The following issues were found

drivers/net/ethernet/mellanox/mlxsw/spectrum.c
43 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 99 Column: 23 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static const char mlxsw_sp2_driver_name[] = "mlxsw_spectrum2";
static const char mlxsw_sp3_driver_name[] = "mlxsw_spectrum3";

static const unsigned char mlxsw_sp1_mac_mask[ETH_ALEN] = {
	0xff, 0xff, 0xff, 0xff, 0xfc, 0x00
};
static const unsigned char mlxsw_sp2_mac_mask[ETH_ALEN] = {
	0xff, 0xff, 0xff, 0xff, 0xf0, 0x00
};

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 102 Column: 23 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static const unsigned char mlxsw_sp1_mac_mask[ETH_ALEN] = {
	0xff, 0xff, 0xff, 0xff, 0xfc, 0x00
};
static const unsigned char mlxsw_sp2_mac_mask[ETH_ALEN] = {
	0xff, 0xff, 0xff, 0xff, 0xf0, 0x00
};

/* tx_hdr_version
 * Tx header version.

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 178 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              			      unsigned int counter_index, u64 *packets,
			      u64 *bytes)
{
	char mgpc_pl[MLXSW_REG_MGPC_LEN];
	int err;

	mlxsw_reg_mgpc_pack(mgpc_pl, counter_index, MLXSW_REG_MGPC_OPCODE_NOP,
			    MLXSW_REG_FLOW_COUNTER_SET_TYPE_PACKETS_BYTES);
	err = mlxsw_reg_query(mlxsw_sp->core, MLXSW_REG(mgpc), mgpc_pl);

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 196 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static int mlxsw_sp_flow_counter_clear(struct mlxsw_sp *mlxsw_sp,
				       unsigned int counter_index)
{
	char mgpc_pl[MLXSW_REG_MGPC_LEN];

	mlxsw_reg_mgpc_pack(mgpc_pl, counter_index, MLXSW_REG_MGPC_OPCODE_CLEAR,
			    MLXSW_REG_FLOW_COUNTER_SET_TYPE_PACKETS_BYTES);
	return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(mgpc), mgpc_pl);
}

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 283 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
static int mlxsw_sp_base_mac_get(struct mlxsw_sp *mlxsw_sp)
{
	char spad_pl[MLXSW_REG_SPAD_LEN] = {0};
	int err;

	err = mlxsw_reg_query(mlxsw_sp->core, MLXSW_REG(spad), spad_pl);
	if (err)
		return err;

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 297 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              				   bool is_up)
{
	struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
	char paos_pl[MLXSW_REG_PAOS_LEN];

	mlxsw_reg_paos_pack(paos_pl, mlxsw_sp_port->local_port,
			    is_up ? MLXSW_PORT_ADMIN_STATUS_UP :
			    MLXSW_PORT_ADMIN_STATUS_DOWN);
	return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(paos), paos_pl);

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 309 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              				      unsigned char *addr)
{
	struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
	char ppad_pl[MLXSW_REG_PPAD_LEN];

	mlxsw_reg_ppad_pack(ppad_pl, true, mlxsw_sp_port->local_port);
	mlxsw_reg_ppad_mac_memcpy_to(ppad_pl, addr);
	return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ppad), ppad_pl);
}

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 329 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static int mlxsw_sp_port_max_mtu_get(struct mlxsw_sp_port *mlxsw_sp_port, int *p_max_mtu)
{
	struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
	char pmtu_pl[MLXSW_REG_PMTU_LEN];
	int err;

	mlxsw_reg_pmtu_pack(pmtu_pl, mlxsw_sp_port->local_port, 0);
	err = mlxsw_reg_query(mlxsw_sp->core, MLXSW_REG(pmtu), pmtu_pl);
	if (err)

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 344 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static int mlxsw_sp_port_mtu_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 mtu)
{
	struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
	char pmtu_pl[MLXSW_REG_PMTU_LEN];

	mtu += MLXSW_TXHDR_LEN + ETH_HLEN;
	if (mtu > mlxsw_sp_port->max_mtu)
		return -EINVAL;


            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 357 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static int mlxsw_sp_port_swid_set(struct mlxsw_sp_port *mlxsw_sp_port, u8 swid)
{
	struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
	char pspa_pl[MLXSW_REG_PSPA_LEN];

	mlxsw_reg_pspa_pack(pspa_pl, swid, mlxsw_sp_port->local_port);
	return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(pspa), pspa_pl);
}


            

Reported by FlawFinder.

tools/perf/scripts/python/futex-contention.py
43 issues
Unable to import 'Util'
Error

Line: 19 Column: 1

              import sys
sys.path.append(os.environ['PERF_EXEC_PATH'] +
                '/scripts/python/Perf-Trace-Util/lib/Perf/Trace')
from Util import *

process_names = {}
thread_thislock = {}
thread_blocktime = {}


            

Reported by Pylint.

