| # | Tier | Score | Cat | Function | File | Variable | Sink | Guard | LLM |
|---|
| 1 | Critical | 390 | B | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | le32_to_cpu(desc_table->raid_map_desc_elements) | sizeof(struct MR_DEV_HANDLE_INFO) * le32_to_cpu(desc_table->raid_map_desc_elements) | no | BUG:oob_write |
| 2 | Critical | 390 | B | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | le32_to_cpu(desc_table->raid_map_desc_elements) | sizeof(struct MR_ARRAY_INFO) * le32_to_cpu(desc_table->raid_map_desc_elements) | no | BUG:oob_write |
| 3 | Critical | 390 | B | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | le32_to_cpu(desc_table->raid_map_desc_elements) | sizeof(struct MR_LD_SPAN_MAP) * le32_to_cpu(desc_table->raid_map_desc_elements) | no | BUG:oob_write |
| 4 | Critical | 390 | B | copy_entries | drivers/md/persistent-data/dm-btree.c | value_size | count * value_size | no | BUG:oob_write |
| 5 | Critical | 390 | B | lpfc_cmpl_els_qfpa | drivers/scsi/lpfc/lpfc_els.c | len | len + 8 | no | BUG:oob_write |
| 6 | Critical | 390 | B | mwifiex_cmd_tx_power_cfg | drivers/net/wireless/marvell/mwifiex/sta_cmd.c | le16_to_cpu(pg_tlv->length) | sizeof(struct host_cmd_ds_txpwr_cfg) +
sizeof(struct mwi + le16_to_cpu(pg_tlv->length) | no | BUG:oob_write |
| 7 | Critical | 370 | E | active_ofld_conn_reply | drivers/infiniband/hw/cxgb4/cm.c | atid | atid->? | no | BUG:oob_write |
| 8 | Critical | 370 | A | amdgpu_ucode_patch_jt | drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | dst_addr | memcpy() | no | BUG:oob_write |
| 9 | Critical | 370 | A | asd_get_response_tasklet | drivers/scsi/aic94xx/aic94xx_task.c | escb | memset() in asd_invalidate_edb() | no | BUG:oob_write |
| 10 | Critical | 370 | E | asd_get_response_tasklet | drivers/scsi/aic94xx/aic94xx_task.c | escb | escb->? | no | BUG:oob_write |
| 11 | Critical | 370 | A | bcm4377_enqueue | drivers/bluetooth/hci_bcm4377.c | entry | memset() | no | BUG:oob_write |
| 12 | Critical | 370 | E | bcm4377_enqueue | drivers/bluetooth/hci_bcm4377.c | entry | entry->id | no | BUG:oob_write |
| 13 | Critical | 370 | E | bcm4377_enqueue | drivers/bluetooth/hci_bcm4377.c | entry | entry->len | no | BUG:oob_write |
| 14 | Critical | 370 | E | bcm4377_enqueue | drivers/bluetooth/hci_bcm4377.c | entry | entry->flags | no | BUG:oob_write |
| 15 | Critical | 370 | E | bcm4377_enqueue | drivers/bluetooth/hci_bcm4377.c | entry | entry->flags | no | BUG:oob_write |
| 16 | Critical | 370 | E | bcm4377_enqueue | drivers/bluetooth/hci_bcm4377.c | entry | entry->payload | no | BUG:oob_write |
| 17 | Critical | 370 | A | bcm4377_enqueue | drivers/bluetooth/hci_bcm4377.c | payload | memcpy() | no | BUG:oob_write |
| 18 | Critical | 370 | E | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | ep_ring | ep_ring->stream_active | no | BUG:oob_write |
| 19 | Critical | 370 | E | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | ep_ring | ep_ring->stream_rejected | no | BUG:oob_write |
| 20 | Critical | 370 | E | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | ep_ring | ep_ring->stream_active | no | BUG:oob_write |
| 21 | Critical | 370 | E | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | ep_ring | ep_ring->stream_rejected | no | BUG:oob_write |
| 22 | Critical | 370 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_mfi | cmd_mfi->flags | no | BUG:oob_write |
| 23 | Critical | 370 | E | cyapa_pip_write_fw_block | drivers/input/mouse/cyapa_gen5.c | bl_packet_end | bl_packet_end->crc | no | BUG:oob_write |
| 24 | Critical | 370 | E | cyapa_pip_write_fw_block | drivers/input/mouse/cyapa_gen5.c | bl_packet_end | bl_packet_end->eop | no | BUG:oob_write |
| 25 | Critical | 370 | E | fix_bios | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->device_id | no | BUG:oob_write |
| 26 | Critical | 370 | E | fix_efi | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->device_id | no | BUG:oob_write |
| 27 | Critical | 370 | A | gfx_v12_1_init_cp_compute_microcode_bo | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | offset | memcpy() | no | BUG:oob_write |
| 28 | Critical | 370 | E | hash_filter_rpl | drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | ftid | ftid->? | no | BUG:oob_write |
| 29 | Critical | 370 | A | idpf_rx_splitq_clean | drivers/net/ethernet/intel/idpf/idpf_txrx.c | hdr | memcpy() in idpf_rx_hsplit_wa() | no | BUG:oob_write |
| 30 | Critical | 370 | A | iwl_dbg_tlv_override_trig_node | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | node_trig | memcpy() | no | BUG:oob_write |
| 31 | Critical | 370 | A | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_ethhdr | memcpy() | no | BUG:oob_write |
| 32 | Critical | 370 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_ethhdr | p_ethhdr->h_source | no | BUG:oob_write |
| 33 | Critical | 370 | A | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_ethhdr | memcpy() | no | BUG:oob_write |
| 34 | Critical | 370 | E | mpi3mr_process_op_reply_q | drivers/scsi/mpi3mr/mpi3mr_fw.c | op_req_q | op_req_q->ci | no | BUG:oob_write |
| 35 | Critical | 370 | A | mt7915_mcu_get_eeprom | drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | buf | memcpy() | no | BUG:oob_write |
| 36 | Critical | 370 | A | mt7996_mcu_get_eeprom | drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | buf | memcpy() | no | BUG:oob_write |
| 37 | Critical | 370 | A | mt7996_mcu_get_eeprom | drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | buf | memcpy() | no | BUG:oob_write |
| 38 | Critical | 370 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | sts_data0 | sts_data0->? | no | BUG:oob_write |
| 39 | Critical | 370 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | sts_data0 | sts_data0->? | no | BUG:oob_write |
| 40 | Critical | 370 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | sts_data0 | sts_data0->? | no | BUG:oob_write |
| 41 | Critical | 370 | E | qed_ll2_lb_rxq_handler | drivers/net/ethernet/qlogic/qed/qed_ll2.c | cid | cid->? | no | BUG:oob_write |
| 42 | Critical | 370 | E | qed_ll2_lb_rxq_handler | drivers/net/ethernet/qlogic/qed/qed_ll2.c | cid | cid->? | no | BUG:oob_write |
| 43 | Critical | 370 | E | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | sts_data0 | sts_data0->? | no | BUG:oob_write |
| 44 | Critical | 370 | E | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | sts_data0 | sts_data0->? | no | BUG:oob_write |
| 45 | Critical | 370 | E | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | sts_data0 | sts_data0->? | no | BUG:oob_write |
| 46 | Critical | 370 | E | smp_snoop | drivers/infiniband/hw/mlx4/mad.c | bn | bn->? | no | BUG:oob_write |
| 47 | Critical | 370 | E | w5100_rx_skb | drivers/net/ethernet/wiznet/w5100.c | skb | skb->data | no | BUG:oob_write |
| 48 | Critical | 360 | C | NFTL_mount | drivers/mtd/nftlmount.c | first_logical_block | subscript | no | BUG:oob_write |
| 49 | Critical | 360 | C | NFTL_mount | drivers/mtd/nftlmount.c | first_logical_block | subscript | no | BUG:oob_write |
| 50 | Critical | 360 | C | __netdev_rx | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_write |
| 51 | Critical | 360 | C | __netdev_rx | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_write |
| 52 | Critical | 360 | C | active_ofld_conn_reply | drivers/infiniband/hw/cxgb4/cm.c | atid | subscript (callee) | no | BUG:oob_write |
| 53 | Critical | 360 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | BUG:oob_write |
| 54 | Critical | 360 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | BUG:oob_write |
| 55 | Critical | 360 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | BUG:oob_write |
| 56 | Critical | 360 | C | amdgpu_ih_ring_write | drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c | wptr | subscript | no | BUG:oob_write |
| 57 | Critical | 360 | B | ath12k_wmi_op_gen_config_pno_start | drivers/net/wireless/ath/ath12k/wmi.c | le32_to_cpu(nlo_list[i].ssid.ssid.ssid_l | memcpy() | no | BUG:oob_write |
| 58 | Critical | 360 | G2 | atomisp_v4l2_framebuffer_to_css_frame | drivers/staging/media/atomisp/pci/atomisp_cmd.c | arg->fmt.sizeimage | copy_from_user() unvalidated size | no | BUG:oob_write |
| 59 | Critical | 360 | B | bcm4377_enqueue | drivers/bluetooth/hci_bcm4377.c | entry | memset() | no | BUG:oob_write |
| 60 | Critical | 360 | B | be_cmd_get_fat_dump | drivers/net/ethernet/emulex/benet/be_cmds.c | le32_to_cpu(resp->read_log_length) | memcpy() | no | BUG:oob_write |
| 61 | Critical | 360 | B | bfa_flash_intr | drivers/net/ethernet/brocade/bna/bfa_ioc.c | len | memcpy() | no | BUG:oob_write |
| 62 | Critical | 360 | B | bfa_flash_intr | drivers/scsi/bfa/bfa_ioc.c | len | memcpy() | no | BUG:oob_write |
| 63 | Critical | 360 | B | bfa_fru_intr | drivers/scsi/bfa/bfa_ioc.c | len | memcpy() | no | BUG:oob_write |
| 64 | Critical | 360 | C | brcmf_msgbuf_process_flow_ring_delete_response | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | flowid | subscript (callee) | no | BUG:oob_write |
| 65 | Critical | 360 | C | cdrom_mrw_set_lba_space | drivers/cdrom/cdrom.c | offset | subscript | no | BUG:oob_write |
| 66 | Critical | 360 | C | cmdq_cmd_ceq_handler | drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | errcode | subscript (callee) | no | BUG:oob_write |
| 67 | Critical | 360 | C | cmdq_cmd_ceq_handler | drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | errcode | subscript (callee) | no | BUG:oob_write |
| 68 | Critical | 360 | C | cmdq_cmd_ceq_handler | drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | errcode | subscript (callee) | no | BUG:oob_write |
| 69 | Critical | 360 | C | cmdq_cmd_ceq_handler | drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | errcode | subscript (callee) | no | BUG:oob_write |
| 70 | Critical | 360 | C | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | port_id | subscript | no | BUG:oob_write |
| 71 | Critical | 360 | C | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | port_id | subscript | no | BUG:oob_write |
| 72 | Critical | 360 | C | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | port_id | subscript | no | BUG:oob_write |
| 73 | Critical | 360 | B | cyapa_pip_write_fw_block | drivers/input/mouse/cyapa_gen5.c | record_len | memcpy() | no | BUG:oob_write |
| 74 | Critical | 360 | B | cyttsp5_handle_irq | drivers/input/touchscreen/cyttsp5.c | size | memcpy() | no | BUG:oob_write |
| 75 | Critical | 360 | B | cyttsp5_handle_irq | drivers/input/touchscreen/cyttsp5.c | size | memcpy() | no | BUG:oob_write |
| 76 | Critical | 360 | G2 | dasd_get_user_string | drivers/s390/block/dasd.c | user_len | copy_from_user() unvalidated size | no | BUG:oob_write |
| 77 | Critical | 360 | B | dm_dmub_hw_init | drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | fw_bss_data_size | memcpy() | no | BUG:oob_write |
| 78 | Critical | 360 | A | efx_devlink_info_running_v2 | drivers/net/ethernet/sfc/efx_devlink.c | offset | snprintf() | no | BUG:stack_overflow |
| 79 | Critical | 360 | C | ehv_bc_tty_probe | drivers/tty/ehv_bytechan.c | i | subscript | no | BUG:oob_write |
| 80 | Critical | 360 | B | fbnic_tlv_attr_get_signed | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | le16_to_cpu(attr->hdr.len) - sizeof(*att | memcpy() | no | BUG:oob_write |
| 81 | Critical | 360 | B | fbnic_tlv_attr_get_unsigned | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | le16_to_cpu(attr->hdr.len) - sizeof(*att | memcpy() | no | BUG:oob_write |
| 82 | Critical | 360 | B | fc_fcp_recv | drivers/scsi/libfc/fc_fcp.c | (size_t) ntohl(dd->ft_data_ro) | memcpy() in fc_fcp_send_data() | no | BUG:oob_write |
| 83 | Critical | 360 | B | fc_fcp_recv | drivers/scsi/libfc/fc_fcp.c | (size_t) ntohl(dd->ft_burst_len) | memcpy() in fc_fcp_send_data() | no | BUG:oob_write |
| 84 | Critical | 360 | G2 | ffs_epfile_ioctl | drivers/usb/gadget/function/f_fs.c | desc1.bLength | copy_to_user() unvalidated size | no | BUG:oob_write |
| 85 | Critical | 360 | B | gfx_v12_1_init_cp_compute_microcode_bo | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_ucode_size | memcpy() | no | BUG:oob_write |
| 86 | Critical | 360 | B | gfx_v12_1_init_cp_compute_microcode_bo | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_data_size | memcpy() | no | BUG:oob_write |
| 87 | Critical | 360 | B | glink_smem_tx_write | drivers/rpmsg/qcom_glink_smem.c | head | memcpy() in glink_smem_tx_write_one() | no | BUG:oob_write |
| 88 | Critical | 360 | C | gve_irq_doorbell | drivers/net/ethernet/google/gve/gve.h | be32_to_cpu(*block->irq_db_index) | subscript | no | BUG:oob_write |
| 89 | Critical | 360 | C | gve_rx_write_doorbell | drivers/net/ethernet/google/gve/gve_rx.c | db_idx | subscript | no | BUG:oob_write |
| 90 | Critical | 360 | C | gve_rx_write_doorbell_dqo | drivers/net/ethernet/google/gve/gve_rx_dqo.c | index | subscript | no | BUG:oob_write |
| 91 | Critical | 360 | C | gve_tx_put_doorbell | drivers/net/ethernet/google/gve/gve_tx.c | be32_to_cpu(q_resources->db_index) | subscript | no | BUG:oob_write |
| 92 | Critical | 360 | C | gve_tx_put_doorbell_dqo | drivers/net/ethernet/google/gve/gve_dqo.h | index | subscript | no | BUG:oob_write |
| 93 | Critical | 360 | C | gve_write_irq_doorbell_dqo | drivers/net/ethernet/google/gve/gve_dqo.h | index | subscript | no | BUG:oob_write |
| 94 | Critical | 360 | B | handle_cmd_rsp | drivers/scsi/ibmvscsi/ibmvscsi.c | be32_to_cpu(rsp->sense_data_len) | memcpy() | no | BUG:oob_write |
| 95 | Critical | 360 | C | hash_filter_rpl | drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | ftid | subscript (callee) | no | BUG:oob_write |
| 96 | Critical | 360 | C | hw_event_phy_down | drivers/scsi/pm8001/pm8001_hwi.c | port_id | subscript | no | BUG:oob_write |
| 97 | Critical | 360 | C | hw_event_phy_down | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 98 | Critical | 360 | C | hw_event_sas_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | port_id | subscript | no | BUG:oob_write |
| 99 | Critical | 360 | C | hw_event_sas_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 100 | Critical | 360 | C | hw_event_sas_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | port_id | subscript | no | BUG:oob_write |
| 101 | Critical | 360 | C | hw_event_sas_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 102 | Critical | 360 | C | hw_event_sata_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | subscript (callee) | no | BUG:oob_write |
| 103 | Critical | 360 | C | hw_event_sata_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | port_id | subscript | no | BUG:oob_write |
| 104 | Critical | 360 | C | hw_event_sata_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 105 | Critical | 360 | B | ibmvfc_scsi_done | drivers/scsi/ibmvscsi/ibmvfc.c | sense_len | memcpy() | no | BUG:oob_write |
| 106 | Critical | 360 | B | ican3_handle_nmtsind | drivers/net/can/janz-ican3.c | le16_to_cpu(msg->len) | memmove() | no | BUG:oob_write |
| 107 | Critical | 360 | B | if_usb_send_fw_pkt | drivers/net/wireless/marvell/libertas/if_usb.c | le32_to_cpu(fwdata->hdr.datalength) | memcpy() | no | BUG:oob_write |
| 108 | Critical | 360 | C | il3945_hdl_tx | drivers/net/wireless/intel/iwlegacy/3945.c | txq_id | subscript (callee) | no | BUG:oob_write |
| 109 | Critical | 360 | B | in_rq_cur | drivers/usb/gadget/function/f_uac1.c | value | memcpy() | no | BUG:oob_write |
| 110 | Critical | 360 | B | in_rq_min | drivers/usb/gadget/function/f_uac1.c | value | memcpy() | no | BUG:oob_write |
| 111 | Critical | 360 | B | in_rq_res | drivers/usb/gadget/function/f_uac1.c | value | memcpy() | no | BUG:oob_write |
| 112 | Critical | 360 | C | intr_handler | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_write |
| 113 | Critical | 360 | C | intr_handler | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_write |
| 114 | Critical | 360 | G2 | ioctl_queue_iso | drivers/firewire/core-cdev.c | transmit_header_bytes | copy_from_user() unvalidated size | no | BUG:oob_write |
| 115 | Critical | 360 | B | ionic_lif_rss_deinit | drivers/net/ethernet/pensando/ionic/ionic_lif.c | tbl_sz | memset() | no | BUG:oob_write |
| 116 | Critical | 360 | C | ipc_protocol_dl_td_prepare | drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | head | subscript | no | BUG:oob_write |
| 117 | Critical | 360 | C | ipc_protocol_dl_td_prepare | drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | head | subscript | no | BUG:oob_write |
| 118 | Critical | 360 | C | ipc_protocol_free_msg_get | drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | head | subscript | no | BUG:oob_write |
| 119 | Critical | 360 | C | ipc_protocol_ul_td_send | drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | head | subscript | no | BUG:oob_write |
| 120 | Critical | 360 | C | ipc_protocol_ul_td_send | drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | head | subscript | no | BUG:oob_write |
| 121 | Critical | 360 | B | iwl_dump_ini_mon_dram_iter | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | frag | memcpy() | no | BUG:oob_write |
| 122 | Critical | 360 | C | iwl_fw_dbg_trigger_check_stop | drivers/net/wireless/intel/iwlwifi/fw/dbg.h | le32_to_cpu(trig->id) | subscript (callee) | no | BUG:oob_write |
| 123 | Critical | 360 | C | iwl_fw_dbg_trigger_check_stop | drivers/net/wireless/intel/iwlwifi/fw/dbg.h | le32_to_cpu(trig->id) | subscript (callee) | no | BUG:oob_write |
| 124 | Critical | 360 | B | iwl_nvm_read_chunk | drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | bytes_read | memcpy() | no | BUG:oob_write |
| 125 | Critical | 360 | C | ixgbe_is_non_eop | drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | ntc | subscript | no | BUG:oob_write |
| 126 | Critical | 360 | B | lbtf_cmd_copyback | drivers/net/wireless/marvell/libertas_tf/cmd.c | copy_len | memcpy() | no | BUG:oob_write |
| 127 | Critical | 360 | C | megasas_get_pd_list | drivers/scsi/megaraid/megaraid_sas_base.c | le16_to_cpu(pd_addr->deviceId) | subscript | no | BUG:oob_write |
| 128 | Critical | 360 | C | megasas_get_pd_list | drivers/scsi/megaraid/megaraid_sas_base.c | le16_to_cpu(pd_addr->deviceId) | subscript | no | BUG:oob_write |
| 129 | Critical | 360 | C | megasas_get_pd_list | drivers/scsi/megaraid/megaraid_sas_base.c | le16_to_cpu(pd_addr->deviceId) | subscript | no | BUG:oob_write |
| 130 | Critical | 360 | C | megasas_host_device_list_query | drivers/scsi/megaraid/megaraid_sas_base.c | target_id | subscript | no | BUG:oob_write |
| 131 | Critical | 360 | C | megasas_host_device_list_query | drivers/scsi/megaraid/megaraid_sas_base.c | target_id | subscript | no | BUG:oob_write |
| 132 | Critical | 360 | C | megasas_host_device_list_query | drivers/scsi/megaraid/megaraid_sas_base.c | target_id | subscript | no | BUG:oob_write |
| 133 | Critical | 360 | C | megasas_host_device_list_query | drivers/scsi/megaraid/megaraid_sas_base.c | target_id | subscript | no | BUG:oob_write |
| 134 | Critical | 360 | C | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | port | subscript | no | BUG:oob_write |
| 135 | Critical | 360 | C | mlx4_qp_detach_common | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | subscript | no | BUG:oob_write |
| 136 | Critical | 360 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 137 | Critical | 360 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | port_id | subscript | no | BUG:oob_write |
| 138 | Critical | 360 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 139 | Critical | 360 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 140 | Critical | 360 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 141 | Critical | 360 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 142 | Critical | 360 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 143 | Critical | 360 | C | mpi_phy_start_resp | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 144 | Critical | 360 | C | mpi_ssp_event | drivers/scsi/pm8001/pm8001_hwi.c | tag | subscript | no | BUG:oob_write |
| 145 | Critical | 360 | C | mpt_lan_receive_post_free | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_write |
| 146 | Critical | 360 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_write |
| 147 | Critical | 360 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_write |
| 148 | Critical | 360 | C | mpt_lan_send_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_write |
| 149 | Critical | 360 | G2 | mptctl_replace_fw | drivers/message/fusion/mptctl.c | newFwSize | copy_from_user() unvalidated size | no | BUG:oob_write |
| 150 | Critical | 360 | C | mtd_parser_tplink_safeloader_read_table | drivers/mtd/parsers/tplink_safeloader.c | size | subscript | no | BUG:oob_write |
| 151 | Critical | 360 | B | mwifiex_cmd_802_11_associate | drivers/net/wireless/marvell/mwifiex/join.c | le16_to_cpu(ssid_tlv->header.len) | memcpy() | no | BUG:oob_write |
| 152 | Critical | 360 | B | mwifiex_cmd_append_11n_tlv | drivers/net/wireless/marvell/mwifiex/11n.c | le16_to_cpu(ext_cap->header.len) | memcpy() | no | BUG:oob_write |
| 153 | Critical | 360 | B | mwifiex_prog_fw_w_helper | drivers/net/wireless/marvell/mwifiex/usb.c | dlen | memcpy() | no | BUG:oob_write |
| 154 | Critical | 360 | C | mwifiex_ret_11n_addba_req | drivers/net/wireless/marvell/mwifiex/11n.c | tid | subscript | no | BUG:oob_write |
| 155 | Critical | 360 | B | mwifiex_uap_custom_ie_prepare | drivers/net/wireless/marvell/mwifiex/uap_cmd.c | le16_to_cpu(ap_ie->len) | memcpy() | no | BUG:oob_write |
| 156 | Critical | 360 | B | mwifiex_update_autoindex_ies | drivers/net/wireless/marvell/mwifiex/ie.c | le16_to_cpu(ie->ie_length) | memcpy() | no | BUG:oob_write |
| 157 | Critical | 360 | C | nfp_flower_get_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | BUG:oob_write |
| 158 | Critical | 360 | C | nfp_flower_get_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | BUG:oob_write |
| 159 | Critical | 360 | C | nfp_flower_rx_flow_stats | drivers/net/ethernet/netronome/nfp/flower/metadata.c | ctx_id | subscript | no | BUG:oob_write |
| 160 | Critical | 360 | C | nfp_flower_rx_flow_stats | drivers/net/ethernet/netronome/nfp/flower/metadata.c | ctx_id | subscript | no | BUG:oob_write |
| 161 | Critical | 360 | C | nfp_flower_rx_flow_stats | drivers/net/ethernet/netronome/nfp/flower/metadata.c | ctx_id | subscript | no | BUG:oob_write |
| 162 | Critical | 360 | C | nvmet_install_queue | drivers/nvme/target/fabrics-cmd.c | qid | subscript | no | BUG:oob_write |
| 163 | Critical | 360 | C | ocrdma_update_free_srq_cqe | drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | wqe_idx | subscript (callee) | no | BUG:oob_write |
| 164 | Critical | 360 | B | pm8001_mpi_get_nvmd_resp | drivers/scsi/pm8001/pm8001_hwi.c | fw_control_context | memcpy() | no | BUG:oob_write |
| 165 | Critical | 360 | C | pm8001_mpi_local_phy_ctl | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 166 | Critical | 360 | C | pm8001_mpi_local_phy_ctl | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | subscript | no | BUG:oob_write |
| 167 | Critical | 360 | B | pqi_build_sas_smp_handler_reply | drivers/scsi/smartpqi/smartpqi_sas_transport.c | le16_to_cpu(error_info->sense_data_lengt | memcpy() | no | BUG:oob_write |
| 168 | Critical | 360 | C | pqi_request_firmware_feature | drivers/scsi/smartpqi/smartpqi_init.c | byte_index | subscript | no | BUG:oob_write |
| 169 | Critical | 360 | G2 | privcmd_irqfd_assign | drivers/xen/privcmd.c | irqfd->size | copy_from_user() unvalidated size | no | BUG:oob_write |
| 170 | Critical | 360 | B | process_receive | drivers/net/fddi/skfp/hwmtm.c | n | memcpy() | no | BUG:oob_write |
| 171 | Critical | 360 | C | qcom_smd_rpm_callback | drivers/soc/qcom/smd-rpm.c | len | subscript | no | BUG:oob_write |
| 172 | Critical | 360 | G2 | qcomtee_update_args | drivers/tee/qcomtee/core.c | u[i].b.size | copy_to_user() unvalidated size | no | BUG:oob_write |
| 173 | Critical | 360 | C | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | subscript | no | BUG:oob_write |
| 174 | Critical | 360 | C | remove_promisc_qp | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | subscript | no | BUG:oob_write |
| 175 | Critical | 360 | B | rtw_get_wps_attr | drivers/staging/rtl8723bs/core/rtw_ieee80211.c | attr_len | memcpy() | no | BUG:oob_write |
| 176 | Critical | 360 | C | si_irq_process | drivers/gpu/drm/radeon/si.c | crtc_idx | subscript | no | BUG:oob_write |
| 177 | Critical | 360 | C | si_irq_process | drivers/gpu/drm/radeon/si.c | hpd_idx | subscript | no | BUG:oob_write |
| 178 | Critical | 360 | C | t4_sge_alloc_ctrl_txq | drivers/net/ethernet/chelsio/cxgb4/sge.c | FW_EQ_CTRL_CMD_EQID_G(ntohl(c.cmpliqid_eqid)) | subscript (callee) | no | BUG:oob_write |
| 179 | Critical | 360 | C | t4_sge_alloc_eth_txq | drivers/net/ethernet/chelsio/cxgb4/sge.c | FW_EQ_ETH_CMD_EQID_G(ntohl(c.eqid_pkd)) | subscript (callee) | no | BUG:oob_write |
| 180 | Critical | 360 | C | t4_sge_alloc_ofld_txq | drivers/net/ethernet/chelsio/cxgb4/sge.c | FW_EQ_OFLD_CMD_EQID_G(ntohl(c.eqid_pkd)) | subscript (callee) | no | BUG:oob_write |
| 181 | Critical | 360 | B | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | pkt_len | memmove() | no | BUG:oob_write |
| 182 | Critical | 360 | B | vdpasim_blk_handle_req | drivers/vdpa/vdpa_sim/vdpa_sim_blk.c | num_sectors | memset() | no | BUG:oob_write |
| 183 | Critical | 360 | C | virtio_gpu_cmd_get_capset_info_cb | drivers/gpu/drm/virtio/virtgpu_vq.c | i | subscript | no | BUG:oob_write |
| 184 | Critical | 360 | C | virtio_gpu_cmd_get_capset_info_cb | drivers/gpu/drm/virtio/virtgpu_vq.c | i | subscript | no | BUG:oob_write |
| 185 | Critical | 360 | C | virtio_gpu_cmd_get_capset_info_cb | drivers/gpu/drm/virtio/virtgpu_vq.c | i | subscript | no | BUG:oob_write |
| 186 | Critical | 360 | G2 | virtiovf_issue_legacy_rw_cmd | drivers/vfio/pci/virtio/legacy_io.c | count | copy_from_user() unvalidated size | no | BUG:oob_write |
| 187 | Critical | 360 | B | wfx_hif_read_mib | drivers/net/wireless/silabs/wfx/hif_tx.c | le16_to_cpu(reply->length) | memcpy() | no | BUG:oob_write |
| 188 | Critical | 360 | C | wx_is_non_eop | drivers/net/ethernet/wangxun/libwx/wx_lib.c | ntc | subscript | no | BUG:oob_write |
| 189 | Critical | 350 | E | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | desc_table | desc_table->raid_map_desc_type | no | BUG:oob_read |
| 190 | Critical | 350 | E | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | desc_table | desc_table->raid_map_desc_offset | no | BUG:oob_read |
| 191 | Critical | 350 | E | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | desc_table | desc_table->raid_map_desc_elements | no | BUG:oob_read |
| 192 | Critical | 350 | E | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | desc_table | desc_table->raid_map_desc_offset | no | BUG:oob_read |
| 193 | Critical | 350 | E | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | desc_table | desc_table->raid_map_desc_elements | no | BUG:oob_read |
| 194 | Critical | 350 | E | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | desc_table | desc_table->raid_map_desc_offset | no | BUG:oob_read |
| 195 | Critical | 350 | E | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | desc_table | desc_table->raid_map_desc_elements | no | BUG:oob_read |
| 196 | Critical | 350 | E | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | desc_table | desc_table->raid_map_desc_offset | no | BUG:oob_read |
| 197 | Critical | 350 | E | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | desc_table | desc_table->raid_map_desc_elements | no | BUG:oob_read |
| 198 | Critical | 350 | E | __rmnet_map_ingress_handler | drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | len | len->? | no | BUG:oob_read |
| 199 | Critical | 350 | F | _clone_sg_entries | drivers/scsi/mpt3sas/mpt3sas_base.c | (le32_to_cpu(sgel->FlagsLength) &
