The following issues were found

drivers/block/paride/pf.c
20 issues
access - This usually indicates a security flaw. If an attacker can change anything along the path between the call to access() and the file's actual use (e.g., by moving files), the attacker can exploit the race condition
Security

Line: 238 Column: 6 CWE codes: 362/367!
Suggestion: Set up the correct permissions (e.g., using setuid()) and try to open the file directly 

              	int media_status;	/* media present ?  WP ? */
	int drive;		/* drive */
	int lun;
	int access;		/* count of active opens ... */
	int present;		/* device present ? */
	char name[PF_NAMELEN];	/* pf0, pf1, ... */
	struct gendisk *disk;
	struct blk_mq_tag_set tag_set;
	struct list_head rq_list;

Reported by FlawFinder.

strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 319 Column: 3 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused) 

              		disk->major = major;
		disk->first_minor = unit;
		disk->minors = 1;
		strcpy(disk->disk_name, pf->name);
		disk->fops = &pf_fops;
		disk->events = DISK_EVENT_MEDIA_CHANGE;
		if (!(*drives[unit])[D_PRT])
			pf_drive_count++;
	}

Reported by FlawFinder.

access - This usually indicates a security flaw. If an attacker can change anything along the path between the call to access() and the file's actual use (e.g., by moving files), the attacker can exploit the race condition
Security

Line: 377 Column: 10 CWE codes: 362/367!
Suggestion: Set up the correct permissions (e.g., using setuid()) and try to open the file directly 

              	if (cmd != CDROMEJECT)
		return -EINVAL;

	if (pf->access != 1)
		return -EBUSY;
	mutex_lock(&pf_mutex);
	pf_eject(pf);
	mutex_unlock(&pf_mutex);

Reported by FlawFinder.

access - This usually indicates a security flaw. If an attacker can change anything along the path between the call to access() and the file's actual use (e.g., by moving files), the attacker can exploit the race condition
Security

Line: 391 Column: 10 CWE codes: 362/367!
Suggestion: Set up the correct permissions (e.g., using setuid()) and try to open the file directly 

              	struct pf_unit *pf = disk->private_data;

	mutex_lock(&pf_mutex);
	if (pf->access <= 0) {
		mutex_unlock(&pf_mutex);
		WARN_ON(1);
		return;
	}

Reported by FlawFinder.

access - This usually indicates a security flaw. If an attacker can change anything along the path between the call to access() and the file's actual use (e.g., by moving files), the attacker can exploit the race condition
Security

Line: 399 Column: 11 CWE codes: 362/367!
Suggestion: Set up the correct permissions (e.g., using setuid()) and try to open the file directly 

              
	pf->access--;

	if (!pf->access && pf->removable)
		pf_lock(pf, 0);

	mutex_unlock(&pf_mutex);
}

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 240 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	int lun;
	int access;		/* count of active opens ... */
	int present;		/* device present ? */
	char name[PF_NAMELEN];	/* pf0, pf1, ... */
	struct gendisk *disk;
	struct blk_mq_tag_set tag_set;
	struct list_head rq_list;
};

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 254 Column: 8 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              static unsigned int pf_check_events(struct gendisk *disk,
				    unsigned int clearing);

static char pf_scratch[512];	/* scratch block buffer */

/* the variables below are used mainly in the I/O request engine, which
   processes only one request at a time.
*/

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 502 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
static void pf_req_sense(struct pf_unit *pf, int quiet)
{
	char rs_cmd[12] =
	    { ATAPI_REQ_SENSE, pf->lun << 5, 0, 0, 16, 0, 0, 0, 0, 0, 0, 0 };
	char buf[16];
	int r;

	r = pf_command(pf, rs_cmd, 16, "Request sense");

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 504 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              {
	char rs_cmd[12] =
	    { ATAPI_REQ_SENSE, pf->lun << 5, 0, 0, 16, 0, 0, 0, 0, 0, 0, 0 };
	char buf[16];
	int r;

	r = pf_command(pf, rs_cmd, 16, "Request sense");
	mdelay(1);
	if (!r)

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 533 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
static void pf_lock(struct pf_unit *pf, int func)
{
	char lo_cmd[12] = { ATAPI_LOCK, pf->lun << 5, 0, 0, func, 0, 0, 0, 0, 0, 0, 0 };

	pf_atapi(pf, lo_cmd, 0, pf_scratch, func ? "lock" : "unlock");
}

static void pf_eject(struct pf_unit *pf)

Reported by FlawFinder.