Undefined variable 'FUTEX_CMD_MASK'
Error

Line: 31 Column: 16

              
def syscalls__sys_enter_futex(event, ctxt, cpu, s, ns, tid, comm, callchain,
                              nr, uaddr, op, val, utime, uaddr2, val3):
    cmd = op & FUTEX_CMD_MASK
    if cmd != FUTEX_WAIT:
        return  # we don't care about originators of WAKE events

    process_names[tid] = comm
    thread_thislock[tid] = uaddr

            

Reported by Pylint.

Undefined variable 'FUTEX_WAIT'
Error

Line: 32 Column: 15

              def syscalls__sys_enter_futex(event, ctxt, cpu, s, ns, tid, comm, callchain,
                              nr, uaddr, op, val, utime, uaddr2, val3):
    cmd = op & FUTEX_CMD_MASK
    if cmd != FUTEX_WAIT:
        return  # we don't care about originators of WAKE events

    process_names[tid] = comm
    thread_thislock[tid] = uaddr
    thread_blocktime[tid] = nsecs(s, ns)

            

Reported by Pylint.

Undefined variable 'nsecs'
Error

Line: 37 Column: 29

              
    process_names[tid] = comm
    thread_thislock[tid] = uaddr
    thread_blocktime[tid] = nsecs(s, ns)


def syscalls__sys_exit_futex(event, ctxt, cpu, s, ns, tid, comm, callchain,
                             nr, ret):
    if tid in thread_blocktime:

            

Reported by Pylint.

Undefined variable 'nsecs'
Error

Line: 43 Column: 19

              def syscalls__sys_exit_futex(event, ctxt, cpu, s, ns, tid, comm, callchain,
                             nr, ret):
    if tid in thread_blocktime:
        elapsed = nsecs(s, ns) - thread_blocktime[tid]
        add_stats(lock_waits, (tid, thread_thislock[tid]), elapsed)
        del thread_blocktime[tid]
        del thread_thislock[tid]



            

Reported by Pylint.

Undefined variable 'add_stats'
Error

Line: 44 Column: 9

                                           nr, ret):
    if tid in thread_blocktime:
        elapsed = nsecs(s, ns) - thread_blocktime[tid]
        add_stats(lock_waits, (tid, thread_thislock[tid]), elapsed)
        del thread_blocktime[tid]
        del thread_thislock[tid]


def trace_begin():

            

Reported by Pylint.

Unpacking a dictionary in iteration without calling .items()
Error

Line: 54 Column: 5

              

def trace_end():
    for (tid, lock) in lock_waits:
        min, max, avg, count = lock_waits[tid, lock]
        print("%s[%d] lock %x contended %d times, %d avg ns [max: %d ns, min %d ns]" %
              (process_names[tid], tid, lock, count, avg, max, min))

            

Reported by Pylint.

Wildcard import Util
Error

Line: 19 Column: 1

              import sys
sys.path.append(os.environ['PERF_EXEC_PATH'] +
                '/scripts/python/Perf-Trace-Util/lib/Perf/Trace')
from Util import *

process_names = {}
thread_thislock = {}
thread_blocktime = {}


            

Reported by Pylint.

Unused argument 'event'
Error

Line: 29 Column: 31

              process_names = {}  # long-lived pid-to-execname mapping


def syscalls__sys_enter_futex(event, ctxt, cpu, s, ns, tid, comm, callchain,
                              nr, uaddr, op, val, utime, uaddr2, val3):
    cmd = op & FUTEX_CMD_MASK
    if cmd != FUTEX_WAIT:
        return  # we don't care about originators of WAKE events


            

Reported by Pylint.

Unused argument 'cpu'
Error

Line: 29 Column: 44

              process_names = {}  # long-lived pid-to-execname mapping


def syscalls__sys_enter_futex(event, ctxt, cpu, s, ns, tid, comm, callchain,
                              nr, uaddr, op, val, utime, uaddr2, val3):
    cmd = op & FUTEX_CMD_MASK
    if cmd != FUTEX_WAIT:
        return  # we don't care about originators of WAKE events


            

Reported by Pylint.

Documentation/conf.py
43 issues
Module 'sphinx' has no 'version_info' member
Error

Line: 22 Column: 23

              from subprocess import check_output

# Get Sphinx version
major, minor, patch = sphinx.version_info[:3]


# If extensions (or modules to document with autodoc) are in another directory,
# add these directories to sys.path here. If the directory is relative to the
# documentation root, use os.path.abspath to make it absolute, like shown here.

            

Reported by Pylint.

Redefining built-in 'copyright'
Error

Line: 129 Column: 1

              
# General information about the project.
project = 'The Linux Kernel'
copyright = 'The kernel development community'
author = 'The kernel development community'

# The version info for the project you're documenting, acts as replacement for
# |version| and |release|, also used in various other places throughout the
# built documents.

            

Reported by Pylint.

No exception type(s) specified
Error

Line: 153 Column: 1

                          makefile_patchlevel = val
        if makefile_version and makefile_patchlevel:
            break
except:
    pass
finally:
    if makefile_version and makefile_patchlevel:
        version = release = makefile_version + '.' + makefile_patchlevel
    else:

            

Reported by Pylint.

