The following issues were found

drivers/net/ethernet/intel/fm10k/fm10k_main.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 261 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		goto add_tail_frag;

	if (likely(size <= FM10K_RX_HDR_LEN)) {
		memcpy(__skb_put(skb, size), va, ALIGN(size, sizeof(long)));

		/* page is reusable, we can reuse buffer as-is */
		if (dev_page_is_reusable(page))
			return true;


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 278 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	pull_len = eth_get_headlen(skb->dev, va, FM10K_RX_HDR_LEN);

	/* align pull length to size of long to optimize memcpy performance */
	memcpy(__skb_put(skb, pull_len), va, ALIGN(pull_len, sizeof(long)));

	/* update all of the pointers */
	va += pull_len;
	size -= pull_len;


            

Reported by FlawFinder.

drivers/net/usb/pegasus.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 360 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              			goto err;
	}

	memcpy(pegasus->net->dev_addr, node_id, sizeof(node_id));

	return;
err:
	eth_hw_addr_random(pegasus->net);
	netif_dbg(pegasus, drv, pegasus->net, "software assigned MAC address.\n");

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 435 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		data[1] = 0;
	data[2] = loopback ? 0x09 : 0x01;

	memcpy(pegasus->eth_regs, data, sizeof(data));
	ret = set_registers(pegasus, EthCtrl0, 3, data);

	if (usb_dev_id[pegasus->dev_index].vendor == VENDOR_LINKSYS ||
	    usb_dev_id[pegasus->dev_index].vendor == VENDOR_LINKSYS2 ||
	    usb_dev_id[pegasus->dev_index].vendor == VENDOR_DLINK) {

            

Reported by FlawFinder.

drivers/net/usb/sierra_net.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 313 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	 * currently build only one kind of header, so it is faster this way
	 */
	put_unaligned_be16(payloadlen, buf);
	memcpy(buf+2, priv->tx_hdr_template, sizeof(priv->tx_hdr_template));
}
/*----------------------------------------------------------------------------*
 *                              END HIP                                       *
 *----------------------------------------------------------------------------*/


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 840 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		if (eth_hdr(skb)->h_proto != cpu_to_be16(ETH_P_IPV6))
			eth_hdr(skb)->h_proto = cpu_to_be16(ETH_P_IP);
		eth_zero_addr(eth_hdr(skb)->h_source);
		memcpy(eth_hdr(skb)->h_dest, dev->net->dev_addr, ETH_ALEN);

		/* Last packet in batch handled by usbnet */
		if (hh.payload_len.word == skb->len)
			return 1;


            

Reported by FlawFinder.

drivers/net/ethernet/intel/e1000e/ich8lan.c
2 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 756 Column: 23 CWE codes: 120 20

               *  This helper function assumes the SW/FW/HW Semaphore is already acquired.
 **/
static s32 __e1000_access_emi_reg_locked(struct e1000_hw *hw, u16 address,
					 u16 *data, bool read)
{
	s32 ret_val;

	ret_val = e1e_wphy_locked(hw, I82579_EMI_ADDR, address);
	if (ret_val)

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 764 Column: 6 CWE codes: 120 20

              	if (ret_val)
		return ret_val;

	if (read)
		ret_val = e1e_rphy_locked(hw, I82579_EMI_DATA, data);
	else
		ret_val = e1e_wphy_locked(hw, I82579_EMI_DATA, *data);

	return ret_val;

            

Reported by FlawFinder.

drivers/net/wan/hdlc_fr.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 378 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		}

		info.dlci = pvc->dlci;
		memcpy(info.master, pvc->frad->name, IFNAMSIZ);
		if (copy_to_user(ifr->ifr_settings.ifs_ifsu.fr_pvc_info,
				 &info, sizeof(info)))
			return -EFAULT;
		return 0;
	}