0x00ffffff) | loop bound | no | BUG:oob_write |
| 200 | Critical | 350 | E | accept_cr | drivers/infiniband/hw/cxgb4/cm.c | tcph | tcph->ece | no | BUG:oob_read |
| 201 | Critical | 350 | F | altera_execute | drivers/misc/altera-stapl/altera.c | uncomp_size | loop bound | no | BUG:oob_write |
| 202 | Critical | 350 | F | altera_execute | drivers/misc/altera-stapl/altera.c | count | loop bound | no | BUG:oob_write |
| 203 | Critical | 350 | F | altera_execute | drivers/misc/altera-stapl/altera.c | count | loop bound | no | BUG:oob_write |
| 204 | Critical | 350 | F | altera_execute | drivers/misc/altera-stapl/altera.c | count | loop bound | no | BUG:oob_write |
| 205 | Critical | 350 | F | altera_execute | drivers/misc/altera-stapl/altera.c | count | loop bound | no | BUG:oob_write |
| 206 | Critical | 350 | F | altera_execute | drivers/misc/altera-stapl/altera.c | size | loop bound | no | BUG:oob_write |
| 207 | Critical | 350 | F | altera_execute | drivers/misc/altera-stapl/altera.c | i | loop bound | no | BUG:oob_write |
| 208 | Critical | 350 | E | amdgpu_atombios_encoder_get_lcd_info | drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | fake_edid_record | fake_edid_record->ucFakeEDIDLength | no | BUG:oob_read |
| 209 | Critical | 350 | E | amdgpu_atombios_encoder_get_lcd_info | drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | fake_edid_record | fake_edid_record->ucFakeEDIDLength | no | BUG:oob_read |
| 210 | Critical | 350 | E | amdgpu_atombios_encoder_get_lcd_info | drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | fake_edid_record | fake_edid_record->ucFakeEDIDString | no | BUG:oob_read |
| 211 | Critical | 350 | E | amdgpu_atombios_encoder_get_lcd_info | drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | panel_res_record | panel_res_record->usHSize | no | BUG:oob_read |
| 212 | Critical | 350 | E | amdgpu_atombios_encoder_get_lcd_info | drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | panel_res_record | panel_res_record->usVSize | no | BUG:oob_read |
| 213 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path_obj | path_obj->ucNumOfDispPath | no | BUG:oob_read |
| 214 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path_obj | path_obj->asDispPath | no | BUG:oob_read |
| 215 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usSize | no | BUG:oob_read |
| 216 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usDeviceTag | no | BUG:oob_read |
| 217 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usConnObjectId | no | BUG:oob_read |
| 218 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usDeviceTag | no | BUG:oob_read |
| 219 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | enc_obj | enc_obj->ucNumberOfObjects | no | BUG:oob_read |
| 220 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | enc_obj | enc_obj->asObjects | no | BUG:oob_read |
| 221 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | enc_obj | enc_obj->asObjects | no | BUG:oob_read |
| 222 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 223 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 224 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 225 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 226 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | cap_record | cap_record->usEncoderCap | no | BUG:oob_read |
| 227 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 228 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | router_obj | router_obj->ucNumberOfObjects | no | BUG:oob_read |
| 229 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | router_obj | router_obj->asObjects | no | BUG:oob_read |
| 230 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | router_obj | router_obj->asObjects | no | BUG:oob_read |
| 231 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | router_obj | router_obj->asObjects | no | BUG:oob_read |
| 232 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | router_src_dst_table | router_src_dst_table->ucNumberOfSrc | no | BUG:oob_read |
| 233 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 234 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 235 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 236 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 237 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | i2c_record | i2c_record->sucI2cId | no | BUG:oob_read |
| 238 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | i2c_config | i2c_config->ucAccess | no | BUG:oob_read |
| 239 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | i2c_record | i2c_record->ucI2CAddr | no | BUG:oob_read |
| 240 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | ddc_path | ddc_path->ucMuxType | no | BUG:oob_read |
| 241 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | ddc_path | ddc_path->ucMuxControlPin | no | BUG:oob_read |
| 242 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | ddc_path | ddc_path->ucMuxState | no | BUG:oob_read |
| 243 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | cd_path | cd_path->ucMuxType | no | BUG:oob_read |
| 244 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | cd_path | cd_path->ucMuxControlPin | no | BUG:oob_read |
| 245 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | cd_path | cd_path->ucMuxState | no | BUG:oob_read |
| 246 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 247 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | con_obj | con_obj->ucNumberOfObjects | no | BUG:oob_read |
| 248 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 249 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 250 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 251 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 252 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | i2c_record | i2c_record->sucI2cId | no | BUG:oob_read |
| 253 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | i2c_config | i2c_config->ucAccess | no | BUG:oob_read |
| 254 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | hpd_record | hpd_record->ucHPDIntGPIOID | no | BUG:oob_read |
| 255 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | hpd_record | hpd_record->ucPlugged_PinState | no | BUG:oob_read |
| 256 | Critical | 350 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 257 | Critical | 350 | E | amdgpu_atombios_has_dce_engine_info | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path_obj | path_obj->ucNumOfDispPath | no | BUG:oob_read |
| 258 | Critical | 350 | E | amdgpu_atombios_init_mc_reg_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | reg_block | reg_block->usRegIndexTblSize | no | BUG:oob_read |
| 259 | Critical | 350 | E | amdgpu_atombios_init_mc_reg_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | reg_block | reg_block->asRegIndexBuf | no | BUG:oob_read |
| 260 | Critical | 350 | E | amdgpu_atombios_init_mc_reg_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | reg_block | reg_block->usRegIndexTblSize | no | BUG:oob_read |
| 261 | Critical | 350 | E | amdgpu_atombios_init_mc_reg_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | format | format->ucPreRegDataLength | no | BUG:oob_read |
| 262 | Critical | 350 | E | amdgpu_atombios_init_mc_reg_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | format | format->usRegIndex | no | BUG:oob_read |
| 263 | Critical | 350 | E | amdgpu_atombios_init_mc_reg_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | format | format->ucPreRegDataLength | no | BUG:oob_read |
| 264 | Critical | 350 | E | amdgpu_atombios_init_mc_reg_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | reg_block | reg_block->usRegDataBlkSize | no | BUG:oob_read |
| 265 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_num_se | no | BUG:oob_read |
| 266 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_num_cu_per_sh | no | BUG:oob_read |
| 267 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_num_sh_per_se | no | BUG:oob_read |
| 268 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_num_rb_per_se | no | BUG:oob_read |
| 269 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_num_tccs | no | BUG:oob_read |
| 270 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_num_gprs | no | BUG:oob_read |
| 271 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_num_max_gs_thds | no | BUG:oob_read |
| 272 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_gs_table_depth | no | BUG:oob_read |
| 273 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_gsprim_buff_depth | no | BUG:oob_read |
| 274 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_double_offchip_lds_buffer | no | BUG:oob_read |
| 275 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_wave_size | no | BUG:oob_read |
| 276 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_max_waves_per_simd | no | BUG:oob_read |
| 277 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_max_scratch_slots_per_cu | no | BUG:oob_read |
| 278 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->gc_lds_size | no | BUG:oob_read |
| 279 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->num_sc_per_sh | no | BUG:oob_read |
| 280 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->num_packer_per_sc | no | BUG:oob_read |
| 281 | Critical | 350 | E | amdgpu_device_parse_gpu_info_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | gpu_info_fw | gpu_info_fw->soc_bounding_box | no | BUG:oob_read |
| 282 | Critical | 350 | E | amdgpu_discovery_get_gc_major_minor_version | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 283 | Critical | 350 | E | amdgpu_discovery_get_gc_major_minor_version | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 284 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 285 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 286 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 287 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 288 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 289 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 290 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 291 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 292 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 293 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 294 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 295 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 296 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 297 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 298 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 299 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 300 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 301 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 302 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 303 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 304 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 305 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | BUG:oob_read |
| 306 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 307 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 308 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 309 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 310 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 311 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 312 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 313 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 314 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 315 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 316 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 317 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 318 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 319 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 320 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 321 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 322 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 323 | Critical | 350 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2 | no | BUG:oob_read |
| 324 | Critical | 350 | E | amdgpu_discovery_get_mall_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | mall_info | mall_info->v1 | no | BUG:oob_read |
| 325 | Critical | 350 | E | amdgpu_discovery_get_mall_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | mall_info | mall_info->v1 | no | BUG:oob_read |
| 326 | Critical | 350 | E | amdgpu_discovery_get_mall_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | mall_info | mall_info->v1 | no | BUG:oob_read |
| 327 | Critical | 350 | E | amdgpu_discovery_get_mall_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | mall_info | mall_info->v1 | no | BUG:oob_read |
| 328 | Critical | 350 | E | amdgpu_discovery_get_mall_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | mall_info | mall_info->v2 | no | BUG:oob_read |
| 329 | Critical | 350 | E | amdgpu_discovery_get_mall_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | mall_info | mall_info->v1 | no | BUG:oob_read |
| 330 | Critical | 350 | E | amdgpu_discovery_get_mall_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | mall_info | mall_info->v1 | no | BUG:oob_read |
| 331 | Critical | 350 | E | amdgpu_discovery_get_vcn_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | vcn_info | vcn_info->v1 | no | BUG:oob_read |
| 332 | Critical | 350 | E | amdgpu_discovery_get_vcn_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | vcn_info | vcn_info->v1 | no | BUG:oob_read |
| 333 | Critical | 350 | E | amdgpu_discovery_get_vcn_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | vcn_info | vcn_info->v1 | no | BUG:oob_read |
| 334 | Critical | 350 | E | amdgpu_discovery_get_vcn_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | vcn_info | vcn_info->v1 | no | BUG:oob_read |
| 335 | Critical | 350 | E | amdgpu_discovery_harvest_ip | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->version | no | BUG:oob_read |
| 336 | Critical | 350 | E | amdgpu_discovery_read_from_harvest_table | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | harvest_info | harvest_info->list | no | BUG:oob_read |
| 337 | Critical | 350 | E | amdgpu_discovery_read_from_harvest_table | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | harvest_info | harvest_info->list | no | BUG:oob_read |
| 338 | Critical | 350 | E | amdgpu_discovery_read_harvest_bit_per_ip | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->num_dies | no | BUG:oob_read |
| 339 | Critical | 350 | E | amdgpu_discovery_read_harvest_bit_per_ip | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->die_info | no | BUG:oob_read |
| 340 | Critical | 350 | E | amdgpu_discovery_read_harvest_bit_per_ip | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | dhdr | dhdr->num_ips | no | BUG:oob_read |
| 341 | Critical | 350 | E | amdgpu_discovery_read_harvest_bit_per_ip | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->number_instance | no | BUG:oob_read |
| 342 | Critical | 350 | E | amdgpu_discovery_read_harvest_bit_per_ip | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 343 | Critical | 350 | E | amdgpu_discovery_read_harvest_bit_per_ip | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->harvest | no | BUG:oob_read |
| 344 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->num_dies | no | BUG:oob_read |
| 345 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->die_info | no | BUG:oob_read |
| 346 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | dhdr | dhdr->num_ips | no | BUG:oob_read |
| 347 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | dhdr | dhdr->die_id | no | BUG:oob_read |
| 348 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->instance_number | no | BUG:oob_read |
| 349 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 350 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->num_base_address | no | BUG:oob_read |
| 351 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 352 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 353 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->instance_number | no | BUG:oob_read |
| 354 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->major | no | BUG:oob_read |
| 355 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->revision | no | BUG:oob_read |
| 356 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 357 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 358 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 359 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 360 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 361 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 362 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 363 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 364 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->base_addr_64_bit | no | BUG:oob_read |
| 365 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->base_address | no | BUG:oob_read |
| 366 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->base_address_64 | no | BUG:oob_read |
| 367 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->base_address | no | BUG:oob_read |
| 368 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->base_address | no | BUG:oob_read |
| 369 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | no | BUG:oob_read |
| 370 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->version | no | BUG:oob_read |
| 371 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->base_addr_64_bit | no | BUG:oob_read |
| 372 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->num_base_address | no | BUG:oob_read |
| 373 | Critical | 350 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->num_base_address | no | BUG:oob_read |
| 374 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | BUG:oob_read |
| 375 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | BUG:oob_read |
| 376 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | BUG:oob_read |
| 377 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | BUG:oob_read |
| 378 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | BUG:oob_read |
| 379 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | BUG:oob_read |
| 380 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | BUG:oob_read |
| 381 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->num_dies | no | BUG:oob_read |
| 382 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->die_info | no | BUG:oob_read |
| 383 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | dhdr | dhdr->num_ips | no | BUG:oob_read |
| 384 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | dhdr | dhdr->die_id | no | BUG:oob_read |
| 385 | Critical | 350 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->base_addr_64_bit | no | BUG:oob_read |
| 386 | Critical | 350 | E | amdgpu_discovery_table_check | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->signature | no | BUG:oob_read |
| 387 | Critical | 350 | E | amdgpu_discovery_table_check | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ihdr | ihdr->size | no | BUG:oob_read |
| 388 | Critical | 350 | E | amdgpu_discovery_table_check | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ghdr | ghdr->table_id | no | BUG:oob_read |
| 389 | Critical | 350 | E | amdgpu_discovery_table_check | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ghdr | ghdr->size | no | BUG:oob_read |
| 390 | Critical | 350 | E | amdgpu_discovery_table_check | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | hhdr | hhdr->signature | no | BUG:oob_read |
| 391 | Critical | 350 | E | amdgpu_discovery_table_check | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | vhdr | vhdr->table_id | no | BUG:oob_read |
| 392 | Critical | 350 | E | amdgpu_discovery_table_check | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | vhdr | vhdr->size_bytes | no | BUG:oob_read |
| 393 | Critical | 350 | E | amdgpu_discovery_table_check | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | mhdr | mhdr->table_id | no | BUG:oob_read |
| 394 | Critical | 350 | E | amdgpu_discovery_table_check | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | mhdr | mhdr->size_bytes | no | BUG:oob_read |
| 395 | Critical | 350 | E | amdgpu_discovery_verify_npsinfo | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | nhdr | nhdr->table_id | no | BUG:oob_read |
| 396 | Critical | 350 | F | amdgpu_gfx_rlc_setup_cp_table | drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.c | table_size | loop bound | no | BUG:oob_write |
| 397 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 398 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 399 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 400 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 401 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 402 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 403 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 404 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 405 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 406 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | clk_v | clk_v->ucNumEntries | no | BUG:oob_read |
| 407 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 408 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 409 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 410 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 411 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 412 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 413 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | psl | psl->ucNumEntries | no | BUG:oob_read |
| 414 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | psl | psl->entries | no | BUG:oob_read |
| 415 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | psl | psl->ucNumEntries | no | BUG:oob_read |
| 416 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usSclkLow | no | BUG:oob_read |
| 417 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usMclkLow | no | BUG:oob_read |
| 418 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usVoltage | no | BUG:oob_read |
| 419 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | psl | psl->ucNumEntries | no | BUG:oob_read |
| 420 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | cac_table | cac_table->ucNumEntries | no | BUG:oob_read |
| 421 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | cac_table | cac_table->entries | no | BUG:oob_read |
| 422 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | cac_table | cac_table->ucNumEntries | no | BUG:oob_read |
| 423 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usVddc1 | no | BUG:oob_read |
| 424 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usVddc2 | no | BUG:oob_read |
| 425 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usVddc3 | no | BUG:oob_read |
| 426 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usVddc | no | BUG:oob_read |
| 427 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->ulLeakageValue | no | BUG:oob_read |
| 428 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | cac_table | cac_table->ucNumEntries | no | BUG:oob_read |
| 429 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usSize | no | BUG:oob_read |
| 430 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | array | array->ucNumEntries | no | BUG:oob_read |
| 431 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | array | array->ucNumEntries | no | BUG:oob_read |
| 432 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 433 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 434 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->entries | no | BUG:oob_read |
| 435 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | states | states->entries | no | BUG:oob_read |
| 436 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | array | array->entries | no | BUG:oob_read |
| 437 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->ucVCEClockInfoIndex | no | BUG:oob_read |
| 438 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | vce_clk | vce_clk->usEVClkLow | no | BUG:oob_read |
| 439 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | vce_clk | vce_clk->usECClkLow | no | BUG:oob_read |
| 440 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usVoltage | no | BUG:oob_read |
| 441 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | states | states->numEntries | no | BUG:oob_read |
| 442 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | states | states->numEntries | no | BUG:oob_read |
| 443 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | array | array->entries | no | BUG:oob_read |
| 444 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | state_entry | state_entry->ucVCEClockInfoIndex | no | BUG:oob_read |
| 445 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | vce_clk | vce_clk->usEVClkLow | no | BUG:oob_read |
| 446 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | vce_clk | vce_clk->usECClkLow | no | BUG:oob_read |
| 447 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | state_entry | state_entry->ucClockInfoIndex | no | BUG:oob_read |
| 448 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | state_entry | state_entry->ucClockInfoIndex | no | BUG:oob_read |
| 449 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | array | array->ucNumEntries | no | BUG:oob_read |
| 450 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 451 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 452 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->entries | no | BUG:oob_read |
| 453 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 454 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | array | array->entries | no | BUG:oob_read |
| 455 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->ucUVDClockInfoIndex | no | BUG:oob_read |
| 456 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | uvd_clk | uvd_clk->usVClkLow | no | BUG:oob_read |
| 457 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | uvd_clk | uvd_clk->usDClkLow | no | BUG:oob_read |
| 458 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usVoltage | no | BUG:oob_read |
| 459 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 460 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 461 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->entries | no | BUG:oob_read |
| 462 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 463 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usSAMClockLow | no | BUG:oob_read |
| 464 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usVoltage | no | BUG:oob_read |
| 465 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppm | ppm->ucPpmDesign | no | BUG:oob_read |
| 466 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppm | ppm->usCpuCoreNumber | no | BUG:oob_read |
| 467 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppm | ppm->ulPlatformTDP | no | BUG:oob_read |
| 468 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppm | ppm->ulSmallACPlatformTDP | no | BUG:oob_read |
| 469 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppm | ppm->ulPlatformTDC | no | BUG:oob_read |
| 470 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppm | ppm->ulSmallACPlatformTDC | no | BUG:oob_read |
| 471 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppm | ppm->ulApuTDP | no | BUG:oob_read |
| 472 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppm | ppm->ulDGpuTDP | no | BUG:oob_read |
| 473 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppm | ppm->ulDGpuUlvPower | no | BUG:oob_read |
| 474 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppm | ppm->ulTjmax | no | BUG:oob_read |
| 475 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 476 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 477 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->entries | no | BUG:oob_read |
| 478 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 479 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usACPClockLow | no | BUG:oob_read |