Anomalous backslash in string: '\s'. String constant might be missing an r prefix.
Error

Line: 363 Column: 267

              
cjk_cmd = check_output(['fc-list', '--format="%{family[0]}\n"']).decode('utf-8', 'ignore')
if cjk_cmd.find("Noto Sans CJK SC") >= 0:
    latex_elements['preamble']  += '''
	% This is needed for translations
        \\usepackage{xeCJK}
        \\setCJKmainfont{Noto Sans CJK SC}
	% Define custom macros to on/off CJK
	\\newcommand{\\kerneldocCJKon}{\\makexeCJKactive}

            

Reported by Pylint.

FIXME: Do not add the index file here; the result will be too big. Adding
Error

Line: 562 Column: 3

              #
# See the Sphinx chapter of https://ralsina.me/static/manual.pdf
#
# FIXME: Do not add the index file here; the result will be too big. Adding
# multiple PDF files here actually tries to get the cross-referencing right
# *between* PDF files.
pdf_documents = [
    ('kernel-documentation', u'Kernel', u'Kernel', u'J. Random Bozo'),
]

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              # -*- coding: utf-8 -*-
#
# The Linux Kernel documentation build configuration file, created by
# sphinx-quickstart on Fri Feb 12 13:51:46 2016.
#
# This file is execfile()d with the current directory set to its
# containing dir.
#
# Note that not all possible configuration values are present in this

            

Reported by Pylint.

Consider possible security implications associated with check_output module.
Security blacklist

Line: 19
Suggestion: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b404-import-subprocess

              import os
import sphinx

from subprocess import check_output

# Get Sphinx version
major, minor, patch = sphinx.version_info[:3]



            

Reported by Bandit.

standard import "from subprocess import check_output" should be placed before "import sphinx"
Error

Line: 19 Column: 1

              import os
import sphinx

from subprocess import check_output

# Get Sphinx version
major, minor, patch = sphinx.version_info[:3]



            

Reported by Pylint.

Import "from load_config import loadConfig" should be placed at the top of the module
Error

Line: 29 Column: 1

              # add these directories to sys.path here. If the directory is relative to the
# documentation root, use os.path.abspath to make it absolute, like shown here.
sys.path.insert(0, os.path.abspath('sphinx'))
from load_config import loadConfig

# -- General configuration ------------------------------------------------

# If your documentation needs a minimal Sphinx version, state it here.
needs_sphinx = '1.7'

            

Reported by Pylint.

third party import "from load_config import loadConfig" should be placed before "import sphinx"
Error

Line: 29 Column: 1

              # add these directories to sys.path here. If the directory is relative to the
# documentation root, use os.path.abspath to make it absolute, like shown here.
sys.path.insert(0, os.path.abspath('sphinx'))
from load_config import loadConfig

# -- General configuration ------------------------------------------------

# If your documentation needs a minimal Sphinx version, state it here.
needs_sphinx = '1.7'

            

Reported by Pylint.

drivers/net/bonding/bond_sysfs.c
42 issues
sprintf - Does not check for buffer overflows
Security

Line: 53 Column: 10 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              			res += sprintf(buf + res, "++more++ ");
			break;
		}
		res += sprintf(buf + res, "%s ", bond->dev->name);
	}
	if (res)
		buf[res-1] = '\n'; /* eat the leftover space */

	rtnl_unlock();

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 184 Column: 10 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              			res += sprintf(buf + res, "++more++ ");
			break;
		}
		res += sprintf(buf + res, "%s ", slave->dev->name);
	}

	rtnl_unlock();

	if (res)

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 206 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              
	val = bond_opt_get_val(BOND_OPT_MODE, BOND_MODE(bond));

	return sprintf(buf, "%s %d\n", val->string, BOND_MODE(bond));
}
static DEVICE_ATTR(mode, 0644, bonding_show_mode, bonding_sysfs_store_option);

/* Show the bonding transmit hash method. */
static ssize_t bonding_show_xmit_hash(struct device *d,

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 220 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              
	val = bond_opt_get_val(BOND_OPT_XMIT_HASH, bond->params.xmit_policy);

	return sprintf(buf, "%s %d\n", val->string, bond->params.xmit_policy);
}
static DEVICE_ATTR(xmit_hash_policy, 0644,
		   bonding_show_xmit_hash, bonding_sysfs_store_option);

/* Show arp_validate. */

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 236 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              	val = bond_opt_get_val(BOND_OPT_ARP_VALIDATE,
			       bond->params.arp_validate);

	return sprintf(buf, "%s %d\n", val->string, bond->params.arp_validate);
}
static DEVICE_ATTR(arp_validate, 0644, bonding_show_arp_validate,
		   bonding_sysfs_store_option);

/* Show arp_all_targets. */

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 251 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              
	val = bond_opt_get_val(BOND_OPT_ARP_ALL_TARGETS,
			       bond->params.arp_all_targets);
	return sprintf(buf, "%s %d\n",
		       val->string, bond->params.arp_all_targets);
}
static DEVICE_ATTR(arp_all_targets, 0644,
		   bonding_show_arp_all_targets, bonding_sysfs_store_option);