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1244 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              			state(hdlc)->first_pvc = NULL;
			state(hdlc)->dce_pvc_count = 0;
		}
		memcpy(&state(hdlc)->settings, &new_settings, size);
		dev->type = ARPHRD_FRAD;
		call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);
		return 0;

	case IF_PROTO_FR_ADD_PVC:

            

Reported by FlawFinder.

drivers/net/ethernet/intel/e1000e/e1000.h
2 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 165 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	/* array of buffer information structs */
	struct e1000_buffer *buffer_info;

	char name[IFNAMSIZ + 5];
	u32 ims_val;
	u32 itr_val;
	void __iomem *itr_register;
	int set_itr;


            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 558 Column: 21 CWE codes: 120 20

              static inline s32 e1000_read_nvm(struct e1000_hw *hw, u16 offset, u16 words,
				 u16 *data)
{
	return hw->nvm.ops.read(hw, offset, words, data);
}

static inline s32 e1000_write_nvm(struct e1000_hw *hw, u16 offset, u16 words,
				  u16 *data)
{

            

Reported by FlawFinder.

drivers/net/wan/ixp4xx_hss.c
2 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 1073 Column: 18 CWE codes: 362

              		goto err_destroy_queues;

	spin_lock_irqsave(&npe_lock, flags);
	if (port->plat->open) {
		err = port->plat->open(port->id, dev, hss_hdlc_set_carrier);
		if (err)
			goto err_unlock;
	}


            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 1074 Column: 21 CWE codes: 362

              
	spin_lock_irqsave(&npe_lock, flags);
	if (port->plat->open) {
		err = port->plat->open(port->id, dev, hss_hdlc_set_carrier);
		if (err)
			goto err_unlock;
	}

	spin_unlock_irqrestore(&npe_lock, flags);

            

Reported by FlawFinder.

drivers/net/wan/z85230.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1189 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	/*	At this point it looks like the chip is behaving
	 */

	memcpy(dev->chanA.regs, reg_init, 16);
	memcpy(dev->chanB.regs, reg_init, 16);

	return 0;
}


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1190 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	 */

	memcpy(dev->chanA.regs, reg_init, 16);
	memcpy(dev->chanB.regs, reg_init, 16);

	return 0;
}

/**

            

Reported by FlawFinder.

drivers/net/wireguard/cookie.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 165 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	down_write(&peer->latest_cookie.lock);
	compute_mac1(macs->mac1, message, len,
		     peer->latest_cookie.message_mac1_key);
	memcpy(peer->latest_cookie.last_mac1_sent, macs->mac1, COOKIE_LEN);
	peer->latest_cookie.have_sent_mac1 = true;
	up_write(&peer->latest_cookie.lock);

	down_read(&peer->latest_cookie.lock);
	if (peer->latest_cookie.is_valid &&

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 224 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
	if (ret) {
		down_write(&peer->latest_cookie.lock);
		memcpy(peer->latest_cookie.cookie, cookie, COOKIE_LEN);
		peer->latest_cookie.birthdate = ktime_get_coarse_boottime_ns();
		peer->latest_cookie.is_valid = true;
		peer->latest_cookie.have_sent_mac1 = false;
		up_write(&peer->latest_cookie.lock);
	} else {

            

Reported by FlawFinder.

drivers/net/wireguard/netlink.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 431 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
	if (preshared_key) {
		down_write(&peer->handshake.lock);
		memcpy(&peer->handshake.preshared_key, preshared_key,
		       NOISE_SYMMETRIC_KEY_LEN);
		up_write(&peer->handshake.lock);
	}

	if (attrs[WGPEER_A_ENDPOINT]) {

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 446 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		     addr->sa_family == AF_INET6)) {
			struct endpoint endpoint = { { { 0 } } };

			memcpy(&endpoint.addr, addr, len);
			wg_socket_set_peer_endpoint(peer, &endpoint);
		}
	}

	if (flags & WGPEER_F_REPLACE_ALLOWEDIPS)

            

Reported by FlawFinder.