The following issues were found
drivers/edac/xgene_edac.c
3 issues
Line: 865
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
{
struct xgene_edac_pmd_ctx *ctx = edac_dev->pvt_info;
struct dentry *dbgfs_dir;
char name[10];
if (!IS_ENABLED(CONFIG_EDAC_DEBUG) || !ctx->edac->dfs)
return;
snprintf(name, sizeof(name), "PMD%d", ctx->pmd);
Reported by FlawFinder.
Line: 892
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct edac_device_ctl_info *edac_dev;
struct xgene_edac_pmd_ctx *ctx;
struct resource res;
char edac_name[10];
u32 pmd;
int rc;
u32 val;
if (!devres_open_group(edac->dev, xgene_edac_pmd_add, GFP_KERNEL))
Reported by FlawFinder.
Line: 1169
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
{
struct xgene_edac_dev_ctx *ctx = edac_dev->pvt_info;
struct dentry *dbgfs_dir;
char name[10];
if (!IS_ENABLED(CONFIG_EDAC_DEBUG) || !ctx->edac->dfs)
return;
snprintf(name, sizeof(name), "l3c%d", ctx->edac_idx);
Reported by FlawFinder.
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c
3 issues
Line: 33
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (!ctx->seed)
return -ENOMEM;
memcpy(ctx->seed, seed, slen);
ctx->slen = slen;
return 0;
}
Reported by FlawFinder.
Line: 166
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
dma_unmap_single(ss->dev, dma_iv, ctx->slen, DMA_TO_DEVICE);
if (!err) {
memcpy(dst, d, dlen);
/* Update seed */
memcpy(ctx->seed, d + dlen, ctx->slen);
}
memzero_explicit(d, todo);
err_free:
Reported by FlawFinder.
Line: 168
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (!err) {
memcpy(dst, d, dlen);
/* Update seed */
memcpy(ctx->seed, d + dlen, ctx->slen);
}
memzero_explicit(d, todo);
err_free:
kfree(d);
Reported by FlawFinder.
drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
3 issues
Line: 311
Column: 14
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
return ret;
}
static const char *encoder_names[41] = {
"NONE",
"INTERNAL_LVDS",
"INTERNAL_TMDS1",
"INTERNAL_TMDS2",
"INTERNAL_DAC1",
Reported by FlawFinder.
Line: 355
Column: 14
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
"VIRTUAL",
};
static const char *hpd_names[6] = {
"HPD1",
"HPD2",
"HPD3",
"HPD4",
"HPD5",
Reported by FlawFinder.
Line: 1323
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
else
amdgpu_crtc->rmx_type = RMX_OFF;
/* copy native mode */
memcpy(&amdgpu_crtc->native_mode,
&amdgpu_encoder->native_mode,
sizeof(struct drm_display_mode));
src_v = crtc->mode.vdisplay;
dst_v = amdgpu_crtc->native_mode.vdisplay;
src_h = crtc->mode.hdisplay;
Reported by FlawFinder.
drivers/edac/edac_device.h
3 issues
Line: 119
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
/* device block control structure */
struct edac_device_block {
struct edac_device_instance *instance; /* Up Pointer */
char name[EDAC_DEVICE_NAME_LEN + 1];
struct edac_device_counter counters; /* basic UE and CE counters */
int nr_attribs; /* how many attributes */
Reported by FlawFinder.
Line: 135
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
/* device instance control structure */
struct edac_device_instance {
struct edac_device_ctl_info *ctl; /* Up pointer */
char name[EDAC_DEVICE_NAME_LEN + 4];
struct edac_device_counter counters; /* instance counters */
u32 nr_blocks; /* how many blocks */
struct edac_device_block *blocks; /* block array */
Reported by FlawFinder.
Line: 212
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
* cpu/cpu2/...
* ...
*/
char name[EDAC_DEVICE_NAME_LEN + 1];
/* Number of instances supported on this control structure
* and the array of those instances
*/
u32 nr_instances;
Reported by FlawFinder.
drivers/crypto/ux500/cryp/cryp_core.c
3 issues
Line: 968
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
return -EINVAL;
}
memcpy(ctx->key, key, keylen);
ctx->keylen = keylen;
ctx->updated = 0;
return 0;
Reported by FlawFinder.
Line: 988
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (err)
return err;
memcpy(ctx->key, key, keylen);
ctx->keylen = keylen;
ctx->updated = 0;
return 0;
}
Reported by FlawFinder.