| 480 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | entry | entry->usVoltage | no | BUG:oob_read |
| 481 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppt | ppt->usMaximumPowerDeliveryLimit | no | BUG:oob_read |
| 482 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppt | ppt->power_tune_table | no | BUG:oob_read |
| 483 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ppt | ppt->power_tune_table | no | BUG:oob_read |
| 484 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | pt | pt->usTDP | no | BUG:oob_read |
| 485 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | pt | pt->usConfigurableTDP | no | BUG:oob_read |
| 486 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | pt | pt->usTDC | no | BUG:oob_read |
| 487 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | pt | pt->usBatteryPowerLimit | no | BUG:oob_read |
| 488 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | pt | pt->usSmallPowerLimit | no | BUG:oob_read |
| 489 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | pt | pt->usLowCACLeakage | no | BUG:oob_read |
| 490 | Critical | 350 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | pt | pt->usHighCACLeakage | no | BUG:oob_read |
| 491 | Critical | 350 | B | amdgpu_ucode_patch_jt | drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | le32_to_cpu(header->jt_size) | le32_to_cpu(header->jt_size) * 4 | no | BUG:integer_overflow |
| 492 | Critical | 350 | A | amdgpu_ucode_patch_jt | drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | src_addr | memcpy() | no | BUG:oob_read |
| 493 | Critical | 350 | A | amdgpu_umsch_mm_allocate_ucode_buffer | drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c | fw_data | memcpy() | no | BUG:oob_read |
| 494 | Critical | 350 | A | amdgpu_umsch_mm_allocate_ucode_data_buffer | drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c | fw_data | memcpy() | no | BUG:oob_read |
| 495 | Critical | 350 | E | asd_get_response_tasklet | drivers/scsi/aic94xx/aic94xx_task.c | edb | edb->vaddr | no | BUG:oob_read |
| 496 | Critical | 350 | A | asd_get_response_tasklet | drivers/scsi/aic94xx/aic94xx_task.c | r | memcpy() | no | BUG:oob_read |
| 497 | Critical | 350 | A | ath10k_wmi_10_4_op_pull_mgmt_rx_ev | drivers/net/wireless/ath/ath10k/wmi.c | ext_info | memcpy() | no | BUG:oob_read |
| 498 | Critical | 350 | A | ath10k_wmi_op_pull_mgmt_rx_ev | drivers/net/wireless/ath/ath10k/wmi.c | ext_info | memcpy() | no | BUG:oob_read |
| 499 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->supported_bands | no | BUG:oob_read |
| 500 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->ampdu_density | no | BUG:oob_read |
| 501 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->phy_id | no | BUG:oob_read |
| 502 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->tx_chain_mask_2g | no | BUG:oob_read |
| 503 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->rx_chain_mask_2g | no | BUG:oob_read |
| 504 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->vht_cap_info_5g | no | BUG:oob_read |
| 505 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->vht_supp_mcs_5g | no | BUG:oob_read |
| 506 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_supp_mcs_5g | no | BUG:oob_read |
| 507 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->tx_chain_mask_5g | no | BUG:oob_read |
| 508 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->rx_chain_mask_5g | no | BUG:oob_read |
| 509 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->nss_ratio | no | BUG:oob_read |
| 510 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->nss_ratio | no | BUG:oob_read |
| 511 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->phy_id | no | BUG:oob_read |
| 512 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->max_bw_supported_2g | no | BUG:oob_read |
| 513 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->ht_cap_info_2g | no | BUG:oob_read |
| 514 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_cap_info_2g | no | BUG:oob_read |
| 515 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_cap_info_2g_ext | no | BUG:oob_read |
| 516 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_supp_mcs_2g | no | BUG:oob_read |
| 517 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_cap_phy_info_2g | no | BUG:oob_read |
| 518 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_ppet2g | no | BUG:oob_read |
| 519 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_ppet2g | no | BUG:oob_read |
| 520 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_ppet2g | no | BUG:oob_read |
| 521 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->phy_id | no | BUG:oob_read |
| 522 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->max_bw_supported_5g | no | BUG:oob_read |
| 523 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->ht_cap_info_5g | no | BUG:oob_read |
| 524 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_cap_info_5g | no | BUG:oob_read |
| 525 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_cap_info_5g_ext | no | BUG:oob_read |
| 526 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_supp_mcs_5g | no | BUG:oob_read |
| 527 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_cap_phy_info_5g | no | BUG:oob_read |
| 528 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_ppet5g | no | BUG:oob_read |
| 529 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_ppet5g | no | BUG:oob_read |
| 530 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_ppet5g | no | BUG:oob_read |
| 531 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->max_bw_supported_5g | no | BUG:oob_read |
| 532 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->ht_cap_info_5g | no | BUG:oob_read |
| 533 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_cap_info_5g | no | BUG:oob_read |
| 534 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_cap_info_5g_ext | no | BUG:oob_read |
| 535 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_supp_mcs_5g | no | BUG:oob_read |
| 536 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_cap_phy_info_5g | no | BUG:oob_read |
| 537 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_ppet5g | no | BUG:oob_read |
| 538 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_ppet5g | no | BUG:oob_read |
| 539 | Critical | 350 | E | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | mac_caps | mac_caps->he_ppet5g | no | BUG:oob_read |
| 540 | Critical | 350 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | datap | datap->h_source | no | BUG:oob_read |
| 541 | Critical | 350 | E | ath6kl_wmi_implicit_create_pstream | drivers/net/wireless/ath/ath6kl/wmi.c | llc_hdr | llc_hdr->eth_type | no | BUG:oob_read |
| 542 | Critical | 350 | F | atomctrl_initialize_mc_reg_table_v2_2 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | reg_block | loop bound | no | BUG:oob_write |
| 543 | Critical | 350 | F | be_cmd_get_profile_config | drivers/net/ethernet/emulex/benet/be_cmds.c | nic_pf_cnt | loop bound | no | BUG:oob_write |
| 544 | Critical | 350 | F | be_cmd_set_fw_log_level | drivers/net/ethernet/emulex/benet/be_cmds.c | (inline) | loop bound | no | BUG:oob_write |
| 545 | Critical | 350 | F | be_cmd_set_fw_log_level | drivers/net/ethernet/emulex/benet/be_cmds.c | num_modes | loop bound | no | BUG:oob_write |
| 546 | Critical | 350 | A | be_flash_skyhawk | drivers/net/ethernet/emulex/benet/be_cmds.c | img_offset | memcmp() in be_check_flash_crc() | no | BUG:oob_read |
| 547 | Critical | 350 | A | be_flash_skyhawk | drivers/net/ethernet/emulex/benet/be_cmds.c | img_size | memcmp() in be_check_flash_crc() | no | BUG:oob_read |
| 548 | Critical | 350 | F | bfa_phy_intr | drivers/scsi/bfa/bfa_ioc.c | sz | loop bound | no | BUG:oob_write |
| 549 | Critical | 350 | E | brcmf_cfg80211_escan_handler | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | bss | bss->length | no | BUG:oob_read |
| 550 | Critical | 350 | B | build_maps | drivers/mtd/ftl.c | blocks | blocks * sizeof(uint32_t) | no | BUG:integer_overflow |
| 551 | Critical | 350 | E | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->ep_state | no | BUG:oob_read |
| 552 | Critical | 350 | E | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->stream_info | no | BUG:oob_read |
| 553 | Critical | 350 | E | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->stream_info | no | BUG:oob_read |
| 554 | Critical | 350 | E | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->stream_info | no | BUG:oob_read |
| 555 | Critical | 350 | E | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->stream_info | no | BUG:oob_read |
| 556 | Critical | 350 | E | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->stream_info | no | BUG:oob_read |
| 557 | Critical | 350 | E | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | ep_ring | ep_ring->td_list | no | BUG:oob_read |
| 558 | Critical | 350 | G2 | cfam_write | drivers/fsi/fsi-core.c | write_len | copy_from_user() unvalidated size | no | BUG:stack_overflow |
| 559 | Critical | 350 | E | chcr_ktls_cpl_act_open_rpl | drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | atid | atid->? | yes? | BUG:oob_write |
| 560 | Critical | 350 | E | check_powerplay_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | state_arrays | state_arrays->ucNumEntries | no | BUG:oob_read |
| 561 | Critical | 350 | E | check_powerplay_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | state_arrays | state_arrays->ucNumEntries | no | BUG:oob_read |
| 562 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 563 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | state_array | state_array->states | no | BUG:oob_read |
| 564 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 565 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 566 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | non_clock_info_array | non_clock_info_array->nonClockInfo | no | BUG:oob_read |
| 567 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | non_clock_info_array | non_clock_info_array->ucEntrySize | no | BUG:oob_read |
| 568 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 569 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 570 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 571 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | clock_info | clock_info->ci | no | BUG:oob_read |
| 572 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | clock_info | clock_info->ci | no | BUG:oob_read |
| 573 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | clock_info | clock_info->ci | no | BUG:oob_read |
| 574 | Critical | 350 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | clock_info | clock_info->ci | no | BUG:oob_read |
| 575 | Critical | 350 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->r1_alt_dev_handle | no | BUG:oob_read |
| 576 | Critical | 350 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | scmd_local | scmd_local->cmd_priv | no | BUG:oob_read |
| 577 | Critical | 350 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->sync_cmd_idx | no | BUG:oob_read |
| 578 | Critical | 350 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_mfi | cmd_mfi->flags | no | BUG:oob_read |
| 579 | Critical | 350 | E | csio_wr_process_iq | drivers/scsi/csiostor/csio_wr.c | q_completed | q_completed->un | no | BUG:oob_read |
| 580 | Critical | 350 | E | csio_wr_process_iq | drivers/scsi/csiostor/csio_wr.c | q_completed | q_completed->un | no | BUG:oob_read |
| 581 | Critical | 350 | E | cxgb4_validate_boot_image | drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | pcir_header | pcir_header->indicator | no | BUG:oob_read |
| 582 | Critical | 350 | E | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | ip | ip->version | no | BUG:oob_read |
| 583 | Critical | 350 | E | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | tcp | tcp->source | no | BUG:oob_read |
| 584 | Critical | 350 | E | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | ip6 | ip6->saddr | no | BUG:oob_read |
| 585 | Critical | 350 | E | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | tcp | tcp->source | no | BUG:oob_read |
| 586 | Critical | 350 | A | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | ip6 | memcpy() | no | BUG:oob_read |
| 587 | Critical | 350 | E | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | ip6 | ip6->saddr | no | BUG:oob_read |
| 588 | Critical | 350 | A | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | ip6 | memcpy() | no | BUG:oob_read |
| 589 | Critical | 350 | E | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | ip6 | ip6->daddr | no | BUG:oob_read |
| 590 | Critical | 350 | E | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | tcp | tcp->source | no | BUG:oob_read |
| 591 | Critical | 350 | E | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | tcp | tcp->dest | no | BUG:oob_read |
| 592 | Critical | 350 | E | cxgbit_pass_accept_rpl | drivers/target/iscsi/cxgbit/cxgbit_cm.c | tcph | tcph->ece | no | BUG:oob_read |
| 593 | Critical | 350 | F | cxlctl_get_feature | drivers/cxl/core/features.c | count | loop bound | no | BUG:oob_write |
| 594 | Critical | 350 | A | dm_dmub_hw_init | drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | fw_inst_const | memcpy() | no | BUG:oob_read |
| 595 | Critical | 350 | A | dm_dmub_hw_init | drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | fw_bss_data | memcpy() | no | BUG:oob_read |
| 596 | Critical | 350 | E | ec_bhf_process_rx | drivers/net/ethernet/ec_bhf.c | skb | skb->protocol | no | BUG:oob_read |
| 597 | Critical | 350 | B | efx_devlink_info_running_v2 | drivers/net/ethernet/sfc/efx_devlink.c | offset | snprintf() | no | BUG:stack_overflow |
| 598 | Critical | 350 | C | efx_devlink_info_running_v2 | drivers/net/ethernet/sfc/efx_devlink.c | offset | subscript | no | BUG:stack_overflow |
| 599 | Critical | 350 | B | efx_devlink_info_running_v2 | drivers/net/ethernet/sfc/efx_devlink.c | offset | snprintf() | no | BUG:stack_overflow |
| 600 | Critical | 350 | C | efx_devlink_info_running_v2 | drivers/net/ethernet/sfc/efx_devlink.c | offset | subscript | no | BUG:stack_overflow |
| 601 | Critical | 350 | B | efx_devlink_info_running_v2 | drivers/net/ethernet/sfc/efx_devlink.c | offset | snprintf() | no | BUG:stack_overflow |
| 602 | Critical | 350 | C | efx_devlink_info_running_v2 | drivers/net/ethernet/sfc/efx_devlink.c | offset | subscript | no | BUG:stack_overflow |
| 603 | Critical | 350 | E | erdma_poll_single_cmd_completion | drivers/infiniband/hw/erdma/erdma_cmdq.c | comp_wait | comp_wait->cmd_status | no | BUG:oob_read |
| 604 | Critical | 350 | E | erdma_poll_single_cmd_completion | drivers/infiniband/hw/erdma/erdma_cmdq.c | comp_wait | comp_wait->cmd_status | yes? | BUG:oob_write |
| 605 | Critical | 350 | E | erdma_poll_single_cmd_completion | drivers/infiniband/hw/erdma/erdma_cmdq.c | comp_wait | comp_wait->comp_status | yes? | BUG:oob_write |
| 606 | Critical | 350 | E | erdma_poll_single_cmd_completion | drivers/infiniband/hw/erdma/erdma_cmdq.c | comp_wait | comp_wait->comp_data | yes? | BUG:oob_write |
| 607 | Critical | 350 | E | esas2r_read_image_type | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->code_type | no | BUG:oob_read |
| 608 | Critical | 350 | F | fc_fcp_recv | drivers/scsi/libfc/fc_fcp.c | (size_t) ntohl(dd->ft_burst_len) | loop bound | no | BUG:oob_write |
| 609 | Critical | 350 | E | fix_efi | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->image_length | no | BUG:oob_read |
| 610 | Critical | 350 | F | fun_handle_cqe_pkt | drivers/net/ethernet/fungible/funeth/funeth_rx.c | si | loop bound | no | BUG:oob_write |
| 611 | Critical | 350 | E | fwevtq_handler | drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | txq | txq->restarts | no | BUG:oob_read |
| 612 | Critical | 350 | E | fwevtq_handler | drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | txq | txq->q_type | no | BUG:oob_read |
| 613 | Critical | 350 | E | fwevtq_handler | drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | oq | oq->qresume_tsk | no | BUG:oob_read |
| 614 | Critical | 350 | E | gelic_wl_scan_complete_event | drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | scan_info | scan_info->size | no | BUG:oob_read |
| 615 | Critical | 350 | E | gelic_wl_scan_complete_event | drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | scan_info | scan_info->bssid | no | BUG:oob_read |
| 616 | Critical | 350 | E | gelic_wl_scan_complete_event | drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | scan_info | scan_info->channel | no | BUG:oob_read |
| 617 | Critical | 350 | E | gelic_wl_scan_complete_event | drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | scan_info | scan_info->bssid | no | BUG:oob_read |
| 618 | Critical | 350 | E | gelic_wl_scan_complete_event | drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | scan_info | scan_info->size | no | BUG:oob_read |
| 619 | Critical | 350 | E | gelic_wl_scan_complete_event | drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | scan_info | scan_info->essid | no | BUG:oob_read |
| 620 | Critical | 350 | E | gelic_wl_scan_complete_event | drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | scan_info | scan_info->essid | no | BUG:oob_read |
| 621 | Critical | 350 | E | gelic_wl_scan_complete_event | drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | scan_info | scan_info->rate | no | BUG:oob_read |
| 622 | Critical | 350 | E | gelic_wl_scan_complete_event | drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | scan_info | scan_info->ext_rate | no | BUG:oob_read |
| 623 | Critical | 350 | E | get_acp_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pExtendedHeader | pExtendedHeader->usSize | no | BUG:oob_read |
| 624 | Critical | 350 | E | get_cacp_tdp_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pExtendedHeader | pExtendedHeader->usSize | no | BUG:oob_read |
| 625 | Critical | 350 | E | get_hpd_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | header | header->record_type | no | BUG:oob_read |
| 626 | Critical | 350 | E | get_number_of_powerplay_table_entries_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | state_arrays | state_arrays->ucNumEntries | no | BUG:oob_read |
| 627 | Critical | 350 | E | get_powerplay_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | state_arrays | state_arrays->ucNumEntries | no | BUG:oob_read |
| 628 | Critical | 350 | E | get_powerplay_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | state_arrays | state_arrays->ucNumEntries | no | BUG:oob_read |
| 629 | Critical | 350 | E | get_powerplay_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | state_entry | state_entry->usClassification | no | BUG:oob_read |
| 630 | Critical | 350 | E | get_powerplay_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | state_entry | state_entry->usClassification2 | no | BUG:oob_read |
| 631 | Critical | 350 | E | get_samu_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | extended_header | extended_header->usSize | no | BUG:oob_read |
| 632 | Critical | 350 | E | get_sclk_vdd_gfx_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pExtendedHeader | pExtendedHeader->usSize | no | BUG:oob_read |
| 633 | Critical | 350 | E | get_uvd_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | extended_header | extended_header->usSize | no | BUG:oob_read |
| 634 | Critical | 350 | E | get_vce_state_table_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | clock_arrays | clock_arrays->clockInfo | no | BUG:oob_read |
| 635 | Critical | 350 | E | get_vce_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | extended_header | extended_header->usSize | no | BUG:oob_read |
| 636 | Critical | 350 | A | gfx_v10_0_cp_gfx_load_ce_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 637 | Critical | 350 | A | gfx_v10_0_cp_gfx_load_me_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 638 | Critical | 350 | A | gfx_v10_0_cp_gfx_load_pfp_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 639 | Critical | 350 | A | gfx_v10_0_mec_init | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 640 | Critical | 350 | A | gfx_v11_0_cp_compute_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 641 | Critical | 350 | A | gfx_v11_0_cp_compute_load_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_ucode | memcpy() | no | BUG:oob_read |
| 642 | Critical | 350 | A | gfx_v11_0_cp_compute_load_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 643 | Critical | 350 | A | gfx_v11_0_cp_gfx_load_me_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 644 | Critical | 350 | A | gfx_v11_0_cp_gfx_load_me_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_ucode | memcpy() | no | BUG:oob_read |
| 645 | Critical | 350 | A | gfx_v11_0_cp_gfx_load_me_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 646 | Critical | 350 | A | gfx_v11_0_cp_gfx_load_pfp_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 647 | Critical | 350 | A | gfx_v11_0_cp_gfx_load_pfp_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_ucode | memcpy() | no | BUG:oob_read |
| 648 | Critical | 350 | A | gfx_v11_0_cp_gfx_load_pfp_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 649 | Critical | 350 | A | gfx_v12_0_cp_compute_load_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_ucode | memcpy() | no | BUG:oob_read |
| 650 | Critical | 350 | A | gfx_v12_0_cp_compute_load_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 651 | Critical | 350 | A | gfx_v12_0_cp_gfx_load_me_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_ucode | memcpy() | no | BUG:oob_read |
| 652 | Critical | 350 | A | gfx_v12_0_cp_gfx_load_me_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 653 | Critical | 350 | A | gfx_v12_0_cp_gfx_load_pfp_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_ucode | memcpy() | no | BUG:oob_read |
| 654 | Critical | 350 | A | gfx_v12_0_cp_gfx_load_pfp_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 655 | Critical | 350 | A | gfx_v12_1_init_cp_compute_microcode_bo | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_ucode | memcpy() | no | BUG:oob_read |
| 656 | Critical | 350 | A | gfx_v12_1_init_cp_compute_microcode_bo | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_data | memcpy() | no | BUG:oob_read |
| 657 | Critical | 350 | A | gfx_v9_0_mec_init | drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 658 | Critical | 350 | A | gfx_v9_4_3_mec_init | drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | fw_data | memcpy() | no | BUG:oob_read |
| 659 | Critical | 350 | E | goodix_hid_irq | drivers/hid/hid-goodix-spi.c | pkg | pkg->data | no | BUG:oob_read |
| 660 | Critical | 350 | B | hl_fw_dynamic_read_and_validate_descriptor | drivers/accel/habanalabs/common/firmware_if.c | fw_data_size | sizeof(struct comms_msg_header) + fw_data_size | no | BUG:undersized_alloc |
| 661 | Critical | 350 | F | hpsa_scsi_do_report_phys_luns | drivers/scsi/hpsa.c | nphys | loop bound | no | BUG:oob_write |
| 662 | Critical | 350 | E | i40e_lldp_to_dcb_config | drivers/net/ethernet/intel/i40e/i40e_dcb.c | tlv | tlv->typelength | no | BUG:oob_read |
| 663 | Critical | 350 | E | i40e_parse_cee_tlv | drivers/net/ethernet/intel/i40e/i40e_dcb.c | sub_tlv | sub_tlv->? | no | BUG:oob_read |
| 664 | Critical | 350 | E | i40e_parse_cee_tlv | drivers/net/ethernet/intel/i40e/i40e_dcb.c | sub_tlv | sub_tlv->? | no | BUG:oob_read |
| 665 | Critical | 350 | E | i40e_parse_cee_tlv | drivers/net/ethernet/intel/i40e/i40e_dcb.c | sub_tlv | sub_tlv->? | no | BUG:oob_read |
| 666 | Critical | 350 | E | i40e_parse_cee_tlv | drivers/net/ethernet/intel/i40e/i40e_dcb.c | sub_tlv | sub_tlv->hdr | no | BUG:oob_read |
| 667 | Critical | 350 | E | i40e_parse_cee_tlv | drivers/net/ethernet/intel/i40e/i40e_dcb.c | sub_tlv | sub_tlv->hdr | no | BUG:oob_read |
| 668 | Critical | 350 | F | ibmvfc_channel_setup_done | drivers/scsi/ibmvscsi/ibmvfc.c | active_queues | loop bound | no | BUG:oob_write |
| 669 | Critical | 350 | E | ice_find_buf_table | drivers/net/ethernet/intel/ice/ice_ddp.c | nvms | nvms->vers | no | BUG:oob_read |
| 670 | Critical | 350 | E | ice_find_buf_table | drivers/net/ethernet/intel/ice/ice_ddp.c | nvms | nvms->table_count | no | BUG:oob_read |
| 671 | Critical | 350 | E | ice_find_seg_in_pkg | drivers/net/ethernet/intel/ice/ice_ddp.c | seg | seg->seg_type | no | BUG:oob_read |
| 672 | Critical | 350 | E | ice_lldp_to_dcb_cfg | drivers/net/ethernet/intel/ice/ice_dcb.c | tlv | tlv->typelen | no | BUG:oob_read |
| 673 | Critical | 350 | E | ice_parse_cee_tlv | drivers/net/ethernet/intel/ice/ice_dcb.c | sub_tlv | sub_tlv->? | no | BUG:oob_read |
| 674 | Critical | 350 | E | ice_parse_cee_tlv | drivers/net/ethernet/intel/ice/ice_dcb.c | sub_tlv | sub_tlv->? | no | BUG:oob_read |
| 675 | Critical | 350 | E | ice_parse_cee_tlv | drivers/net/ethernet/intel/ice/ice_dcb.c | sub_tlv | sub_tlv->? | no | BUG:oob_read |
| 676 | Critical | 350 | E | ice_parse_cee_tlv | drivers/net/ethernet/intel/ice/ice_dcb.c | sub_tlv | sub_tlv->hdr | no | BUG:oob_read |
| 677 | Critical | 350 | E | ice_parse_cee_tlv | drivers/net/ethernet/intel/ice/ice_dcb.c | sub_tlv | sub_tlv->hdr | no | BUG:oob_read |
| 678 | Critical | 350 | A | idpf_rx_splitq_clean | drivers/net/ethernet/intel/idpf/idpf_txrx.c | rx_buf | memcpy() in idpf_rx_hsplit_wa() | no | BUG:oob_read |
| 679 | Critical | 350 | E | init_dpm2_parameters | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | extended_header | extended_header->usPPMTableOffset | no | BUG:oob_read |
| 680 | Critical | 350 | E | init_dpm2_parameters | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | extended_header | extended_header->usSize | no | BUG:oob_read |
| 681 | Critical | 350 | F | init_dpm_2_parameters | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | pVddcCACTable | loop bound | no | BUG:oob_write |
| 682 | Critical | 350 | F | init_dpm_2_parameters | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | pVddgfxCACTable | loop bound | no | BUG:oob_write |
| 683 | Critical | 350 | F | init_dpm_2_parameters | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | vddc_table | loop bound | no | BUG:oob_write |
| 684 | Critical | 350 | F | init_dpm_2_parameters | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | vdd_mem_table | loop bound | no | BUG:oob_write |
| 685 | Critical | 350 | F | init_dpm_2_parameters | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | vddci_table | loop bound | no | BUG:oob_write |
| 686 | Critical | 350 | E | init_over_drive_limits | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | gfxclk_dep_table | gfxclk_dep_table->ucRevId | no | BUG:oob_read |
| 687 | Critical | 350 | E | init_overdrive_limits_V2_1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | header | header->ulMaxEngineClock | no | BUG:oob_read |
| 688 | Critical | 350 | E | init_overdrive_limits_V2_1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | header | header->ulMaxMemoryClock | no | BUG:oob_read |
| 689 | Critical | 350 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | ptable | ptable->ucNumEntries | no | BUG:oob_read |
| 690 | Critical | 350 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | ptable | ptable->ucNumEntries | no | BUG:oob_read |
| 691 | Critical | 350 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | ptable | ptable->entries | no | BUG:oob_read |
| 692 | Critical | 350 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | ptable | ptable->entries | no | BUG:oob_read |
| 693 | Critical | 350 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | ptable | ptable->entries | no | BUG:oob_read |
| 694 | Critical | 350 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | ptable | ptable->entries | no | BUG:oob_read |
