The following issues were found

drivers/iio/common/hid-sensors/hid-sensor-trigger.c
2 issues
sprintf - Does not check for buffer overflows
Security

Line: 54 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              	if (latency < 0)
		return latency;

	return sprintf(buf, "%d.%06u\n", latency / 1000, (latency % 1000) * 1000);
}

static ssize_t _hid_sensor_get_fifo_state(struct device *dev,
					  struct device_attribute *attr,
					  char *buf)

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 69 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              	if (latency < 0)
		return latency;

	return sprintf(buf, "%d\n", !!latency);
}

static IIO_DEVICE_ATTR(hwfifo_timeout, 0644,
		       _hid_sensor_get_report_latency,
		       _hid_sensor_set_report_latency, 0);

Reported by FlawFinder.

drivers/iio/common/ms_sensors/ms_sensors_i2c.c
2 issues
sprintf - Does not check for buffer overflows
Security

Line: 327 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              	if (ret)
		return ret;

	return sprintf(buf, "%d\n", (config_reg & 0x40) >> 6);
}
EXPORT_SYMBOL(ms_sensors_show_battery_low);

/**
 * ms_sensors_show_heater() - Show device heater

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 354 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              	if (ret)
		return ret;

	return sprintf(buf, "%d\n", (config_reg & 0x4) >> 2);
}
EXPORT_SYMBOL(ms_sensors_show_heater);

/**
 * ms_sensors_write_heater() - Write device heater

Reported by FlawFinder.

drivers/iio/dac/ad5686.h
2 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 135 Column: 20 CWE codes: 120 20 

              	unsigned int			pwr_down_mask;
	unsigned int			pwr_down_mode;
	ad5686_write_func		write;
	ad5686_read_func		read;
	bool				use_internal_vref;
	struct mutex			lock;

	/*
	 * DMA (thus cache coherency maintenance) requires the

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 155 Column: 21 CWE codes: 120 20 

              int ad5686_probe(struct device *dev,
		 enum ad5686_supported_device_ids chip_type,
		 const char *name, ad5686_write_func write,
		 ad5686_read_func read);

int ad5686_remove(struct device *dev);


#endif /* __DRIVERS_IIO_DAC_AD5686_H__ */

Reported by FlawFinder.

drivers/iio/frequency/ad9523.c
2 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 278 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	unsigned long		vcxo_freq;
	unsigned long		vco_freq;
	unsigned long		vco_out_freq[AD9523_NUM_CLK_SRC];
	unsigned char		vco_out_map[AD9523_NUM_CHAN_ALT_CLK_SRC];

	/*
	 * Lock for accessing device registers. Some operations require
	 * multiple consecutive R/W operations, during which the device
	 * shouldn't be interrupted.  The buffers are also shared across

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 554 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              	mutex_lock(&st->lock);
	ret = ad9523_read(indio_dev, AD9523_READBACK_0);
	if (ret >= 0) {
		ret = sprintf(buf, "%d\n", !!(ret & (1 <<
			(u32)this_attr->address)));
	}
	mutex_unlock(&st->lock);

	return ret;

Reported by FlawFinder.

drivers/iio/frequency/adf4371.c
2 issues
sprintf - Does not check for buffer overflows
Security

Line: 357 Column: 10 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              		val = !(readval & BIT(bit));
		break;
	case ADF4371_CHANNEL_NAME:
		return sprintf(buf, "%s\n", adf4371_ch_names[chan->channel]);
	default:
		ret = -EINVAL;
		val = 0;
		break;
	}

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 364 Column: 25 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              		break;
	}

	return ret < 0 ? ret : sprintf(buf, "%llu\n", val);
}

static ssize_t adf4371_write(struct iio_dev *indio_dev,
			     uintptr_t private,
			     const struct iio_chan_spec *chan,

Reported by FlawFinder.