            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 268 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              	val = bond_opt_get_val(BOND_OPT_FAIL_OVER_MAC,
			       bond->params.fail_over_mac);

	return sprintf(buf, "%s %d\n", val->string, bond->params.fail_over_mac);
}
static DEVICE_ATTR(fail_over_mac, 0644,
		   bonding_show_fail_over_mac, bonding_sysfs_store_option);

/* Show the arp timer interval. */

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 352 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              
	val = bond_opt_get_val(BOND_OPT_LACP_RATE, bond->params.lacp_fast);

	return sprintf(buf, "%s %d\n", val->string, bond->params.lacp_fast);
}
static DEVICE_ATTR(lacp_rate, 0644,
		   bonding_show_lacp, bonding_sysfs_store_option);

static ssize_t bonding_show_min_links(struct device *d,

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 377 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              
	val = bond_opt_get_val(BOND_OPT_AD_SELECT, bond->params.ad_select);

	return sprintf(buf, "%s %d\n", val->string, bond->params.ad_select);
}
static DEVICE_ATTR(ad_select, 0644,
		   bonding_show_ad_select, bonding_sysfs_store_option);

/* Show the number of peer notifications to send after a failover event. */

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 420 Column: 11 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              	rcu_read_lock();
	primary = rcu_dereference(bond->primary_slave);
	if (primary)
		count = sprintf(buf, "%s\n", primary->dev->name);
	rcu_read_unlock();

	return count;
}
static DEVICE_ATTR(primary, 0644,

            

Reported by FlawFinder.

tools/perf/util/header.c
42 issues
sscanf - The scanf() family's %s operation, without a limit specification, permits buffer overflows
Security

Line: 665 Column: 7 CWE codes: 120 20
Suggestion: Specify a limit to %s, or use a different input function

              			break;
	}
	if (!ret) {
		n = sscanf(buf, "%*s %"PRIu64, &mem);
		if (n == 1)
			ret = do_write(ff, &mem, sizeof(mem));
	} else
		ret = -1;
	free(buf);

            

Reported by FlawFinder.

fprintf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 1928 Column: 5 CWE codes: 134
Suggestion: Use a constant for the format specification

              			for (j = 0, id = evsel->core.id; j < evsel->core.ids; j++, id++) {
				if (j)
					fputc(',', fp);
				fprintf(fp, " %"PRIu64, *id);
			}
			fprintf(fp, " }");
		}

		perf_event_attr__fprintf(fp, &evsel->core.attr, __desc_attr__fprintf, NULL);

            

Reported by FlawFinder.

fprintf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 2072 Column: 3 CWE codes: 134
Suggestion: Use a constant for the format specification

              			goto error;

		str = tmp + 1;
		fprintf(fp, "%s%s = %" PRIu32, delimiter, str, type);

		delimiter = ", ";
		str += strlen(str) + 1;
		pmu_num--;
	}

            

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 3975 Column: 44 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available

              	}

	if (!evsel->name) {
		snprintf(bf, sizeof(bf), "%s:%s", event->system, event->name);
		evsel->name = strdup(bf);
		if (evsel->name == NULL)
			return -1;
	}


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 125 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		ff->size = new_size;
	}

	memcpy(ff->buf + ff->offset, buf, size);
	ff->offset += size;

	return 0;
}


            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 162 Column: 15 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              int write_padded(struct feat_fd *ff, const void *bf,
		 size_t count, size_t count_aligned)
{
	static const char zero_buf[NAME_ALIGN];
	int err = do_write(ff, bf, count);

	if (!err)
		err = do_write(ff, zero_buf, count_aligned - count);


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 205 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	if (size > (ssize_t)ff->size - ff->offset)
		return -1;

	memcpy(addr, ff->buf + ff->offset, size);
	ff->offset += size;

	return 0;

}

            

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 390 Column: 9 CWE codes: 362

              	if (!search)
		return -1;

	file = fopen("/proc/cpuinfo", "r");
	if (!file)
		return -1;

	while (getline(&buf, &len, file) > 0) {
		ret = strncmp(buf, search, strlen(search));

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 548 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static int write_cmdline(struct feat_fd *ff,
			 struct evlist *evlist __maybe_unused)
{
	char pbuf[MAXPATHLEN], *buf;
	int i, ret, n;

	/* actual path to perf binary */
	buf = perf_exe(pbuf, MAXPATHLEN);


            

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 655 Column: 7 CWE codes: 362

              	int ret = -1, n;
	uint64_t mem;

	fp = fopen("/proc/meminfo", "r");
	if (!fp)
		return -1;

	while (getline(&buf, &len, fp) > 0) {
		ret = strncmp(buf, "MemTotal:", 9);

            

Reported by FlawFinder.

drivers/block/rbd.c
42 issues
sprintf - Does not check for buffer overflows
Security

