The following issues were found
arch/powerpc/kernel/prom.c
1 issues
Line: 132
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (!p)
panic("Failed to allocate %lu bytes to move device tree\n",
size);
memcpy(p, initial_boot_params, size);
initial_boot_params = p;
DBG("Moved device tree to 0x%px\n", p);
}
DBG("<- move_device_tree\n");
Reported by FlawFinder.
arch/powerpc/kernel/pci_of_scan.c
1 issues
Line: 330
Column: 2
CWE codes:
120
Suggestion:
Use sprintf_s, snprintf, or vsnprintf
region.end = region.start + size - 1;
pcibios_bus_to_resource(dev->bus, res, ®ion);
}
sprintf(bus->name, "PCI Bus %04x:%02x", pci_domain_nr(bus),
bus->number);
pr_debug(" bus name: %s\n", bus->name);
phb = pci_bus_to_host(bus);
Reported by FlawFinder.
arch/powerpc/kernel/pci_32.c
1 issues
Line: 144
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
map_prop = of_find_property(dn, "pci-OF-bus-map", NULL);
if (map_prop) {
BUG_ON(pci_bus_count > map_prop->length);
memcpy(map_prop->value, pci_to_OF_bus_map, pci_bus_count);
}
of_node_put(dn);
#ifdef DEBUG
printk("PCI->OF bus map:\n");
for (i=0; i<pci_bus_count; i++) {
Reported by FlawFinder.
arch/powerpc/kernel/optprobes.c
1 issues
Line: 281
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
* Backup instructions which will be replaced
* by jump address
*/
memcpy(op->optinsn.copied_insn, op->kp.addr, RELATIVEJUMP_SIZE);
create_branch(&instr, op->kp.addr, (unsigned long)op->optinsn.insn, 0);
patch_instruction(op->kp.addr, instr);
list_del_init(&op->list);
}
}
Reported by FlawFinder.
arch/powerpc/kernel/crash_dump.c
1 issues
Line: 78
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (copy_to_user((char __user *)buf, (vaddr + offset), csize))
return -EFAULT;
} else
memcpy(buf, (vaddr + offset), csize);
return csize;
}
/**
Reported by FlawFinder.
arch/powerpc/include/uapi/asm/termios.h
1 issues
Line: 60
Column: 11
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
unsigned short c_cflag; /* control mode flags */
unsigned short c_lflag; /* local mode flags */
unsigned char c_line; /* line discipline */
unsigned char c_cc[NCC]; /* control characters */
};
/* c_cc characters */
#define _VINTR 0
#define _VQUIT 1
Reported by FlawFinder.
arch/powerpc/mm/book3s64/hash_pgtable.c
1 issues
Line: 22
#define CREATE_TRACE_POINTS
#include <trace/events/thp.h>
#if H_PGTABLE_RANGE > (USER_VSID_RANGE * (TASK_SIZE_USER64 / TASK_CONTEXT_SIZE))
#warning Limited user VSID range means pagetable space is wasted
#endif
#ifdef CONFIG_SPARSEMEM_VMEMMAP
/*
Reported by Cppcheck.
arch/powerpc/include/uapi/asm/kvm.h
1 issues
Line: 362
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
/* for KVM_CAP_PPC_RTAS */
struct kvm_rtas_token_args {
char name[120];
__u64 token; /* Use a token of 0 to undefine a mapping */
};
struct kvm_book3e_206_tlb_entry {
__u32 mas8;
Reported by FlawFinder.
arch/powerpc/mm/book3s64/mmu_context.c
1 issues
Line: 120
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
slice_init_new_context_exec(mm);
} else {
/* This is fork. Copy hash_context details from current->mm */
memcpy(mm->context.hash_context, current->mm->context.hash_context, sizeof(struct hash_mm_context));
#ifdef CONFIG_PPC_SUBPAGE_PROT
/* inherit subpage prot details if we have one. */
if (current->mm->context.hash_context->spt) {
mm->context.hash_context->spt = kmalloc(sizeof(struct subpage_prot_table),
GFP_KERNEL);
Reported by FlawFinder.
arch/powerpc/mm/book3s64/radix_pgtable.c
1 issues
Line: 249
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
static inline void __meminit
print_mapping(unsigned long start, unsigned long end, unsigned long size, bool exec)
{
char buf[10];
if (end <= start)
return;
string_get_size(size, 1, STRING_UNITS_2, buf, sizeof(buf));
Reported by FlawFinder.