The following issues were found

drivers/crypto/chelsio/chcr_algo.c
75 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 318 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		error = crypto_shash_init(desc) ?:
			crypto_shash_update(desc, iopad, SHA1_BLOCK_SIZE) ?:
			crypto_shash_export(desc, (void *)&sha1_st);
		memcpy(result_hash, sha1_st.state, SHA1_DIGEST_SIZE);
	} else if (digest_size == SHA224_DIGEST_SIZE) {
		error = crypto_shash_init(desc) ?:
			crypto_shash_update(desc, iopad, SHA256_BLOCK_SIZE) ?:
			crypto_shash_export(desc, (void *)&sha256_st);
		memcpy(result_hash, sha256_st.state, SHA256_DIGEST_SIZE);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 323 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		error = crypto_shash_init(desc) ?:
			crypto_shash_update(desc, iopad, SHA256_BLOCK_SIZE) ?:
			crypto_shash_export(desc, (void *)&sha256_st);
		memcpy(result_hash, sha256_st.state, SHA256_DIGEST_SIZE);

	} else if (digest_size == SHA256_DIGEST_SIZE) {
		error = crypto_shash_init(desc) ?:
			crypto_shash_update(desc, iopad, SHA256_BLOCK_SIZE) ?:
			crypto_shash_export(desc, (void *)&sha256_st);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 329 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		error = crypto_shash_init(desc) ?:
			crypto_shash_update(desc, iopad, SHA256_BLOCK_SIZE) ?:
			crypto_shash_export(desc, (void *)&sha256_st);
		memcpy(result_hash, sha256_st.state, SHA256_DIGEST_SIZE);

	} else if (digest_size == SHA384_DIGEST_SIZE) {
		error = crypto_shash_init(desc) ?:
			crypto_shash_update(desc, iopad, SHA512_BLOCK_SIZE) ?:
			crypto_shash_export(desc, (void *)&sha512_st);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 335 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		error = crypto_shash_init(desc) ?:
			crypto_shash_update(desc, iopad, SHA512_BLOCK_SIZE) ?:
			crypto_shash_export(desc, (void *)&sha512_st);
		memcpy(result_hash, sha512_st.state, SHA512_DIGEST_SIZE);

	} else if (digest_size == SHA512_DIGEST_SIZE) {
		error = crypto_shash_init(desc) ?:
			crypto_shash_update(desc, iopad, SHA512_BLOCK_SIZE) ?:
			crypto_shash_export(desc, (void *)&sha512_st);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 341 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		error = crypto_shash_init(desc) ?:
			crypto_shash_update(desc, iopad, SHA512_BLOCK_SIZE) ?:
			crypto_shash_export(desc, (void *)&sha512_st);
		memcpy(result_hash, sha512_st.state, SHA512_DIGEST_SIZE);
	} else {
		error = -EINVAL;
		pr_err("Unknown digest size %d\n", digest_size);
	}
	return error;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 597 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              			       struct _key_ctx *key_ctx)
{
	if (ablkctx->ciph_mode == CHCR_SCMD_CIPHER_MODE_AES_CBC) {
		memcpy(key_ctx->key, ablkctx->rrkey, ablkctx->enckey_len);
	} else {
		memcpy(key_ctx->key,
		       ablkctx->key + (ablkctx->enckey_len >> 1),
		       ablkctx->enckey_len >> 1);
		memcpy(key_ctx->key + (ablkctx->enckey_len >> 1),

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 599 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	if (ablkctx->ciph_mode == CHCR_SCMD_CIPHER_MODE_AES_CBC) {
		memcpy(key_ctx->key, ablkctx->rrkey, ablkctx->enckey_len);
	} else {
		memcpy(key_ctx->key,
		       ablkctx->key + (ablkctx->enckey_len >> 1),
		       ablkctx->enckey_len >> 1);
		memcpy(key_ctx->key + (ablkctx->enckey_len >> 1),
		       ablkctx->rrkey, ablkctx->enckey_len >> 1);
	}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 602 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		memcpy(key_ctx->key,
		       ablkctx->key + (ablkctx->enckey_len >> 1),
		       ablkctx->enckey_len >> 1);
		memcpy(key_ctx->key + (ablkctx->enckey_len >> 1),
		       ablkctx->rrkey, ablkctx->enckey_len >> 1);
	}
	return 0;
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 862 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	} else {
		if ((ablkctx->ciph_mode == CHCR_SCMD_CIPHER_MODE_AES_CBC) ||
		    (ablkctx->ciph_mode == CHCR_SCMD_CIPHER_MODE_AES_CTR)) {
			memcpy(chcr_req->key_ctx.key, ablkctx->key,
			       ablkctx->enckey_len);
		} else {
			memcpy(chcr_req->key_ctx.key, ablkctx->key +
			       (ablkctx->enckey_len >> 1),
			       ablkctx->enckey_len >> 1);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 865 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              			memcpy(chcr_req->key_ctx.key, ablkctx->key,
			       ablkctx->enckey_len);
		} else {
			memcpy(chcr_req->key_ctx.key, ablkctx->key +
			       (ablkctx->enckey_len >> 1),
			       ablkctx->enckey_len >> 1);
			memcpy(chcr_req->key_ctx.key +
			       (ablkctx->enckey_len >> 1),
			       ablkctx->key,

Reported by FlawFinder.

tools/perf/scripts/python/syscall-counts-by-pid.py
75 issues
Unable to import 'perf_trace_context'
Error

Line: 15 Column: 1 

              sys.path.append(os.environ['PERF_EXEC_PATH'] + \
	'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')

from perf_trace_context import *
from Core import *
from Util import syscall_name

usage = "perf script -s syscall-counts-by-pid.py [comm]\n";

Reported by Pylint.