drivers/net/wireless/intel/iwlegacy/common.c
20 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1103 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	dtim_period = il->vif ? il->vif->bss_conf.dtim_period : 0;

	if (dtim_period <= 2) {
		memcpy(cmd->sleep_interval, interval[0], sizeof(interval[0]));
		no_dtim = 2;
	} else if (dtim_period <= 10) {
		memcpy(cmd->sleep_interval, interval[1], sizeof(interval[1]));
		no_dtim = 2;
	} else {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1106 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		memcpy(cmd->sleep_interval, interval[0], sizeof(interval[0]));
		no_dtim = 2;
	} else if (dtim_period <= 10) {
		memcpy(cmd->sleep_interval, interval[1], sizeof(interval[1]));
		no_dtim = 2;
	} else {
		memcpy(cmd->sleep_interval, interval[2], sizeof(interval[2]));
		no_dtim = 0;
	}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1109 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		memcpy(cmd->sleep_interval, interval[1], sizeof(interval[1]));
		no_dtim = 2;
	} else {
		memcpy(cmd->sleep_interval, interval[2], sizeof(interval[2]));
		no_dtim = 0;
	}

	if (dtim_period == 0) {
		dtim_period = 1;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1176 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		return -EIO;

	/* scan complete use sleep_power_next, need to be updated */
	memcpy(&il->power_data.sleep_cmd_next, cmd, sizeof(*cmd));
	if (test_bit(S_SCANNING, &il->status) && !force) {
		D_INFO("Defer power set mode while scanning\n");
		return 0;
	}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1197 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              				"calibration running: %d\n",
				il->chain_noise_data.state);

		memcpy(&il->power_data.sleep_cmd, cmd, sizeof(*cmd));
	} else
		IL_ERR("set power fail, ret = %d", ret);

	return ret;
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1626 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
	frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
	eth_broadcast_addr(frame->da);
	memcpy(frame->sa, ta, ETH_ALEN);
	eth_broadcast_addr(frame->bssid);
	frame->seq_ctrl = 0;

	len += 24;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1648 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		return len;

	if (ies && ie_len) {
		memcpy(pos, ies, ie_len);
		len += ie_len;
	}

	return (u16) len;
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1976 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
	/* Set up the C_ADD_STA command to send to device */
	memset(&station->sta, 0, sizeof(struct il_addsta_cmd));
	memcpy(station->sta.sta.addr, addr, ETH_ALEN);
	station->sta.mode = 0;
	station->sta.sta.sta_id = sta_id;
	station->sta.station_flags = 0;

	/*

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 2041 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	}

	il->stations[sta_id].used |= IL_STA_UCODE_INPROGRESS;
	memcpy(&sta_cmd, &il->stations[sta_id].sta,
	       sizeof(struct il_addsta_cmd));
	spin_unlock_irqrestore(&il->sta_lock, flags_spin);

	/* Add station to device's station table */
	ret = il_send_add_sta(il, &sta_cmd, CMD_SYNC);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 2099 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
	memset(&rm_sta_cmd, 0, sizeof(rm_sta_cmd));
	rm_sta_cmd.num_sta = 1;
	memcpy(&rm_sta_cmd.addr, addr, ETH_ALEN);

	cmd.flags |= CMD_WANT_SKB;

	ret = il_send_cmd(il, &cmd);

Reported by FlawFinder.

drivers/dma/s3c24xx-dma.c
20 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 241 Column: 22 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	struct soc_data				*sdata;
	void __iomem				*base;
	struct dma_device			slave;
	struct dma_device			memcpy;
	struct s3c24xx_dma_phy			*phy_chans;
};

/*
 * Physical channel handling

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 581 Column: 34 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	next = NULL;

	/* Find a waiting virtual channel for the next transfer. */
	list_for_each_entry(p, &s3cdma->memcpy.channels, vc.chan.device_node)
		if (p->state == S3C24XX_DMA_CHAN_WAITING) {
			next = p;
			break;
		}

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1233 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* acquire irqs and clocks for all physical channels */
	for (i = 0; i < pdata->num_phy_channels; i++) {
		struct s3c24xx_dma_phy *phy = &s3cdma->phy_chans[i];
		char clk_name[6];

		phy->id = i;
		phy->base = s3cdma->base + (i * sdata->stride);
		phy->host = s3cdma;

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 1252 Column: 4 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              		}

		if (sdata->has_clocks) {
			sprintf(clk_name, "dma.%d", i);
			phy->clk = devm_clk_get(&pdev->dev, clk_name);
			if (IS_ERR(phy->clk) && sdata->has_clocks) {
				dev_err(&pdev->dev, "unable to acquire clock for channel %d, error %lu\n",
					i, PTR_ERR(phy->clk));
				continue;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1276 Column: 34 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	}

