Part I
This time I add references to linux kernel github - although I ran my naive code analyzer on version 4.18 - all found bugs have long and happy life in current source tree
gb_generate_enum_strings in drivers/staging/greybus/audio_topology.c:
rt2880_pinmux_pins in drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c:
Using unchecked result from devm_kmalloc_array:
ti_sci_scan_clocks_from_fw in drivers/clk/keystone/sci-clk.c:
Doubtful case (I think is has delayed effects bcs no checks for ports field) - function mscc_ocelot_probe in drivers/net/ethernet/mscc/ocelot_board.c
This time I add references to linux kernel github - although I ran my naive code analyzer on version 4.18 - all found bugs have long and happy life in current source tree
gb_generate_enum_strings in drivers/staging/greybus/audio_topology.c:
strings = devm_kcalloc(gb->dev, items, sizeof(char *), GFP_KERNEL);
data = gbenum->names;
for (i = 0; i < items; i++) {
strings[i] = (const char *)data;
rt2880_pinmux_pins in drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c:
p->func[i]->pins = devm_kcalloc(p->dev,
p->func[i]->pin_count,
sizeof(int),
GFP_KERNEL);
for (j = 0; j < p->func[i]->pin_count; j++)
p->func[i]->pins[j] = p->func[i]->pin_first + j;
Using unchecked result from devm_kmalloc_array:
ti_sci_scan_clocks_from_fw in drivers/clk/keystone/sci-clk.c:
tmp_clks = devm_kmalloc_array(dev, max_clks + 64,
sizeof(sci_clk),
GFP_KERNEL);
memcpy(tmp_clks, clks, max_clks * sizeof(sci_clk));
Doubtful case (I think is has delayed effects bcs no checks for ports field) - function mscc_ocelot_probe in drivers/net/ethernet/mscc/ocelot_board.c
ocelot->ports = devm_kcalloc(&pdev->dev, ocelot->num_phys_ports,
sizeof(struct ocelot_port *), GFP_KERNEL);