Unable to import 'Core'
Error

Line: 16 Column: 1 

              	'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')

from perf_trace_context import *
from Core import *
from Util import syscall_name

usage = "perf script -s syscall-counts-by-pid.py [comm]\n";

for_comm = None

Reported by Pylint.

Unable to import 'Util'
Error

Line: 17 Column: 1 

              
from perf_trace_context import *
from Core import *
from Util import syscall_name

usage = "perf script -s syscall-counts-by-pid.py [comm]\n";

for_comm = None
for_pid = None

Reported by Pylint.

Undefined variable 'autodict'
Error

Line: 33 Column: 12 

              	except:
		for_comm = sys.argv[1]

syscalls = autodict()

def trace_begin():
	print("Press control+C to stop and show the summary")

def trace_end():

Reported by Pylint.

Wildcard import perf_trace_context
Error

Line: 15 Column: 1 

              sys.path.append(os.environ['PERF_EXEC_PATH'] + \
	'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')

from perf_trace_context import *
from Core import *
from Util import syscall_name

usage = "perf script -s syscall-counts-by-pid.py [comm]\n";

Reported by Pylint.

Wildcard import Core
Error

Line: 16 Column: 1 

              	'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')

from perf_trace_context import *
from Core import *
from Util import syscall_name

usage = "perf script -s syscall-counts-by-pid.py [comm]\n";

for_comm = None

Reported by Pylint.

Unnecessary semicolon
Error

Line: 19 Column: 1 

              from Core import *
from Util import syscall_name

usage = "perf script -s syscall-counts-by-pid.py [comm]\n";

for_comm = None
for_pid = None

if len(sys.argv) > 2:

Reported by Pylint.

No exception type(s) specified
Error

Line: 30 Column: 2 

              if len(sys.argv) > 1:
	try:
		for_pid = int(sys.argv[1])
	except:
		for_comm = sys.argv[1]

syscalls = autodict()

def trace_begin():

Reported by Pylint.

Unused argument 'event_name'
Error

Line: 41 Column: 29 

              def trace_end():
	print_syscall_totals()

def raw_syscalls__sys_enter(event_name, context, common_cpu,
		common_secs, common_nsecs, common_pid, common_comm,
		common_callchain, id, args):
	if (for_comm and common_comm != for_comm) or \
		(for_pid and common_pid != for_pid ):
		return

Reported by Pylint.

Unused argument 'common_cpu'
Error

Line: 41 Column: 50 

              def trace_end():
	print_syscall_totals()

def raw_syscalls__sys_enter(event_name, context, common_cpu,
		common_secs, common_nsecs, common_pid, common_comm,
		common_callchain, id, args):
	if (for_comm and common_comm != for_comm) or \
		(for_pid and common_pid != for_pid ):
		return

Reported by Pylint.

tools/testing/selftests/net/ipsec.c
74 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 2329 Column: 3 CWE codes: 134
Suggestion: Use a constant for the format specification 

              	for (i = 0; i < nr_process; i++) {
		char veth[VETH_LEN];

		snprintf(veth, VETH_LEN, VETH_FMT, i);

		if (veth_add(route_sock, route_seq++, veth, nsfd_childa, veth, nsfd_childb)) {
			close(route_sock);
			ksft_exit_fail_msg("Failed to create veth device");
		}

Reported by FlawFinder.

Possible null pointer dereference: payload
Error

Line: 192 CWE codes: 476 

              
	attr->rta_len = RTA_LENGTH(size);
	attr->rta_type = rta_type;
	memcpy(RTA_DATA(attr), payload, size);

	return 0;
}

static struct rtattr *_rtattr_begin(struct nlmsghdr *nh, size_t req_sz,

Reported by Cppcheck.

srand - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 2309 Column: 2 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values 

              		}
	}

	srand(time(NULL));
	page_size = sysconf(_SC_PAGESIZE);
	if (page_size < 1)
		ksft_exit_skip("sysconf(): %m\n");

	if (pipe2(test_desc_fd, O_DIRECT) < 0)

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 94 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	if (leftover) {
		int tmp = rand();

		memcpy(buf + buflen - leftover, &tmp, leftover);
	}

	return;
}

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 110 Column: 7 CWE codes: 362 

              		return -1;
	}

	fd = open(netns_path, O_RDONLY);
	if (fd <= 0) {
		pr_err("open(%s)", netns_path);
		return -1;
	}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 192 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
	attr->rta_len = RTA_LENGTH(size);
	attr->rta_type = rta_type;
	memcpy(RTA_DATA(attr), payload, size);

	return 0;
}

static struct rtattr *_rtattr_begin(struct nlmsghdr *nh, size_t req_sz,

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 276 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	struct {
		struct nlmsghdr		nh;
		struct ifinfomsg	info;
		char			attrbuf[MAX_PAYLOAD];
	} req;
	const char veth_type[] = "veth";
	struct rtattr *link_info, *info_data;

	memset(&req, 0, sizeof(req));