	/* Initialize memcpy engine */
	dma_cap_set(DMA_MEMCPY, s3cdma->memcpy.cap_mask);
	dma_cap_set(DMA_PRIVATE, s3cdma->memcpy.cap_mask);
	s3cdma->memcpy.dev = &pdev->dev;
	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1277 Column: 35 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
	/* Initialize memcpy engine */
	dma_cap_set(DMA_MEMCPY, s3cdma->memcpy.cap_mask);
	dma_cap_set(DMA_PRIVATE, s3cdma->memcpy.cap_mask);
	s3cdma->memcpy.dev = &pdev->dev;
	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;
	s3cdma->memcpy.device_tx_status = s3c24xx_dma_tx_status;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1278 Column: 10 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	/* Initialize memcpy engine */
	dma_cap_set(DMA_MEMCPY, s3cdma->memcpy.cap_mask);
	dma_cap_set(DMA_PRIVATE, s3cdma->memcpy.cap_mask);
	s3cdma->memcpy.dev = &pdev->dev;
	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;
	s3cdma->memcpy.device_tx_status = s3c24xx_dma_tx_status;
	s3cdma->memcpy.device_issue_pending = s3c24xx_dma_issue_pending;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1279 Column: 10 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	dma_cap_set(DMA_MEMCPY, s3cdma->memcpy.cap_mask);
	dma_cap_set(DMA_PRIVATE, s3cdma->memcpy.cap_mask);
	s3cdma->memcpy.dev = &pdev->dev;
	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;
	s3cdma->memcpy.device_tx_status = s3c24xx_dma_tx_status;
	s3cdma->memcpy.device_issue_pending = s3c24xx_dma_issue_pending;
	s3cdma->memcpy.device_config = s3c24xx_dma_set_runtime_config;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1281 Column: 10 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	s3cdma->memcpy.dev = &pdev->dev;
	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;
	s3cdma->memcpy.device_tx_status = s3c24xx_dma_tx_status;
	s3cdma->memcpy.device_issue_pending = s3c24xx_dma_issue_pending;
	s3cdma->memcpy.device_config = s3c24xx_dma_set_runtime_config;
	s3cdma->memcpy.device_terminate_all = s3c24xx_dma_terminate_all;
	s3cdma->memcpy.device_synchronize = s3c24xx_dma_synchronize;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1282 Column: 10 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;
	s3cdma->memcpy.device_tx_status = s3c24xx_dma_tx_status;
	s3cdma->memcpy.device_issue_pending = s3c24xx_dma_issue_pending;
	s3cdma->memcpy.device_config = s3c24xx_dma_set_runtime_config;
	s3cdma->memcpy.device_terminate_all = s3c24xx_dma_terminate_all;
	s3cdma->memcpy.device_synchronize = s3c24xx_dma_synchronize;

Reported by FlawFinder.

net/ipv4/devinet.c
20 issues
strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 1267 Column: 3 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused) 

              		if (len < size)
			break;
		memset(&ifr, 0, sizeof(struct ifreq));
		strcpy(ifr.ifr_name, ifa->ifa_label);

		(*(struct sockaddr_in *)&ifr.ifr_addr).sin_family = AF_INET;
		(*(struct sockaddr_in *)&ifr.ifr_addr).sin_addr.s_addr =
								ifa->ifa_local;

Reported by FlawFinder.

strcat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 1496 Column: 4 CWE codes: 120
Suggestion: Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused) 

              			dot = old;
		}
		if (strlen(dot) + strlen(dev->name) < IFNAMSIZ)
			strcat(ifa->ifa_label, dot);
		else
			strcpy(ifa->ifa_label + (IFNAMSIZ - strlen(dot) - 1), dot);
skip:
		rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
	}

Reported by FlawFinder.

strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 1498 Column: 4 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused) 

              		if (strlen(dot) + strlen(dev->name) < IFNAMSIZ)
			strcat(ifa->ifa_label, dot);
		else
			strcpy(ifa->ifa_label + (IFNAMSIZ - strlen(dot) - 1), dot);
skip:
		rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
	}
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 885 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	if (tb[IFA_LABEL])
		nla_strscpy(ifa->ifa_label, tb[IFA_LABEL], IFNAMSIZ);
	else
		memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);

	if (tb[IFA_RT_PRIORITY])
		ifa->ifa_rt_priority = nla_get_u32(tb[IFA_RT_PRIORITY]);

	if (tb[IFA_CACHEINFO]) {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1023 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	ifr->ifr_name[IFNAMSIZ - 1] = 0;

	/* save original address for comparison */
	memcpy(&sin_orig, sin, sizeof(*sin));

	colon = strchr(ifr->ifr_name, ':');
	if (colon)
		*colon = 0;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1157 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              				break;
			INIT_HLIST_NODE(&ifa->hash);
			if (colon)
				memcpy(ifa->ifa_label, ifr->ifr_name, IFNAMSIZ);
			else
				memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
		} else {
			ret = 0;
			if (ifa->ifa_local == sin->sin_addr.s_addr)

