The following issues were found
drivers/gpu/drm/radeon/ni.c
1 issues
Line: 706
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
const char *rlc_chip_name;
size_t pfp_req_size, me_req_size, rlc_req_size, mc_req_size;
size_t smc_req_size = 0;
char fw_name[30];
int err;
DRM_DEBUG("\n");
switch (rdev->family) {
Reported by FlawFinder.
drivers/gpu/drm/radeon/evergreen.c
1 issues
Line: 2970
r700_cp_stop(rdev);
WREG32(CP_RB_CNTL,
#ifdef __BIG_ENDIAN
BUF_SWAP_32BIT |
#endif
RB_NO_UPDATE | RB_BLKSZ(15) | RB_BUFSZ(3));
fw_data = (const __be32 *)rdev->pfp_fw->data;
Reported by Cppcheck.
drivers/gpu/drm/radeon/atombios_i2c.c
1 issues
Line: 68
Column: 4
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (num)
num--;
if (num)
memcpy(&out, &buf[1], num);
args.lpI2CDataOut = cpu_to_le16(out);
} else {
args.ucRegIndex = 0;
args.lpI2CDataOut = 0;
}
Reported by FlawFinder.
drivers/gpu/drm/gma500/cdv_intel_display.c
1 issues
Line: 448
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
}
gma_crtc->clock_funcs->clock(refclk, &clock);
memcpy(best_clock, &clock, sizeof(struct gma_clock_t));
return true;
}
#define FIFO_PIPEA (1 << 0)
#define FIFO_PIPEB (1 << 1)
Reported by FlawFinder.
drivers/isdn/mISDN/dsp_tones.c
1 issues
Line: 419
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (num + start > (*(pat->siz[index])))
num = (*(pat->siz[index])) - start;
/* copy memory */
memcpy(data, pat->data[index] + start, num);
/* reduce length */
data += num;
count += num;
len -= num;
}
Reported by FlawFinder.
drivers/gpu/drm/radeon/atombios_encoders.c
1 issues
Line: 195
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct backlight_properties props;
struct radeon_backlight_privdata *pdata;
struct radeon_encoder_atom_dig *dig;
char bl_name[16];
/* Mac laptops with multiple GPUs use the gmux driver for backlight
* so don't register a backlight device
*/
if ((rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE) &&
Reported by FlawFinder.
drivers/gpu/drm/radeon/atombios.h
1 issues
Line: 6726
Column: 3
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
UCHAR ucRefreshRateFactor; // [1:0]=RefreshFactor (00=8ms, 01=16ms, 10=32ms,11=64ms)
UCHAR ucFIFODepth; // FIFO depth can be detected during vendor detection, here is hardcoded per memory
UCHAR ucCDR_Bandwidth; // [0:3]=Read CDR bandwidth, [4:7] - Write CDR Bandwidth
char strMemPNString[20]; // part number end with '0'.
}ATOM_VRAM_MODULE_V7;
typedef struct _ATOM_VRAM_INFO_V2
{
ATOM_COMMON_TABLE_HEADER sHeader;
Reported by FlawFinder.
drivers/gpu/drm/radeon/atom-bits.h
1 issues
Line: 30
Column: 23
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
static inline uint8_t get_u8(void *bios, int ptr)
{
return ((unsigned char *)bios)[ptr];
}
#define U8(ptr) get_u8(ctx->ctx->bios, (ptr))
#define CU8(ptr) get_u8(ctx->bios, (ptr))
static inline uint16_t get_u16(void *bios, int ptr)
{
Reported by FlawFinder.
drivers/gpu/drm/r128/r128_drv.h
1 issues
Line: 515
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
DRM_INFO("ADVANCE_RING() wr=0x%06x tail=0x%06x\n", \
write, dev_priv->ring.tail); \
if (R128_BROKEN_CCE && write < 32) \
memcpy(dev_priv->ring.end, \
dev_priv->ring.start, \
write * sizeof(u32)); \
if (((dev_priv->ring.tail + _nr) & tail_mask) != write) \
DRM_ERROR( \
"ADVANCE_RING(): mismatch: nr: %x write: %x line: %d\n", \
Reported by FlawFinder.
drivers/infiniband/hw/mlx5/mem.c
1 issues
Line: 138
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
qp->sq.w_list[idx].next = qp->sq.cur_post;
qp->sq.head++;
memcpy(mmio_wqe, ctrl, sizeof(*ctrl));
((struct mlx5_wqe_ctrl_seg *)&mmio_wqe)->fm_ce_se |=
MLX5_WQE_CTRL_CQ_UPDATE;
/* Make sure that descriptors are written before
* updating doorbell record and ringing the doorbell
Reported by FlawFinder.