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 326 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	struct {
		struct nlmsghdr		nh;
		struct ifaddrmsg	info;
		char			attrbuf[MAX_PAYLOAD];
	} req;

	memset(&req, 0, sizeof(req));
	req.nh.nlmsg_len	= NLMSG_LENGTH(sizeof(req.info));
	req.nh.nlmsg_type	= RTM_NEWADDR;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 340 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
#ifdef DEBUG
	{
		char addr_str[IPV4_STR_SZ] = {};

		strncpy(addr_str, inet_ntoa(addr), IPV4_STR_SZ - 1);

		printk("ip addr set %s", addr_str);
	}

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 366 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	struct {
		struct nlmsghdr		nh;
		struct ifinfomsg	info;
		char			attrbuf[MAX_PAYLOAD];
	} req;

	memset(&req, 0, sizeof(req));
	req.nh.nlmsg_len	= NLMSG_LENGTH(sizeof(req.info));
	req.nh.nlmsg_type	= RTM_NEWLINK;

Reported by FlawFinder.

tools/testing/kunit/kunit_config.py
74 issues
Missing module docstring
Error

Line: 1 Column: 1 

              # SPDX-License-Identifier: GPL-2.0
#
# Builds a .config from a kunitconfig.
#
# Copyright (C) 2019, Google LLC.
# Author: Felix Guo <felixguoxiuping@gmail.com>
# Author: Brendan Higgins <brendanhiggins@google.com>

import collections

Reported by Pylint.

Missing class docstring
Error

Line: 18 Column: 1 

              
KconfigEntryBase = collections.namedtuple('KconfigEntryBase', ['name', 'value'])

class KconfigEntry(KconfigEntryBase):

	def __str__(self) -> str:
		if self.value == 'n':
			return r'# CONFIG_%s is not set' % (self.name)
		else:

Reported by Pylint.

Bad indentation. Found 1 spaces, expected 4
Style

Line: 20 Column: 1 

              
class KconfigEntry(KconfigEntryBase):

	def __str__(self) -> str:
		if self.value == 'n':
			return r'# CONFIG_%s is not set' % (self.name)
		else:
			return r'CONFIG_%s=%s' % (self.name, self.value)

Reported by Pylint.

Bad indentation. Found 2 spaces, expected 8
Style

Line: 21 Column: 1 

              class KconfigEntry(KconfigEntryBase):

	def __str__(self) -> str:
		if self.value == 'n':
			return r'# CONFIG_%s is not set' % (self.name)
		else:
			return r'CONFIG_%s=%s' % (self.name, self.value)

Reported by Pylint.

Unnecessary "else" after "return"
Error

Line: 21 Column: 3 

              class KconfigEntry(KconfigEntryBase):

	def __str__(self) -> str:
		if self.value == 'n':
			return r'# CONFIG_%s is not set' % (self.name)
		else:
			return r'CONFIG_%s=%s' % (self.name, self.value)

Reported by Pylint.

Bad indentation. Found 3 spaces, expected 12
Style

Line: 22 Column: 1 

              
	def __str__(self) -> str:
		if self.value == 'n':
			return r'# CONFIG_%s is not set' % (self.name)
		else:
			return r'CONFIG_%s=%s' % (self.name, self.value)


class KconfigParseError(Exception):

Reported by Pylint.

Bad indentation. Found 2 spaces, expected 8
Style

Line: 23 Column: 1 

              	def __str__(self) -> str:
		if self.value == 'n':
			return r'# CONFIG_%s is not set' % (self.name)
		else:
			return r'CONFIG_%s=%s' % (self.name, self.value)


class KconfigParseError(Exception):
	"""Error parsing Kconfig defconfig or .config."""

Reported by Pylint.

Bad indentation. Found 3 spaces, expected 12
Style

Line: 24 Column: 1 

              		if self.value == 'n':
			return r'# CONFIG_%s is not set' % (self.name)
		else:
			return r'CONFIG_%s=%s' % (self.name, self.value)


class KconfigParseError(Exception):
	"""Error parsing Kconfig defconfig or .config."""

Reported by Pylint.

Bad indentation. Found 1 spaces, expected 4
Style

Line: 28 Column: 1 

              

class KconfigParseError(Exception):
	"""Error parsing Kconfig defconfig or .config."""


class Kconfig(object):
	"""Represents defconfig or .config specified using the Kconfig language."""

Reported by Pylint.