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1159 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              			if (colon)
				memcpy(ifa->ifa_label, ifr->ifr_name, IFNAMSIZ);
			else
				memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
		} else {
			ret = 0;
			if (ifa->ifa_local == sin->sin_addr.s_addr)
				break;
			inet_del_ifa(in_dev, ifap, 0);

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1484 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	int named = 0;

	in_dev_for_each_ifa_rtnl(ifa, in_dev) {
		char old[IFNAMSIZ], *dot;

		memcpy(old, ifa->ifa_label, IFNAMSIZ);
		memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
		if (named++ == 0)
			goto skip;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1486 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	in_dev_for_each_ifa_rtnl(ifa, in_dev) {
		char old[IFNAMSIZ], *dot;

		memcpy(old, ifa->ifa_label, IFNAMSIZ);
		memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
		if (named++ == 0)
			goto skip;
		dot = strchr(old, ':');
		if (!dot) {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1487 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		char old[IFNAMSIZ], *dot;

		memcpy(old, ifa->ifa_label, IFNAMSIZ);
		memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
		if (named++ == 0)
			goto skip;
		dot = strchr(old, ':');
		if (!dot) {
			sprintf(old, ":%d", named);

Reported by FlawFinder.

include/linux/bcm963xx_tag.h
20 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 48 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
struct bcm_tag {
	/* 0-3: Version of the image tag */
	char tag_version[TAGVER_LEN];
	/* 4-23: Company Line 1 */
	char sig_1[SIG1_LEN];
	/*  24-37: Company Line 2 */
	char sig_2[SIG2_LEN];
	/* 38-43: Chip this image is for */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 50 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 0-3: Version of the image tag */
	char tag_version[TAGVER_LEN];
	/* 4-23: Company Line 1 */
	char sig_1[SIG1_LEN];
	/*  24-37: Company Line 2 */
	char sig_2[SIG2_LEN];
	/* 38-43: Chip this image is for */
	char chip_id[CHIPID_LEN];
	/* 44-59: Board name */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 52 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 4-23: Company Line 1 */
	char sig_1[SIG1_LEN];
	/*  24-37: Company Line 2 */
	char sig_2[SIG2_LEN];
	/* 38-43: Chip this image is for */
	char chip_id[CHIPID_LEN];
	/* 44-59: Board name */
	char board_id[BOARDID_LEN];
	/* 60-61: Map endianness -- 1 BE 0 LE */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 54 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/*  24-37: Company Line 2 */
	char sig_2[SIG2_LEN];
	/* 38-43: Chip this image is for */
	char chip_id[CHIPID_LEN];
	/* 44-59: Board name */
	char board_id[BOARDID_LEN];
	/* 60-61: Map endianness -- 1 BE 0 LE */
	char big_endian[ENDIANFLAG_LEN];
	/* 62-71: Total length of image */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 56 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 38-43: Chip this image is for */
	char chip_id[CHIPID_LEN];
	/* 44-59: Board name */
	char board_id[BOARDID_LEN];
	/* 60-61: Map endianness -- 1 BE 0 LE */
	char big_endian[ENDIANFLAG_LEN];
	/* 62-71: Total length of image */
	char total_length[IMAGE_LEN];
	/* 72-83: Address in memory of CFE */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 58 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 44-59: Board name */
	char board_id[BOARDID_LEN];
	/* 60-61: Map endianness -- 1 BE 0 LE */
	char big_endian[ENDIANFLAG_LEN];
	/* 62-71: Total length of image */
	char total_length[IMAGE_LEN];
	/* 72-83: Address in memory of CFE */
	char cfe__address[ADDRESS_LEN];
	/* 84-93: Size of CFE */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 60 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 60-61: Map endianness -- 1 BE 0 LE */
	char big_endian[ENDIANFLAG_LEN];
	/* 62-71: Total length of image */
	char total_length[IMAGE_LEN];
	/* 72-83: Address in memory of CFE */
	char cfe__address[ADDRESS_LEN];
	/* 84-93: Size of CFE */
	char cfe_length[IMAGE_LEN];
	/* 94-105: Address in memory of image start

