The following issues were found

drivers/char/toshiba.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 405 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              static int tosh_probe(void)
{
	int i,major,minor,day,year,month,flag;
	unsigned char signature[7] = { 0x54,0x4f,0x53,0x48,0x49,0x42,0x41 };
	SMMRegisters regs;
	void __iomem *bios = ioremap(0xf0000, 0x10000);

	if (!bios)
		return -ENOMEM;

Reported by FlawFinder.

drivers/char/tpm/eventlog/efi.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 110 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	 * 'main log'. Events can be logged in both if events are generated
	 * between GetEventLog() and ExitBootServices().
	 */
	memcpy((void *)log->bios_event_log + log_size,
	       final_tbl->events + log_tbl->final_events_preboot_size,
	       final_events_log_size);
	/*
	 * The size of the 'combined log' is the size of the 'main log' plus
	 * the size of the 'final events log'.

Reported by FlawFinder.

drivers/ata/sata_rcar.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 465 Column: 12 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
	/* Transfer trailing byte, if any. */
	if (unlikely(buflen & 0x01)) {
		unsigned char pad[2] = { };

		/* Point buf to the tail of buffer */
		buf += buflen - 1;

		/*

Reported by FlawFinder.

drivers/char/tpm/st33zp24/i2c.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 41 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	struct st33zp24_i2c_phy *phy = phy_id;

	phy->buf[0] = tpm_register;
	memcpy(phy->buf + 1, tpm_data, tpm_size);
	return i2c_master_send(phy->client, phy->buf, tpm_size + 1);
} /* write8_reg() */

/*
 * read8_reg

Reported by FlawFinder.

drivers/ata/sata_nv.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1894 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	int rc;
	u8 rev;
	u8 check_maxtor = 0;
	unsigned char model_num[ATA_ID_PROD_LEN + 1];

	rc = ata_scsi_slave_config(sdev);
	if (sdev->id >= ATA_MAX_DEVICES || sdev->channel || sdev->lun)
		/* Not a proper libata device, ignore */
		return rc;

Reported by FlawFinder.

drivers/char/tpm/tpm_i2c_atmel.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 90 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              			"%s early(buf=%*ph count=%0zx) -> ret=%d\n", __func__,
			(int)min_t(size_t, 64, expected_len), buf, count,
			expected_len);
		memcpy(buf, priv->buffer, expected_len);
		return expected_len;
	}

	rc = i2c_master_recv(client, buf, expected_len);
	dev_dbg(&chip->dev,

Reported by FlawFinder.

drivers/char/tpm/tpm_i2c_infineon.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 226 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
	/* prepend the 'register address' to the buffer */
	tpm_dev.buf[0] = addr;
	memcpy(&(tpm_dev.buf[1]), buffer, len);

	/*
	 * NOTE: We have to use these special mechanisms here and unfortunately
	 * cannot rely on the standard behavior of i2c_transfer.
	 * Even for newer chips the smbus functions are not

Reported by FlawFinder.

drivers/char/tpm/tpm_tis_i2c_cr50.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 262 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
	/* Prepend the 'register address' to the buffer */
	priv->buf[0] = addr;
	memcpy(priv->buf + 1, buffer, len);

	i2c_lock_bus(client->adapter, I2C_LOCK_SEGMENT);

	/* Prepare for completion interrupt */
	tpm_cr50_i2c_enable_tpm_irq(chip);

Reported by FlawFinder.

drivers/char/ttyprintk.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 42 Column: 8 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
static int tpk_curr;

static char tpk_buffer[TPK_STR_SIZE + 4];

static void tpk_flush(void)
{
	if (tpk_curr > 0) {
		tpk_buffer[tpk_curr] = '\0';

Reported by FlawFinder.

drivers/ata/sata_inic162x.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 526 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
	/* setup PRD for CDB */
	if (is_atapi) {
		memcpy(pkt->cdb, qc->cdb, ATAPI_CDB_LEN);
		prd->mad = cpu_to_le32(pp->pkt_dma +
				       offsetof(struct inic_pkt, cdb));
		prd->len = cpu_to_le16(cdb_len);
		prd->flags = PRD_CDB | PRD_WRITE;
		if (!is_data)

Reported by FlawFinder.