Class 'Kconfig' inherits from object, can be safely removed from bases in python3
Error

Line: 31 Column: 1 

              	"""Error parsing Kconfig defconfig or .config."""


class Kconfig(object):
	"""Represents defconfig or .config specified using the Kconfig language."""

	def __init__(self) -> None:
		self._entries = []  # type: List[KconfigEntry]

Reported by Pylint.

drivers/staging/rtl8712/rtl871x_ioctl_linux.c
73 issues
crypt - The crypt functions use a poor one-way hashing algorithm; since they only accept passwords of 8 characters or fewer and only a two-byte salt, they are excessively vulnerable to dictionary attacks given today's faster computing equipment
Security

Line: 81 Column: 41 CWE codes: 327
Suggestion: Use a different algorithm, such as SHA-256, with a larger, non-repeating salt 

              				       struct _adapter *padapter)
{
	/* pairwise key */
	memcpy(psta->x_UncstKey.skey, param->u.crypt.key,
	       (param->u.crypt. key_len > 16 ? 16 : param->u.crypt.key_len));
	if (strcmp(param->u.crypt.alg, "TKIP") == 0) { /* set mic key */
		memcpy(psta->tkiptxmickey. skey,
		       &(param->u.crypt.key[16]), 8);
		memcpy(psta->tkiprxmickey. skey,

Reported by FlawFinder.

crypt - The crypt functions use a poor one-way hashing algorithm; since they only accept passwords of 8 characters or fewer and only a two-byte salt, they are excessively vulnerable to dictionary attacks given today's faster computing equipment
Security

Line: 82 Column: 19 CWE codes: 327
Suggestion: Use a different algorithm, such as SHA-256, with a larger, non-repeating salt 

              {
	/* pairwise key */
	memcpy(psta->x_UncstKey.skey, param->u.crypt.key,
	       (param->u.crypt. key_len > 16 ? 16 : param->u.crypt.key_len));
	if (strcmp(param->u.crypt.alg, "TKIP") == 0) { /* set mic key */
		memcpy(psta->tkiptxmickey. skey,
		       &(param->u.crypt.key[16]), 8);
		memcpy(psta->tkiprxmickey. skey,
		       &(param->u.crypt.key[24]), 8);

Reported by FlawFinder.

crypt - The crypt functions use a poor one-way hashing algorithm; since they only accept passwords of 8 characters or fewer and only a two-byte salt, they are excessively vulnerable to dictionary attacks given today's faster computing equipment
Security

Line: 82 Column: 55 CWE codes: 327
Suggestion: Use a different algorithm, such as SHA-256, with a larger, non-repeating salt 

              {
	/* pairwise key */
	memcpy(psta->x_UncstKey.skey, param->u.crypt.key,
	       (param->u.crypt. key_len > 16 ? 16 : param->u.crypt.key_len));
	if (strcmp(param->u.crypt.alg, "TKIP") == 0) { /* set mic key */
		memcpy(psta->tkiptxmickey. skey,
		       &(param->u.crypt.key[16]), 8);
		memcpy(psta->tkiprxmickey. skey,
		       &(param->u.crypt.key[24]), 8);

Reported by FlawFinder.

crypt - The crypt functions use a poor one-way hashing algorithm; since they only accept passwords of 8 characters or fewer and only a two-byte salt, they are excessively vulnerable to dictionary attacks given today's faster computing equipment
Security

Line: 83 Column: 22 CWE codes: 327
Suggestion: Use a different algorithm, such as SHA-256, with a larger, non-repeating salt 

              	/* pairwise key */
	memcpy(psta->x_UncstKey.skey, param->u.crypt.key,
	       (param->u.crypt. key_len > 16 ? 16 : param->u.crypt.key_len));
	if (strcmp(param->u.crypt.alg, "TKIP") == 0) { /* set mic key */
		memcpy(psta->tkiptxmickey. skey,
		       &(param->u.crypt.key[16]), 8);
		memcpy(psta->tkiprxmickey. skey,
		       &(param->u.crypt.key[24]), 8);
		padapter->securitypriv. busetkipkey = false;

Reported by FlawFinder.

crypt - The crypt functions use a poor one-way hashing algorithm; since they only accept passwords of 8 characters or fewer and only a two-byte salt, they are excessively vulnerable to dictionary attacks given today's faster computing equipment
Security

Line: 85 Column: 21 CWE codes: 327
Suggestion: Use a different algorithm, such as SHA-256, with a larger, non-repeating salt 

              	       (param->u.crypt. key_len > 16 ? 16 : param->u.crypt.key_len));
	if (strcmp(param->u.crypt.alg, "TKIP") == 0) { /* set mic key */
		memcpy(psta->tkiptxmickey. skey,
		       &(param->u.crypt.key[16]), 8);
		memcpy(psta->tkiprxmickey. skey,
		       &(param->u.crypt.key[24]), 8);
		padapter->securitypriv. busetkipkey = false;
		mod_timer(&padapter->securitypriv.tkip_timer,
			  jiffies + msecs_to_jiffies(50));

Reported by FlawFinder.

crypt - The crypt functions use a poor one-way hashing algorithm; since they only accept passwords of 8 characters or fewer and only a two-byte salt, they are excessively vulnerable to dictionary attacks given today's faster computing equipment
Security

Line: 87 Column: 21 CWE codes: 327
Suggestion: Use a different algorithm, such as SHA-256, with a larger, non-repeating salt 

              		memcpy(psta->tkiptxmickey. skey,
		       &(param->u.crypt.key[16]), 8);
		memcpy(psta->tkiprxmickey. skey,
		       &(param->u.crypt.key[24]), 8);
		padapter->securitypriv. busetkipkey = false;
		mod_timer(&padapter->securitypriv.tkip_timer,
			  jiffies + msecs_to_jiffies(50));
	}
	r8712_setstakey_cmd(padapter, (unsigned char *)psta, true);

Reported by FlawFinder.