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 62 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 62-71: Total length of image */
	char total_length[IMAGE_LEN];
	/* 72-83: Address in memory of CFE */
	char cfe__address[ADDRESS_LEN];
	/* 84-93: Size of CFE */
	char cfe_length[IMAGE_LEN];
	/* 94-105: Address in memory of image start
	 * (kernel for OpenWRT, rootfs for stock firmware)
	 */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 64 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 72-83: Address in memory of CFE */
	char cfe__address[ADDRESS_LEN];
	/* 84-93: Size of CFE */
	char cfe_length[IMAGE_LEN];
	/* 94-105: Address in memory of image start
	 * (kernel for OpenWRT, rootfs for stock firmware)
	 */
	char flash_image_start[ADDRESS_LEN];
	/* 106-115: Size of rootfs */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 68 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 94-105: Address in memory of image start
	 * (kernel for OpenWRT, rootfs for stock firmware)
	 */
	char flash_image_start[ADDRESS_LEN];
	/* 106-115: Size of rootfs */
	char root_length[IMAGE_LEN];
	/* 116-127: Address in memory of kernel */
	char kernel_address[ADDRESS_LEN];
	/* 128-137: Size of kernel */

Reported by FlawFinder.

tools/testing/selftests/bpf/test_bpftool.py
20 issues
Unused import collections
Error

Line: 4 Column: 1 

              # SPDX-License-Identifier: GPL-2.0
# Copyright (c) 2020 SUSE LLC.

import collections
import functools
import json
import os
import socket
import subprocess

Reported by Pylint.

Redefining name 'json' from outer scope (line 6)
Error

Line: 28 Column: 20 

                  pass


def _bpftool(args, json=True):
    _args = ["bpftool"]
    if json:
        _args.append("-j")
    _args.extend(args)

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1 

              # SPDX-License-Identifier: GPL-2.0
# Copyright (c) 2020 SUSE LLC.

import collections
import functools
import json
import os
import socket
import subprocess

Reported by Pylint.

Consider possible security implications associated with subprocess module.
Security blacklist

Line: 9
Suggestion: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b404-import-subprocess 

              import json
import os
import socket
import subprocess
import unittest


# Add the source tree of bpftool and /usr/local/sbin to PATH
cur_dir = os.path.dirname(os.path.realpath(__file__))

Reported by Bandit.

Missing class docstring
Error

Line: 20 Column: 1 

              os.environ["PATH"] = bpftool_dir + ":/usr/local/sbin:" + os.environ["PATH"]


class IfaceNotFoundError(Exception):
    pass


class UnprivilegedUserError(Exception):
    pass

Reported by Pylint.

Missing class docstring
Error

Line: 24 Column: 1 

                  pass


class UnprivilegedUserError(Exception):
    pass


def _bpftool(args, json=True):
    _args = ["bpftool"]

Reported by Pylint.

subprocess call - check for execution of untrusted input.
Security injection

Line: 34
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b603_subprocess_without_shell_equals_true.html 

                      _args.append("-j")
    _args.extend(args)

    return subprocess.check_output(_args)


def bpftool(args):
    return _bpftool(args, json=False).decode("utf-8")

Reported by Bandit.

Missing function or method docstring
Error

Line: 37 Column: 1 

                  return subprocess.check_output(_args)


def bpftool(args):
    return _bpftool(args, json=False).decode("utf-8")


def bpftool_json(args):
    res = _bpftool(args)

Reported by Pylint.

Missing function or method docstring
Error

Line: 41 Column: 1 

                  return _bpftool(args, json=False).decode("utf-8")


def bpftool_json(args):
    res = _bpftool(args)
    return json.loads(res)


def get_default_iface():

Reported by Pylint.

Missing function or method docstring
Error

Line: 46 Column: 1 

                  return json.loads(res)


def get_default_iface():
    for iface in socket.if_nameindex():
        if iface[1] != "lo":
            return iface[1]
    raise IfaceNotFoundError("Could not find any network interface to probe")

Reported by Pylint.

drivers/base/regmap/regmap.c
20 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 288 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              {
	u16 v = val << shift;

	memcpy(buf, &v, sizeof(v));
}

static void regmap_format_24(void *buf, unsigned int val, unsigned int shift)
{
	u8 *b = buf;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 317 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              {
	u32 v = val << shift;

	memcpy(buf, &v, sizeof(v));
}

#ifdef CONFIG_64BIT
static void regmap_format_64_be(void *buf, unsigned int val, unsigned int shift)
{

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 336 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              {
	u64 v = (u64) val << shift;

	memcpy(buf, &v, sizeof(v));
}
#endif

static void regmap_parse_inplace_noop(void *buf)
{

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 365 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              {
	u16 v = get_unaligned_be16(buf);

	memcpy(buf, &v, sizeof(v));
}

static void regmap_parse_16_le_inplace(void *buf)
{
	u16 v = get_unaligned_le16(buf);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 372 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              {
	u16 v = get_unaligned_le16(buf);

	memcpy(buf, &v, sizeof(v));
}

static unsigned int regmap_parse_16_native(const void *buf)
{
	u16 v;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 407 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              {
	u32 v = get_unaligned_be32(buf);

