Line: 316 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	lq_sta = &mvmsta->lq_sta.rs_fw;

	if (flags & IWL_TLC_NOTIF_FLAG_RATE) {
		char pretty_rate[100];
		lq_sta->last_rate_n_flags = le32_to_cpu(notif->rate);
		rs_pretty_print_rate(pretty_rate, sizeof(pretty_rate),
				     lq_sta->last_rate_n_flags);
		IWL_DEBUG_RATE(mvm, "new rate: %s\n", pretty_rate);
	}

            

Line: 174 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	unsigned long	ptbuf;		/* buffer pointer */
	unsigned short	len;		/* data length */
	unsigned char	status;		/* status */
	unsigned char	filler[5];	/* alignment filler (16 bytes) */ 
} pcsca_bd_t;

/* Block Descriptor Structure */
typedef struct {
	u32 cp;			/* pointer to next block descriptor */

            

Line: 283 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              struct cpsw_slave_data {
	struct device_node *slave_node;
	struct device_node *phy_node;
	char		phy_id[MII_BUS_ID_SIZE];
	phy_interface_t	phy_if;
	u8		mac_addr[ETH_ALEN];
	u16		dual_emac_res_vlan;	/* Reserved VLAN for DualEMAC */
	struct phy	*ifphy;
	bool		disabled;

            

Line: 354 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		if (result)
			return result;

		memcpy(&state(hdlc)->settings, &new_settings, size);
		spin_lock_init(&state(hdlc)->lock);
		dev->header_ops = &cisco_header_ops;
		dev->hard_header_len = sizeof(struct hdlc_header);
		dev->type = ARPHRD_CISCO;
		call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);

            

Line: 721 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	MLX5_SET(qpc, qpc, primary_address_path.src_addr_index,
		 conn->qp.sgid_index);
	MLX5_SET(qpc, qpc, primary_address_path.hop_limit, 0);
	memcpy(MLX5_ADDR_OF(qpc, qpc, primary_address_path.rgid_rip),
	       MLX5_ADDR_OF(fpga_qpc, conn->fpga_qpc, fpga_ip),
	       MLX5_FLD_SZ_BYTES(qpc, primary_address_path.rgid_rip));

	MLX5_SET(init2rtr_qp_in, in, opcode, MLX5_CMD_OP_INIT2RTR_QP);
	MLX5_SET(init2rtr_qp_in, in, qpn, conn->qp.qpn);

            

Line: 91 Column: 6 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              	u32 iaddr2;			/* FEC + 0x11C */
	u32 gaddr1;			/* FEC + 0x120 */
	u32 gaddr2;			/* FEC + 0x124 */
	u32 random;			/* FEC + 0x128 */
	u32 rand1;			/* FEC + 0x12C */
	u32 tmp;			/* FEC + 0x130 */

	u32 reserved6[3];		/* FEC + 0x134-13C */
	u32 fifo_id;			/* FEC + 0x140 */

            

Line: 82 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              					      sizeof(raw_hdlc_proto));
		if (result)
			return result;
		memcpy(hdlc->state, &new_settings, size);
		dev->type = ARPHRD_RAWHDLC;
		call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);
		netif_dormant_off(dev);
		return 0;
	}

            

Line: 98 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              					      sizeof(raw_hdlc_proto));
		if (result)
			return result;
		memcpy(hdlc->state, &new_settings, size);
		old_qlen = dev->tx_queue_len;
		ether_setup(dev);
		dev->tx_queue_len = old_qlen;
		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
		eth_hw_addr_random(dev);

            

Line: 345 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		if (result)
			return result;

		memcpy(&state(hdlc)->settings, &new_settings, size);
		state(hdlc)->up = false;
		spin_lock_init(&state(hdlc)->up_lock);
		skb_queue_head_init(&state(hdlc)->rx_queue);
		tasklet_setup(&state(hdlc)->rx_tasklet, x25_rx_queue_kick);


            

Line: 898 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	pf_mac->entry = 0;
	pf_mac->dmac_filter = true;
	pf_mac->location = pfvf->flow_cfg->ntuple_max_flows;
	memcpy(&pf_mac->flow_spec, &flow->flow_spec,
	       sizeof(struct ethtool_rx_flow_spec));
	pf_mac->flow_spec.location = pf_mac->location;

	/* Copy PF mac address */
	eth_hdr = &pf_mac->flow_spec.h_u.ether_spec;