crypt - The crypt functions use a poor one-way hashing algorithm; since they only accept passwords of 8 characters or fewer and only a two-byte salt, they are excessively vulnerable to dictionary attacks given today's faster computing equipment
Security

Line: 102 Column: 15 CWE codes: 327
Suggestion: Use a different algorithm, such as SHA-256, with a larger, non-repeating salt 

              	union Keytype *gtk = padapter->securitypriv.XGrptxmickey;
	union Keytype *grk = padapter->securitypriv.XGrprxmickey;

	if (param->u.crypt.idx > 0 &&
	    param->u.crypt.idx < 3) {
		/* group key idx is 1 or 2 */
		memcpy(gk[param->u.crypt.idx - 1].skey,
		       param->u.crypt.key,
		       (param->u.crypt.key_len > 16 ? 16 :

Reported by FlawFinder.

crypt - The crypt functions use a poor one-way hashing algorithm; since they only accept passwords of 8 characters or fewer and only a two-byte salt, they are excessively vulnerable to dictionary attacks given today's faster computing equipment
Security

Line: 103 Column: 15 CWE codes: 327
Suggestion: Use a different algorithm, such as SHA-256, with a larger, non-repeating salt 

              	union Keytype *grk = padapter->securitypriv.XGrprxmickey;

	if (param->u.crypt.idx > 0 &&
	    param->u.crypt.idx < 3) {
		/* group key idx is 1 or 2 */
		memcpy(gk[param->u.crypt.idx - 1].skey,
		       param->u.crypt.key,
		       (param->u.crypt.key_len > 16 ? 16 :
			param->u.crypt.key_len));

Reported by FlawFinder.

crypt - The crypt functions use a poor one-way hashing algorithm; since they only accept passwords of 8 characters or fewer and only a two-byte salt, they are excessively vulnerable to dictionary attacks given today's faster computing equipment
Security

Line: 105 Column: 22 CWE codes: 327
Suggestion: Use a different algorithm, such as SHA-256, with a larger, non-repeating salt 

              	if (param->u.crypt.idx > 0 &&
	    param->u.crypt.idx < 3) {
		/* group key idx is 1 or 2 */
		memcpy(gk[param->u.crypt.idx - 1].skey,
		       param->u.crypt.key,
		       (param->u.crypt.key_len > 16 ? 16 :
			param->u.crypt.key_len));
		memcpy(gtk[param->u.crypt.idx - 1].skey,
		       &param->u.crypt.key[16], 8);

Reported by FlawFinder.

crypt - The crypt functions use a poor one-way hashing algorithm; since they only accept passwords of 8 characters or fewer and only a two-byte salt, they are excessively vulnerable to dictionary attacks given today's faster computing equipment
Security

Line: 106 Column: 19 CWE codes: 327
Suggestion: Use a different algorithm, such as SHA-256, with a larger, non-repeating salt 

              	    param->u.crypt.idx < 3) {
		/* group key idx is 1 or 2 */
		memcpy(gk[param->u.crypt.idx - 1].skey,
		       param->u.crypt.key,
		       (param->u.crypt.key_len > 16 ? 16 :
			param->u.crypt.key_len));
		memcpy(gtk[param->u.crypt.idx - 1].skey,
		       &param->u.crypt.key[16], 8);
		memcpy(grk[param->u.crypt.idx - 1].skey,

Reported by FlawFinder.

tools/testing/selftests/powerpc/ptrace/ptrace.h
73 issues
Memory leak: regs
Error

Line: 486 CWE codes: 401 

              	ret = ptrace(PTRACE_GETREGSET, child, NT_PPC_TM_CGPR, &iov);
	if (ret) {
		perror("ptrace(PTRACE_GETREGSET) failed");
		return TEST_FAIL;
	}

	if (gpr) {
		for (i = 14; i < 32; i++)
			gpr[i-14] = regs->gpr[i];

Reported by Cppcheck.

Memory leak: regs
Error

Line: 486 CWE codes: 401 

              	ret = ptrace(PTRACE_GETREGSET, child, NT_PPC_TM_CGPR, &iov);
	if (ret) {
		perror("ptrace(PTRACE_GETREGSET) failed");
		return TEST_FAIL;
	}

	if (gpr) {
		for (i = 14; i < 32; i++)
			gpr[i-14] = regs->gpr[i];

Reported by Cppcheck.

Memory leak: regs
Error

Line: 486 CWE codes: 401 

              	ret = ptrace(PTRACE_GETREGSET, child, NT_PPC_TM_CGPR, &iov);
	if (ret) {
		perror("ptrace(PTRACE_GETREGSET) failed");
		return TEST_FAIL;
	}

	if (gpr) {
		for (i = 14; i < 32; i++)
			gpr[i-14] = regs->gpr[i];

Reported by Cppcheck.

Memory leak: regs
Error

Line: 486 CWE codes: 401 

              	ret = ptrace(PTRACE_GETREGSET, child, NT_PPC_TM_CGPR, &iov);
	if (ret) {
		perror("ptrace(PTRACE_GETREGSET) failed");
		return TEST_FAIL;
	}

	if (gpr) {
		for (i = 14; i < 32; i++)
			gpr[i-14] = regs->gpr[i];

Reported by Cppcheck.

