The following issues were found

drivers/net/wireless/ath/ath9k/eeprom_def.c
1 issues
Array 'rep->ctlEdges[3][8]' accessed at index -1, which is out of bounds.
Error

Line: 1044 CWE codes: 786

              				rep = &(pEepData->ctlData[i]);

				twiceMinEdgePower = ath9k_hw_get_max_edge_power(freq,
				rep->ctlEdges[ar5416_get_ntxchains(tx_chainmask) - 1],
				IS_CHAN_2GHZ(chan), AR5416_NUM_BAND_EDGES);

				if ((cfgCtl & ~CTL_MODE_M) == SD_NO_CTL) {
					twiceMaxEdgePower = min(twiceMaxEdgePower,
								twiceMinEdgePower);

            

Reported by Cppcheck.

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 405 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              };

struct hclge_comm_stats_str {
	char desc[ETH_GSTRING_LEN];
	unsigned long offset;
};

/* mac stats ,opcode id: 0x0032 */
struct hclge_mac_stats {

            

Reported by FlawFinder.

drivers/net/wireless/ath/ath9k/hif_usb.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 129 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	struct usb_anchor reg_in_submitted;
	struct usb_anchor mgmt_submitted;
	struct sk_buff *remain_skb;
	char fw_name[32];
	int fw_minor_index;
	int rx_remain_len;
	int rx_pkt_len;
	int rx_transfer_len;
	int rx_pad_len;

            

Reported by FlawFinder.

drivers/net/wireless/ath/ath9k/htc.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 516 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              #ifdef CONFIG_MAC80211_LEDS
	enum led_brightness brightness;
	bool led_registered;
	char led_name[32];
	struct led_classdev led_cdev;
	struct work_struct led_work;
#endif

	int cabq;

            

Reported by FlawFinder.

drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 248 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
	beacon_hdr.vif_index = avp->index;
	tx_fhdr = skb_push(beacon, sizeof(beacon_hdr));
	memcpy(tx_fhdr, (u8 *) &beacon_hdr, sizeof(beacon_hdr));

	ret = htc_send(priv->htc, beacon);
	if (ret != 0) {
		if (ret == -ENOMEM) {
			ath_dbg(common, BSTUCK,

            

Reported by FlawFinder.

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 2344 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		goto err_buf_alloc;
	}

	memcpy(desc_data, &desc[0].data[0], buf_len);
	for (i = 0; i < buf_size; i++)
		buf[i] = le32_to_cpu(desc_data[i]);

	hclge_handle_error_module_log(ae_dev, buf, buf_size);
	kfree(buf);

            

Reported by FlawFinder.

drivers/net/wireless/ath/ath9k/htc_drv_init.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 836 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	struct ath_hw *ah;
	int error = 0;
	struct ath_regulatory *reg;
	char hw_name[64];

	/* Bring up device */
	error = ath9k_init_priv(priv, devid, product, drv_info);
	if (error != 0)
		goto err_init;

            

Reported by FlawFinder.

drivers/net/ethernet/mellanox/mlx4/en_rx.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1214 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		rss_context->hash_fn = MLX4_RSS_HASH_XOR;
	} else if (priv->rss_hash_fn == ETH_RSS_HASH_TOP) {
		rss_context->hash_fn = MLX4_RSS_HASH_TOP;
		memcpy(rss_context->rss_key, priv->rss_key,
		       MLX4_EN_RSS_KEY_SIZE);
	} else {
		en_err(priv, "Unknown RSS hash function requested\n");
		err = -EINVAL;
		goto indir_err;

            

Reported by FlawFinder.

drivers/net/ethernet/pensando/ionic/ionic_stats.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 55 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	__le64_to_cpu(*((__le64 *)(((u8 *)(base_ptr)) + (desc_ptr)->offset)))

struct ionic_stat_desc {
	char name[ETH_GSTRING_LEN];
	u64 offset;
};

#endif /* _IONIC_STATS_H_ */

            

Reported by FlawFinder.

drivers/net/ethernet/marvell/mvpp2/mvpp2.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1091 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	unsigned int max_port_rxqs;

	/* Workqueue to gather hardware statistics */
	char queue_name[30];
	struct workqueue_struct *stats_queue;

	/* Debugfs root entry */
	struct dentry *dbgfs_dir;


            

Reported by FlawFinder.