| 695 | Critical | 350 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | ptable | ptable->entries | no | BUG:oob_read |
| 696 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | thermal_controller | thermal_controller->ucType | no | BUG:oob_read |
| 697 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | thermal_controller | thermal_controller->ucI2cLine | no | BUG:oob_read |
| 698 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | thermal_controller | thermal_controller->ucI2cAddress | no | BUG:oob_read |
| 699 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | thermal_controller | thermal_controller->ucFanParameters | no | BUG:oob_read |
| 700 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | thermal_controller | thermal_controller->ucFanParameters | no | BUG:oob_read |
| 701 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | thermal_controller | thermal_controller->ucFanMinRPM | no | BUG:oob_read |
| 702 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | thermal_controller | thermal_controller->ucFanMaxRPM | no | BUG:oob_read |
| 703 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | header | header->ucRevId | no | BUG:oob_read |
| 704 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->ucRevId | no | BUG:oob_read |
| 705 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanOutputSensitivity | no | BUG:oob_read |
| 706 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanRPMMax | no | BUG:oob_read |
| 707 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usThrottlingRPM | no | BUG:oob_read |
| 708 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanAcousticLimit | no | BUG:oob_read |
| 709 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usTargetTemperature | no | BUG:oob_read |
| 710 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usMinimumPWMLimit | no | BUG:oob_read |
| 711 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usTargetGfxClk | no | BUG:oob_read |
| 712 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanGainEdge | no | BUG:oob_read |
| 713 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanGainHotspot | no | BUG:oob_read |
| 714 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanGainLiquid | no | BUG:oob_read |
| 715 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanGainVrVddc | no | BUG:oob_read |
| 716 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanGainVrMvdd | no | BUG:oob_read |
| 717 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanGainPlx | no | BUG:oob_read |
| 718 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanGainHbm | no | BUG:oob_read |
| 719 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->ucEnableZeroRPM | no | BUG:oob_read |
| 720 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanStopTemperature | no | BUG:oob_read |
| 721 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v1 | fan_table_v1->usFanStartTemperature | no | BUG:oob_read |
| 722 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->ucFanParameters | no | BUG:oob_read |
| 723 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->ucFanMinRPM | no | BUG:oob_read |
| 724 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->ucFanMaxRPM | no | BUG:oob_read |
| 725 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usFanOutputSensitivity | no | BUG:oob_read |
| 726 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->ucFanMaxRPM | no | BUG:oob_read |
| 727 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usThrottlingRPM | no | BUG:oob_read |
| 728 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usFanAcousticLimitRpm | no | BUG:oob_read |
| 729 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usTargetTemperature | no | BUG:oob_read |
| 730 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usMinimumPWMLimit | no | BUG:oob_read |
| 731 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usTargetGfxClk | no | BUG:oob_read |
| 732 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usFanGainEdge | no | BUG:oob_read |
| 733 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usFanGainHotspot | no | BUG:oob_read |
| 734 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usFanGainLiquid | no | BUG:oob_read |
| 735 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usFanGainVrVddc | no | BUG:oob_read |
| 736 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usFanGainVrMvdd | no | BUG:oob_read |
| 737 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usFanGainPlx | no | BUG:oob_read |
| 738 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usFanGainHbm | no | BUG:oob_read |
| 739 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->ucEnableZeroRPM | no | BUG:oob_read |
| 740 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usFanStopTemperature | no | BUG:oob_read |
| 741 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v2 | fan_table_v2->usFanStartTemperature | no | BUG:oob_read |
| 742 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->ucFanParameters | no | BUG:oob_read |
| 743 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->ucFanMinRPM | no | BUG:oob_read |
| 744 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->ucFanMaxRPM | no | BUG:oob_read |
| 745 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usFanOutputSensitivity | no | BUG:oob_read |
| 746 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->ucFanMaxRPM | no | BUG:oob_read |
| 747 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usThrottlingRPM | no | BUG:oob_read |
| 748 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usFanAcousticLimitRpm | no | BUG:oob_read |
| 749 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usTargetTemperature | no | BUG:oob_read |
| 750 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usMinimumPWMLimit | no | BUG:oob_read |
| 751 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usTargetGfxClk | no | BUG:oob_read |
| 752 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usFanGainEdge | no | BUG:oob_read |
| 753 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usFanGainHotspot | no | BUG:oob_read |
| 754 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usFanGainLiquid | no | BUG:oob_read |
| 755 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usFanGainVrVddc | no | BUG:oob_read |
| 756 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usFanGainVrMvdd | no | BUG:oob_read |
| 757 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usFanGainPlx | no | BUG:oob_read |
| 758 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usFanGainHbm | no | BUG:oob_read |
| 759 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->ucEnableZeroRPM | no | BUG:oob_read |
| 760 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usFanStopTemperature | no | BUG:oob_read |
| 761 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usFanStartTemperature | no | BUG:oob_read |
| 762 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | fan_table_v3 | fan_table_v3->usMGpuThrottlingRPM | no | BUG:oob_read |
| 763 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | thermal_controller | thermal_controller->ucType | no | BUG:oob_read |
| 764 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | thermal_controller | thermal_controller->ucI2cLine | no | BUG:oob_read |
| 765 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | thermal_controller | thermal_controller->ucI2cAddress | no | BUG:oob_read |
| 766 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | thermal_controller | thermal_controller->ucFanParameters | no | BUG:oob_read |
| 767 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | thermal_controller | thermal_controller->ucFanParameters | no | BUG:oob_read |
| 768 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | thermal_controller | thermal_controller->ucFanMinRPM | no | BUG:oob_read |
| 769 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | thermal_controller | thermal_controller->ucFanMaxRPM | no | BUG:oob_read |
| 770 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fan_table | fan_table->ucRevId | no | BUG:oob_read |
| 771 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fan_table | fan_table->ucRevId | no | BUG:oob_read |
| 772 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->ucTHyst | no | BUG:oob_read |
| 773 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->usTMin | no | BUG:oob_read |
| 774 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->usTMed | no | BUG:oob_read |
| 775 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->usTHigh | no | BUG:oob_read |
| 776 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->usPWMMin | no | BUG:oob_read |
| 777 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->usPWMMed | no | BUG:oob_read |
| 778 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->usPWMHigh | no | BUG:oob_read |
| 779 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->usTMax | no | BUG:oob_read |
| 780 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->ucFanControlMode | no | BUG:oob_read |
| 781 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->usFanPWMMax | no | BUG:oob_read |
| 782 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->usFanOutputSensitivity | no | BUG:oob_read |
| 783 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->usFanRPMMax | no | BUG:oob_read |
| 784 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->ulMinFanSCLKAcousticLimit | no | BUG:oob_read |
| 785 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->ucTargetTemperature | no | BUG:oob_read |
| 786 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | tonga_fan_table | tonga_fan_table->ucMinimumPWMLimit | no | BUG:oob_read |
| 787 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->ucTHyst | no | BUG:oob_read |
| 788 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usTMin | no | BUG:oob_read |
| 789 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usTMed | no | BUG:oob_read |
| 790 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usTHigh | no | BUG:oob_read |
| 791 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usPWMMin | no | BUG:oob_read |
| 792 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usPWMMed | no | BUG:oob_read |
| 793 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usPWMHigh | no | BUG:oob_read |
| 794 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usTMax | no | BUG:oob_read |
| 795 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->ucFanControlMode | no | BUG:oob_read |
| 796 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usFanPWMMax | no | BUG:oob_read |
| 797 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->ucFanTableFormat | no | BUG:oob_read |
| 798 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usFanOutputSensitivity | no | BUG:oob_read |
| 799 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usFanRPMMax | no | BUG:oob_read |
| 800 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->ulMinFanSCLKAcousticLimit | no | BUG:oob_read |
| 801 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->ucTargetTemperature | no | BUG:oob_read |
| 802 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->ucMinimumPWMLimit | no | BUG:oob_read |
| 803 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usFanGainEdge | no | BUG:oob_read |
| 804 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usFanGainHotspot | no | BUG:oob_read |
| 805 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usFanGainLiquid | no | BUG:oob_read |
| 806 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usFanGainVrVddc | no | BUG:oob_read |
| 807 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usFanGainVrMvdd | no | BUG:oob_read |
| 808 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usFanGainPlx | no | BUG:oob_read |
| 809 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->ucFanTableFormat | no | BUG:oob_read |
| 810 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fiji_fan_table | fiji_fan_table->usFanGainHbm | no | BUG:oob_read |
| 811 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table2 | fan_table2->usTMax | no | BUG:oob_read |
| 812 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->ucTHyst | no | BUG:oob_read |
| 813 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->ucFanTableFormat | no | BUG:oob_read |
| 814 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usTMin | no | BUG:oob_read |
| 815 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usTMed | no | BUG:oob_read |
| 816 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usTHigh | no | BUG:oob_read |
| 817 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table3 | fan_table3->ucFanControlMode | no | BUG:oob_read |
| 818 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usPWMMin | no | BUG:oob_read |
| 819 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usPWMMed | no | BUG:oob_read |
| 820 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usPWMHigh | no | BUG:oob_read |
| 821 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usTMax | no | BUG:oob_read |
| 822 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table3 | fan_table3->usFanPWMMax | no | BUG:oob_read |
| 823 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->ucFanControlMode | no | BUG:oob_read |
| 824 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usFanPWMMax | no | BUG:oob_read |
| 825 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table3 | fan_table3->usFanOutputSensitivity | no | BUG:oob_read |
| 826 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usFanOutputSensitivity | no | BUG:oob_read |
| 827 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->ucFanTableFormat | no | BUG:oob_read |
| 828 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usFanRPMMax | no | BUG:oob_read |
| 829 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->ulMinFanSCLKAcousticLimit | no | BUG:oob_read |
| 830 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->ucTargetTemperature | no | BUG:oob_read |
| 831 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->ucMinimumPWMLimit | no | BUG:oob_read |
| 832 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table4 | fan_table4->usFanRPMMax | no | BUG:oob_read |
| 833 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usFanGainEdge | no | BUG:oob_read |
| 834 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usFanGainHotspot | no | BUG:oob_read |
| 835 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->ucFanTableFormat | no | BUG:oob_read |
| 836 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usFanGainLiquid | no | BUG:oob_read |
| 837 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usFanGainVrVddc | no | BUG:oob_read |
| 838 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usFanGainVrMvdd | no | BUG:oob_read |
| 839 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usFanGainPlx | no | BUG:oob_read |
| 840 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->usFanGainHbm | no | BUG:oob_read |
| 841 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table5 | fan_table5->usFanCurrentLow | no | BUG:oob_read |
| 842 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->ucEnableZeroRPM | no | BUG:oob_read |
| 843 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table5 | fan_table5->usFanCurrentHigh | no | BUG:oob_read |
| 844 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->ucFanStopTemperature | no | BUG:oob_read |
| 845 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table5 | fan_table5->usFanRPMLow | no | BUG:oob_read |
| 846 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | polaris_fan_table | polaris_fan_table->ucFanStartTemperature | no | BUG:oob_read |
| 847 | Critical | 350 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table5 | fan_table5->usFanRPMHigh | no | BUG:oob_read |
| 848 | Critical | 350 | F | ionic_lif_rss_config | drivers/net/ethernet/pensando/ionic/ionic_lif.c | tbl_sz | loop bound | no | BUG:oob_write |
| 849 | Critical | 350 | F | ionic_lif_rss_init | drivers/net/ethernet/pensando/ionic/ionic_lif.c | tbl_sz | loop bound | no | BUG:oob_write |
| 850 | Critical | 350 | E | ipc_mux_get_payload_from_adb | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->signature | no | BUG:oob_read |
| 851 | Critical | 350 | E | ipc_mux_get_payload_from_adb | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | dg | dg->datagram_index | no | BUG:oob_read |
| 852 | Critical | 350 | E | ipr_log_fabric_error | drivers/scsi/ipr.c | fabric | fabric->length | no | BUG:oob_read |
| 853 | Critical | 350 | E | ipr_log_sis64_fabric_error | drivers/scsi/ipr.c | fabric | fabric->length | no | BUG:oob_read |
| 854 | Critical | 350 | F | ipw_load_firmware | drivers/net/wireless/intel/ipw2x00/ipw2200.c | nr | loop bound | no | BUG:oob_write |
| 855 | Critical | 350 | A | iqs5xx_fw_file_parse | drivers/input/touchscreen/iqs5xx.c | rec_addr | memcpy() | yes? | BUG:oob_write |
| 856 | Critical | 350 | F | iwl_dump_ini_config_iter | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | (inline) | loop bound | no | BUG:oob_write |
| 857 | Critical | 350 | F | iwl_dump_ini_csr_iter | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | (inline) | loop bound | no | BUG:oob_write |
| 858 | Critical | 350 | F | iwl_dump_ini_dbgi_sram_iter | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | (inline) | loop bound | no | BUG:oob_write |
| 859 | Critical | 350 | F | iwl_dump_ini_prph_snps_dphyip_iter | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | (inline) | loop bound | no | BUG:oob_write |
| 860 | Critical | 350 | E | iwl_mvm_rx_mgmt_prot | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | mmie | mmie->key_id | no | BUG:oob_read |
| 861 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 862 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | state_array | state_array->states | no | BUG:oob_read |
| 863 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 864 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 865 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | non_clock_info_array | non_clock_info_array->nonClockInfo | no | BUG:oob_read |
| 866 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 867 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 868 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | non_clock_info_array | non_clock_info_array->ucEntrySize | no | BUG:oob_read |
| 869 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 870 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | clock_info | clock_info->sumo | no | BUG:oob_read |
| 871 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | clock_info | clock_info->sumo | no | BUG:oob_read |
| 872 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 873 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | state_array | state_array->states | no | BUG:oob_read |
| 874 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 875 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 876 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | non_clock_info_array | non_clock_info_array->nonClockInfo | no | BUG:oob_read |
| 877 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 878 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 879 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | clock_info_array | clock_info_array->ucNumEntries | no | BUG:oob_read |
| 880 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | non_clock_info_array | non_clock_info_array->ucEntrySize | no | BUG:oob_read |
| 881 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 882 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | clock_info | clock_info->sumo | no | BUG:oob_read |
| 883 | Critical | 350 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | clock_info | clock_info->sumo | no | BUG:oob_read |
| 884 | Critical | 350 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->eth803_hdr | no | BUG:oob_read |
| 885 | Critical | 350 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->eth803_hdr | no | BUG:oob_read |
| 886 | Critical | 350 | A | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | memcmp() | no | BUG:oob_read |
| 887 | Critical | 350 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->rfc1042_hdr | no | BUG:oob_read |
| 888 | Critical | 350 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_ethhdr | p_ethhdr->h_dest | no | BUG:oob_read |
| 889 | Critical | 350 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_ethhdr | p_ethhdr->h_dest | no | BUG:oob_read |
| 890 | Critical | 350 | F | load_waveform | drivers/video/fbdev/metronomefb.c | rl | loop bound | no | BUG:oob_write |
| 891 | Critical | 350 | F | lpfc_cmpl_els_qfpa | drivers/scsi/lpfc/lpfc_els.c | len | loop bound | no | BUG:oob_write |
| 892 | Critical | 350 | B | lpfc_els_rcv_fpin | drivers/scsi/lpfc/lpfc_els.c | cnt | cnt + sizeof(struct fc_els_fpin) | no | BUG:integer_overflow |
| 893 | Critical | 350 | B | lpfc_send_rscn_event | drivers/scsi/lpfc/lpfc_els.c | payload_len | sizeof(struct lpfc_rscn_event_header) + payload_len | no | BUG:undersized_alloc |
| 894 | Critical | 350 | E | megasas_complete_r1_command | drivers/scsi/megaraid/megaraid_sas_fusion.c | r1_cmd | r1_cmd->cmd_completed | no | BUG:oob_read |
| 895 | Critical | 350 | E | megasas_complete_r1_command | drivers/scsi/megaraid/megaraid_sas_fusion.c | r1_cmd | r1_cmd->RaidContext | no | BUG:oob_read |
| 896 | Critical | 350 | E | megasas_complete_r1_command | drivers/scsi/megaraid/megaraid_sas_fusion.c | rctx_g35 | rctx_g35->status | no | BUG:oob_read |
| 897 | Critical | 350 | E | megasas_complete_r1_command | drivers/scsi/megaraid/megaraid_sas_fusion.c | r1_cmd | r1_cmd->DataLength | no | BUG:oob_read |
| 898 | Critical | 350 | E | megasas_complete_r1_command | drivers/scsi/megaraid/megaraid_sas_fusion.c | r1_cmd | r1_cmd->sense | no | BUG:oob_read |
| 899 | Critical | 350 | F | megasas_sync_map_info | drivers/scsi/megaraid/megaraid_sas_fusion.c | num_lds | loop bound | no | BUG:oob_write |
| 900 | Critical | 350 | A | mes_v11_0_allocate_ucode_buffer | drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 901 | Critical | 350 | A | mes_v11_0_allocate_ucode_data_buffer | drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 902 | Critical | 350 | A | mes_v12_0_allocate_ucode_buffer | drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 903 | Critical | 350 | A | mes_v12_0_allocate_ucode_data_buffer | drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 904 | Critical | 350 | A | mes_v12_1_allocate_ucode_buffer | drivers/gpu/drm/amd/amdgpu/mes_v12_1.c | fw_data | memcpy() | no | BUG:oob_read |
| 905 | Critical | 350 | A | mes_v12_1_allocate_ucode_data_buffer | drivers/gpu/drm/amd/amdgpu/mes_v12_1.c | fw_data | memcpy() | no | BUG:oob_read |
| 906 | Critical | 350 | B | mlxfw_mfa2_file_component_get | drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c | comp_data | sizeof(*comp_data) + comp_buf_size | no | BUG:integer_overflow |
| 907 | Critical | 350 | F | mlxsw_linecard_types_file_parse | drivers/net/ethernet/mellanox/mlxsw/core_linecards.c | ini_file_size | loop bound | no | BUG:oob_write |
| 908 | Critical | 350 | E | modify_device_id | drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | pcir_header | pcir_header->code_type | no | BUG:oob_read |
| 909 | Critical | 350 | E | modify_device_id | drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | pcir_header | pcir_header->device_id | yes? | BUG:oob_write |
| 910 | Critical | 350 | E | modify_device_id | drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | pcir_header | pcir_header->device_id | yes? | BUG:oob_write |
| 911 | Critical | 350 | E | modify_device_id | drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | pcir_header | pcir_header->indicator | no | BUG:oob_read |
| 912 | Critical | 350 | A | mptctl_reply | drivers/message/fusion/mptctl.c | sense_data | memcpy() | no | BUG:oob_read |
| 913 | Critical | 350 | A | mptscsih_copy_sense_data | drivers/message/fusion/mptscsih.c | sense_data | memcpy() | no | BUG:oob_read |
| 914 | Critical | 350 | E | ms_lib_process_bootblock | drivers/usb/storage/ene_ub6250.c | idi | idi->wIDIgeneralConfiguration | no | BUG:oob_read |
| 915 | Critical | 350 | A | mspro_block_read_attributes | drivers/memstick/core/mspro_block.c | buffer | memcpy() | no | BUG:oob_read |
| 916 | Critical | 350 | E | mt7603_fill_txs | drivers/net/wireless/mediatek/mt76/mt7603/mac.c | cur_rate | cur_rate->idx | no | BUG:oob_read |
| 917 | Critical | 350 | E | mt7615_fill_txs | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | cur_rate | cur_rate->idx | no | BUG:oob_read |
| 918 | Critical | 350 | E | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 919 | Critical | 350 | E | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 920 | Critical | 350 | E | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 921 | Critical | 350 | E | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 922 | Critical | 350 | E | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 923 | Critical | 350 | E | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 924 | Critical | 350 | E | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 925 | Critical | 350 | E | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 926 | Critical | 350 | E | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 927 | Critical | 350 | E | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 928 | Critical | 350 | E | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 929 | Critical | 350 | E | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 930 | Critical | 350 | E | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | hdr_gap | hdr_gap->? | no | BUG:oob_read |
| 931 | Critical | 350 | B | mtd_parser_tplink_safeloader_read_table | drivers/mtd/parsers/tplink_safeloader.c | size | size + 1 | no | BUG:undersized_alloc |
| 932 | Critical | 350 | A | mwifiex_handle_uap_rx_forward | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | memcpy() | no | BUG:oob_read |
| 933 | Critical | 350 | E | mwifiex_handle_uap_rx_forward | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | no | BUG:oob_read |
| 934 | Critical | 350 | E | nand_flash_detect_ext_param_page | drivers/mtd/nand/raw/nand_onfi.c | s | s->type | no | BUG:oob_read |
| 935 | Critical | 350 | E | nand_flash_detect_ext_param_page | drivers/mtd/nand/raw/nand_onfi.c | ecc | ecc->codeword_size | no | BUG:oob_read |
| 936 | Critical | 350 | E | nand_flash_detect_ext_param_page | drivers/mtd/nand/raw/nand_onfi.c | ecc | ecc->ecc_bits | no | BUG:oob_read |
| 937 | Critical | 350 | E | nand_flash_detect_ext_param_page | drivers/mtd/nand/raw/nand_onfi.c | ecc | ecc->codeword_size | no | BUG:oob_read |
| 938 | Critical | 350 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | sts_data0 | sts_data0->? | no | BUG:oob_read |
| 939 | Critical | 350 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | sts_data0 | sts_data0->? | no | BUG:oob_read |
| 940 | Critical | 350 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | sts_data0 | sts_data0->? | no | BUG:oob_read |
| 941 | Critical | 350 | F | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | desc_cnt | loop bound | no | BUG:oob_write |
| 942 | Critical | 350 | F | nfp_dump_csr_range | drivers/net/ethernet/netronome/nfp/nfp_net_debugdump.c | reg_sz | loop bound | no | BUG:oob_write |
| 943 | Critical | 350 | E | ni_parse_power_table | drivers/gpu/drm/radeon/ni_dpm.c | power_state | power_state->v1 | no | BUG:oob_read |
| 944 | Critical | 350 | E | ni_parse_power_table | drivers/gpu/drm/radeon/ni_dpm.c | power_state | power_state->v1 | no | BUG:oob_read |
| 945 | Critical | 350 | E | nvme_query_fdp_granularity | drivers/nvme/host/core.c | desc | desc->dsze | no | BUG:oob_read |
| 946 | Critical | 350 | E | nvme_query_fdp_granularity | drivers/nvme/host/core.c | desc | desc->nrg | no | BUG:oob_read |