Line: 3640 Column: 2 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              static void format_lock_cookie(struct rbd_device *rbd_dev, char *buf)
{
	mutex_lock(&rbd_dev->watch_mutex);
	sprintf(buf, "%s %llu", RBD_LOCK_COOKIE_PREFIX, rbd_dev->watch_cookie);
	mutex_unlock(&rbd_dev->watch_mutex);
}

static void __rbd_lock(struct rbd_device *rbd_dev, const char *cookie)
{

            

Reported by FlawFinder.

strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 3649 Column: 2 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)

              	struct rbd_client_id cid = rbd_get_cid(rbd_dev);

	rbd_dev->lock_state = RBD_LOCK_STATE_LOCKED;
	strcpy(rbd_dev->lock_cookie, cookie);
	rbd_set_owner_cid(rbd_dev, &cid);
	queue_work(rbd_dev->task_wq, &rbd_dev->acquired_lock_work);
}

/*

            

Reported by FlawFinder.

sscanf - The scanf() family's %s operation, without a limit specification, permits buffer overflows
Security

Line: 3907 Column: 2 CWE codes: 120 20
Suggestion: Specify a limit to %s, or use a different input function

              	if (ret)
		return ret;

	sscanf(locker->id.cookie, RBD_LOCK_COOKIE_PREFIX " %llu", &cookie);
	for (i = 0; i < num_watchers; i++) {
		/*
		 * Ignore addr->type while comparing.  This mimics
		 * entity_addr_t::get_legacy_str() + strcmp().
		 */

            

Reported by FlawFinder.

snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 4935 Column: 2 CWE codes: 134
Suggestion: Use a constant for the format specification

              	}
	q = disk->queue;

	snprintf(disk->disk_name, sizeof(disk->disk_name), RBD_DRV_NAME "%d",
		 rbd_dev->dev_id);
	disk->major = rbd_dev->major;
	disk->first_minor = rbd_dev->minor;
	if (single_major) {
		disk->minors = (1 << RBD_SINGLE_MAJOR_PART_SHIFT);

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 5057 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

	return sprintf(buf, "%s\n", rbd_dev->config_info);
}

static ssize_t rbd_pool_show(struct device *dev,
			     struct device_attribute *attr, char *buf)
{

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 5065 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              {
	struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);

	return sprintf(buf, "%s\n", rbd_dev->spec->pool_name);
}

static ssize_t rbd_pool_id_show(struct device *dev,
			     struct device_attribute *attr, char *buf)
{

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 5082 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              {
	struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);

	return sprintf(buf, "%s\n", rbd_dev->spec->pool_ns ?: "");
}

static ssize_t rbd_name_show(struct device *dev,
			     struct device_attribute *attr, char *buf)
{

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 5091 Column: 10 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              	struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);

	if (rbd_dev->spec->image_name)
		return sprintf(buf, "%s\n", rbd_dev->spec->image_name);

	return sprintf(buf, "(unknown)\n");
}

static ssize_t rbd_image_id_show(struct device *dev,

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 5101 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              {
	struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);

	return sprintf(buf, "%s\n", rbd_dev->spec->image_id);
}

/*
 * Shows the name of the currently-mapped snapshot (or
 * RBD_SNAP_HEAD_NAME for the base image).

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 5114 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              {
	struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);

	return sprintf(buf, "%s\n", rbd_dev->spec->snap_name);
}

static ssize_t rbd_snap_id_show(struct device *dev,
				struct device_attribute *attr, char *buf)
{

            

Reported by FlawFinder.

drivers/crypto/inside-secure/safexcel_hash.c
42 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 125 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	 */
	if (unlikely(req->digest == CONTEXT_CONTROL_DIGEST_XCM)) {
		if (req->xcbcmac)
			memcpy(ctx->base.ctxr->data, &ctx->base.ipad, ctx->key_sz);
		else
			memcpy(ctx->base.ctxr->data, req->state, req->state_sz);

		if (!req->finish && req->xcbcmac)
			cdesc->control_data.control0 |=

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 127 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		if (req->xcbcmac)
			memcpy(ctx->base.ctxr->data, &ctx->base.ipad, ctx->key_sz);
		else
			memcpy(ctx->base.ctxr->data, req->state, req->state_sz);

		if (!req->finish && req->xcbcmac)
			cdesc->control_data.control0 |=
				CONTEXT_CONTROL_DIGEST_XCM |
				CONTEXT_CONTROL_TYPE_HASH_OUT  |

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 162 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	}

	/* Hash continuation or HMAC, setup (inner) digest from state */
	memcpy(ctx->base.ctxr->data, req->state, req->state_sz);

	if (req->finish) {
		/* Compute digest count for hash/HMAC finish operations */
		if ((req->digest == CONTEXT_CONTROL_DIGEST_PRECOMPUTED) ||
		    req->hmac_zlen || (req->processed != req->block_sz)) {

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 206 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              			req->hmac_zlen = false;
		} else { /* HMAC */
			/* Need outer digest for HMAC finalization */
			memcpy(ctx->base.ctxr->data + (req->state_sz >> 2),
			       &ctx->base.opad, req->state_sz);