Memory leak: regs
Error

Line: 486 CWE codes: 401 

              	ret = ptrace(PTRACE_GETREGSET, child, NT_PPC_TM_CGPR, &iov);
	if (ret) {
		perror("ptrace(PTRACE_GETREGSET) failed");
		return TEST_FAIL;
	}

	if (gpr) {
		for (i = 14; i < 32; i++)
			gpr[i-14] = regs->gpr[i];

Reported by Cppcheck.

Memory leak: regs
Error

Line: 486 CWE codes: 401 

              	ret = ptrace(PTRACE_GETREGSET, child, NT_PPC_TM_CGPR, &iov);
	if (ret) {
		perror("ptrace(PTRACE_GETREGSET) failed");
		return TEST_FAIL;
	}

	if (gpr) {
		for (i = 14; i < 32; i++)
			gpr[i-14] = regs->gpr[i];

Reported by Cppcheck.

Memory leak: regs
Error

Line: 486 CWE codes: 401 

              	ret = ptrace(PTRACE_GETREGSET, child, NT_PPC_TM_CGPR, &iov);
	if (ret) {
		perror("ptrace(PTRACE_GETREGSET) failed");
		return TEST_FAIL;
	}

	if (gpr) {
		for (i = 14; i < 32; i++)
			gpr[i-14] = regs->gpr[i];

Reported by Cppcheck.

Memory leak: regs
Error

Line: 486 CWE codes: 401 

              	ret = ptrace(PTRACE_GETREGSET, child, NT_PPC_TM_CGPR, &iov);
	if (ret) {
		perror("ptrace(PTRACE_GETREGSET) failed");
		return TEST_FAIL;
	}

	if (gpr) {
		for (i = 14; i < 32; i++)
			gpr[i-14] = regs->gpr[i];

Reported by Cppcheck.

Memory leak: regs
Error

Line: 486 CWE codes: 401 

              	ret = ptrace(PTRACE_GETREGSET, child, NT_PPC_TM_CGPR, &iov);
	if (ret) {
		perror("ptrace(PTRACE_GETREGSET) failed");
		return TEST_FAIL;
	}

	if (gpr) {
		for (i = 14; i < 32; i++)
			gpr[i-14] = regs->gpr[i];

Reported by Cppcheck.

Memory leak: regs
Error

Line: 486 CWE codes: 401 

              	ret = ptrace(PTRACE_GETREGSET, child, NT_PPC_TM_CGPR, &iov);
	if (ret) {
		perror("ptrace(PTRACE_GETREGSET) failed");
		return TEST_FAIL;
	}

	if (gpr) {
		for (i = 14; i < 32; i++)
			gpr[i-14] = regs->gpr[i];

Reported by Cppcheck.

kernel/trace/trace_events.c
73 issues
system - This causes a new program to execute and is difficult to use safely
Security

Line: 48 Column: 59 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              static struct kmem_cache *field_cachep;
static struct kmem_cache *file_cachep;

static inline int system_refcount(struct event_subsystem *system)
{
	return system->ref_count;
}

static int system_refcount_inc(struct event_subsystem *system)

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 53 Column: 56 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              	return system->ref_count;
}

static int system_refcount_inc(struct event_subsystem *system)
{
	return system->ref_count++;
}

static int system_refcount_dec(struct event_subsystem *system)

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 58 Column: 56 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              	return system->ref_count++;
}

static int system_refcount_dec(struct event_subsystem *system)
{
	return --system->ref_count;
}

/* Double loops, do not use break, only goto's work */

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 900 Column: 50 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              	mutex_unlock(&event_mutex);
}

static void __put_system(struct event_subsystem *system)
{
	struct event_filter *filter = system->filter;

	WARN_ON_ONCE(system_refcount(system) == 0);
	if (system_refcount_dec(system))

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 904 Column: 31 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              {
	struct event_filter *filter = system->filter;

	WARN_ON_ONCE(system_refcount(system) == 0);
	if (system_refcount_dec(system))
		return;

	list_del(&system->list);

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 905 Column: 26 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              	struct event_filter *filter = system->filter;

	WARN_ON_ONCE(system_refcount(system) == 0);
	if (system_refcount_dec(system))
		return;

	list_del(&system->list);

	if (filter) {

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 915 Column: 8 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              		kfree(filter);
	}
	kfree_const(system->name);
	kfree(system);
}

static void __get_system(struct event_subsystem *system)
{
	WARN_ON_ONCE(system_refcount(system) == 0);

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 918 Column: 50 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              	kfree(system);
}

static void __get_system(struct event_subsystem *system)
{
	WARN_ON_ONCE(system_refcount(system) == 0);
	system_refcount_inc(system);
}

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 920 Column: 31 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              
static void __get_system(struct event_subsystem *system)
{
	WARN_ON_ONCE(system_refcount(system) == 0);
	system_refcount_inc(system);
}

static void __get_system_dir(struct trace_subsystem_dir *dir)
{

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 921 Column: 22 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              static void __get_system(struct event_subsystem *system)
{
	WARN_ON_ONCE(system_refcount(system) == 0);
	system_refcount_inc(system);
}

static void __get_system_dir(struct trace_subsystem_dir *dir)
{
	WARN_ON_ONCE(dir->ref_count == 0);

Reported by FlawFinder.

tools/perf/scripts/python/net_dropmonitor.py
73 issues
Unable to import 'perf_trace_context'
Error

Line: 12 Column: 1 

              sys.path.append(os.environ['PERF_EXEC_PATH'] + \
	'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')

from perf_trace_context import *
from Core import *
from Util import *

drop_log = {}
kallsyms = []

Reported by Pylint.