| 947 | Critical | 350 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | exp_if | exp_if->if_id | no | BUG:oob_read |
| 948 | Critical | 350 | F | pcrs_show | drivers/char/tpm/tpm-sysfs.c | num_pcrs | loop bound | no | BUG:oob_write |
| 949 | Critical | 350 | F | pdsfc_get_operations | drivers/fwctl/pds/main.c | num_entries | loop bound | no | BUG:oob_write |
| 950 | Critical | 350 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pstate_arrays | pstate_arrays->ucNumEntries | no | BUG:oob_read |
| 951 | Critical | 350 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pnon_clock_arrays | pnon_clock_arrays->nonClockInfo | no | BUG:oob_read |
| 952 | Critical | 350 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pstate_entry_v2 | pstate_entry_v2->nonClockInfoIndex | no | BUG:oob_read |
| 953 | Critical | 350 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pnon_clock_arrays | pnon_clock_arrays->ucEntrySize | no | BUG:oob_read |
| 954 | Critical | 350 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pnon_clock_arrays | pnon_clock_arrays->ucEntrySize | no | BUG:oob_read |
| 955 | Critical | 350 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pstate_entry_v2 | pstate_entry_v2->ucNumDPMLevels | no | BUG:oob_read |
| 956 | Critical | 350 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pclock_arrays | pclock_arrays->clockInfo | no | BUG:oob_read |
| 957 | Critical | 350 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pstate_entry_v2 | pstate_entry_v2->clockInfoIndex | no | BUG:oob_read |
| 958 | Critical | 350 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pclock_arrays | pclock_arrays->ucEntrySize | no | BUG:oob_read |
| 959 | Critical | 350 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pstate_entry | pstate_entry->ucNonClockStateIndex | no | BUG:oob_read |
| 960 | Critical | 350 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pstate_entry | pstate_entry->ucClockStateIndices | no | BUG:oob_read |
| 961 | Critical | 350 | E | pp_tables_get_num_of_entries | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pstate_arrays | pstate_arrays->ucNumEntries | no | BUG:oob_read |
| 962 | Critical | 350 | E | ppt_get_num_of_vce_state_table_entries_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | vce_state_table | vce_state_table->ucNumEntries | no | BUG:oob_read |
| 963 | Critical | 350 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | vce_state_table | vce_state_table->ucNumEntries | no | BUG:oob_read |
| 964 | Critical | 350 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | vce_state_record | vce_state_record->ucSCLKIndex | no | BUG:oob_read |
| 965 | Critical | 350 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | vce_state_record | vce_state_record->ucVCEClockIndex | no | BUG:oob_read |
| 966 | Critical | 350 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | vce_state_record | vce_state_record->ucFlag | no | BUG:oob_read |
| 967 | Critical | 350 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | mm_dep_record | mm_dep_record->ulEClk | no | BUG:oob_read |
| 968 | Critical | 350 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | mm_dep_record | mm_dep_record->ulEClk | no | BUG:oob_read |
| 969 | Critical | 350 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | sclk_dep_record | sclk_dep_record->ulSclk | no | BUG:oob_read |
| 970 | Critical | 350 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | vce_state_record | vce_state_record->ucMCLKIndex | no | BUG:oob_read |
| 971 | Critical | 350 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | mclk_dep_table | mclk_dep_table->ucNumEntries | no | BUG:oob_read |
| 972 | Critical | 350 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | mclk_dep_record | mclk_dep_record->ulMclk | no | BUG:oob_read |
| 973 | Critical | 350 | B | pqi_get_device_lists | drivers/scsi/smartpqi/smartpqi_init.c | logdev_data_length | logdev_data_length + sizeof(struct report_log_lun) | no | BUG:undersized_alloc |
| 974 | Critical | 350 | E | pqi_process_config_table | drivers/scsi/smartpqi/smartpqi_init.c | section | section->section_id | no | BUG:oob_read |
| 975 | Critical | 350 | E | pqi_process_config_table | drivers/scsi/smartpqi/smartpqi_init.c | section | section->next_section_offset | no | BUG:oob_read |
| 976 | Critical | 350 | F | prepare_xfer | drivers/mtd/ftl.c | nbam | loop bound | no | BUG:oob_write |
| 977 | Critical | 350 | E | qla27xx_execute_fwdt_template | drivers/scsi/qla2xxx/qla_tmpl.c | tmp | tmp->? | no | BUG:oob_read |
| 978 | Critical | 350 | F | qla27xx_fwdt_entry_t262 | drivers/scsi/qla2xxx/qla_tmpl.c | dwords | loop bound | no | BUG:oob_write |
| 979 | Critical | 350 | F | qla27xx_fwdt_entry_t262 | drivers/scsi/qla2xxx/qla_tmpl.c | dwords | loop bound | no | BUG:oob_write |
| 980 | Critical | 350 | F | qla27xx_fwdt_entry_t272 | drivers/scsi/qla2xxx/qla_tmpl.c | dwords | loop bound | no | BUG:oob_write |
| 981 | Critical | 350 | F | qla27xx_fwdt_entry_t272 | drivers/scsi/qla2xxx/qla_tmpl.c | dwords | loop bound | no | BUG:oob_write |
| 982 | Critical | 350 | E | qla27xx_walk_template | drivers/scsi/qla2xxx/qla_tmpl.c | ent | ent->hdr | no | BUG:oob_read |
| 983 | Critical | 350 | F | qla28xx_load_fw_template | drivers/scsi/qla2xxx/qla_init.c | risc_size | loop bound | no | BUG:oob_write |
| 984 | Critical | 350 | B | qla28xx_load_fw_template | drivers/scsi/qla2xxx/qla_init.c | risc_size | risc_size * sizeof(*dcode) | no | BUG:integer_overflow |
| 985 | Critical | 350 | A | qla28xx_write_flash_data | drivers/scsi/qla2xxx/qla_sup.c | buf_size_without_sfub | memcpy() in qla28xx_extract_sfub_and_verify() | no | BUG:oob_read |
| 986 | Critical | 350 | F | qla2x00_load_risc | drivers/scsi/qla2xxx/qla_init.c | wlen | loop bound | no | BUG:oob_write |
| 987 | Critical | 350 | F | qla4_84xx_minidump_process_rddfe | drivers/scsi/qla4xxx/ql4_nx.c | count | loop bound | no | BUG:oob_write |
| 988 | Critical | 350 | F | qla4_84xx_minidump_process_rdmdio | drivers/scsi/qla4xxx/ql4_nx.c | count | loop bound | no | BUG:oob_write |
| 989 | Critical | 350 | F | qla83xx_minidump_process_pollrd | drivers/scsi/qla4xxx/ql4_nx.c | (inline) | loop bound | no | BUG:oob_write |
| 990 | Critical | 350 | E | qlcnic_validate_bootld | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | descr | descr->findex | no | BUG:oob_read |
| 991 | Critical | 350 | E | qlcnic_validate_fw | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | descr | descr->findex | no | BUG:oob_read |
| 992 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 993 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 994 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 995 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 996 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 997 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 998 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 999 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 1000 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan | no | BUG:oob_read |
| 1001 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | clk_v | clk_v->ucNumEntries | no | BUG:oob_read |
| 1002 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 1003 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 1004 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 1005 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 1006 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 1007 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | clk_v | clk_v->entries | no | BUG:oob_read |
| 1008 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | psl | psl->ucNumEntries | no | BUG:oob_read |
| 1009 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | psl | psl->entries | no | BUG:oob_read |
| 1010 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | psl | psl->ucNumEntries | no | BUG:oob_read |
| 1011 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usSclkLow | no | BUG:oob_read |
| 1012 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usMclkLow | no | BUG:oob_read |
| 1013 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usVoltage | no | BUG:oob_read |
| 1014 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | psl | psl->ucNumEntries | no | BUG:oob_read |
| 1015 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | cac_table | cac_table->ucNumEntries | no | BUG:oob_read |
| 1016 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | cac_table | cac_table->entries | no | BUG:oob_read |
| 1017 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | cac_table | cac_table->ucNumEntries | no | BUG:oob_read |
| 1018 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usVddc1 | no | BUG:oob_read |
| 1019 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usVddc2 | no | BUG:oob_read |
| 1020 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usVddc3 | no | BUG:oob_read |
| 1021 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usVddc | no | BUG:oob_read |
| 1022 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->ulLeakageValue | no | BUG:oob_read |
| 1023 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | cac_table | cac_table->ucNumEntries | no | BUG:oob_read |
| 1024 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usSize | no | BUG:oob_read |
| 1025 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | array | array->ucNumEntries | no | BUG:oob_read |
| 1026 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | array | array->ucNumEntries | no | BUG:oob_read |
| 1027 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1028 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1029 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->entries | no | BUG:oob_read |
| 1030 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | states | states->entries | no | BUG:oob_read |
| 1031 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1032 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | array | array->entries | no | BUG:oob_read |
| 1033 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->ucVCEClockInfoIndex | no | BUG:oob_read |
| 1034 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | vce_clk | vce_clk->usEVClkLow | no | BUG:oob_read |
| 1035 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | vce_clk | vce_clk->usECClkLow | no | BUG:oob_read |
| 1036 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usVoltage | no | BUG:oob_read |
| 1037 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | states | states->numEntries | no | BUG:oob_read |
| 1038 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | array | array->entries | no | BUG:oob_read |
| 1039 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | state_entry | state_entry->ucVCEClockInfoIndex | no | BUG:oob_read |
| 1040 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | vce_clk | vce_clk->usEVClkLow | no | BUG:oob_read |
| 1041 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | vce_clk | vce_clk->usECClkLow | no | BUG:oob_read |
| 1042 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | state_entry | state_entry->ucClockInfoIndex | no | BUG:oob_read |
| 1043 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | state_entry | state_entry->ucClockInfoIndex | no | BUG:oob_read |
| 1044 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | array | array->ucNumEntries | no | BUG:oob_read |
| 1045 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1046 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1047 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->entries | no | BUG:oob_read |
| 1048 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1049 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | array | array->entries | no | BUG:oob_read |
| 1050 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->ucUVDClockInfoIndex | no | BUG:oob_read |
| 1051 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | uvd_clk | uvd_clk->usVClkLow | no | BUG:oob_read |
| 1052 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | uvd_clk | uvd_clk->usDClkLow | no | BUG:oob_read |
| 1053 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usVoltage | no | BUG:oob_read |
| 1054 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1055 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1056 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->entries | no | BUG:oob_read |
| 1057 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1058 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usSAMClockLow | no | BUG:oob_read |
| 1059 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usVoltage | no | BUG:oob_read |
| 1060 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppm | ppm->ucPpmDesign | no | BUG:oob_read |
| 1061 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppm | ppm->usCpuCoreNumber | no | BUG:oob_read |
| 1062 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppm | ppm->ulPlatformTDP | no | BUG:oob_read |
| 1063 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppm | ppm->ulSmallACPlatformTDP | no | BUG:oob_read |
| 1064 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppm | ppm->ulPlatformTDC | no | BUG:oob_read |
| 1065 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppm | ppm->ulSmallACPlatformTDC | no | BUG:oob_read |
| 1066 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppm | ppm->ulApuTDP | no | BUG:oob_read |
| 1067 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppm | ppm->ulDGpuTDP | no | BUG:oob_read |
| 1068 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppm | ppm->ulDGpuUlvPower | no | BUG:oob_read |
| 1069 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppm | ppm->ulTjmax | no | BUG:oob_read |
| 1070 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1071 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1072 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->entries | no | BUG:oob_read |
| 1073 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:oob_read |
| 1074 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usACPClockLow | no | BUG:oob_read |
| 1075 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | entry | entry->usVoltage | no | BUG:oob_read |
| 1076 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppt | ppt->usMaximumPowerDeliveryLimit | no | BUG:oob_read |
| 1077 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppt | ppt->power_tune_table | no | BUG:oob_read |
| 1078 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ppt | ppt->power_tune_table | no | BUG:oob_read |
| 1079 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | pt | pt->usTDP | no | BUG:oob_read |
| 1080 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | pt | pt->usConfigurableTDP | no | BUG:oob_read |
| 1081 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | pt | pt->usTDC | no | BUG:oob_read |
| 1082 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | pt | pt->usBatteryPowerLimit | no | BUG:oob_read |
| 1083 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | pt | pt->usSmallPowerLimit | no | BUG:oob_read |
| 1084 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | pt | pt->usLowCACLeakage | no | BUG:oob_read |
| 1085 | Critical | 350 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | pt | pt->usHighCACLeakage | no | BUG:oob_read |
| 1086 | Critical | 350 | E | radeon_atom_get_mclk_range_table | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->usModuleSize | no | BUG:oob_read |
| 1087 | Critical | 350 | E | radeon_atom_get_mclk_range_table | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->usModuleSize | no | BUG:oob_read |
| 1088 | Critical | 350 | E | radeon_atom_get_mclk_range_table | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->asMemTiming | no | BUG:oob_read |
| 1089 | Critical | 350 | E | radeon_atom_get_mclk_range_table | drivers/gpu/drm/radeon/radeon_atombios.c | format | format->ulClkRange | no | BUG:oob_read |
| 1090 | Critical | 350 | E | radeon_atom_get_memory_info | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->usSize | no | BUG:oob_read |
| 1091 | Critical | 350 | E | radeon_atom_get_memory_info | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->asMemory | no | BUG:oob_read |
| 1092 | Critical | 350 | E | radeon_atom_get_memory_info | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->asMemory | no | BUG:oob_read |
| 1093 | Critical | 350 | E | radeon_atom_get_memory_info | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->usModuleSize | no | BUG:oob_read |
| 1094 | Critical | 350 | E | radeon_atom_get_memory_info | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->ucMemoryVenderID | no | BUG:oob_read |
| 1095 | Critical | 350 | E | radeon_atom_get_memory_info | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->ucMemoryType | no | BUG:oob_read |
| 1096 | Critical | 350 | E | radeon_atom_get_memory_info | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->usModuleSize | no | BUG:oob_read |
| 1097 | Critical | 350 | E | radeon_atom_get_memory_info | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->ucMemoryVenderID | no | BUG:oob_read |
| 1098 | Critical | 350 | E | radeon_atom_get_memory_info | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->ucMemoryType | no | BUG:oob_read |
| 1099 | Critical | 350 | E | radeon_atom_init_mc_reg_table | drivers/gpu/drm/radeon/radeon_atombios.c | reg_block | reg_block->usRegIndexTblSize | no | BUG:oob_read |
| 1100 | Critical | 350 | E | radeon_atom_init_mc_reg_table | drivers/gpu/drm/radeon/radeon_atombios.c | reg_block | reg_block->asRegIndexBuf | no | BUG:oob_read |
| 1101 | Critical | 350 | E | radeon_atom_init_mc_reg_table | drivers/gpu/drm/radeon/radeon_atombios.c | reg_block | reg_block->usRegIndexTblSize | no | BUG:oob_read |
| 1102 | Critical | 350 | E | radeon_atom_init_mc_reg_table | drivers/gpu/drm/radeon/radeon_atombios.c | format | format->ucPreRegDataLength | no | BUG:oob_read |
| 1103 | Critical | 350 | E | radeon_atom_init_mc_reg_table | drivers/gpu/drm/radeon/radeon_atombios.c | format | format->usRegIndex | no | BUG:oob_read |
| 1104 | Critical | 350 | E | radeon_atom_init_mc_reg_table | drivers/gpu/drm/radeon/radeon_atombios.c | format | format->ucPreRegDataLength | no | BUG:oob_read |
| 1105 | Critical | 350 | E | radeon_atom_init_mc_reg_table | drivers/gpu/drm/radeon/radeon_atombios.c | reg_block | reg_block->usRegDataBlkSize | no | BUG:oob_read |
| 1106 | Critical | 350 | E | radeon_atombios_get_lvds_info | drivers/gpu/drm/radeon/radeon_atombios.c | fake_edid_record | fake_edid_record->ucFakeEDIDLength | no | BUG:oob_read |
| 1107 | Critical | 350 | E | radeon_atombios_get_lvds_info | drivers/gpu/drm/radeon/radeon_atombios.c | fake_edid_record | fake_edid_record->ucFakeEDIDLength | no | BUG:oob_read |
| 1108 | Critical | 350 | E | radeon_atombios_get_lvds_info | drivers/gpu/drm/radeon/radeon_atombios.c | fake_edid_record | fake_edid_record->ucFakeEDIDString | no | BUG:oob_read |
| 1109 | Critical | 350 | E | radeon_atombios_get_lvds_info | drivers/gpu/drm/radeon/radeon_atombios.c | panel_res_record | panel_res_record->usHSize | no | BUG:oob_read |
| 1110 | Critical | 350 | E | radeon_atombios_get_lvds_info | drivers/gpu/drm/radeon/radeon_atombios.c | panel_res_record | panel_res_record->usVSize | no | BUG:oob_read |
| 1111 | Critical | 350 | E | radeon_atombios_parse_power_table_4_5 | drivers/gpu/drm/radeon/radeon_atombios.c | power_state | power_state->v1 | no | BUG:oob_read |
| 1112 | Critical | 350 | E | radeon_atombios_parse_power_table_4_5 | drivers/gpu/drm/radeon/radeon_atombios.c | power_state | power_state->v1 | no | BUG:oob_read |
| 1113 | Critical | 350 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 1114 | Critical | 350 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1115 | Critical | 350 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | non_clock_info_array | non_clock_info_array->nonClockInfo | no | BUG:oob_read |
| 1116 | Critical | 350 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1117 | Critical | 350 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1118 | Critical | 350 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1119 | Critical | 350 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1120 | Critical | 350 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | clock_info_array | clock_info_array->clockInfo | no | BUG:oob_read |
| 1121 | Critical | 350 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1122 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path_obj | path_obj->ucNumOfDispPath | no | BUG:oob_read |
| 1123 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path_obj | path_obj->asDispPath | no | BUG:oob_read |
| 1124 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usSize | no | BUG:oob_read |
| 1125 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usDeviceTag | no | BUG:oob_read |
| 1126 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usConnObjectId | no | BUG:oob_read |
| 1127 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usConnObjectId | no | BUG:oob_read |
| 1128 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usDeviceTag | no | BUG:oob_read |
| 1129 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | enc_obj | enc_obj->ucNumberOfObjects | no | BUG:oob_read |
| 1130 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | enc_obj | enc_obj->asObjects | no | BUG:oob_read |
| 1131 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | enc_obj | enc_obj->asObjects | no | BUG:oob_read |
| 1132 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 1133 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 1134 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 1135 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 1136 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | cap_record | cap_record->usEncoderCap | no | BUG:oob_read |
| 1137 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 1138 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | router_obj | router_obj->ucNumberOfObjects | no | BUG:oob_read |
| 1139 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | router_obj | router_obj->asObjects | no | BUG:oob_read |
| 1140 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | router_obj | router_obj->asObjects | no | BUG:oob_read |
| 1141 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | router_obj | router_obj->asObjects | no | BUG:oob_read |
| 1142 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | router_src_dst_table | router_src_dst_table->ucNumberOfSrc | no | BUG:oob_read |
| 1143 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 1144 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 1145 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 1146 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 1147 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | i2c_record | i2c_record->sucI2cId | no | BUG:oob_read |
| 1148 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | i2c_config | i2c_config->ucAccess | no | BUG:oob_read |
| 1149 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | i2c_record | i2c_record->ucI2CAddr | no | BUG:oob_read |
| 1150 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | ddc_path | ddc_path->ucMuxType | no | BUG:oob_read |
| 1151 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | ddc_path | ddc_path->ucMuxControlPin | no | BUG:oob_read |
| 1152 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | ddc_path | ddc_path->ucMuxState | no | BUG:oob_read |
| 1153 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | cd_path | cd_path->ucMuxType | no | BUG:oob_read |
| 1154 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | cd_path | cd_path->ucMuxControlPin | no | BUG:oob_read |
| 1155 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | cd_path | cd_path->ucMuxState | no | BUG:oob_read |
| 1156 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 1157 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | con_obj | con_obj->ucNumberOfObjects | no | BUG:oob_read |
| 1158 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 1159 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 1160 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 1161 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordType | no | BUG:oob_read |
| 1162 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | i2c_record | i2c_record->sucI2cId | no | BUG:oob_read |
| 1163 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | i2c_config | i2c_config->ucAccess | no | BUG:oob_read |
| 1164 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | hpd_record | hpd_record->ucHPDIntGPIOID | no | BUG:oob_read |
| 1165 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | hpd_record | hpd_record->ucPlugged_PinState | no | BUG:oob_read |
| 1166 | Critical | 350 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | record->ucRecordSize | no | BUG:oob_read |
| 1167 | Critical | 350 | E | rmi_f34v7_parse_image_header_10 | drivers/input/rmi4/rmi_f34v7.c | descriptor | descriptor->content_address | no | BUG:oob_read |
| 1168 | Critical | 350 | E | rmi_f34v7_parse_image_header_10 | drivers/input/rmi4/rmi_f34v7.c | descriptor | descriptor->content_length | no | BUG:oob_read |
| 1169 | Critical | 350 | E | rmi_f34v7_parse_image_header_10 | drivers/input/rmi4/rmi_f34v7.c | descriptor | descriptor->container_id | no | BUG:oob_read |
| 1170 | Critical | 350 | E | rmi_f34v7_parse_image_header_10 | drivers/input/rmi4/rmi_f34v7.c | descriptor | descriptor->content_address | no | BUG:oob_read |
| 1171 | Critical | 350 | E | rmi_f34v7_parse_image_header_10 | drivers/input/rmi4/rmi_f34v7.c | descriptor | descriptor->content_length | no | BUG:oob_read |
| 1172 | Critical | 350 | E | rmi_f34v7_parse_img_header_10_bl_container | drivers/input/rmi4/rmi_f34v7.c | descriptor | descriptor->container_id | no | BUG:oob_read |
| 1173 | Critical | 350 | E | rmi_f34v7_parse_img_header_10_bl_container | drivers/input/rmi4/rmi_f34v7.c | descriptor | descriptor->content_address | no | BUG:oob_read |
| 1174 | Critical | 350 | E | rmi_f34v7_parse_img_header_10_bl_container | drivers/input/rmi4/rmi_f34v7.c | descriptor | descriptor->content_length | no | BUG:oob_read |
| 1175 | Critical | 350 | F | rpmi_clk_get_supported_rates | drivers/clk/clk-rpmi.c | (inline) | loop bound | no | BUG:oob_write |
| 1176 | Critical | 350 | F | rpmi_clk_get_supported_rates | drivers/clk/clk-rpmi.c | (inline) | loop bound | no | BUG:oob_write |
| 1177 | Critical | 350 | E | rs780_parse_power_table | drivers/gpu/drm/radeon/rs780_dpm.c | power_state | power_state->v1 | no | BUG:oob_read |
| 1178 | Critical | 350 | E | rs780_parse_power_table | drivers/gpu/drm/radeon/rs780_dpm.c | power_state | power_state->v1 | no | BUG:oob_read |
| 1179 | Critical | 350 | E | rtw89_mac_diag_do_equalv | drivers/net/wireless/realtek/rtw89/debug.c | name | name->len | no | BUG:oob_read |
| 1180 | Critical | 350 | E | rtw89_mac_diag_do_equalv | drivers/net/wireless/realtek/rtw89/debug.c | name | name->string | no | BUG:oob_read |
| 1181 | Critical | 350 | E | rtw89_mac_diag_do_equalv | drivers/net/wireless/realtek/rtw89/debug.c | msg | msg->len | no | BUG:oob_read |
| 1182 | Critical | 350 | E | rtw89_mac_diag_do_increment | drivers/net/wireless/realtek/rtw89/debug.c | name | name->len | no | BUG:oob_read |
| 1183 | Critical | 350 | E | rtw89_mac_diag_do_increment | drivers/net/wireless/realtek/rtw89/debug.c | name | name->string | no | BUG:oob_read |
| 1184 | Critical | 350 | E | rtw89_mac_diag_do_increment | drivers/net/wireless/realtek/rtw89/debug.c | msg | msg->len | no | BUG:oob_read |
| 1185 | Critical | 350 | E | rtw89_mac_diag_iter_all | drivers/net/wireless/realtek/rtw89/debug.c | msg_start | msg_start->? | no | BUG:oob_read |