			/* Single pass HMAC - no digest count */
			cdesc->control_data.control0 |=
				CONTEXT_CONTROL_SIZE(req->state_sz >> 1) |

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 273 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		if (sreq->hmac &&
		    (sreq->digest != CONTEXT_CONTROL_DIGEST_HMAC)) {
			/* Faking HMAC using hash - need to do outer hash */
			memcpy(sreq->cache, sreq->state,
			       crypto_ahash_digestsize(ahash));

			memcpy(sreq->state, &ctx->base.opad, sreq->digest_sz);

			sreq->len = sreq->block_sz +

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 276 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              			memcpy(sreq->cache, sreq->state,
			       crypto_ahash_digestsize(ahash));

			memcpy(sreq->state, &ctx->base.opad, sreq->digest_sz);

			sreq->len = sreq->block_sz +
				    crypto_ahash_digestsize(ahash);
			sreq->processed = sreq->block_sz;
			sreq->hmac = 0;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 297 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              			/* Undo final XOR with 0xffffffff ...*/
			*(__le32 *)areq->result = ~sreq->state[0];
		} else {
			memcpy(areq->result, sreq->state,
			       crypto_ahash_digestsize(ahash));
		}
	}

	cache_len = safexcel_queued_len(sreq);

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 304 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
	cache_len = safexcel_queued_len(sreq);
	if (cache_len)
		memcpy(sreq->cache, sreq->cache_next, cache_len);

	*should_complete = true;

	return 1;
}

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 781 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		 * result directly here.
		 */
		if (ctx->alg == CONTEXT_CONTROL_CRYPTO_ALG_MD5)
			memcpy(areq->result, md5_zero_message_hash,
			       MD5_DIGEST_SIZE);
		else if (ctx->alg == CONTEXT_CONTROL_CRYPTO_ALG_SHA1)
			memcpy(areq->result, sha1_zero_message_hash,
			       SHA1_DIGEST_SIZE);
		else if (ctx->alg == CONTEXT_CONTROL_CRYPTO_ALG_SHA224)

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 784 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              			memcpy(areq->result, md5_zero_message_hash,
			       MD5_DIGEST_SIZE);
		else if (ctx->alg == CONTEXT_CONTROL_CRYPTO_ALG_SHA1)
			memcpy(areq->result, sha1_zero_message_hash,
			       SHA1_DIGEST_SIZE);
		else if (ctx->alg == CONTEXT_CONTROL_CRYPTO_ALG_SHA224)
			memcpy(areq->result, sha224_zero_message_hash,
			       SHA224_DIGEST_SIZE);
		else if (ctx->alg == CONTEXT_CONTROL_CRYPTO_ALG_SHA256)

            

Reported by FlawFinder.

net/mac80211/cfg.c
42 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 37 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
		BUILD_BUG_ON(sizeof(membership) != WLAN_MEMBERSHIP_LEN);

		memcpy(sdata->vif.bss_conf.mu_group.membership,
		       params->vht_mumimo_groups, WLAN_MEMBERSHIP_LEN);
		memcpy(sdata->vif.bss_conf.mu_group.position,
		       params->vht_mumimo_groups + WLAN_MEMBERSHIP_LEN,
		       WLAN_USER_POSITION_LEN);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_MU_GROUPS);

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 39 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
		memcpy(sdata->vif.bss_conf.mu_group.membership,
		       params->vht_mumimo_groups, WLAN_MEMBERSHIP_LEN);
		memcpy(sdata->vif.bss_conf.mu_group.position,
		       params->vht_mumimo_groups + WLAN_MEMBERSHIP_LEN,
		       WLAN_USER_POSITION_LEN);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_MU_GROUPS);
		/* don't care about endianness - just check for 0 */
		memcpy(&membership, params->vht_mumimo_groups,

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 44 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		       WLAN_USER_POSITION_LEN);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_MU_GROUPS);
		/* don't care about endianness - just check for 0 */
		memcpy(&membership, params->vht_mumimo_groups,
		       WLAN_MEMBERSHIP_LEN);
		mu_mimo_groups = membership != 0;
	}

	if (params->vht_mumimo_follow_addr) {

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 645 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE &&
		    !(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
			drv_get_key_seq(sdata->local, key, &kseq);
			memcpy(seq, kseq.ccmp.pn, 6);
		} else {
			pn64 = atomic64_read(&key->conf.tx_pn);
			seq[0] = pn64;
			seq[1] = pn64 >> 8;
			seq[2] = pn64 >> 16;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 763 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	sta = sta_info_get_by_idx(sdata, idx);
	if (sta) {
		ret = 0;
		memcpy(mac, sta->sta.addr, ETH_ALEN);
		sta_set_sinfo(sta, sinfo, true);
	}

	mutex_unlock(&local->sta_mtx);


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 847 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		return -ENOMEM;

	new->len = resp_len;
	memcpy(new->data, resp, resp_len);

	if (csa)
		memcpy(new->cntdwn_counter_offsets, csa->counter_offsets_presp,
		       csa->n_counter_offsets_presp *
		       sizeof(new->cntdwn_counter_offsets[0]));