	memcpy(buf, &v, sizeof(v));
}

static void regmap_parse_32_le_inplace(void *buf)
{
	u32 v = get_unaligned_le32(buf);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 414 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              {
	u32 v = get_unaligned_le32(buf);

	memcpy(buf, &v, sizeof(v));
}

static unsigned int regmap_parse_32_native(const void *buf)
{
	u32 v;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 440 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              {
	u64 v =  get_unaligned_be64(buf);

	memcpy(buf, &v, sizeof(v));
}

static void regmap_parse_64_le_inplace(void *buf)
{
	u64 v = get_unaligned_le64(buf);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 447 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              {
	u64 v = get_unaligned_le64(buf);

	memcpy(buf, &v, sizeof(v));
}

static unsigned int regmap_parse_64_native(const void *buf)
{
	u64 v;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1721 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	 * writes of single registers optimise that case.
	 */
	if (val != work_val && val_len == map->format.val_bytes) {
		memcpy(work_val, val, map->format.val_bytes);
		val = work_val;
	}

	if (map->async && map->bus->async_write) {
		struct regmap_async *async;

Reported by FlawFinder.

drivers/net/wireless/ath/wil6210/debugfs.c
20 issues
Pointer addition with NULL pointer.
Error

Line: 463 CWE codes: 682 

              		switch (tbl[i].type) {
		case doff_u32:
			debugfs_create_u32(tbl[i].name, tbl[i].mode, dbg,
					   base + tbl[i].off);
			break;
		case doff_x32:
			debugfs_create_x32(tbl[i].name, tbl[i].mode, dbg,
					   base + tbl[i].off);
			break;

Reported by Cppcheck.

Pointer addition with NULL pointer.
Error

Line: 467 CWE codes: 682 

              			break;
		case doff_x32:
			debugfs_create_x32(tbl[i].name, tbl[i].mode, dbg,
					   base + tbl[i].off);
			break;
		case doff_ulong:
			debugfs_create_file_unsafe(tbl[i].name, tbl[i].mode,
						   dbg, base + tbl[i].off,
						   &wil_fops_ulong);

Reported by Cppcheck.

Pointer addition with NULL pointer.
Error

Line: 471 CWE codes: 682 

              			break;
		case doff_ulong:
			debugfs_create_file_unsafe(tbl[i].name, tbl[i].mode,
						   dbg, base + tbl[i].off,
						   &wil_fops_ulong);
			break;
		case doff_io32:
			wil_debugfs_create_iomem_x32(tbl[i].name, tbl[i].mode,
						     dbg, base + tbl[i].off,

Reported by Cppcheck.

Pointer addition with NULL pointer.
Error

Line: 476 CWE codes: 682 

              			break;
		case doff_io32:
			wil_debugfs_create_iomem_x32(tbl[i].name, tbl[i].mode,
						     dbg, base + tbl[i].off,
						     wil);
			break;
		case doff_u8:
			debugfs_create_u8(tbl[i].name, tbl[i].mode, dbg,
					  base + tbl[i].off);

Reported by Cppcheck.

Pointer addition with NULL pointer.
Error

Line: 481 CWE codes: 682 

              			break;
		case doff_u8:
			debugfs_create_u8(tbl[i].name, tbl[i].mode, dbg,
					  base + tbl[i].off);
			break;
		}
	}
}

Reported by Cppcheck.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 151 Column: 4 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              			int used = (ring->size + swhead - swtail)
				   % ring->size;
			int avail = ring->size - used - 1;
			char name[10];
			char sidle[10];
			/* performance monitoring */
			cycles_t now = get_cycles();
			uint64_t idle = txdata->idle * 100;
			uint64_t total = now - txdata->begin;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 152 Column: 4 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              				   % ring->size;
			int avail = ring->size - used - 1;
			char name[10];
			char sidle[10];
			/* performance monitoring */
			cycles_t now = get_cycles();
			uint64_t idle = txdata->idle * 100;
			uint64_t total = now - txdata->begin;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 333 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              				   le16_to_cpu(hdr.seq), len,
				   le16_to_cpu(hdr.type), hdr.flags);
			if (len <= MAX_MBOXITEM_SIZE) {
				unsigned char databuf[MAX_MBOXITEM_SIZE];
				void __iomem *src = wmi_buffer(wil, d.addr) +
					sizeof(struct wil6210_mbox_hdr);
				/*
				 * No need to check @src for validity -
				 * we already validated @d.addr while

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 783 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	struct wil6210_priv *wil = file->private_data;
	int rc;
	char *kbuf = kmalloc(len + 1, GFP_KERNEL);
	char cmd[9];
	int p1, p2, p3;

	if (!kbuf)
		return -ENOMEM;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 880 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	struct wil6210_priv *wil = file->private_data;
	int rc;
	char *kbuf = kmalloc(len + 1, GFP_KERNEL);
	char cmd[9];
	int num_descs, desc_size;

	if (!kbuf)
		return -ENOMEM;

Reported by FlawFinder.

drivers/net/wireless/ath/wil6210/wmi.c
20 issues
Using pointer to local variable 'evt' that is out of scope.
Error

Line: 2635 CWE codes: 562 

              	} __packed evt;
	int rc;

	memset(&evt, 0, sizeof(evt));

	if (wdev->iftype == NL80211_IFTYPE_MONITOR) {
		struct ieee80211_channel *ch = wil->monitor_chandef.chan;

		cmd.sniffer_cfg.mode = cpu_to_le32(WMI_SNIFFER_ON);

Reported by Cppcheck.