| 1186 | Critical | 350 | E | rtw89_mac_diag_iter_all | drivers/net/wireless/realtek/rtw89/debug.c | msg_start | msg_start->? | no | BUG:oob_read |
| 1187 | Critical | 350 | E | rtw89_mac_diag_iter_all | drivers/net/wireless/realtek/rtw89/debug.c | msg_start | msg_start->? | no | BUG:oob_read |
| 1188 | Critical | 350 | E | rtw89_mac_diag_iter_all | drivers/net/wireless/realtek/rtw89/debug.c | msg_start | msg_start->? | no | BUG:oob_read |
| 1189 | Critical | 350 | E | rtw89_mac_diag_iter_all | drivers/net/wireless/realtek/rtw89/debug.c | msg_start | msg_start->? | no | BUG:oob_read |
| 1190 | Critical | 350 | E | rv6xx_parse_power_table | drivers/gpu/drm/radeon/rv6xx_dpm.c | power_state | power_state->v1 | no | BUG:oob_read |
| 1191 | Critical | 350 | E | rv6xx_parse_power_table | drivers/gpu/drm/radeon/rv6xx_dpm.c | power_state | power_state->v1 | no | BUG:oob_read |
| 1192 | Critical | 350 | E | rv7xx_parse_power_table | drivers/gpu/drm/radeon/rv770_dpm.c | power_state | power_state->v1 | no | BUG:oob_read |
| 1193 | Critical | 350 | E | rv7xx_parse_power_table | drivers/gpu/drm/radeon/rv770_dpm.c | power_state | power_state->v1 | no | BUG:oob_read |
| 1194 | Critical | 350 | E | rx_urb_complete | drivers/net/wireless/purelifi/plfxlc/usb.c | length | length->? | no | BUG:oob_read |
| 1195 | Critical | 350 | A | sdma_v7_0_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | fw_data | memcpy() | no | BUG:oob_read |
| 1196 | Critical | 350 | A | sdma_v7_1_inst_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v7_1.c | fw_data | memcpy() | no | BUG:oob_read |
| 1197 | Critical | 350 | G1 | send_exception_work_handler | drivers/gpu/drm/amd/amdkfd/kfd_process.c | | put_user() retval discarded | no | BUG:oob_write |
| 1198 | Critical | 350 | F | sh_eth_rx | drivers/net/ethernet/renesas/sh_eth.c | pkt_len | loop bound | no | BUG:oob_write |
| 1199 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 1200 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | state_array | state_array->states | no | BUG:oob_read |
| 1201 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1202 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | non_clock_info_array | non_clock_info_array->nonClockInfo | no | BUG:oob_read |
| 1203 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | non_clock_info_array | non_clock_info_array->ucEntrySize | no | BUG:oob_read |
| 1204 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | clock_info_array | clock_info_array->ucNumEntries | no | BUG:oob_read |
| 1205 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | clock_info | clock_info->si | no | BUG:oob_read |
| 1206 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | clock_info | clock_info->si | no | BUG:oob_read |
| 1207 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | clock_info | clock_info->si | no | BUG:oob_read |
| 1208 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 1209 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | state_array | state_array->states | no | BUG:oob_read |
| 1210 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 1211 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1212 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | non_clock_info_array | non_clock_info_array->nonClockInfo | no | BUG:oob_read |
| 1213 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | non_clock_info_array | non_clock_info_array->ucEntrySize | no | BUG:oob_read |
| 1214 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1215 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1216 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | clock_info_array | clock_info_array->ucNumEntries | no | BUG:oob_read |
| 1217 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1218 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | clock_info | clock_info->si | no | BUG:oob_read |
| 1219 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | clock_info | clock_info->si | no | BUG:oob_read |
| 1220 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | clock_info | clock_info->si | no | BUG:oob_read |
| 1221 | Critical | 350 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | clock_info | clock_info->si | no | BUG:oob_read |
| 1222 | Critical | 350 | A | smp_snoop | drivers/infiniband/hw/mlx4/mad.c | bn | memcpy() in mlx4_ib_update_cache_on_guid_change() | yes? | BUG:oob_write |
| 1223 | Critical | 350 | E | smp_snoop | drivers/infiniband/hw/mlx4/mad.c | bn | bn->? | no | BUG:oob_read |
| 1224 | Critical | 350 | E | smu7_get_pp_table_entry_callback_func_v1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | mclk_dep_table | mclk_dep_table->entries | no | BUG:oob_read |
| 1225 | Critical | 350 | E | smu7_get_pp_table_entry_callback_func_v1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | sclk_dep_table | sclk_dep_table->ucRevId | no | BUG:oob_read |
| 1226 | Critical | 350 | E | smu7_get_pp_table_entry_callback_func_v1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | mclk_dep_table | mclk_dep_table->entries | no | BUG:oob_read |
| 1227 | Critical | 350 | E | smu7_get_pp_table_entry_callback_func_v1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | sclk_dep_table | sclk_dep_table->ucRevId | no | BUG:oob_read |
| 1228 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 1229 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | state_array | state_array->states | no | BUG:oob_read |
| 1230 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 1231 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1232 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | non_clock_info_array | non_clock_info_array->nonClockInfo | no | BUG:oob_read |
| 1233 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1234 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1235 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | clock_info_array | clock_info_array->clockInfo | no | BUG:oob_read |
| 1236 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | clock_info_array | clock_info_array->ucEntrySize | no | BUG:oob_read |
| 1237 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | non_clock_info_array | non_clock_info_array->ucEntrySize | no | BUG:oob_read |
| 1238 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1239 | Critical | 350 | E | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 1240 | Critical | 350 | E | tg3_load_firmware_cpu | drivers/net/ethernet/broadcom/tg3.c | fw_hdr | fw_hdr->len | no | BUG:oob_read |
| 1241 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 1242 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | state_array | state_array->states | no | BUG:oob_read |
| 1243 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 1244 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1245 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | non_clock_info_array | non_clock_info_array->nonClockInfo | no | BUG:oob_read |
| 1246 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1247 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1248 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | clock_info_array | clock_info_array->ucNumEntries | no | BUG:oob_read |
| 1249 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | non_clock_info_array | non_clock_info_array->ucEntrySize | no | BUG:oob_read |
| 1250 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | power_state | power_state->v2 | no | BUG:oob_read |
| 1251 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | state_array | state_array->ucNumEntries | no | BUG:oob_read |
| 1252 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | clock_info | clock_info->sumo | no | BUG:oob_read |
| 1253 | Critical | 350 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | clock_info | clock_info->sumo | no | BUG:oob_read |
| 1254 | Critical | 350 | A | tsi721_get_inb_message | drivers/rapidio/devices/tsi721.c | rx_virt | memcpy() | no | BUG:oob_read |
| 1255 | Critical | 350 | E | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | resp | resp->numDesc | no | BUG:oob_read |
| 1256 | Critical | 350 | E | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | resp | resp->seqNo | no | BUG:oob_read |
| 1257 | Critical | 350 | E | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | resp | resp->cmd | no | BUG:oob_read |
| 1258 | Critical | 350 | E | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | rxb | rxb->skb | no | BUG:oob_read |
| 1259 | Critical | 350 | E | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | rxb | rxb->dma_addr | no | BUG:oob_read |
| 1260 | Critical | 350 | E | vce_v1_0_load_fw | drivers/gpu/drm/amd/amdgpu/vce_v1_0.c | sign | sign->number | no | BUG:oob_read |
| 1261 | Critical | 350 | E | vce_v1_0_load_fw | drivers/gpu/drm/amd/amdgpu/vce_v1_0.c | sign | sign->val | no | BUG:oob_read |
| 1262 | Critical | 350 | E | vce_v1_0_load_fw | drivers/gpu/drm/amd/amdgpu/vce_v1_0.c | sign | sign->length | yes? | BUG:oob_write |
| 1263 | Critical | 350 | E | vce_v1_0_load_fw | drivers/gpu/drm/amd/amdgpu/vce_v1_0.c | sign | sign->length | yes? | BUG:oob_write |
| 1264 | Critical | 350 | E | vce_v1_0_load_fw | drivers/gpu/drm/amd/amdgpu/vce_v1_0.c | sign | sign->val | yes? | BUG:oob_write |
| 1265 | Critical | 350 | E | vega10_get_number_of_powerplay_table_entries | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | state_arrays | state_arrays->ucNumEntries | no | BUG:oob_read |
| 1266 | Critical | 350 | E | vega10_get_powerplay_table_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | state_arrays | state_arrays->ucNumEntries | no | BUG:oob_read |
| 1267 | Critical | 350 | E | vega10_get_powerplay_table_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | state_arrays | state_arrays->ucNumEntries | no | BUG:oob_read |
| 1268 | Critical | 350 | E | vega10_get_powerplay_table_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | state_arrays | state_arrays->states | no | BUG:oob_read |
| 1269 | Critical | 350 | E | vega10_get_powerplay_table_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | state_entry | state_entry->usClassification | no | BUG:oob_read |
| 1270 | Critical | 350 | E | vega10_get_powerplay_table_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | state_entry | state_entry->usClassification2 | no | BUG:oob_read |
| 1271 | Critical | 350 | E | vega10_get_pp_table_entry_callback_func | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | socclk_dep_table | socclk_dep_table->entries | no | BUG:oob_read |
| 1272 | Critical | 350 | E | vega10_get_pp_table_entry_callback_func | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | gfxclk_dep_table | gfxclk_dep_table->entries | no | BUG:oob_read |
| 1273 | Critical | 350 | E | vega10_get_pp_table_entry_callback_func | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | mclk_dep_table | mclk_dep_table->entries | no | BUG:oob_read |
| 1274 | Critical | 350 | E | vega10_get_pp_table_entry_callback_func | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | socclk_dep_table | socclk_dep_table->entries | no | BUG:oob_read |
| 1275 | Critical | 350 | E | vega10_get_pp_table_entry_callback_func | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | gfxclk_dep_table | gfxclk_dep_table->ucRevId | no | BUG:oob_read |
| 1276 | Critical | 350 | E | vega10_get_pp_table_entry_callback_func | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | mclk_dep_table | mclk_dep_table->entries | no | BUG:oob_read |
| 1277 | Critical | 350 | E | vega12_get_powerplay_table_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_processpptables.c | state_arrays | state_arrays->ucNumEntries | no | BUG:oob_read |
| 1278 | Critical | 350 | E | vega12_get_powerplay_table_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_processpptables.c | state_arrays | state_arrays->ucNumEntries | no | BUG:oob_read |
| 1279 | Critical | 350 | E | vega12_get_powerplay_table_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_processpptables.c | state_arrays | state_arrays->states | no | BUG:oob_read |
| 1280 | Critical | 350 | E | vega12_get_powerplay_table_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_processpptables.c | state_entry | state_entry->usClassification | no | BUG:oob_read |
| 1281 | Critical | 350 | E | vega12_get_powerplay_table_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_processpptables.c | state_entry | state_entry->usClassification2 | no | BUG:oob_read |
| 1282 | Critical | 350 | E | vsc_identify_ace_image | drivers/misc/mei/vsc-fw-loader.c | sign | sign->image | no | BUG:oob_read |
| 1283 | Critical | 350 | B | wil_cfg80211_iface_combinations_from_fw | drivers/net/wireless/ath/wil6210/cfg80211.c | n_combos | n_combos * sizeof(struct ieee80211_iface_combination) + total_limits * sizeof(struct ieee80211_iface_limit) | no | BUG:undersized_alloc |
| 1284 | Critical | 350 | F | wil_cfg80211_iface_combinations_from_fw | drivers/net/wireless/ath/wil6210/cfg80211.c | n_combos | loop bound | no | BUG:oob_write |
| 1285 | Critical | 340 | C | AdvISR | drivers/scsi/advansys.c | irq_next_vpa | subscript (callee) | no | BUG:oob_read |
| 1286 | Critical | 340 | C | AdvISR | drivers/scsi/advansys.c | pa_offset | subscript (callee) | no | BUG:oob_read |
| 1287 | Critical | 340 | C | NFTL_mount | drivers/mtd/nftlmount.c | first_logical_block | subscript | no | BUG:oob_read |
| 1288 | Critical | 340 | C | NFTL_mount | drivers/mtd/nftlmount.c | first_logical_block | subscript | yes? | BUG:oob_write |
| 1289 | Critical | 340 | C | NFTL_mount | drivers/mtd/nftlmount.c | first_logical_block | subscript | no | BUG:oob_read |
| 1290 | Critical | 340 | C | __netdev_rx | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_read |
| 1291 | Critical | 340 | C | __netdev_rx | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_read |
| 1292 | Critical | 340 | C | __netdev_rx | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_read |
| 1293 | Critical | 340 | C | __netdev_rx | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_read |
| 1294 | Critical | 340 | C | __netdev_rx | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_read |
| 1295 | Critical | 340 | C | _show_fbtc_step_v2 | drivers/net/wireless/realtek/rtw89/coex.c | i | subscript | no | BUG:oob_read |
| 1296 | Critical | 340 | C | _show_fbtc_step_v2 | drivers/net/wireless/realtek/rtw89/coex.c | i | subscript | no | BUG:oob_read |
| 1297 | Critical | 340 | C | _show_fbtc_step_v2 | drivers/net/wireless/realtek/rtw89/coex.c | i | subscript | no | BUG:oob_read |
| 1298 | Critical | 340 | C | aac_command_normal | drivers/scsi/aacraid/dpcsup.c | index | subscript | no | BUG:oob_read |
| 1299 | Critical | 340 | C | aac_response_normal | drivers/scsi/aacraid/dpcsup.c | index | subscript | no | BUG:oob_read |
| 1300 | Critical | 340 | C | add_promisc_qp | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | subscript | yes? | BUG:oob_write |
| 1301 | Critical | 340 | B | aggr_slice_amsdu | drivers/net/wireless/ath/ath6kl/txrx.c | frame_8023_len | memcpy() | no | BUG:oob_read |
| 1302 | Critical | 340 | C | altera_check_crc | drivers/misc/altera-stapl/altera.c | crc_section | subscript | no | BUG:oob_read |
| 1303 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | offset | subscript | no | BUG:oob_read |
| 1304 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | offset | subscript | no | BUG:oob_read |
| 1305 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | offset | subscript | no | BUG:oob_read |
| 1306 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | data_sect | subscript | no | BUG:oob_read |
| 1307 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | data_sect | subscript | no | BUG:oob_read |
| 1308 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | action_table | subscript | no | BUG:oob_read |
| 1309 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | str_table | subscript | no | BUG:oob_read |
| 1310 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | action_table | subscript | no | BUG:oob_read |
| 1311 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | proc_table | subscript | no | BUG:oob_read |
| 1312 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | proc_table | subscript | no | BUG:oob_read |
| 1313 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | BUG:oob_read |
| 1314 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | BUG:oob_read |
| 1315 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | proc_table | subscript | no | BUG:oob_read |
| 1316 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | proc_table | subscript | no | BUG:oob_read |
| 1317 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | pc | subscript | no | BUG:oob_read |
| 1318 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | pc | subscript | no | BUG:oob_read |
| 1319 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | proc_table | subscript | no | BUG:oob_read |
| 1320 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | BUG:oob_read |
| 1321 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | BUG:oob_read |
| 1322 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | proc_table | subscript | no | BUG:oob_read |
| 1323 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | proc_table | subscript | no | BUG:oob_read |
| 1324 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | str_table | subscript | no | BUG:oob_read |
| 1325 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_tmp | subscript | no | BUG:oob_read |
| 1326 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx | subscript | yes? | BUG:oob_write |
| 1327 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx | subscript | yes? | BUG:oob_write |
| 1328 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_tmp | subscript | no | BUG:oob_read |
| 1329 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | str_table | subscript | no | BUG:oob_read |
| 1330 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_tmp | subscript | no | BUG:oob_read |
| 1331 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | BUG:oob_read |
| 1332 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | str_table | subscript | no | BUG:oob_read |
| 1333 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | k | subscript | no | BUG:oob_read |
| 1334 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx | subscript | yes? | BUG:oob_write |
| 1335 | Critical | 340 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx | subscript | yes? | BUG:oob_write |
| 1336 | Critical | 340 | C | altera_get_act_info | drivers/misc/altera-stapl/altera.c | action_table | subscript | no | BUG:oob_read |
| 1337 | Critical | 340 | C | altera_get_act_info | drivers/misc/altera-stapl/altera.c | action_table | subscript | no | BUG:oob_read |
| 1338 | Critical | 340 | C | altera_get_act_info | drivers/misc/altera-stapl/altera.c | action_table | subscript | no | BUG:oob_read |
| 1339 | Critical | 340 | C | altera_get_act_info | drivers/misc/altera-stapl/altera.c | str_table | subscript | no | BUG:oob_read |
| 1340 | Critical | 340 | C | altera_get_act_info | drivers/misc/altera-stapl/altera.c | proc_table | subscript | no | BUG:oob_read |
| 1341 | Critical | 340 | C | altera_get_act_info | drivers/misc/altera-stapl/altera.c | proc_table | subscript | no | BUG:oob_read |
| 1342 | Critical | 340 | C | altera_get_act_info | drivers/misc/altera-stapl/altera.c | str_table | subscript | no | BUG:oob_read |
| 1343 | Critical | 340 | C | altera_get_act_info | drivers/misc/altera-stapl/altera.c | proc_table | subscript | no | BUG:oob_read |
| 1344 | Critical | 340 | C | altera_get_note | drivers/misc/altera-stapl/altera.c | delta | subscript | no | BUG:oob_read |
| 1345 | Critical | 340 | C | altera_get_note | drivers/misc/altera-stapl/altera.c | delta | subscript | no | BUG:oob_read |
| 1346 | Critical | 340 | C | altera_get_note | drivers/misc/altera-stapl/altera.c | delta | subscript | no | BUG:oob_read |
| 1347 | Critical | 340 | C | altera_get_note | drivers/misc/altera-stapl/altera.c | note_strings +
get_unaligned_be32(
| subscript | no | BUG:oob_read |
| 1348 | Critical | 340 | C | altera_get_note | drivers/misc/altera-stapl/altera.c | note_table | subscript | no | BUG:oob_read |
| 1349 | Critical | 340 | C | altera_get_note | drivers/misc/altera-stapl/altera.c | note_strings +
get_unaligned_be32( | subscript | no | BUG:oob_read |
| 1350 | Critical | 340 | C | altera_get_note | drivers/misc/altera-stapl/altera.c | note_table | subscript | no | BUG:oob_read |
| 1351 | Critical | 340 | C | altera_get_note | drivers/misc/altera-stapl/altera.c | note_strings +
get_unaligned_be32( | subscript | no | BUG:oob_read |
| 1352 | Critical | 340 | C | altera_get_note | drivers/misc/altera-stapl/altera.c | note_table | subscript | no | BUG:oob_read |
| 1353 | Critical | 340 | C | altera_get_note | drivers/misc/altera-stapl/altera.c | note_strings +
get_unaligned_be32( | subscript | no | BUG:oob_read |
| 1354 | Critical | 340 | C | altera_get_note | drivers/misc/altera-stapl/altera.c | note_table | subscript | no | BUG:oob_read |
| 1355 | Critical | 340 | G2 | amdgpu_debugfs_umsch_fwlog_read | drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c | read_num[i] | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1356 | Critical | 340 | G2 | amdgpu_debugfs_vcn_fwlog_read | drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | read_num[i] | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1357 | Critical | 340 | C | amdgpu_gfx_rlc_setup_cp_table | drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.c | table_offset | subscript | no | BUG:oob_read |
| 1358 | Critical | 340 | B | amdgpu_umsch_mm_allocate_ucode_buffer | drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c | fw_size | memcpy() | no | BUG:oob_read |
| 1359 | Critical | 340 | B | amdgpu_umsch_mm_allocate_ucode_data_buffer | drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c | fw_size | memcpy() | no | BUG:oob_read |
| 1360 | Critical | 340 | C | asd_dl_tasklet_handler | drivers/scsi/aic94xx/aic94xx_hwi.c | (int)le16_to_cpu(dl->index) | subscript (callee) | no | BUG:oob_read |
| 1361 | Critical | 340 | C | asd_get_response_tasklet | drivers/scsi/aic94xx/aic94xx_task.c | escb | subscript | no | BUG:oob_read |
| 1362 | Critical | 340 | C | asd_get_response_tasklet | drivers/scsi/aic94xx/aic94xx_task.c | (int)le16_to_cpu(resp_sb->index_escb) | subscript (callee) | no | BUG:oob_read |
| 1363 | Critical | 340 | C | asd_get_response_tasklet | drivers/scsi/aic94xx/aic94xx_task.c | escb | subscript (callee) | no | BUG:oob_read |
| 1364 | Critical | 340 | C | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | escb | subscript | no | BUG:oob_read |
| 1365 | Critical | 340 | C | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | (int)le16_to_cpu(resp_sb->index_escb) | subscript (callee) | no | BUG:oob_read |
| 1366 | Critical | 340 | C | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | escb | subscript (callee) | no | BUG:oob_read |
| 1367 | Critical | 340 | C | ath10k_htt_get_tx_fetch_ind_resp_ids | drivers/net/wireless/ath/ath10k/htt.h | le16_to_cpu(ind->num_records) | subscript | no | BUG:oob_read |
| 1368 | Critical | 340 | B | ath12k_wmi_tpc_stats_copy_buffer | drivers/net/wireless/ath/ath12k/wmi.c | len1 | memcpy() | yes? | BUG:oob_write |
| 1369 | Critical | 340 | B | ath12k_wmi_tpc_stats_copy_buffer | drivers/net/wireless/ath/ath12k/wmi.c | len2 | memcpy() | yes? | BUG:oob_write |
| 1370 | Critical | 340 | B | ath12k_wmi_tpc_stats_copy_buffer | drivers/net/wireless/ath/ath12k/wmi.c | len3 | memcpy() | yes? | BUG:oob_write |
| 1371 | Critical | 340 | B | ath12k_wmi_tpc_stats_copy_buffer | drivers/net/wireless/ath/ath12k/wmi.c | len4 | memcpy() | yes? | BUG:oob_write |
| 1372 | Critical | 340 | C | bdc_sr_xsf | drivers/usb/gadget/udc/bdc/bdc_ep.c | sr_status | subscript | no | BUG:oob_read |
| 1373 | Critical | 340 | C | be_async_port_misconfig_event_process | drivers/net/ethernet/emulex/benet/be_cmds.c | msg_severity | subscript | no | BUG:oob_read |
| 1374 | Critical | 340 | C | be_async_port_misconfig_event_process | drivers/net/ethernet/emulex/benet/be_cmds.c | phy_oper_state | subscript | no | BUG:oob_read |
| 1375 | Critical | 340 | C | be_async_port_misconfig_event_process | drivers/net/ethernet/emulex/benet/be_cmds.c | msg_severity | subscript | no | BUG:oob_read |
| 1376 | Critical | 340 | C | be_async_port_misconfig_event_process | drivers/net/ethernet/emulex/benet/be_cmds.c | phy_oper_state | subscript | no | BUG:oob_read |
| 1377 | Critical | 340 | B | be_complete_io | drivers/scsi/be2iscsi/be_main.c | sense_len | memcpy() | no | BUG:oob_read |
| 1378 | Critical | 340 | C | bng_re_process_qp_event | drivers/infiniband/hw/bng_re/bng_fw.c | cookie | subscript | no | BUG:oob_read |
| 1379 | Critical | 340 | C | bnge_napi_poll | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | idx | subscript | no | BUG:oob_read |
| 1380 | Critical | 340 | B | bnge_rx_pkt | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | len | memcpy() in bnge_copy_skb() | yes? | BUG:oob_write |
| 1381 | Critical | 340 | B | bnge_send_msg | drivers/net/ethernet/broadcom/bnge/bnge_auxr.c | resp_len | memcpy() | no | BUG:oob_read |
| 1382 | Critical | 340 | C | bnx2x_handle_classification_eqe | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | cid | subscript | no | BUG:oob_read |
| 1383 | Critical | 340 | C | bnx2x_rx_int | drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | pages | subscript (callee) | no | BUG:oob_read |
| 1384 | Critical | 340 | C | bnx2x_rx_int | drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | pages | subscript (callee) | no | BUG:oob_read |
| 1385 | Critical | 340 | B | bnxt_hwrm_dbg_dma_data | drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c | copylen | memcpy() | no | BUG:oob_read |
| 1386 | Critical | 340 | C | bnxt_poll_p5 | drivers/net/ethernet/broadcom/bnxt/bnxt.c | cpr2 | subscript (callee) | no | BUG:oob_read |
| 1387 | Critical | 340 | C | bnxt_poll_p5 | drivers/net/ethernet/broadcom/bnxt/bnxt.c | cpr2 | subscript (callee) | no | BUG:oob_read |
| 1388 | Critical | 340 | C | bnxt_poll_p5 | drivers/net/ethernet/broadcom/bnxt/bnxt.c | idx | subscript | no | BUG:oob_read |
| 1389 | Critical | 340 | C | bnxt_qplib_process_qp_event | drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | cookie | subscript | no | BUG:oob_read |
| 1390 | Critical | 340 | B | bnxt_send_msg | drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | resp_len | memcpy() | no | BUG:oob_read |
| 1391 | Critical | 340 | C | brcm_nvram_parse | drivers/nvmem/brcm_nvram.c | len | subscript (callee) | yes? | BUG:oob_write |
| 1392 | Critical | 340 | C | brcm_nvram_parse | drivers/nvmem/brcm_nvram.c | len | subscript (callee) | yes? | BUG:oob_write |
| 1393 | Critical | 340 | C | brcmf_msgbuf_process_flow_ring_create_response | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | flowid | subscript (callee) | no | BUG:oob_read |
| 1394 | Critical | 340 | C | brcmf_msgbuf_process_flow_ring_create_response | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | flowid | subscript (callee) | no | BUG:oob_read |
| 1395 | Critical | 340 | C | brcmf_msgbuf_process_flow_ring_create_response | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | flowid | subscript (callee) | no | BUG:oob_read |
| 1396 | Critical | 340 | C | brcmf_msgbuf_process_flow_ring_create_response | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | flowid | subscript (callee) | no | BUG:oob_read |
| 1397 | Critical | 340 | C | brcmf_msgbuf_process_flow_ring_delete_response | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | flowid | subscript (callee) | no | BUG:oob_read |
| 1398 | Critical | 340 | C | brcmf_msgbuf_process_flow_ring_delete_response | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | flowid | subscript (callee) | no | BUG:oob_read |