drivers/iio/gyro/adis16136.c
2 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 73 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              {
	struct adis16136 *adis16136 = file->private_data;
	uint16_t lot1, lot2, lot3, serial;
	char buf[20];
	size_t len;
	int ret;

	ret = adis_read_reg_16(&adis16136->adis, ADIS16136_REG_SERIAL_NUM,
		&serial);

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 230 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              	if (ret)
		return ret;

	return sprintf(buf, "%d\n", freq);
}

static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO,
				  adis16136_read_frequency,
				  adis16136_write_frequency);

Reported by FlawFinder.

drivers/iio/imu/adis16475.c
2 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 133 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              						size_t count, loff_t *ppos)
{
	struct adis16475 *st = file->private_data;
	char buf[7];
	size_t len;
	u16 rev;
	int ret;

	ret = adis_read_reg_16(&st->adis, ADIS16475_REG_FIRM_REV, &rev);

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 160 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              {
	struct adis16475 *st = file->private_data;
	u16 md, year;
	char buf[12];
	size_t len;
	int ret;

	ret = adis_read_reg_16(&st->adis, ADIS16475_REG_FIRM_Y, &year);
	if (ret)

Reported by FlawFinder.

drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c
2 issues
syntax error: { . fs_avl
Error

Line: 60 

              			.odr_len = 4,
		},
		.fs_table = {
			.fs_avl[0] = {
				.gain = 1500,
				.val = 0x0,
			}, /* 1500 uG/LSB */
			.fs_len = 1,
		},

Reported by Cppcheck.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 771 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		if (!ext_channels)
			return NULL;

		memcpy(ext_channels, magn_channels, sizeof(magn_channels));
		iio_dev->available_scan_masks = st_lsm6dsx_available_scan_masks;
		iio_dev->channels = ext_channels;
		iio_dev->num_channels = ARRAY_SIZE(magn_channels);

		scnprintf(sensor->name, sizeof(sensor->name), "%s_magn",

Reported by FlawFinder.

drivers/iio/light/cm32181.c
2 issues
sprintf - Does not check for buffer overflows
Security

Line: 400 Column: 10 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              
	n = cm32181->num_als_it;
	for (i = 0, len = 0; i < n; i++)
		len += sprintf(buf + len, "0.%06u ", cm32181->als_it_values[i]);
	return len + sprintf(buf + len, "\n");
}

static const struct iio_chan_spec cm32181_channels[] = {
	{

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 401 Column: 15 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              	n = cm32181->num_als_it;
	for (i = 0, len = 0; i < n; i++)
		len += sprintf(buf + len, "0.%06u ", cm32181->als_it_values[i]);
	return len + sprintf(buf + len, "\n");
}

static const struct iio_chan_spec cm32181_channels[] = {
	{
		.type = IIO_LIGHT,

Reported by FlawFinder.

drivers/iio/magnetometer/ak8974.c
2 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 544 Column: 17 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              				       fab_data2, sizeof(fab_data2));

		for (i = 0; i < 3; ++i) {
			static const char axis[3] = "XYZ";
			static const char pgaxis[6] = "ZYZXYX";
			unsigned offz = le16_to_cpu(fab_data2[i]) & 0x7F;
			unsigned fine = le16_to_cpu(fab_data1[i]);
			unsigned sens = le16_to_cpu(fab_data1[i + 3]);
			unsigned pgain1 = le16_to_cpu(fab_data1[i + 6]);

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 545 Column: 17 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
		for (i = 0; i < 3; ++i) {
			static const char axis[3] = "XYZ";
			static const char pgaxis[6] = "ZYZXYX";
			unsigned offz = le16_to_cpu(fab_data2[i]) & 0x7F;
			unsigned fine = le16_to_cpu(fab_data1[i]);
			unsigned sens = le16_to_cpu(fab_data1[i + 3]);
			unsigned pgain1 = le16_to_cpu(fab_data1[i + 6]);
			unsigned pgain2 = pgain1 >> 8;

Reported by FlawFinder.