Using pointer to local variable 'evt' that is out of scope.
Error

Line: 2662 CWE codes: 562 

              
	/* typical time for secure PCP is 840ms */
	rc = wmi_call(wil, WMI_CFG_RX_CHAIN_CMDID, vif->mid, &cmd, sizeof(cmd),
		      WMI_CFG_RX_CHAIN_DONE_EVENTID, &evt, sizeof(evt), 2000);
	if (rc)
		return rc;

	if (le32_to_cpu(evt.evt.status) != WMI_CFG_RX_CHAIN_SUCCESS)
		rc = -EINVAL;

Reported by Cppcheck.

Using pointer to local variable 'evt' that is out of scope.
Error

Line: 3652 CWE codes: 562 

              	memcpy(cmd->payload, buf, len);

	rc = wmi_call(wil, WMI_SW_TX_REQ_CMDID, vif->mid, cmd, total,
		      WMI_SW_TX_COMPLETE_EVENTID, &evt, sizeof(evt), 2000);
	if (!rc && evt.evt.status != WMI_FW_STATUS_SUCCESS) {
		wil_dbg_wmi(wil, "mgmt_tx failed with status %d\n",
			    evt.evt.status);
		rc = -EAGAIN;
	}

Reported by Cppcheck.

Using pointer to local variable 'evt' that is out of scope.
Error

Line: 3706 CWE codes: 562 

              	cmd->duration_ms = cpu_to_le16(duration_ms);

	rc = wmi_call(wil, WMI_SW_TX_REQ_EXT_CMDID, vif->mid, cmd, total,
		      WMI_SW_TX_COMPLETE_EVENTID, &evt, sizeof(evt), 2000);
	if (!rc && evt.evt.status != WMI_FW_STATUS_SUCCESS) {
		wil_dbg_wmi(wil, "mgmt_tx_ext failed with status %d\n",
			    evt.evt.status);
		rc = -EAGAIN;
	}

Reported by Cppcheck.

Using pointer to local variable 'cmd' that is out of scope.
Error

Line: 4039 CWE codes: 562 

              	if (rssi_thold > S8_MAX || rssi_thold < S8_MIN || rssi_hyst > U8_MAX)
		return -EINVAL;

	rc = wmi_call(wil, WMI_SET_LINK_MONITOR_CMDID, vif->mid, &cmd,
		      sizeof(cmd), WMI_SET_LINK_MONITOR_EVENTID,
		      &reply, sizeof(reply), WIL_WMI_CALL_GENERAL_TO_MS);
	if (rc) {
		wil_err(wil, "WMI_SET_LINK_MONITOR_CMDID failed, rc %d\n", rc);
		return rc;

Reported by Cppcheck.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1995 Column: 6 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              			if (wil->reply_id && wil->reply_id == id &&
			    wil->reply_mid == mid) {
				if (wil->reply_buf) {
					memcpy(wil->reply_buf, wmi,
					       min(len, wil->reply_size));
					immed_reply = true;
				}
				if (id == WMI_TRAFFIC_SUSPEND_EVENTID) {
					wil_dbg_wmi(wil,

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 2288 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	if (ssid_len > sizeof(cmd.ssid))
		return -EINVAL;

	memcpy(cmd.ssid, ssid, ssid_len);

	return wmi_send(wil, WMI_SET_SSID_CMDID, vif->mid, &cmd, sizeof(cmd));
}

int wmi_get_ssid(struct wil6210_vif *vif, u8 *ssid_len, void *ssid)

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 2316 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		return -EINVAL;

	*ssid_len = len;
	memcpy(ssid, reply.cmd.ssid, len);

	return 0;
}

int wmi_set_channel(struct wil6210_priv *wil, int channel)

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 2459 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	};

	if (mac_addr)
		memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);

	return wmi_send(wil, WMI_DELETE_CIPHER_KEY_CMDID, vif->mid,
			&cmd, sizeof(cmd));
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 2485 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		return -EINVAL;

	if (key)
		memcpy(cmd.key, key, key_len);

	if (mac_addr)
		memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);

	return wmi_send(wil, WMI_ADD_CIPHER_KEY_CMDID, vif->mid,

Reported by FlawFinder.