| 1399 | Critical | 340 | C | brcmf_msgbuf_process_flow_ring_delete_response | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | flowid | subscript (callee) | no | BUG:oob_read |
| 1400 | Critical | 340 | C | brcmf_msgbuf_process_txstatus | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | flowid | subscript | no | BUG:oob_read |
| 1401 | Critical | 340 | F | btusb_submit_isoc_urb | drivers/bluetooth/btusb.c | le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) | loop bound | no | BUG:stack_overflow |
| 1402 | Critical | 340 | B | build_i2c_fw_hdr | drivers/usb/serial/io_ti.c | le16_to_cpu(img_header->Length) | memcpy() | no | BUG:oob_read |
| 1403 | Critical | 340 | C | build_mlx_header | drivers/infiniband/hw/mlx4/qp.c | be32_to_cpu(ah->av.ib.port_pd) >> 24 | subscript (callee) | no | BUG:oob_read |
| 1404 | Critical | 340 | G2 | ca8210_test_int_user_read | drivers/net/ieee802154/ca8210.c | bytes_not_copied | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1405 | Critical | 340 | C | cdns2_ep0_handle_feature_endpoint | drivers/usb/gadget/udc/cdns2/cdns2-ep0.c | cdns2_w_index_to_ep_index(le16_to_cpu(ct | subscript | no | BUG:oob_read |
| 1406 | Critical | 340 | C | cdns2_ep0_handle_feature_endpoint | drivers/usb/gadget/udc/cdns2/cdns2-ep0.c | pep | subscript (callee) | no | BUG:oob_read |
| 1407 | Critical | 340 | C | cdns2_ep0_handle_feature_endpoint | drivers/usb/gadget/udc/cdns2/cdns2-ep0.c | pep | subscript (callee) | no | BUG:oob_read |
| 1408 | Critical | 340 | C | cdns2_req_ep0_handle_status | drivers/usb/gadget/udc/cdns2/cdns2-ep0.c | ep_sts | subscript | no | BUG:oob_read |
| 1409 | Critical | 340 | C | cdns3_ep0_feature_handle_endpoint | drivers/usb/cdns3/cdns3-ep0.c | index | subscript | no | BUG:oob_read |
| 1410 | Critical | 340 | C | cdns3_req_ep0_get_status | drivers/usb/cdns3/cdns3-ep0.c | index | subscript | no | BUG:oob_read |
| 1411 | Critical | 340 | C | cdnsp_ep0_handle_feature_endpoint | drivers/usb/cdns3/cdnsp-ep0.c | cdnsp_w_index_to_ep_index(le16_to_cpu(ct | subscript | no | BUG:oob_read |
| 1412 | Critical | 340 | C | cdnsp_ep0_handle_status | drivers/usb/cdns3/cdnsp-ep0.c | ep_sts | subscript | no | BUG:oob_read |
| 1413 | Critical | 340 | C | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | ep_index | subscript | no | BUG:oob_read |
| 1414 | Critical | 340 | C | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | ep_index | subscript | no | BUG:oob_read |
| 1415 | Critical | 340 | C | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | dev_sid | subscript | no | BUG:oob_read |
| 1416 | Critical | 340 | C | chcr_ktls_cpl_act_open_rpl | drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | tx_info | subscript (callee) | yes? | BUG:oob_write |
| 1417 | Critical | 340 | C | chcr_ktls_cpl_act_open_rpl | drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | atid | subscript (callee) | yes? | BUG:oob_write |
| 1418 | Critical | 340 | C | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | non_clock_array_index | subscript | no | BUG:oob_read |
| 1419 | Critical | 340 | C | cik_init_cp_pg_table | drivers/gpu/drm/radeon/cik.c | table_offset | subscript | no | BUG:oob_read |
| 1420 | Critical | 340 | C | clear_feature | drivers/usb/gadget/udc/m66592-udc.c | w_index | subscript | no | BUG:oob_read |
| 1421 | Critical | 340 | C | clear_feature | drivers/usb/gadget/udc/r8a66597-udc.c | w_index | subscript | no | BUG:oob_read |
| 1422 | Critical | 340 | G2 | cm_mport_get_list | drivers/rapidio/rio_cm.c | sizeof(u32) * (count + 1) | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1423 | Critical | 340 | C | cmdq_cmd_ceq_handler | drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | errcode | subscript (callee) | no | BUG:oob_read |
| 1424 | Critical | 340 | C | cmdq_cmd_ceq_handler | drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | errcode | subscript (callee) | no | BUG:oob_read |
| 1425 | Critical | 340 | C | cmdq_cmd_ceq_handler | drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | errcode | subscript (callee) | no | BUG:oob_read |
| 1426 | Critical | 340 | C | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | smid | subscript | no | BUG:oob_read |
| 1427 | Critical | 340 | C | complete_v3_hw | drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | device_id | subscript | no | BUG:oob_read |
| 1428 | Critical | 340 | C | complete_v3_hw | drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | device_id | subscript | no | BUG:oob_read |
| 1429 | Critical | 340 | B | control_msg_handler | drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | le32_to_cpu(ctrl_msg_h->data_length) | memcpy() in t7xx_fsm_append_event() | no | BUG:oob_read |
| 1430 | Critical | 340 | C | cq_interrupt_v1_hw | drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | idx | subscript | no | BUG:oob_read |
| 1431 | Critical | 340 | C | cq_thread_v2_hw | drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | dev_id | subscript | no | BUG:oob_read |
| 1432 | Critical | 340 | C | cq_thread_v2_hw | drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | iptt | subscript | no | BUG:oob_read |
| 1433 | Critical | 340 | C | cq_thread_v2_hw | drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | iptt | subscript | no | BUG:oob_read |
| 1434 | Critical | 340 | C | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | port_id | subscript | no | BUG:oob_read |
| 1435 | Critical | 340 | C | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | port_id | subscript | no | BUG:oob_read |
| 1436 | Critical | 340 | C | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | port_id | subscript | yes? | BUG:oob_write |
| 1437 | Critical | 340 | B | csio_scsi_err_handler | drivers/scsi/csiostor/csio_scsi.c | sns_len | memcpy() | no | BUG:oob_read |
| 1438 | Critical | 340 | C | csio_wr_process_iq | drivers/scsi/csiostor/csio_wr.c | qid | subscript | no | BUG:oob_read |
| 1439 | Critical | 340 | C | cxgb4_dcb_handle_fw_update | drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | port | subscript | no | BUG:oob_read |
| 1440 | Critical | 340 | C | cxgbi_parse_pdu_itt | drivers/scsi/cxgbi/libcxgbi.c | tag | subscript (callee) | no | BUG:oob_read |
| 1441 | Critical | 340 | C | cxgbit_handle_iscsi_dataout | drivers/target/iscsi/cxgbit/cxgbit_target.c | sg_off | subscript | no | BUG:oob_read |
| 1442 | Critical | 340 | C | cyttsp5_validate_cmd_response | drivers/input/touchscreen/cyttsp5.c | size | subscript | no | BUG:oob_read |
| 1443 | Critical | 340 | C | dcb_rpl | drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | port | subscript | no | BUG:oob_read |
| 1444 | Critical | 340 | B | decompress | drivers/crypto/nx/nx-842.c | adj_slen | memset() | yes? | BUG:oob_write |
| 1445 | Critical | 340 | B | decompress | drivers/crypto/nx/nx-842.c | slen | memcpy() | yes? | BUG:oob_write |
| 1446 | Critical | 340 | B | decompress | drivers/crypto/nx/nx-842.c | dlen | memcpy() | yes? | BUG:oob_write |
| 1447 | Critical | 340 | C | dell_wmi_ddv_update_sensors | drivers/platform/x86/dell/dell-wmi-ddv.c | buffer_size | subscript | no | BUG:oob_read |
| 1448 | Critical | 340 | C | do_act_establish | drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | tcp_opt | subscript | no | BUG:oob_read |
| 1449 | Critical | 340 | C | do_cr | drivers/net/ethernet/chelsio/cxgb3/cxgb3_offload.c | stid | subscript (callee) | no | BUG:oob_read |
| 1450 | Critical | 340 | C | dwc3_wIndex_to_dep | drivers/usb/dwc3/ep0.c | epnum | subscript | no | BUG:oob_read |
| 1451 | Critical | 340 | B | emi62_load_firmware | drivers/usb/misc/emi62.c | be16_to_cpu(rec->len) | memcpy() | no | BUG:oob_read |
| 1452 | Critical | 340 | C | ep0_handle_status | drivers/usb/gadget/udc/bdc/bdc_ep.c | epnum | subscript | no | BUG:oob_read |
| 1453 | Critical | 340 | C | erdma_poll_one_cqe | drivers/infiniband/hw/erdma/erdma_cq.c | opcode | subscript | no | BUG:oob_read |
| 1454 | Critical | 340 | C | erdma_poll_single_cmd_completion | drivers/infiniband/hw/erdma/erdma_cmdq.c | ctx_id | subscript | no | BUG:oob_read |
| 1455 | Critical | 340 | C | fbnic_tlv_attr_get_string | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | srclen | subscript | no | BUG:oob_read |
| 1456 | Critical | 340 | B | fbnic_tlv_attr_get_string | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | len | memcpy() | no | BUG:oob_read |
| 1457 | Critical | 340 | B | fc_fcp_resp | drivers/scsi/libfc/fc_fcp.c | snsl | memcpy() | no | BUG:oob_read |
| 1458 | Critical | 340 | C | find_key | drivers/md/persistent-data/dm-btree.c | i | subscript (callee) | no | BUG:oob_read |
| 1459 | Critical | 340 | C | find_key | drivers/md/persistent-data/dm-btree.c | i | subscript | no | BUG:oob_read |
| 1460 | Critical | 340 | C | fotg210_set_feature | drivers/usb/fotg210/fotg210-udc.c | epnum | subscript | no | BUG:oob_read |
| 1461 | Critical | 340 | C | fun_complete_admin_cmd | drivers/net/ethernet/fungible/funcore/fun_dev.c | cid | subscript | no | BUG:oob_read |
| 1462 | Critical | 340 | B | fun_data_from_rq | drivers/net/ethernet/fungible/funcore/fun_queue.c | fragsize | memcpy() | no | BUG:oob_read |
| 1463 | Critical | 340 | C | fwevtq_handler | drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | qid | subscript | no | BUG:oob_read |
| 1464 | Critical | 340 | C | fwevtq_handler | drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | port | subscript | no | BUG:oob_read |
| 1465 | Critical | 340 | C | get_status | drivers/usb/gadget/udc/m66592-udc.c | w_index | subscript | no | BUG:oob_read |
| 1466 | Critical | 340 | C | get_status | drivers/usb/gadget/udc/r8a66597-udc.c | w_index | subscript | no | BUG:oob_read |
| 1467 | Critical | 340 | B | gfx_v10_0_cp_gfx_load_ce_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_size | memcpy() | no | BUG:oob_read |
| 1468 | Critical | 340 | B | gfx_v10_0_cp_gfx_load_me_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_size | memcpy() | no | BUG:oob_read |
| 1469 | Critical | 340 | B | gfx_v10_0_cp_gfx_load_pfp_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_size | memcpy() | no | BUG:oob_read |
| 1470 | Critical | 340 | B | gfx_v10_0_mec_init | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_size | memcpy() | no | BUG:oob_read |
| 1471 | Critical | 340 | B | gfx_v11_0_cp_compute_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | memcpy() | no | BUG:oob_read |
| 1472 | Critical | 340 | B | gfx_v11_0_cp_compute_load_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_ucode_size | memcpy() | no | BUG:oob_read |
| 1473 | Critical | 340 | B | gfx_v11_0_cp_compute_load_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_data_size | memcpy() | no | BUG:oob_read |
| 1474 | Critical | 340 | B | gfx_v11_0_cp_gfx_load_me_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | memcpy() | no | BUG:oob_read |
| 1475 | Critical | 340 | B | gfx_v11_0_cp_gfx_load_me_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_ucode_size | memcpy() | no | BUG:oob_read |
| 1476 | Critical | 340 | B | gfx_v11_0_cp_gfx_load_me_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_data_size | memcpy() | no | BUG:oob_read |
| 1477 | Critical | 340 | B | gfx_v11_0_cp_gfx_load_pfp_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | memcpy() | no | BUG:oob_read |
| 1478 | Critical | 340 | B | gfx_v11_0_cp_gfx_load_pfp_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_ucode_size | memcpy() | no | BUG:oob_read |
| 1479 | Critical | 340 | B | gfx_v11_0_cp_gfx_load_pfp_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_data_size | memcpy() | no | BUG:oob_read |
| 1480 | Critical | 340 | B | gfx_v11_0_rlc_backdoor_autoload_copy_sdma_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | memcpy() in gfx_v11_0_rlc_backdoor_autoload_copy_ucode() | no | BUG:oob_read |
| 1481 | Critical | 340 | B | gfx_v12_0_cp_gfx_load_me_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_ucode_size | memcpy() | no | BUG:oob_read |
| 1482 | Critical | 340 | B | gfx_v12_0_cp_gfx_load_me_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_data_size | memcpy() | no | BUG:oob_read |
| 1483 | Critical | 340 | B | gfx_v12_0_cp_gfx_load_pfp_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_ucode_size | memcpy() | no | BUG:oob_read |
| 1484 | Critical | 340 | B | gfx_v12_0_cp_gfx_load_pfp_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_data_size | memcpy() | no | BUG:oob_read |
| 1485 | Critical | 340 | B | gfx_v9_0_mec_init | drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | fw_size | memcpy() | no | BUG:oob_read |
| 1486 | Critical | 340 | B | gfx_v9_4_3_mec_init | drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | fw_size | memcpy() | no | BUG:oob_read |
| 1487 | Critical | 340 | B | gve_adminq_process_flow_rules_query | drivers/net/ethernet/google/gve/gve_adminq.c | rule_info_len | memcpy() | yes? | BUG:oob_write |
| 1488 | Critical | 340 | B | gve_adminq_process_flow_rules_query | drivers/net/ethernet/google/gve/gve_adminq.c | rule_info_len | memcpy() | yes? | BUG:oob_write |
| 1489 | Critical | 340 | C | gve_tx_load_event_counter | drivers/net/ethernet/google/gve/gve_tx.c | counter_index | subscript | no | BUG:oob_read |
| 1490 | Critical | 340 | C | handle_responder | drivers/infiniband/hw/mlx5/cq.c | wqe_ctr | subscript | no | BUG:oob_read |
| 1491 | Critical | 340 | C | handle_xsr_succ_status | drivers/usb/gadget/udc/bdc/bdc_ep.c | short_bdi | subscript (callee) | no | BUG:oob_read |
| 1492 | Critical | 340 | B | hdlc_rx_done | drivers/net/wan/fsl_ucc_hdlc.c | length | memcpy() | no | BUG:oob_read |
| 1493 | Critical | 340 | B | hdlc_rx_done | drivers/net/wan/fsl_ucc_hdlc.c | length | memcpy() | no | BUG:oob_read |
| 1494 | Critical | 340 | G2 | hgcm_call_copy_back_result | drivers/virt/vboxguest/vboxguest_utils.c | min(src_parm->u.pointer.size,
dst_parm->u.pointer.size) | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1495 | Critical | 340 | C | hl_irq_handler_cq | drivers/accel/habanalabs/common/irq.c | shadow_index | subscript (callee) | no | BUG:oob_read |
| 1496 | Critical | 340 | C | hns3_handle_bdinfo | drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | ol_info | subscript (callee) | no | BUG:oob_read |
| 1497 | Critical | 340 | C | hns3_handle_bdinfo | drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | ol_info | subscript (callee) | no | BUG:oob_read |
| 1498 | Critical | 340 | C | hw_event_phy_down | drivers/scsi/pm8001/pm80xx_hwi.c | port_id | subscript | no | BUG:oob_read |
| 1499 | Critical | 340 | C | hw_event_phy_down | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1500 | Critical | 340 | C | hw_event_port_recover | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1501 | Critical | 340 | C | hw_event_port_recover | drivers/scsi/pm8001/pm80xx_hwi.c | port_id | subscript | no | BUG:oob_read |
| 1502 | Critical | 340 | C | hw_event_sas_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | subscript (callee) | no | BUG:oob_read |
| 1503 | Critical | 340 | C | hw_event_sata_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | port_id | subscript | no | BUG:oob_read |
| 1504 | Critical | 340 | C | hw_event_sata_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1505 | Critical | 340 | C | i40e_aq_discover_capabilities | drivers/net/ethernet/intel/i40e/i40e_common.c | le32_to_cpu(cmd->count) | subscript (callee) | yes? | BUG:oob_write |
| 1506 | Critical | 340 | C | i40e_aq_discover_capabilities | drivers/net/ethernet/intel/i40e/i40e_common.c | le32_to_cpu(cmd->count) | subscript (callee) | yes? | BUG:oob_write |
| 1507 | Critical | 340 | C | i40e_handle_lan_overflow_event | drivers/net/ethernet/intel/i40e/i40e_main.c | vf_id | subscript | no | BUG:oob_read |
| 1508 | Critical | 340 | C | ibmvnic_complete_tx | drivers/net/ethernet/ibm/ibmvnic.c | index | subscript | no | BUG:oob_read |
| 1509 | Critical | 340 | B | ice_fill_tbl | drivers/net/ethernet/intel/ice/ice_flex_pipe.c | sect_len | memcpy() | no | BUG:oob_read |
| 1510 | Critical | 340 | C | idpf_mac_filter_async_handler | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | le32_to_cpu(ma_list->vport_id) | subscript | no | BUG:oob_read |
| 1511 | Critical | 340 | C | idpf_rx_splitq_clean | drivers/net/ethernet/intel/idpf/idpf_txrx.c | buf_id | subscript | no | BUG:oob_read |
| 1512 | Critical | 340 | C | idpf_rx_splitq_clean | drivers/net/ethernet/intel/idpf/idpf_txrx.c | buf_id | subscript | no | BUG:oob_read |
| 1513 | Critical | 340 | C | idpf_tx_handle_rs_completion | drivers/net/ethernet/intel/idpf/idpf_txrx.c | rs_compl_val | subscript (callee) | no | BUG:oob_read |
| 1514 | Critical | 340 | C | idpf_tx_handle_rs_completion | drivers/net/ethernet/intel/idpf/idpf_txrx.c | rs_compl_val | subscript (callee) | no | BUG:oob_read |
| 1515 | Critical | 340 | C | idpf_tx_handle_rs_completion | drivers/net/ethernet/intel/idpf/idpf_txrx.c | rs_compl_val | subscript (callee) | no | BUG:oob_read |
| 1516 | Critical | 340 | C | idpf_wait_for_sw_marker_completion | drivers/net/ethernet/intel/idpf/idpf_txrx.c | id | subscript | no | BUG:oob_read |
| 1517 | Critical | 340 | B | if_usb_send_fw_pkt | drivers/net/wireless/marvell/libertas_tf/if_usb.c | le32_to_cpu(fwdata->hdr.datalength) | memcpy() | no | BUG:oob_read |
| 1518 | Critical | 340 | C | il3945_hdl_tx | drivers/net/wireless/intel/iwlegacy/3945.c | txq_id | subscript (callee) | no | BUG:oob_read |
| 1519 | Critical | 340 | C | il3945_hdl_tx | drivers/net/wireless/intel/iwlegacy/3945.c | txq_id | subscript (callee) | no | BUG:oob_read |
| 1520 | Critical | 340 | C | il3945_hdl_tx | drivers/net/wireless/intel/iwlegacy/3945.c | txq_id | subscript | no | BUG:oob_read |
| 1521 | Critical | 340 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | tid | subscript (callee) | no | BUG:oob_read |
| 1522 | Critical | 340 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | tid | subscript (callee) | yes? | BUG:oob_write |
| 1523 | Critical | 340 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | txq_id | subscript | no | BUG:oob_read |
| 1524 | Critical | 340 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | tid | subscript | no | BUG:oob_read |
| 1525 | Critical | 340 | C | il4965_rs_sta_dbgfs_scale_table_read | drivers/net/wireless/intel/iwlegacy/4965-rs.c | idx | subscript | no | BUG:oob_read |
| 1526 | Critical | 340 | C | il4965_rs_sta_dbgfs_scale_table_read | drivers/net/wireless/intel/iwlegacy/4965-rs.c | idx | subscript | no | BUG:oob_read |
| 1527 | Critical | 340 | C | il4965_rs_sta_dbgfs_scale_table_read | drivers/net/wireless/intel/iwlegacy/4965-rs.c | idx | subscript | no | BUG:oob_read |
| 1528 | Critical | 340 | C | il4965_tx_status_reply_compressed_ba | drivers/net/wireless/intel/iwlegacy/4965-mac.c | scd_flow | subscript | no | BUG:oob_read |
| 1529 | Critical | 340 | C | il4965_tx_status_reply_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | idx | subscript | no | BUG:oob_read |
| 1530 | Critical | 340 | C | il4965_tx_status_reply_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | txq_id | subscript | no | BUG:oob_read |
| 1531 | Critical | 340 | C | init_powerplay_extended_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | dcefclk_dep_table | subscript (callee) | no | BUG:oob_read |
| 1532 | Critical | 340 | C | intr_handler | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_read |
| 1533 | Critical | 340 | C | intr_handler | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_read |
| 1534 | Critical | 340 | C | intr_handler | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_read |
| 1535 | Critical | 340 | C | intr_handler | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | BUG:oob_read |
| 1536 | Critical | 340 | C | ipc_mux_dl_acb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | next_cmd_index | subscript | no | BUG:oob_read |
| 1537 | Critical | 340 | G2 | ipmb_read | drivers/char/ipmi/ipmb_dev_int.c | count | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1538 | Critical | 340 | B | ipmi_powernv_recv | drivers/char/ipmi/ipmi_powernv.c | size | memcpy() | yes? | BUG:oob_write |
| 1539 | Critical | 340 | B | ipr_read_dump | drivers/scsi/ipr.c | len | memcpy() | no | BUG:oob_read |
| 1540 | Critical | 340 | B | ipr_read_dump | drivers/scsi/ipr.c | len | memcpy() | no | BUG:oob_read |
| 1541 | Critical | 340 | B | ipw_load_firmware | drivers/net/wireless/intel/ipw2x00/ipw2200.c | size | memcpy() | no | BUG:oob_read |
| 1542 | Critical | 340 | C | ipw_load_firmware | drivers/net/wireless/intel/ipw2x00/ipw2200.c | nr | subscript | no | BUG:oob_read |
| 1543 | Critical | 340 | C | isr_setup_packet_handler | drivers/usb/chipidea/udc.c | num | subscript | no | BUG:oob_read |
| 1544 | Critical | 340 | C | isr_setup_packet_handler | drivers/usb/chipidea/udc.c | num | subscript | no | BUG:oob_read |
| 1545 | Critical | 340 | C | isr_setup_packet_handler | drivers/usb/chipidea/udc.c | num | subscript | no | BUG:oob_read |
| 1546 | Critical | 340 | B | iwl_dbg_tlv_override_trig_node | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | trig_data_len | memcpy() | no | BUG:oob_read |
| 1547 | Critical | 340 | C | iwl_dbg_tlv_ver_support | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tlv_idx | subscript | no | BUG:oob_read |
| 1548 | Critical | 340 | B | iwl_dbgfs_monitor_data_read | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c | size | copy_to_user() in iwl_write_to_user_buf() | no | BUG:oob_read |
| 1549 | Critical | 340 | C | iwl_dump_ini_mon_dram_get_size | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | alloc_id | subscript | no | BUG:oob_read |
| 1550 | Critical | 340 | C | iwl_dump_ini_mon_dram_iter | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | alloc_id | subscript | no | BUG:oob_read |
| 1551 | Critical | 340 | C | iwl_dump_ini_mon_dram_ranges | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | alloc_id | subscript | no | BUG:oob_read |
| 1552 | Critical | 340 | C | iwl_fw_dbg_trigger_check_stop | drivers/net/wireless/intel/iwlwifi/fw/dbg.h | le32_to_cpu(trig->id) | subscript (callee) | no | BUG:oob_read |
| 1553 | Critical | 340 | B | iwl_mei_handle_sap_data | drivers/net/wireless/intel/iwlwifi/mei/main.c | len | memcpy() in iwl_mei_read_from_q() | yes? | BUG:oob_write |
| 1554 | Critical | 340 | B | iwl_mei_handle_sap_data | drivers/net/wireless/intel/iwlwifi/mei/main.c | len | memcpy() in iwl_mei_read_from_q() | yes? | BUG:oob_write |
| 1555 | Critical | 340 | B | iwl_mei_handle_sap_rx_cmd | drivers/net/wireless/intel/iwlwifi/mei/main.c | len | memcpy() in iwl_mei_read_from_q() | yes? | BUG:oob_write |
| 1556 | Critical | 340 | B | iwl_mei_handle_sap_rx_cmd | drivers/net/wireless/intel/iwlwifi/mei/main.c | len | memcpy() in iwl_mei_read_from_q() | yes? | BUG:oob_write |
| 1557 | Critical | 340 | C | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | rate_n_flags | subscript (callee) | no | BUG:oob_read |
| 1558 | Critical | 340 | B | iwlagn_rx_noa_notification | drivers/net/wireless/intel/iwlwifi/dvm/rx.c | copylen | memcpy() | no | BUG:oob_read |
| 1559 | Critical | 340 | C | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | non_clock_array_index | subscript | no | BUG:oob_read |
| 1560 | Critical | 340 | C | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | non_clock_array_index | subscript | no | BUG:oob_read |
| 1561 | Critical | 340 | B | lbs_cmd_copyback | drivers/net/wireless/marvell/libertas/cmd.c | copy_len | memcpy() | no | BUG:oob_read |
| 1562 | Critical | 340 | G2 | lcd_read | drivers/usb/misc/usblcd.c | bytes_read | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1563 | Critical | 340 | C | libipw_rx_frame_decrypt | drivers/net/wireless/intel/ipw2x00/libipw_rx.c | hdrlen | subscript | no | BUG:oob_read |
| 1564 | Critical | 340 | B | lpfc_send_rscn_event | drivers/scsi/lpfc/lpfc_els.c | payload_len | memcpy() | no | BUG:oob_read |
| 1565 | Critical | 340 | B | m920x_firmware_download | drivers/media/usb/dvb-usb/m920x.c | size | memcpy() | no | BUG:oob_read |
| 1566 | Critical | 340 | C | megasas_complete_cmd_dpc | drivers/scsi/megaraid/megaraid_sas_base.c | consumer | subscript | no | BUG:oob_read |
| 1567 | Critical | 340 | C | megasas_complete_r1_command | drivers/scsi/megaraid/megaraid_sas_fusion.c | peer_smid | subscript | no | BUG:oob_read |
| 1568 | Critical | 340 | B | mes_v12_0_allocate_ucode_buffer | drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | fw_size | memcpy() | no | BUG:oob_read |
| 1569 | Critical | 340 | B | mes_v12_0_allocate_ucode_data_buffer | drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | fw_size | memcpy() | no | BUG:oob_read |
| 1570 | Critical | 340 | B | mes_v12_1_allocate_ucode_data_buffer | drivers/gpu/drm/amd/amdgpu/mes_v12_1.c | fw_size | memcpy() | no | BUG:oob_read |
| 1571 | Critical | 340 | C | mlx4_MAD_IFC_wrapper | drivers/net/ethernet/mellanox/mlx4/cmd.c | vidx | subscript | no | BUG:oob_read |
| 1572 | Critical | 340 | C | mlx4_MAD_IFC_wrapper | drivers/net/ethernet/mellanox/mlx4/cmd.c | pidx | subscript | no | BUG:oob_read |
| 1573 | Critical | 340 | C | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | port | subscript | no | BUG:oob_read |
| 1574 | Critical | 340 | C | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | port | subscript | yes? | BUG:oob_write |
| 1575 | Critical | 340 | C | mlx4_ib_multiplex_mad | drivers/infiniband/hw/mlx4/mad.c | be16_to_cpu(tunnel->hdr.pkey_index) | subscript (callee) | no | BUG:oob_read |
| 1576 | Critical | 340 | C | mlx4_ib_poll_one | drivers/infiniband/hw/mlx4/cq.c | wqe_ctr | subscript | no | BUG:oob_read |
| 1577 | Critical | 340 | C | mlx4_ib_poll_one | drivers/infiniband/hw/mlx4/cq.c | wqe_ctr | subscript | no | BUG:oob_read |
| 1578 | Critical | 340 | C | mlx4_qp_detach_common | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | subscript | no | BUG:oob_read |
| 1579 | Critical | 340 | C | mlx5_poll_one | drivers/infiniband/hw/mlx5/cq.c | wqe_ctr | subscript | no | BUG:oob_read |
| 1580 | Critical | 340 | C | mlx5e_handle_rx_cqe_mpwrq_shampo | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | page_idx | subscript (callee) | no | BUG:oob_read |
| 1581 | Critical | 340 | C | mlx5e_handle_rx_cqe_mpwrq_shampo | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | page_idx | subscript | no | BUG:oob_read |
| 1582 | Critical | 340 | C | mlx5e_handle_rx_cqe_mpwrq_shampo | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | page_idx | subscript | no | BUG:oob_read |
| 1583 | Critical | 340 | B | mousevsc_on_receive_device_info | drivers/hid/hid-hyperv.c | le16_to_cpu(desc->rpt_desc.wDescriptorLe | memcpy() | no | BUG:oob_read |
| 1584 | Critical | 340 | B | mpi3mr_process_op_reply_desc | drivers/scsi/mpi3mr/mpi3mr_os.c | sz | memcpy() | no | BUG:oob_read |
| 1585 | Critical | 340 | C | mpi3mr_process_op_reply_q | drivers/scsi/mpi3mr/mpi3mr_fw.c | req_q_idx | subscript | no | BUG:oob_read |
| 1586 | Critical | 340 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1587 | Critical | 340 | C | mpi_hw_event | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1588 | Critical | 340 | C | mpi_hw_event | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1589 | Critical | 340 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1590 | Critical | 340 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1591 | Critical | 340 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1592 | Critical | 340 | C | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1593 | Critical | 340 | C | mpi_phy_stop_resp | drivers/scsi/pm8001/pm80xx_hwi.c | phyid | subscript | no | BUG:oob_read |
| 1594 | Critical | 340 | C | mpi_sata_completion | drivers/scsi/pm8001/pm8001_hwi.c | tag | subscript | no | BUG:oob_read |