Unable to import 'Core'
Error

Line: 13 Column: 1 

              	'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')

from perf_trace_context import *
from Core import *
from Util import *

drop_log = {}
kallsyms = []

Reported by Pylint.

Unable to import 'Util'
Error

Line: 14 Column: 1 

              
from perf_trace_context import *
from Core import *
from Util import *

drop_log = {}
kallsyms = []

def get_kallsyms_table():

Reported by Pylint.

Wildcard import perf_trace_context
Error

Line: 12 Column: 1 

              sys.path.append(os.environ['PERF_EXEC_PATH'] + \
	'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')

from perf_trace_context import *
from Core import *
from Util import *

drop_log = {}
kallsyms = []

Reported by Pylint.

Wildcard import Core
Error

Line: 13 Column: 1 

              	'/scripts/python/Perf-Trace-Util/lib/Perf/Trace')

from perf_trace_context import *
from Core import *
from Util import *

drop_log = {}
kallsyms = []

Reported by Pylint.

Wildcard import Util
Error

Line: 14 Column: 1 

              
from perf_trace_context import *
from Core import *
from Util import *

drop_log = {}
kallsyms = []

def get_kallsyms_table():

Reported by Pylint.

Using the global statement
Error

Line: 20 Column: 2 

              kallsyms = []

def get_kallsyms_table():
	global kallsyms

	try:
		f = open("/proc/kallsyms", "r")
	except:
		return

Reported by Pylint.

No exception type(s) specified
Error

Line: 24 Column: 2 

              
	try:
		f = open("/proc/kallsyms", "r")
	except:
		return

	for line in f:
		loc = int(line.split()[0], 16)
		name = line.split()[2]

Reported by Pylint.

Unused argument 'context'
Error

Line: 72 Column: 26 

              	print_drop_table()

# called from perf, when it finds a correspoinding event
def skb__kfree_skb(name, context, cpu, sec, nsec, pid, comm, callchain,
		   skbaddr, location, protocol):
	slocation = str(location)
	try:
		drop_log[slocation] = drop_log[slocation] + 1
	except:

Reported by Pylint.

Unused argument 'callchain'
Error

Line: 72 Column: 62 

              	print_drop_table()

# called from perf, when it finds a correspoinding event
def skb__kfree_skb(name, context, cpu, sec, nsec, pid, comm, callchain,
		   skbaddr, location, protocol):
	slocation = str(location)
	try:
		drop_log[slocation] = drop_log[slocation] + 1
	except:

Reported by Pylint.

drivers/scsi/lpfc/lpfc_attr.c
73 issues
sprintf - Does not check for buffer overflows
Security

Line: 4331 Column: 2 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              		break;
	}

	sprintf(&buf[index], "Statistical Data enabled :%d, "
		"blocked :%d, Bucket type :%s, Bucket base :%d,"
		" Bucket step :%d\nLatency Ranges :",
		vport->stat_data_enabled, vport->stat_data_blocked,
		bucket_type, phba->bucket_base, phba->bucket_step);
	index = strlen(buf);

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 171 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	char *statep;
	int i;
	int len = 0;
	char tmp[LPFC_MAX_NVME_INFO_TMP_LEN] = {0};

	if (!(vport->cfg_enable_fc4_type & LPFC_ENABLE_NVME)) {
		len = scnprintf(buf, PAGE_SIZE, "NVME Disabled\n");
		return len;
	}

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 535 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	u64 data1, data2, data3;
	u64 tot, totin, totout;
	int i;
	char tmp[LPFC_MAX_SCSI_INFO_TMP_LEN] = {0};

	if (!(vport->cfg_enable_fc4_type & LPFC_ENABLE_FCP) ||
	    (phba->sli_rev != LPFC_SLI_REV4))
		return 0;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 800 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	struct lpfc_hba   *phba = vport->phba;
	uint32_t if_type;
	uint8_t sli_family;
	char fwrev[FW_REV_STR_SIZE];
	int len;

	lpfc_decode_firmware_rev(phba, fwrev, 1);
	if_type = phba->sli4_hba.pc_sli4_params.if_type;
	sli_family = phba->sli4_hba.pc_sli4_params.sli_family;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 828 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              static ssize_t
lpfc_hdw_show(struct device *dev, struct device_attribute *attr, char *buf)
{
	char hdw[9];
	struct Scsi_Host  *shost = class_to_shost(dev);
	struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
	struct lpfc_hba   *phba = vport->phba;
	lpfc_vpd_t *vp = &phba->vpd;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 854 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	struct Scsi_Host  *shost = class_to_shost(dev);
	struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
	struct lpfc_hba   *phba = vport->phba;
	char fwrev[FW_REV_STR_SIZE];

	if (phba->sli_rev < LPFC_SLI_REV4)
		return scnprintf(buf, PAGE_SIZE, "%s\n",
				phba->OptionROMVersion);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 2968 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	if (rc)
		return rc;