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 850 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	memcpy(new->data, resp, resp_len);

	if (csa)
		memcpy(new->cntdwn_counter_offsets, csa->counter_offsets_presp,
		       csa->n_counter_offsets_presp *
		       sizeof(new->cntdwn_counter_offsets[0]));

	rcu_assign_pointer(sdata->u.ap.probe_resp, new);
	if (old)

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 879 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	if (!new)
		return -ENOMEM;
	new->len = params->tmpl_len;
	memcpy(new->data, params->tmpl, params->tmpl_len);
	rcu_assign_pointer(sdata->u.ap.fils_discovery, new);

	if (old)
		kfree_rcu(old, rcu_head);


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 902 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	if (!new)
		return -ENOMEM;
	new->len = params->tmpl_len;
	memcpy(new->data, params->tmpl, params->tmpl_len);
	rcu_assign_pointer(sdata->u.ap.unsol_bcast_probe_resp, new);

	if (old)
		kfree_rcu(old, rcu_head);


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 939 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	if (lci_len) {
		new->lci_len = lci_len;
		new->lci = pos;
		memcpy(pos, lci, lci_len);
		pos += lci_len;
	}

	if (civicloc_len) {
		new->civicloc_len = civicloc_len;

            

Reported by FlawFinder.

drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
42 issues
syntax error
Error

Line: 3938

              
	result = vega20_disable_dpm_tasks(hwmgr);
	PP_ASSERT_WITH_CODE((0 == result),
			"[PowerOffAsic] Failed to disable DPM!",
			);
	data->water_marks_bitmap &= ~(WaterMarksLoaded);

	return result;
}

            

Reported by Cppcheck.

sprintf - Does not check for buffer overflows
Security

Line: 3247 Column: 10 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              			return ret);

	size += sprintf(buf + size, "Current ppfeatures: 0x%016llx\n", features_enabled);
	size += sprintf(buf + size, "%-19s %-22s %s\n",
				output_title[0],
				output_title[1],
				output_title[2]);
	for (i = 0; i < GNLD_FEATURES_MAX; i++) {
		size += sprintf(buf + size, "%-19s 0x%016llx %6s\n",

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 3252 Column: 11 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              				output_title[1],
				output_title[2]);
	for (i = 0; i < GNLD_FEATURES_MAX; i++) {
		size += sprintf(buf + size, "%-19s 0x%016llx %6s\n",
					ppfeature_name[i],
					1ULL << i,
					(features_enabled & (1ULL << i)) ? "Y" : "N");
	}


            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 3381 Column: 12 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              		}

		for (i = 0; i < clocks.num_levels; i++)
			size += sprintf(buf + size, "%d: %uMhz %s\n",
				i, clocks.data[i].clocks_in_khz / 1000,
				(clocks.data[i].clocks_in_khz == now * 10) ? "*" : "");
		break;

	case PP_MCLK:

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 3399 Column: 12 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              		}

		for (i = 0; i < clocks.num_levels; i++)
			size += sprintf(buf + size, "%d: %uMhz %s\n",
				i, clocks.data[i].clocks_in_khz / 1000,
				(clocks.data[i].clocks_in_khz == now * 10) ? "*" : "");
		break;

	case PP_SOCCLK:

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 3417 Column: 12 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              		}

		for (i = 0; i < clocks.num_levels; i++)
			size += sprintf(buf + size, "%d: %uMhz %s\n",
				i, clocks.data[i].clocks_in_khz / 1000,
				(clocks.data[i].clocks_in_khz == now * 10) ? "*" : "");
		break;

	case PP_FCLK:

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 3429 Column: 12 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              				return ret);

		for (i = 0; i < fclk_dpm_table->count; i++)
			size += sprintf(buf + size, "%d: %uMhz %s\n",
				i, fclk_dpm_table->dpm_levels[i].value,
				fclk_dpm_table->dpm_levels[i].value == (now / 100) ? "*" : "");
		break;

	case PP_DCEFCLK:

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 3447 Column: 12 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              		}

		for (i = 0; i < clocks.num_levels; i++)
			size += sprintf(buf + size, "%d: %uMhz %s\n",
				i, clocks.data[i].clocks_in_khz / 1000,
				(clocks.data[i].clocks_in_khz == now * 10) ? "*" : "");
		break;

	case PP_PCIE:

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 3461 Column: 12 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              			gen_speed = pptable->PcieGenSpeed[i];
			lane_width = pptable->PcieLaneCount[i];

			size += sprintf(buf + size, "%d: %s %s %dMhz %s\n", i,
					(gen_speed == 0) ? "2.5GT/s," :
					(gen_speed == 1) ? "5.0GT/s," :
					(gen_speed == 2) ? "8.0GT/s," :
					(gen_speed == 3) ? "16.0GT/s," : "",
					(lane_width == 1) ? "x1" :

            

