Line: 77 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	struct qedr_dev		*dev;
	struct qed_chain	pbl;
	struct qed_sb_info	*sb;
	char			name[32];
	u64			n_comp;
	__le16			*hw_cons_ptr;
	u8			index;
};


            

Line: 636 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	cm_info->private_data = conn_param->private_data;
	cm_info->private_data_len = conn_param->private_data_len;
	in_params.qp = qp->qed_qp;
	memcpy(in_params.local_mac_addr, dev->ndev->dev_addr, ETH_ALEN);

	if (test_and_set_bit(QEDR_IWARP_CM_WAIT_FOR_CONNECT,
			     &qp->iwarp_cm_flags)) {
		rc = -ENODEV;
		goto err; /* QP already being destroyed */

            

Line: 530 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		packet->tx_dest = QED_LL2_TX_DEST_NW;

	packet->roce_mode = roce_mode;
	memcpy(packet->header.vaddr, ud_header_buffer, header_size);
	packet->header.len = header_size;
	packet->n_seg = swr->num_sge;
	for (i = 0; i < packet->n_seg; i++) {
		packet->payload[i].baddr = swr->sg_list[i].addr;
		packet->payload[i].len = swr->sg_list[i].length;

            

Line: 190

              	struct nvkm_device *device = vmm->mmu->subdev.device;
	nvkm_wr32(device, 0x100814, vmm->limit - 4096);
	nvkm_wr32(device, 0x100808, 0x000000020);
	nvkm_msec(device, 2000,
		if (nvkm_rd32(device, 0x100808) & 0x00000001)
			break;
	);
	nvkm_wr32(device, 0x100808, 0x00000000);
}

            

Line: 199 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	pid_t pid;
	pid_t subpid[QLOGIC_IB_MAX_SUBCTXT];
	/* same size as task_struct .comm[], command that opened context */
	char comm[16];
	/* pkeys set by this use of this ctxt */
	u16 pkeys[4];
	/* so file ops can get at unit */
	struct qib_devdata *dd;
	/* so funcs that need physical port can get it easily */

            

Line: 87

              
	mutex_lock(&vmm->mmu->mutex);
	nvkm_wr32(device, 0x100810, 0x00000022);
	nvkm_msec(device, 2000,
		if (nvkm_rd32(device, 0x100810) & 0x00000020)
			break;
	);
	nvkm_wr32(device, 0x100810, 0x00000000);
	mutex_unlock(&vmm->mmu->mutex);

            

Line: 198

              	/* Looks like maybe a "free flush slots" counter, the
	 * faster you write to 0x100cbc to more it decreases.
	 */
	nvkm_msec(device, 2000,
		if (nvkm_rd32(device, 0x100c80) & 0x00ff0000)
			break;
	);

	if (!(type & 0x00000002) /* ALL_PDB. */) {

            

Line: 125 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		if (args->v0.count > count)
			return -EINVAL;
		args->v0.kind_inv = kind_inv;
		memcpy(args->v0.data, kind, args->v0.count);
	} else
		return ret;

	return 0;
}

            

Line: 162 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
int qib_diag_add(struct qib_devdata *dd)
{
	char name[16];
	int ret = 0;

	if (atomic_inc_return(&diagpkt_count) == 1) {
		ret = qib_cdev_init(QIB_DIAGPKT_MINOR, "ipath_diagpkt",
				    &diagpkt_file_ops, &diagpkt_cdev,

            

Line: 79 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	u32 base = 0x140400 + (c * 0x2000) + (s * 0x200);
	u32 intr = nvkm_rd32(device, base + 0x00c);
	u16 stat = intr & 0x0000ffff;
	char msg[128];

	if (stat) {
		nvkm_snprintbf(msg, sizeof(msg), gf100_ltc_lts_intr_name, stat);
		nvkm_error(subdev, "LTC%d_LTS%d: %08x [%s]\n", c, s, intr, msg);
	}