Line: 1007
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (err)
return err;
memcpy(ctx->key, key, keylen);
ctx->keylen = keylen;
ctx->updated = 0;
return 0;
}
Reported by FlawFinder.
drivers/comedi/comedi.h
3 issues
Line: 814
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct comedi_devinfo {
unsigned int version_code;
unsigned int n_subdevs;
char driver_name[COMEDI_NAMELEN];
char board_name[COMEDI_NAMELEN];
int read_subdevice;
int write_subdevice;
int unused[30];
};
Reported by FlawFinder.
Line: 815
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
unsigned int version_code;
unsigned int n_subdevs;
char driver_name[COMEDI_NAMELEN];
char board_name[COMEDI_NAMELEN];
int read_subdevice;
int write_subdevice;
int unused[30];
};
Reported by FlawFinder.
Line: 835
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
* handled in a driver-specific manner.
*/
struct comedi_devconfig {
char board_name[COMEDI_NAMELEN];
int options[COMEDI_NDEVCONFOPTS];
};
/**
* struct comedi_bufconfig - used to set or get buffer size for a subdevice
Reported by FlawFinder.
drivers/acpi/acpica/rscreate.c
3 issues
Line: 14
#include "acnamesp.h"
#define _COMPONENT ACPI_RESOURCES
ACPI_MODULE_NAME("rscreate")
/*******************************************************************************
*
* FUNCTION: acpi_buffer_to_resource
*
Reported by Cppcheck.
Line: 327
Column: 5
CWE codes:
120
Suggestion:
Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)
case ACPI_TYPE_STRING:
strcpy(user_prt->source,
obj_desc->string.pointer);
/*
* Add to the Length field the length of the string
* (add 1 for terminator)
Reported by FlawFinder.
Line: 322
Column: 14
CWE codes:
126
/* +1 to include null terminator */
user_prt->length +=
(u32)strlen(user_prt->source) + 1;
break;
case ACPI_TYPE_STRING:
strcpy(user_prt->source,
Reported by FlawFinder.
drivers/firmware/edd.c
3 issues
Line: 250
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (len > (sizeof(info->params)))
len = sizeof(info->params);
memcpy(buf, &info->params, len);
return len;
}
static ssize_t
edd_show_version(struct edd_device *edev, char *buf)
Reported by FlawFinder.
Line: 644
Column: 50
CWE codes:
126
info = edd_dev_get_info(edev);
if (type && info) {
if (!strncmp(info->params.host_bus_type, type, strlen(type)) ||
!strncmp(info->params.interface_type, type, strlen(type)))
return 1;
}
return 0;
}
Reported by FlawFinder.
Line: 645
Column: 51
CWE codes:
126
if (type && info) {
if (!strncmp(info->params.host_bus_type, type, strlen(type)) ||
!strncmp(info->params.interface_type, type, strlen(type)))
return 1;
}
return 0;
}
Reported by FlawFinder.
drivers/char/hw_random/amd-rng.c
3 issues
Line: 74
Column: 9
CWE codes:
120
20
* New random numbers are generated approximately 128 microseconds
* after RNGDATA is read
*/
while (read < max) {
if (ioread32(priv->iobase + RNGDONE) == 0) {
if (wait) {
/* Delay given by datasheet */
usleep_range(128, 196);
if (timeout-- == 0)
Reported by FlawFinder.
Line: 80
Column: 13
CWE codes:
120
20
/* Delay given by datasheet */
usleep_range(128, 196);
if (timeout-- == 0)
return read;
} else {
return 0;
}
} else {
*data = ioread32(priv->iobase + RNGDATA);
Reported by FlawFinder.
drivers/crypto/cavium/cpt/cptvf_reqmanager.c
3 issues
Line: 182
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
((__be16 *)info->in_buffer)[2] = 0;
((__be16 *)info->in_buffer)[3] = 0;
memcpy(&info->in_buffer[8], info->gather_components,
g_sz_bytes);
memcpy(&info->in_buffer[8 + g_sz_bytes],
info->scatter_components, s_sz_bytes);
info->dptr_baddr = dma_map_single(&pdev->dev,
Reported by FlawFinder.
Line: 184
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
memcpy(&info->in_buffer[8], info->gather_components,
g_sz_bytes);
memcpy(&info->in_buffer[8 + g_sz_bytes],
info->scatter_components, s_sz_bytes);
info->dptr_baddr = dma_map_single(&pdev->dev,
(void *)info->in_buffer,
info->dlen,
Reported by FlawFinder.
Line: 244
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
/* lock commad queue */
spin_lock(&queue->lock);
ent = &queue->qhead->head[queue->idx * qinfo->cmd_size];
memcpy(ent, (void *)cmd, qinfo->cmd_size);
if (++queue->idx >= queue->qhead->size / 64) {
hlist_for_each_entry(chunk, &queue->chead, nextchunk) {
if (chunk == queue->qhead) {
continue;
Reported by FlawFinder.