	memcpy(phba->cfg_oas_tgt_wwpn, wwpn, (8 * sizeof(uint8_t)));
	memcpy(phba->sli4_hba.oas_next_tgt_wwpn, wwpn, (8 * sizeof(uint8_t)));
	if (wwn_to_u64(wwpn) == 0)
		phba->cfg_oas_flags |= OAS_FIND_ANY_TARGET;
	else
		phba->cfg_oas_flags &= ~OAS_FIND_ANY_TARGET;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 2969 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		return rc;

	memcpy(phba->cfg_oas_tgt_wwpn, wwpn, (8 * sizeof(uint8_t)));
	memcpy(phba->sli4_hba.oas_next_tgt_wwpn, wwpn, (8 * sizeof(uint8_t)));
	if (wwn_to_u64(wwpn) == 0)
		phba->cfg_oas_flags |= OAS_FIND_ANY_TARGET;
	else
		phba->cfg_oas_flags &= ~OAS_FIND_ANY_TARGET;
	phba->cfg_oas_flags &= ~OAS_LUN_VALID;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 3099 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	if (rc)
		return rc;

	memcpy(phba->cfg_oas_vpt_wwpn, wwpn, (8 * sizeof(uint8_t)));
	memcpy(phba->sli4_hba.oas_next_vpt_wwpn, wwpn, (8 * sizeof(uint8_t)));
	if (wwn_to_u64(wwpn) == 0)
		phba->cfg_oas_flags |= OAS_FIND_ANY_VPORT;
	else
		phba->cfg_oas_flags &= ~OAS_FIND_ANY_VPORT;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 3100 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		return rc;

	memcpy(phba->cfg_oas_vpt_wwpn, wwpn, (8 * sizeof(uint8_t)));
	memcpy(phba->sli4_hba.oas_next_vpt_wwpn, wwpn, (8 * sizeof(uint8_t)));
	if (wwn_to_u64(wwpn) == 0)
		phba->cfg_oas_flags |= OAS_FIND_ANY_VPORT;
	else
		phba->cfg_oas_flags &= ~OAS_FIND_ANY_VPORT;
	phba->cfg_oas_flags &= ~OAS_LUN_VALID;

Reported by FlawFinder.

tools/testing/selftests/drivers/net/mlxsw/sharedbuffer_configuration.py
73 issues
subprocess call with shell=True identified, security issue.
Security injection

Line: 122
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html 

              

def run_cmd(cmd, json=False):
    out = subprocess.check_output(cmd, shell=True)
    if json:
        return j.loads(out)
    return out

Reported by Bandit.

Unused argument 'dlname'
Error

Line: 290 Column: 18 

                                                                                tcbind["sb"]), err_msg)


def check_tcbind(dlname, ports, pools):
    tcbinds = get_tcbinds(ports, verify_existence=True)

    # Save defaults
    record_vp = RecordValuePicker(tcbinds)

Reported by Pylint.

Unused argument 'dlname'
Error

Line: 357 Column: 20 

                                                                                  portpool["sb"]), err_msg)


def check_portpool(dlname, ports, pools):
    portpools = get_portpools(ports, verify_existence=True)

    # Save defaults
    record_vp = RecordValuePicker(portpools)

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1 

              #!/usr/bin/env python
# SPDX-License-Identifier: GPL-2.0

import subprocess
import json as j
import random


class SkipTest(Exception):

Reported by Pylint.

Consider possible security implications associated with subprocess module.
Security blacklist

Line: 4
Suggestion: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b404-import-subprocess 

              #!/usr/bin/env python
# SPDX-License-Identifier: GPL-2.0

import subprocess
import json as j
import random


class SkipTest(Exception):

Reported by Bandit.

Missing class docstring
Error

Line: 9 Column: 1 

              import random


class SkipTest(Exception):
    pass


class RandomValuePicker:
    """

Reported by Pylint.

Too few public methods (1/2)
Error

Line: 13 Column: 1 

                  pass


class RandomValuePicker:
    """
    Class for storing shared buffer configuration. Can handle 3 different
    objects, pool, tcbind and portpool. Provide an interface to get random
    values for a specific object type as the follow:
      1. Pool:

Reported by Pylint.

Argument name "th" doesn't conform to snake_case naming style
Error

Line: 36 Column: 5 

                  def _cell_size(self):
        return self._pools[0]["cell_size"]

    def _get_static_size(self, th):
        # For threshold of 16, this works out to be about 12MB on Spectrum-1,
        # and about 17MB on Spectrum-2.
        return th * 8000 * self._cell_size()

    def _get_size(self):

Reported by Pylint.

Method could be a function
Error

Line: 44 Column: 5 

                  def _get_size(self):
        return self._get_static_size(16)

    def _get_thtype(self):
        return "static"

    def _get_th(self, pool):
        # Threshold value could be any integer between 3 to 16
        th = random.randint(3, 16)

Reported by Pylint.

Standard pseudo-random generators are not suitable for security/cryptographic purposes.
Security blacklist

Line: 49
Suggestion: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b311-random 

              
    def _get_th(self, pool):
        # Threshold value could be any integer between 3 to 16
        th = random.randint(3, 16)
        if pool["thtype"] == "dynamic":
            return th
        else:
            return self._get_static_size(th)

Reported by Bandit.