
 
-	expected = len2 < n ? min(len1 + len2 - 1, n) : n;
+	expected = min(strlen(s2), n) + strlen(s1);
 	actual = strlcat(s2, s1, n);
 	if (expected != actual) {
 		ut_failf(uts, __FILE__, line, __func__,
-			 "strlcat(s2, s1, 2) == len2 < n ? min(len1 + len2, n) : n",
+			 "strlcat(s2, s1, n) == min(len2, n) + len1",
 			 "Expected %#zx (%zd), got %#zx (%zd)",
 			 expected, expected, actual, actual);
 		return CMD_RET_FAILURE;
diff --git a/test/unicode_ut.c b/test/unicode_ut.c
index b27d7116b9e..1d0d90c2d73 100644
--- a/test/unicode_ut.c
+++ b/test/unicode_ut.c
@@ -807,28 +807,28 @@ static int unicode_test_u16_strlcat(struct unit_test_state *uts)
 
 	/* dest and src are empty string */
 	memset(buf, 0, sizeof(buf));
-	ret = u16_strlcat(buf, &null_src, sizeof(buf));
-	ut_asserteq(1, ret);
+	ret = u16_strlcat(buf, &null_src, ARRAY_SIZE(buf));
+	ut_asserteq(0, ret);
 
 	/* dest is empty string */
 	memset(buf, 0, sizeof(buf));
-	ret = u16_strlcat(buf, src, sizeof(buf));
-	ut_asserteq(5, ret);
+	ret = u16_strlcat(buf, src, ARRAY_SIZE(buf));
+	ut_asserteq(4, ret);
 	ut_assert(!unicode_test_u16_strcmp(buf, src, 40));
 
 	/* src is empty string */
 	memset(buf, 0xCD, (sizeof(buf) - sizeof(u16)));
 	buf[39] = 0;
 	memcpy(buf, dest, sizeof(dest));
-	ret = u16_strlcat(buf, &null_src, sizeof(buf));
-	ut_asserteq(6, ret);
+	ret = u16_strlcat(buf, &null_src, ARRAY_SIZE(buf));
+	ut_asserteq(5, ret);
 	ut_assert(!unicode_test_u16_strcmp(buf, dest, 40));
 
 	for (i = 0; i <= 40; i++) {
 		memset(buf, 0xCD, (sizeof(buf) - sizeof(u16)));
 		buf[39] = 0;
 		memcpy(buf, dest, sizeof(dest));
-		expected = 10;
+		expected = min(5, i) + 4;
 		ret = u16_strlcat(buf, src, i);
 		ut_asserteq(expected, ret);
 		if (i <= 6) {
diff --git a/tools/default_image.c b/tools/default_image.c
index 0e49ab33015..04bc85bf932 100644
--- a/tools/default_image.c
+++ b/tools/default_image.c
@@ -15,7 +15,6 @@
 
 #include "imagetool.h"
 #include "mkimage.h"
-#include <u-boot/crc.h>
 
 #include <image.h>
 #include <tee/optee.h>