drivers/net/wireless/atmel/at76c50x-usb.c
20 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 298 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
struct dfu_status {
	unsigned char status;
	unsigned char poll_timeout[3];
	unsigned char state;
	unsigned char string;
} __packed;

static inline int at76_is_intersil(enum board_type board)

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 440 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              			at76_dbg(DBG_DFU, "DFU IDLE");

			bsize = min_t(int, size, FW_BLOCK_SIZE);
			memcpy(block, buf, bsize);
			at76_dbg(DBG_DFU, "int fw, size left = %5d, "
				 "bsize = %4d, blockno = %2d", size, bsize,
				 blockno);
			ret =
			    at76_load_int_fw_block(udev, blockno, block, bsize);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 620 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              					       sizeof(hwcfg->i));
		if (ret < 0)
			goto exit;
		memcpy(priv->mac_addr, hwcfg->i.mac_addr, ETH_ALEN);
		priv->regulatory_domain = hwcfg->i.regulatory_domain;
	} else if (at76_is_503rfmd(priv->board_type)) {
		ret = at76_get_hw_cfg(priv->udev, hwcfg, sizeof(hwcfg->r3));
		if (ret < 0)
			goto exit;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 626 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		ret = at76_get_hw_cfg(priv->udev, hwcfg, sizeof(hwcfg->r3));
		if (ret < 0)
			goto exit;
		memcpy(priv->mac_addr, hwcfg->r3.mac_addr, ETH_ALEN);
		priv->regulatory_domain = hwcfg->r3.regulatory_domain;
	} else {
		ret = at76_get_hw_cfg(priv->udev, hwcfg, sizeof(hwcfg->r5));
		if (ret < 0)
			goto exit;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 632 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		ret = at76_get_hw_cfg(priv->udev, hwcfg, sizeof(hwcfg->r5));
		if (ret < 0)
			goto exit;
		memcpy(priv->mac_addr, hwcfg->r5.mac_addr, ETH_ALEN);
		priv->regulatory_domain = hwcfg->r5.regulatory_domain;
	}

exit:
	kfree(hwcfg);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 733 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	cmd_buf->cmd = cmd;
	cmd_buf->reserved = 0;
	cmd_buf->size = cpu_to_le16(buf_size);
	memcpy(cmd_buf->data, buf, buf_size);

	at76_dbg_dump(DBG_CMD, cmd_buf, sizeof(struct at76_command) + buf_size,
		      "issuing command %s (0x%02x)",
		      at76_get_cmd_string(cmd), cmd);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1283 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	/* for fw >= 0.100, the device needs an extra empty block */
	do {
		bsize = min_t(int, size, FW_BLOCK_SIZE);
		memcpy(block, buf, bsize);
		at76_dbg(DBG_DEVSTART,
			 "ext fw, size left = %5d, bsize = %4d, blockno = %2d",
			 size, bsize, blockno);
		ret = at76_load_ext_fw_block(udev, blockno, block, bsize);
		if (ret != bsize) {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1398 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	ccfg->rts_threshold = cpu_to_le16(priv->rts_threshold);
	ccfg->fragmentation_threshold = cpu_to_le16(priv->frag_threshold);

	memcpy(ccfg->basic_rate_set, hw_rates, 4);
	/* jal: really needed, we do a set_mib for autorate later ??? */
	ccfg->auto_rate_fallback = (priv->txrate == TX_RATE_AUTO ? 1 : 0);
	ccfg->channel = priv->channel;
	ccfg->privacy_invoked = priv->wep_enabled;
	memcpy(ccfg->current_ssid, priv->essid, IW_ESSID_MAX_SIZE);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1403 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	ccfg->auto_rate_fallback = (priv->txrate == TX_RATE_AUTO ? 1 : 0);
	ccfg->channel = priv->channel;
	ccfg->privacy_invoked = priv->wep_enabled;
	memcpy(ccfg->current_ssid, priv->essid, IW_ESSID_MAX_SIZE);
	ccfg->ssid_len = priv->essid_size;

	ccfg->wep_default_key_id = priv->wep_key_id;
	memcpy(ccfg->wep_default_key_value, priv->wep_keys,
	       sizeof(priv->wep_keys));

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1407 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	ccfg->ssid_len = priv->essid_size;

	ccfg->wep_default_key_id = priv->wep_key_id;
	memcpy(ccfg->wep_default_key_value, priv->wep_keys,
	       sizeof(priv->wep_keys));

	ccfg->short_preamble = priv->preamble_type;
	ccfg->beacon_period = cpu_to_le16(priv->beacon_period);

Reported by FlawFinder.