The following issues were found
arch/arm64/mm/mmu.c
1 issues
Line: 325
CWE codes:
476
if (flags & NO_EXEC_MAPPINGS)
p4dval |= P4D_TABLE_PXN;
BUG_ON(!pgtable_alloc);
pud_phys = pgtable_alloc(PUD_SHIFT);
__p4d_populate(p4dp, pud_phys, p4dval);
p4d = READ_ONCE(*p4dp);
}
BUG_ON(p4d_bad(p4d));
Reported by Cppcheck.
arch/arm64/mm/flush.c
1 issues
Line: 47
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
unsigned long uaddr, void *dst, const void *src,
unsigned long len)
{
memcpy(dst, src, len);
flush_ptrace_access(vma, (unsigned long)dst, (unsigned long)dst + len);
}
void __sync_icache_dcache(pte_t pte)
{
Reported by FlawFinder.
arch/arm64/lib/uaccess_flushcache.c
1 issues
Line: 17
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
* non-cacheable memory, such that we don't need an explicit
* barrier to order the cache maintenance against the memcpy.
*/
memcpy(dst, src, cnt);
dcache_clean_pop((unsigned long)dst, (unsigned long)dst + cnt);
}
EXPORT_SYMBOL_GPL(memcpy_flushcache);
void memcpy_page_flushcache(char *to, struct page *page, size_t offset,
Reported by FlawFinder.
block/blk-timeout.c
1 issues
Line: 45
Column: 9
CWE codes:
120
Suggestion:
Use sprintf_s, snprintf, or vsnprintf
struct gendisk *disk = dev_to_disk(dev);
int set = test_bit(QUEUE_FLAG_FAIL_IO, &disk->queue->queue_flags);
return sprintf(buf, "%d\n", set != 0);
}
ssize_t part_timeout_store(struct device *dev, struct device_attribute *attr,
const char *buf, size_t count)
{
Reported by FlawFinder.
arch/x86/include/asm/user32.h
1 issues
Line: 66
Column: 3
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
/* the registers. */
__u32 u_fpstate; /* Math Co-processor pointer. */
__u32 magic; /* To uniquely identify a core file */
char u_comm[32]; /* User command that was responsible */
int u_debugreg[8];
};
#endif /* _ASM_X86_USER32_H */
Reported by FlawFinder.
arch/x86/include/asm/user_32.h
1 issues
Line: 124
Column: 3
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
/* the registers. */
struct user_i387_struct *u_fpstate; /* Math Co-processor pointer. */
unsigned long magic; /* To uniquely identify a core file */
char u_comm[32]; /* User command that was responsible */
int u_debugreg[8];
};
#define NBPG PAGE_SIZE
#define UPAGES 1
#define HOST_TEXT_START_ADDR (u.start_code)
Reported by FlawFinder.
arch/x86/include/asm/user_64.h
1 issues
Line: 128
Column: 3
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
/* the registers. */
struct user_i387_struct *u_fpstate; /* Math Co-processor pointer. */
unsigned long magic; /* To uniquely identify a core file */
char u_comm[32]; /* User command that was responsible */
unsigned long u_debugreg[8];
unsigned long error_code; /* CPU error code or 0 */
unsigned long fault_address; /* CR3 or 0 */
};
#define NBPG PAGE_SIZE
Reported by FlawFinder.
arch/arm64/kvm/vgic/vgic-mmio.h
1 issues
Line: 14
Column: 19
CWE codes:
120
20
unsigned int bits_per_irq;
unsigned int access_flags;
union {
unsigned long (*read)(struct kvm_vcpu *vcpu, gpa_t addr,
unsigned int len);
unsigned long (*its_read)(struct kvm *kvm, struct vgic_its *its,
gpa_t addr, unsigned int len);
};
union {
Reported by FlawFinder.
arch/x86/include/asm/uv/uv_geo.h
1 issues
Line: 68
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct geo_rtr_s rtr;
struct geo_cpu_s cpu;
struct geo_mem_s mem;
char padsize[GEOID_SIZE];
};
/* Defined constants */
#define GEO_MAX_LEN 48
Reported by FlawFinder.
arch/x86/include/asm/xen/hypercall.h
1 issues
Line: 89
Column: 17
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
* there aren't more than 5 arguments...)
*/
extern struct { char _entry[32]; } hypercall_page[];
#define __HYPERCALL "call hypercall_page+%c[offset]"
#define __HYPERCALL_ENTRY(x) \
[offset] "i" (__HYPERVISOR_##x * sizeof(hypercall_page[0]))
Reported by FlawFinder.