Line: 83 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	out = &output_buffer[decompressed_bytes - skip];
	size = min(decompressed_bytes + size, limit) - decompressed_bytes;

	memcpy(out, in, size);
	decompressed_bytes += size;

	return buffer_size;
}


            

Line: 80 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              static ssize_t idle_show(struct kobject *kobj, struct kobj_attribute *attr,
			 char *buf)
{
	return sprintf(buf, "%hu\n", enable_dyn_sleep);
}

static ssize_t idle_store(struct kobject *kobj, struct kobj_attribute *attr,
			  const char * buf, size_t n)
{

            

Line: 32 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	u8			root_bus_nr;
	void __iomem		*base;
	spinlock_t		conf_lock;
	char			mem_space_name[20];
	struct resource		res;
};

static struct pcie_port pcie_port[8];
static int num_pcie_ports;

            

Line: 260 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		msg_node = kzalloc(sizeof(*msg_node), GFP_ATOMIC);
		if (msg_node) {
			INIT_LIST_HEAD(&msg_node->list);
			memcpy(&msg_node->msg, msg, sizeof(struct opal_msg));
			list_add_tail(&msg_node->list, &msg_list);
			msg_list_size++;
		} else
			pr_warn_once("message queue no memory\n");


            

Line: 171 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static inline u32 ibm4xx_denali_get_cs(void)
{
	void *devp;
	char model[64];
	u32 val, cs;

	devp = finddevice("/");
	if (!devp)
		goto read_cs;

            

Line: 154 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
	if (msg) {
		ret = 1;
		memcpy(msg, &m, sizeof(m));
	}

exit:
	opal_async_release_token(token);
	return ret;

            

Line: 276 Column: 16 CWE codes: 126

              	pnv_prepare_going_down();

	do {
		if (!cmd || !strlen(cmd))
			rc = opal_cec_reboot();
		else if (strcmp(cmd, "full") == 0)
			rc = opal_cec_reboot2(OPAL_REBOOT_FULL_IPL, NULL);
		else if (strcmp(cmd, "mpipl") == 0)
			rc = opal_cec_reboot2(OPAL_REBOOT_MPIPL, NULL);

            

Line: 410 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              static ssize_t show_subcores_per_core(struct device *dev,
		struct device_attribute *attr, char *buf)
{
	return sprintf(buf, "%x\n", subcores_per_core);
}

static DEVICE_ATTR(subcores_per_core, 0644,
		show_subcores_per_core, store_subcores_per_core);


            

Line: 119 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		if (vinst->fault_crbs == (vinst->fault_fifo_size / CRB_SIZE))
			vinst->fault_crbs = 0;

		memcpy(crb, fifo, CRB_SIZE);
		entry->stamp.nx.pswid = cpu_to_be32(FIFO_INVALID_ENTRY);
		entry->ccw |= cpu_to_be32(CCW0_INVALID);
		/*
		 * Return credit for the fault window.
		 */

            

Line: 265

               *	- the name of the macro (eg: VAS_LPID_OFFSET), defining the
 *	  register's offset in the window context
 */
#define VREG_SFX(n, s)	__stringify(n), VAS_##n##s
#define VREG(r)		VREG_SFX(r, _OFFSET)

/*
 * Local Notify Scope Control Register. (Receive windows only).
 */