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 3482 Column: 11 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              	case OD_SCLK:
		if (od8_settings[OD8_SETTING_GFXCLK_FMIN].feature_id &&
		    od8_settings[OD8_SETTING_GFXCLK_FMAX].feature_id) {
			size = sprintf(buf, "%s:\n", "OD_SCLK");
			size += sprintf(buf + size, "0: %10uMhz\n",
				od_table->GfxclkFmin);
			size += sprintf(buf + size, "1: %10uMhz\n",
				od_table->GfxclkFmax);
		}

            

Reported by FlawFinder.

drivers/scsi/qla2xxx/qla_init.c
42 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 3588 Column: 2 CWE codes: 134
Suggestion: Use a constant for the format specification

              	int leftover, len;

	memset(str, 0, STR_LEN);
	snprintf(str, SFF_VEN_NAME_LEN+1, a0->vendor_name);
	ql_dbg(ql_dbg_init, vha, 0x015a,
	    "SFP MFG Name: %s\n", str);

	memset(str, 0, STR_LEN);
	snprintf(str, SFF_PART_NAME_LEN+1, a0->vendor_pn);

            

Reported by FlawFinder.

snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 3593 Column: 2 CWE codes: 134
Suggestion: Use a constant for the format specification

              	    "SFP MFG Name: %s\n", str);

	memset(str, 0, STR_LEN);
	snprintf(str, SFF_PART_NAME_LEN+1, a0->vendor_pn);
	ql_dbg(ql_dbg_init, vha, 0x015c,
	    "SFP Part Name: %s\n", str);

	/* media */
	memset(str, 0, STR_LEN);

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1704 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	e->u.new_sess.id = *id;
	e->u.new_sess.pla = pla;
	e->u.new_sess.fc4_type = fc4_type;
	memcpy(e->u.new_sess.port_name, port_name, WWN_SIZE);
	if (node_name)
		memcpy(e->u.new_sess.node_name, node_name, WWN_SIZE);

	return qla2x00_post_work(vha, e);
}

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1706 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	e->u.new_sess.fc4_type = fc4_type;
	memcpy(e->u.new_sess.port_name, port_name, WWN_SIZE);
	if (node_name)
		memcpy(e->u.new_sess.node_name, node_name, WWN_SIZE);

	return qla2x00_post_work(vha, e);
}

void qla2x00_handle_rscn(scsi_qla_host_t *vha, struct event_arg *ea)

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 3427 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		} else {
			mutex_lock(&ha->optrom_mutex);
			if (ha->fw_dumped) {
				memcpy(fw_dump, ha->fw_dump, ha->fw_dump_len);
				vfree(ha->fw_dump);
				ha->fw_dump = fw_dump;
				ha->fw_dump_alloc_len =  dump_size;
				ql_dbg(ql_dbg_init, vha, 0x00c5,
				    "Re-Allocated (%d KB) and save firmware dump.\n",

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 4493 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	uint8_t       al_pa;
	uint8_t       area;
	uint8_t       domain;
	char		connect_type[22];
	struct qla_hw_data *ha = vha->hw;
	scsi_qla_host_t *base_vha = pci_get_drvdata(ha->pdev);
	port_id_t id;
	unsigned long flags;


            

Reported by FlawFinder.

strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 4540 Column: 3 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)

              	case 0:
		ql_dbg(ql_dbg_disc, vha, 0x200b, "HBA in NL topology.\n");
		ha->current_topology = ISP_CFG_NL;
		strcpy(connect_type, "(Loop)");
		break;

	case 1:
		ql_dbg(ql_dbg_disc, vha, 0x200c, "HBA in FL topology.\n");
		ha->switch_cap = sw_cap;

            

Reported by FlawFinder.

strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 4547 Column: 3 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)

              		ql_dbg(ql_dbg_disc, vha, 0x200c, "HBA in FL topology.\n");
		ha->switch_cap = sw_cap;
		ha->current_topology = ISP_CFG_FL;
		strcpy(connect_type, "(FL_Port)");
		break;

	case 2:
		ql_dbg(ql_dbg_disc, vha, 0x200d, "HBA in N P2P topology.\n");
		ha->operating_mode = P2P;

            

Reported by FlawFinder.

strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 4554 Column: 3 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)

              		ql_dbg(ql_dbg_disc, vha, 0x200d, "HBA in N P2P topology.\n");
		ha->operating_mode = P2P;
		ha->current_topology = ISP_CFG_N;
		strcpy(connect_type, "(N_Port-to-N_Port)");
		break;

	case 3:
		ql_dbg(ql_dbg_disc, vha, 0x200e, "HBA in F P2P topology.\n");
		ha->switch_cap = sw_cap;

            

Reported by FlawFinder.

strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 4562 Column: 3 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)

              		ha->switch_cap = sw_cap;
		ha->operating_mode = P2P;
		ha->current_topology = ISP_CFG_F;
		strcpy(connect_type, "(F_Port)");
		break;

	default:
		ql_dbg(ql_dbg_disc, vha, 0x200f,
		    "HBA in unknown topology %x, using NL.\n", topo);

            

Reported by FlawFinder.