| 1595 | Critical | 340 | C | mpi_sata_completion | drivers/scsi/pm8001/pm80xx_hwi.c | tag | subscript | no | BUG:oob_read |
| 1596 | Critical | 340 | C | mpi_sata_event | drivers/scsi/pm8001/pm8001_hwi.c | tag | subscript | no | BUG:oob_read |
| 1597 | Critical | 340 | C | mpi_sata_event | drivers/scsi/pm8001/pm80xx_hwi.c | tag | subscript | no | BUG:oob_read |
| 1598 | Critical | 340 | C | mpi_smp_completion | drivers/scsi/pm8001/pm8001_hwi.c | tag | subscript | no | BUG:oob_read |
| 1599 | Critical | 340 | C | mpi_smp_completion | drivers/scsi/pm8001/pm80xx_hwi.c | tag | subscript | no | BUG:oob_read |
| 1600 | Critical | 340 | C | mpi_ssp_completion | drivers/scsi/pm8001/pm8001_hwi.c | tag | subscript | no | BUG:oob_read |
| 1601 | Critical | 340 | C | mpi_ssp_completion | drivers/scsi/pm8001/pm80xx_hwi.c | tag | subscript | no | BUG:oob_read |
| 1602 | Critical | 340 | C | mpi_ssp_event | drivers/scsi/pm8001/pm80xx_hwi.c | tag | subscript | no | BUG:oob_read |
| 1603 | Critical | 340 | B | mpt3sas_ctl_add_to_event_log | drivers/scsi/mpt3sas/mpt3sas_ctl.c | sz | memcpy() | no | BUG:oob_read |
| 1604 | Critical | 340 | B | mpt3sas_scsih_event_callback | drivers/scsi/mpt3sas/mpt3sas_scsih.c | sz | memcpy() | no | BUG:oob_read |
| 1605 | Critical | 340 | C | mpt_lan_receive_post_free | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1606 | Critical | 340 | C | mpt_lan_receive_post_free | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1607 | Critical | 340 | C | mpt_lan_receive_post_free | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1608 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1609 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1610 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1611 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1612 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1613 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1614 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1615 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1616 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1617 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1618 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1619 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1620 | Critical | 340 | C | mpt_lan_receive_post_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1621 | Critical | 340 | C | mpt_lan_send_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1622 | Critical | 340 | C | mpt_lan_send_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1623 | Critical | 340 | C | mpt_lan_send_reply | drivers/message/fusion/mptlan.c | ctx | subscript | no | BUG:oob_read |
| 1624 | Critical | 340 | C | mptscsih_io_done | drivers/message/fusion/mptscsih.c | req_idx | subscript (callee) | yes? | BUG:oob_write |
| 1625 | Critical | 340 | C | mptscsih_io_done | drivers/message/fusion/mptscsih.c | req_idx | subscript (callee) | yes? | BUG:oob_write |
| 1626 | Critical | 340 | C | msb_ftl_scan | drivers/memstick/core/ms_block.c | lba | subscript | yes? | BUG:oob_write |
| 1627 | Critical | 340 | C | msb_ftl_scan | drivers/memstick/core/ms_block.c | lba | subscript | yes? | BUG:oob_write |
| 1628 | Critical | 340 | C | msb_ftl_scan | drivers/memstick/core/ms_block.c | lba | subscript | yes? | BUG:oob_write |
| 1629 | Critical | 340 | C | mt7603_fill_txs | drivers/net/wireless/mediatek/mt76/mt7603/mac.c | first_idx | subscript | no | BUG:oob_read |
| 1630 | Critical | 340 | C | mt7603_fill_txs | drivers/net/wireless/mediatek/mt76/mt7603/mac.c | idx | subscript | no | BUG:oob_read |
| 1631 | Critical | 340 | C | mt7615_fill_txs | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | first_idx | subscript | no | BUG:oob_read |
| 1632 | Critical | 340 | C | mt7615_fill_txs | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | idx | subscript | no | BUG:oob_read |
| 1633 | Critical | 340 | B | mt7921_load_clc | drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | le32_to_cpu(clc->len) | memcpy() in devm_kmemdup() | no | BUG:oob_read |
| 1634 | Critical | 340 | B | mt7925_load_clc | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | le32_to_cpu(clc->len) | memcpy() in devm_kmemdup() | no | BUG:oob_read |
| 1635 | Critical | 340 | F | mt7925_mcu_uni_hif_ctrl_event | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | (inline) | loop bound | no | BUG:stack_overflow |
| 1636 | Critical | 340 | C | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | band_idx | subscript | no | BUG:oob_read |
| 1637 | Critical | 340 | C | mt7996_mac_tx_free | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | wcid | subscript | no | BUG:oob_read |
| 1638 | Critical | 340 | B | mt7996_mcu_get_eeprom | drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | ret_len | memcpy() | no | BUG:oob_read |
| 1639 | Critical | 340 | C | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | seq_id | subscript (callee) | no | BUG:oob_read |
| 1640 | Critical | 340 | C | mthca_ah_query | drivers/infiniband/hw/mthca/mthca_av.c | port_num | subscript (callee) | no | BUG:oob_read |
| 1641 | Critical | 340 | C | mthca_ah_query | drivers/infiniband/hw/mthca/mthca_av.c | port_num | subscript (callee) | no | BUG:oob_read |
| 1642 | Critical | 340 | C | mthca_poll_one | drivers/infiniband/hw/mthca/mthca_cq.c | wqe_index | subscript | no | BUG:oob_read |
| 1643 | Critical | 340 | C | mthca_poll_one | drivers/infiniband/hw/mthca/mthca_cq.c | wqe_index | subscript | no | BUG:oob_read |
| 1644 | Critical | 340 | C | mthca_poll_one | drivers/infiniband/hw/mthca/mthca_cq.c | wqe_index | subscript | no | BUG:oob_read |
| 1645 | Critical | 340 | C | mwifiex_cmd_11n_addba_rsp_gen | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | tid | subscript (callee) | no | BUG:oob_read |
| 1646 | Critical | 340 | C | mwifiex_cmd_11n_addba_rsp_gen | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | tid | subscript (callee) | no | BUG:oob_read |
| 1647 | Critical | 340 | C | mwifiex_cmd_11n_addba_rsp_gen | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | tid | subscript (callee) | no | BUG:oob_read |
| 1648 | Critical | 340 | C | mwifiex_cmd_11n_addba_rsp_gen | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | tid | subscript | no | BUG:oob_read |
| 1649 | Critical | 340 | B | mwifiex_process_cmdresp | drivers/net/wireless/marvell/mwifiex/cmdevt.c | size | memcpy() | no | BUG:oob_read |
| 1650 | Critical | 340 | B | mwifiex_process_mgmt_packet | drivers/net/wireless/marvell/mwifiex/util.c | pkt_len | memmove() | yes? | BUG:oob_write |
| 1651 | Critical | 340 | C | mwifiex_ret_11n_addba_req | drivers/net/wireless/marvell/mwifiex/11n.c | tid | subscript | no | BUG:oob_read |
| 1652 | Critical | 340 | C | mwifiex_ret_11n_addba_req | drivers/net/wireless/marvell/mwifiex/11n.c | tid | subscript (callee) | no | BUG:oob_read |
| 1653 | Critical | 340 | C | mwifiex_ret_11n_addba_req | drivers/net/wireless/marvell/mwifiex/11n.c | tid | subscript (callee) | no | BUG:oob_read |
| 1654 | Critical | 340 | C | mwifiex_ret_11n_addba_req | drivers/net/wireless/marvell/mwifiex/11n.c | tid_down | subscript (callee) | no | BUG:oob_read |
| 1655 | Critical | 340 | C | mwifiex_ret_11n_addba_resp | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | tid | subscript | no | BUG:oob_read |
| 1656 | Critical | 340 | C | mwifiex_update_autoindex_ies | drivers/net/wireless/marvell/mwifiex/ie.c | index | subscript | yes? | BUG:oob_write |
| 1657 | Critical | 340 | B | mwifiex_update_uap_custom_ie | drivers/net/wireless/marvell/mwifiex/ie.c | len | memcpy() | no | BUG:oob_read |
| 1658 | Critical | 340 | B | mwifiex_update_uap_custom_ie | drivers/net/wireless/marvell/mwifiex/ie.c | len | memcpy() | no | BUG:oob_read |
| 1659 | Critical | 340 | B | mwifiex_update_uap_custom_ie | drivers/net/wireless/marvell/mwifiex/ie.c | len | memcpy() | no | BUG:oob_read |
| 1660 | Critical | 340 | B | nand_flash_detect_ext_param_page | drivers/mtd/nand/raw/nand_onfi.c | len | kmalloc() | no | BUG:oob_read |
| 1661 | Critical | 340 | B | nfp_dump_error_tlv | drivers/net/ethernet/netronome/nfp/nfp_net_debugdump.c | total_spec_size | memcpy() | no | BUG:oob_read |
| 1662 | Critical | 340 | C | nfp_flower_get_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | BUG:oob_read |
| 1663 | Critical | 340 | C | nfp_flower_get_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | BUG:oob_read |
| 1664 | Critical | 340 | C | nvmet_install_queue | drivers/nvme/target/fabrics-cmd.c | qid | subscript | yes? | BUG:oob_write |
| 1665 | Critical | 340 | C | nvmet_install_queue | drivers/nvme/target/fabrics-cmd.c | qid | subscript (callee) | yes? | BUG:oob_write |
| 1666 | Critical | 340 | C | nvmet_install_queue | drivers/nvme/target/fabrics-cmd.c | qid | subscript (callee) | yes? | BUG:oob_write |
| 1667 | Critical | 340 | C | nvmet_pci_epf_get_sgl_segment | drivers/nvme/target/pci-epf.c | nr_descs | subscript | no | BUG:oob_read |
| 1668 | Critical | 340 | C | nvmet_rdma_map_sgl_inline | drivers/nvme/target/rdma.c | off | subscript (callee) | yes? | BUG:oob_write |
| 1669 | Critical | 340 | C | nvmet_rdma_map_sgl_inline | drivers/nvme/target/rdma.c | off | subscript (callee) | yes? | BUG:oob_write |
| 1670 | Critical | 340 | C | nx_fw_cmd_create_rx_ctx | drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c | le32_to_cpu(prsp->rds_ring_offset) | subscript | no | BUG:oob_read |
| 1671 | Critical | 340 | C | nx_fw_cmd_create_rx_ctx | drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c | le32_to_cpu(prsp->sds_ring_offset) | subscript | no | BUG:oob_read |
| 1672 | Critical | 340 | C | ocrdma_update_free_srq_cqe | drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | wqe_idx | subscript | no | BUG:oob_read |
| 1673 | Critical | 340 | C | or51132_load_firmware | drivers/media/dvb-frontends/or51132.c | firmwareAsize | subscript | no | BUG:oob_read |
| 1674 | Critical | 340 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | curve_data | memcpy() in p54_convert_rev0() | yes? | BUG:oob_write |
| 1675 | Critical | 340 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | curve_data | memcpy() in p54_convert_rev1() | yes? | BUG:oob_write |
| 1676 | Critical | 340 | C | pass_establish | drivers/infiniband/hw/cxgb4/cm.c | tcp_opt | subscript (callee) | no | BUG:oob_read |
| 1677 | Critical | 340 | G2 | picolcd_debug_eeprom_read | drivers/hid/hid-picolcd_debugfs.c | ret | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1678 | Critical | 340 | C | pm8001_mpi_fw_flash_update_resp | drivers/scsi/pm8001/pm8001_hwi.c | tag | subscript | no | BUG:oob_read |
| 1679 | Critical | 340 | C | pm8001_mpi_get_nvmd_resp | drivers/scsi/pm8001/pm8001_hwi.c | tag | subscript | no | BUG:oob_read |
| 1680 | Critical | 340 | C | pm8001_mpi_local_phy_ctl | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1681 | Critical | 340 | C | pm8001_mpi_local_phy_ctl | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | subscript | no | BUG:oob_read |
| 1682 | Critical | 340 | C | pm8001_mpi_reg_resp | drivers/scsi/pm8001/pm8001_hwi.c | htag | subscript | no | BUG:oob_read |
| 1683 | Critical | 340 | C | pm8001_mpi_set_dev_state_resp | drivers/scsi/pm8001/pm8001_hwi.c | tag | subscript | no | BUG:oob_read |
| 1684 | Critical | 340 | C | pm8001_mpi_set_nvmd_resp | drivers/scsi/pm8001/pm8001_hwi.c | tag | subscript | no | BUG:oob_read |
| 1685 | Critical | 340 | C | pm8001_mpi_task_abort_resp | drivers/scsi/pm8001/pm8001_hwi.c | tag | subscript | no | BUG:oob_read |
| 1686 | Critical | 340 | B | pm8001_update_flash | drivers/scsi/pm8001/pm8001_ctl.c | fc_len | memcpy() | no | BUG:oob_read |
| 1687 | Critical | 340 | B | pmcraid_error_handler | drivers/scsi/pmcraid.c | data_size | memcpy() | no | BUG:oob_read |
| 1688 | Critical | 340 | C | pptp_rcv | drivers/net/ppp/pptp.c | ntohs(header->call_id) | subscript (callee) | no | BUG:oob_read |
| 1689 | Critical | 340 | B | pqi_get_device_lists | drivers/scsi/smartpqi/smartpqi_init.c | logdev_data_length | memcpy() | no | BUG:oob_read |
| 1690 | Critical | 340 | C | process_intrq | drivers/net/ethernet/chelsio/cxgb4/sge.c | qid | subscript | no | BUG:oob_read |
| 1691 | Critical | 340 | G2 | ps3_lpm_copy_tb_to_user | drivers/ps3/ps3-lpm.c | tmp | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1692 | Critical | 340 | G2 | qaic_manage_ioctl | drivers/accel/qaic/qaic_control.c | msg->len | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1693 | Critical | 340 | C | qcom_smem_get_item_count | drivers/soc/qcom/smem.c | le32_to_cpu(ptable->num_entries) | subscript | no | BUG:oob_read |
| 1694 | Critical | 340 | C | qed_init_cmd_mode | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | offset | subscript (callee) | no | BUG:oob_read |
| 1695 | Critical | 340 | C | qed_init_cmd_wr | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | le16_to_cpu(arg->runtime.offset) | subscript (callee) | no | BUG:oob_read |
| 1696 | Critical | 340 | C | qed_init_cmd_wr | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | le16_to_cpu(arg->runtime.offset) | subscript (callee) | no | BUG:oob_read |
| 1697 | Critical | 340 | C | qed_ll2_lb_rxq_handler | drivers/net/ethernet/qlogic/qed/qed_ll2.c | cid | subscript (callee) | no | BUG:oob_read |
| 1698 | Critical | 340 | G2 | qeth_query_oat_command | drivers/s390/net/qeth_core_main.c | priv.response_len | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1699 | Critical | 340 | B | qla24xx_copy_eft | drivers/scsi/qla2xxx/qla_dbg.c | ntohl(ha->fw_dump->eft_size) | memcpy() | no | BUG:oob_read |
| 1700 | Critical | 340 | B | qla27xx_execute_fwdt_template | drivers/scsi/qla2xxx/qla_tmpl.c | len | memcpy() | no | BUG:oob_read |
| 1701 | Critical | 340 | B | qla27xx_fwdt_entry_t275 | drivers/scsi/qla2xxx/qla_tmpl.c | length | memcpy() in qla27xx_insertbuf() | no | BUG:oob_read |
| 1702 | Critical | 340 | H | qla4_84xx_minidump_process_rddfe | drivers/scsi/qla4xxx/ql4_nx.c | count | truncation | no | BUG:oob_write |
| 1703 | Critical | 340 | C | qla82xx_get_bootld_offset | drivers/scsi/qla2xxx/qla_nx.c | offset | subscript | no | BUG:oob_read |
| 1704 | Critical | 340 | C | qla82xx_get_data_desc | drivers/scsi/qla2xxx/qla_nx.c | offset | subscript | no | BUG:oob_read |
| 1705 | Critical | 340 | C | qla82xx_get_fw_offs | drivers/scsi/qla2xxx/qla_nx.c | offset | subscript | no | BUG:oob_read |
| 1706 | Critical | 340 | C | qla82xx_get_table_desc | drivers/scsi/qla2xxx/qla_nx.c | offset | subscript | no | BUG:oob_read |
| 1707 | Critical | 340 | C | qla82xx_get_table_desc | drivers/scsi/qla2xxx/qla_nx.c | offset | subscript | no | BUG:oob_read |
| 1708 | Critical | 340 | C | qla82xx_set_product_offset | drivers/scsi/qla2xxx/qla_nx.c | offset | subscript | no | BUG:oob_read |
| 1709 | Critical | 340 | C | qla82xx_set_product_offset | drivers/scsi/qla2xxx/qla_nx.c | offset | subscript | no | BUG:oob_read |
| 1710 | Critical | 340 | C | qlafx00_multistatus_entry | drivers/scsi/qla2xxx/qla_mr.c | que | subscript | no | BUG:oob_read |
| 1711 | Critical | 340 | C | qlcnic_82xx_fw_cmd_create_rx_ctx | drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c | le32_to_cpu(prsp->rds_ring_offset) | subscript | no | BUG:oob_read |
| 1712 | Critical | 340 | C | qlcnic_82xx_fw_cmd_create_rx_ctx | drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c | le32_to_cpu(prsp->sds_ring_offset) | subscript | no | BUG:oob_read |
| 1713 | Critical | 340 | C | qlcnic_get_bootld_offs | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | offs | subscript | no | BUG:oob_read |
| 1714 | Critical | 340 | C | qlcnic_get_data_desc | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | offs | subscript | no | BUG:oob_read |
| 1715 | Critical | 340 | C | qlcnic_get_fw_offs | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | offs | subscript | no | BUG:oob_read |
| 1716 | Critical | 340 | C | qlcnic_get_table_desc | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | offs | subscript | no | BUG:oob_read |
| 1717 | Critical | 340 | C | qlcnic_get_table_desc | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | offs | subscript | no | BUG:oob_read |
| 1718 | Critical | 340 | C | qlcnic_validate_bootld | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | offs | subscript | no | BUG:oob_read |
| 1719 | Critical | 340 | C | qlcnic_validate_fw | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | offs | subscript | no | BUG:oob_read |
| 1720 | Critical | 340 | C | qlcnic_validate_product_offs | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | offs | subscript | no | BUG:oob_read |
| 1721 | Critical | 340 | C | qlcnic_validate_product_offs | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | offs | subscript | no | BUG:oob_read |
| 1722 | Critical | 340 | C | qm_aeq_thread | drivers/crypto/hisilicon/qm.c | qp_id | subscript (callee) | no | BUG:oob_read |
| 1723 | Critical | 340 | B | qtnf_cmd_resp_proc_hw_info | drivers/net/wireless/quantenna/qtnfmac/commands.c | tlv_len | memcpy() | no | BUG:oob_read |
| 1724 | Critical | 340 | B | qtnf_event_parse | drivers/net/wireless/quantenna/qtnfmac/event.c | event_len | memcpy() in qtnf_event_handle_update_owe() | no | BUG:oob_read |
| 1725 | Critical | 340 | C | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | non_clock_array_index | subscript | no | BUG:oob_read |
| 1726 | Critical | 340 | C | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | clock_array_index | subscript | no | BUG:oob_read |
| 1727 | Critical | 340 | C | radeon_ring_backup | drivers/gpu/drm/radeon/radeon_ring.c | ptr | subscript | no | BUG:oob_read |
| 1728 | Critical | 340 | C | recv_interrupt | drivers/tty/serial/icom.c | offset | subscript | no | BUG:oob_read |
| 1729 | Critical | 340 | C | remove_promisc_qp | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | subscript | no | BUG:oob_read |
| 1730 | Critical | 340 | C | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | new_zone | subscript | no | BUG:oob_read |
| 1731 | Critical | 340 | C | rmi_f34_flash_firmware | drivers/input/rmi4/rmi_f34.c | image_size | subscript | no | BUG:oob_read |
| 1732 | Critical | 340 | B | rsi_hci_recv_pkt | drivers/bluetooth/btrsi.c | pkt_len | memcpy() | no | BUG:oob_read |
| 1733 | Critical | 340 | C | rtw89_fw_log_create_fmts_dict | drivers/net/wireless/realtek/rtw89/fw.c | fmt_count | subscript | no | BUG:oob_read |
| 1734 | Critical | 340 | C | save_frame | drivers/media/usb/s2255/s2255drv.c | le32_to_cpu(pdword[1]) | subscript | no | BUG:oob_read |
| 1735 | Critical | 340 | B | sdma_v7_0_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | fw_size | memcpy() | no | BUG:oob_read |
| 1736 | Critical | 340 | B | sdma_v7_1_inst_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v7_1.c | fw_size | memcpy() | no | BUG:oob_read |
| 1737 | Critical | 340 | C | set_feature | drivers/usb/gadget/udc/m66592-udc.c | w_index | subscript | no | BUG:oob_read |
| 1738 | Critical | 340 | C | set_feature | drivers/usb/gadget/udc/r8a66597-udc.c | w_index | subscript | no | BUG:oob_read |
| 1739 | Critical | 340 | G2 | sev_ioctl_do_get_id2 | drivers/crypto/ccp/sev-dev.c | data.len | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1740 | Critical | 340 | C | si_irq_process | drivers/gpu/drm/radeon/si.c | crtc_idx | subscript (callee) | no | BUG:oob_read |
| 1741 | Critical | 340 | C | si_irq_process | drivers/gpu/drm/radeon/si.c | crtc_idx | subscript (callee) | no | BUG:oob_read |
| 1742 | Critical | 340 | C | si_irq_process | drivers/gpu/drm/radeon/si.c | src_id | subscript (callee) | no | BUG:oob_read |
| 1743 | Critical | 340 | C | si_irq_process | drivers/gpu/drm/radeon/si.c | crtc_idx | subscript | no | BUG:oob_read |
| 1744 | Critical | 340 | C | si_irq_process | drivers/gpu/drm/radeon/si.c | crtc_idx | subscript | no | BUG:oob_read |
| 1745 | Critical | 340 | C | si_irq_process | drivers/gpu/drm/radeon/si.c | crtc_idx | subscript | no | BUG:oob_read |
| 1746 | Critical | 340 | C | si_irq_process | drivers/gpu/drm/radeon/si.c | hpd_idx | subscript | no | BUG:oob_read |
| 1747 | Critical | 340 | C | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | non_clock_array_index | subscript | no | BUG:oob_read |
| 1748 | Critical | 340 | C | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | non_clock_array_index | subscript | no | BUG:oob_read |
| 1749 | Critical | 340 | C | sis_read_packet | drivers/input/touchscreen/sis_i2c.c | count_idx | subscript | no | BUG:oob_read |
| 1750 | Critical | 340 | C | smp_snoop | drivers/infiniband/hw/mlx4/mad.c | bn | subscript (callee) | no | BUG:oob_read |
| 1751 | Critical | 340 | C | smp_snoop | drivers/infiniband/hw/mlx4/mad.c | bn | subscript (callee) | yes? | BUG:oob_write |
| 1752 | Critical | 340 | C | smp_snoop | drivers/infiniband/hw/mlx4/mad.c | bn | subscript (callee) | no | BUG:oob_read |
| 1753 | Critical | 340 | C | smp_snoop | drivers/infiniband/hw/mlx4/mad.c | bn | subscript (callee) | no | BUG:oob_read |
| 1754 | Critical | 340 | C | smp_snoop | drivers/infiniband/hw/mlx4/mad.c | bn | subscript | yes? | BUG:oob_write |
| 1755 | Critical | 340 | B | smsc75xx_rx_fixup | drivers/net/usb/smsc75xx.c | size | memcpy() | yes? | BUG:oob_write |
| 1756 | Critical | 340 | G2 | smu_read_command | drivers/macintosh/smu.c | size | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1757 | Critical | 340 | C | sppctl_dt_node_to_map | drivers/pinctrl/sunplus/sppctl.c | pin_func | subscript | no | BUG:oob_read |
| 1758 | Critical | 340 | C | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | non_clock_array_index | subscript | no | BUG:oob_read |
| 1759 | Critical | 340 | C | t4_load_boot | drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | pcir_offset | subscript | no | BUG:oob_read |
| 1760 | Critical | 340 | C | t7xx_port_proxy_recv_skb | drivers/net/wwan/t7xx/t7xx_port_proxy.c | channel | subscript (callee) | no | BUG:oob_read |
| 1761 | Critical | 340 | C | tc35815_clear_queues | drivers/net/ethernet/toshiba/tc35815.c | fdsystem | subscript | no | BUG:oob_read |
| 1762 | Critical | 340 | C | tc35815_free_queues | drivers/net/ethernet/toshiba/tc35815.c | fdsystem | subscript | no | BUG:oob_read |
| 1763 | Critical | 340 | C | tc35815_txdone | drivers/net/ethernet/toshiba/tc35815.c | fdsystem | subscript | no | BUG:oob_read |
| 1764 | Critical | 340 | B | tn40_rx_receive | drivers/net/ethernet/tehuti/tn40.c | tmp_len | memcpy() | yes? | BUG:oob_write |
| 1765 | Critical | 340 | C | tpm_buf_check_hmac_response | drivers/char/tpm/tpm2-sessions.c | offset_p | subscript | no | BUG:oob_read |
| 1766 | Critical | 340 | C | tpm_buf_check_hmac_response | drivers/char/tpm/tpm2-sessions.c | offset_p | subscript | no | BUG:oob_read |
| 1767 | Critical | 340 | C | tpm_buf_check_hmac_response | drivers/char/tpm/tpm2-sessions.c | offset_p | subscript | no | BUG:oob_read |
| 1768 | Critical | 340 | C | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | non_clock_array_index | subscript | no | BUG:oob_read |
| 1769 | Critical | 340 | B | tsi721_get_inb_message | drivers/rapidio/devices/tsi721.c | msg_size | memcpy() | no | BUG:oob_read |
| 1770 | Critical | 340 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript (callee) | yes? | BUG:oob_write |
| 1771 | Critical | 340 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript (callee) | yes? | BUG:oob_write |
| 1772 | Critical | 340 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript (callee) | yes? | BUG:oob_write |
| 1773 | Critical | 340 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript | no | BUG:oob_read |
| 1774 | Critical | 340 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript | yes? | BUG:oob_write |
| 1775 | Critical | 340 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript | no | BUG:oob_read |
| 1776 | Critical | 340 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript | no | BUG:oob_read |
| 1777 | Critical | 340 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript | yes? | BUG:oob_write |
| 1778 | Critical | 340 | C | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | idx | subscript (callee) | no | BUG:oob_read |
| 1779 | Critical | 340 | C | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | idx | subscript (callee) | no | BUG:oob_read |
| 1780 | Critical | 340 | C | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | idx | subscript | no | BUG:oob_read |
| 1781 | Critical | 340 | C | ubi_eba_copy_leb | drivers/mtd/ubi/eba.c | idx | subscript | no | BUG:oob_read |
| 1782 | Critical | 340 | C | ubi_eba_copy_leb | drivers/mtd/ubi/eba.c | lnum | subscript | no | BUG:oob_read |
| 1783 | Critical | 340 | C | ubi_eba_copy_leb | drivers/mtd/ubi/eba.c | lnum | subscript | yes? | BUG:oob_write |
| 1784 | Critical | 340 | C | udc_handle_ep0_setup | drivers/usb/gadget/udc/lpc32xx_udc.c | wIndex | subscript (callee) | no | BUG:oob_read |
| 1785 | Critical | 340 | B | ufshcd_copy_sense_data | drivers/ufs/core/ufshcd.c | len_to_copy | memcpy() | no | BUG:oob_read |
| 1786 | Critical | 340 | B | update_edgeport_E2PROM | drivers/usb/serial/io_edgeport.c | be16_to_cpu(rec->len) | memcpy() in rom_write() | no | BUG:oob_read |
| 1787 | Critical | 340 | G2 | update_user_bitmap | drivers/vfio/vfio_iommu_type1.c | DIRTY_BITMAP_BYTES(nbits + shift) | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1788 | Critical | 340 | C | usb_get_bos_descriptor | drivers/usb/core/config.c | cap_type | subscript | no | BUG:oob_read |
| 1789 | Critical | 340 | C | value_base | drivers/md/persistent-data/dm-btree-internal.h | le32_to_cpu(n->header.max_entries) | subscript | no | BUG:oob_read |
| 1790 | Critical | 340 | B | velocity_receive_frame | drivers/net/ethernet/via/via-velocity.c | pkt_len | memmove() in velocity_iph_realign() | yes? | BUG:oob_write |
| 1791 | Critical | 340 | G2 | virtiovf_issue_legacy_rw_cmd | drivers/vfio/pci/virtio/legacy_io.c | count | copy_to_user() unvalidated size | no | BUG:oob_read |
| 1792 | Critical | 340 | C | vmu_connect | drivers/mtd/maps/vmu-flash.c | c | subscript | no | BUG:oob_read |
| 1793 | Critical | 340 | B | wilc_wlan_firmware_download | drivers/net/wireless/microchip/wilc1000/wlan.c | size2 | memcpy() | no | BUG:oob_read |
| 1794 | Critical | 340 | C | wlcore_event_fw_logger | drivers/net/wireless/ti/wlcore/event.c | start_loc | subscript | no | BUG:oob_read |
| 1795 | Critical | 340 | B | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | len | memcpy() in wil_memcpy_fromio_32() | no | BUG:oob_read |
| 1796 | Critical | 340 | C | xgene_dma_cleanup_descriptors | drivers/dma/xgene-dma.c | status | subscript | no | BUG:oob_read |
| 1797 | Critical | 330 | F | DBG_DUMP_REPLY_FRAME | drivers/message/fusion/mptdebug.h | n | loop bound | no | BUG:oob_read |
| 1798 | Critical | 330 | F | DBG_DUMP_TM_REPLY_FRAME | drivers/message/fusion/mptdebug.h | n | loop bound | no | BUG:oob_read |
| 1799 | Critical | 330 | F | MR_GetSpanBlock | drivers/scsi/megaraid/megaraid_sas_fp.c | (inline) | loop bound | no | BUG:oob_read |
| 1800 | Critical | 330 | F | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | (inline) | loop bound | no | BUG:oob_read |
| 1801 | Critical | 330 | F | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | desc_table | loop bound | no | BUG:oob_read |
| 1802 | Critical | 330 | F | NFTL_makefreeblock | drivers/mtd/nftlcore.c | (inline) | loop bound | no | BUG:oob_read |
| 1803 | Critical | 330 | F | __mt7921_mcu_set_clc | drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | buf_len | loop bound | no | BUG:oob_read |
| 1804 | Critical | 330 | F | __mt7925_mcu_set_clc | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | last_pos | loop bound | no | BUG:oob_read |
| 1805 | Critical | 330 | F | _show_fbtc_step_v2 | drivers/net/wireless/realtek/rtw89/coex.c | n_stop | loop bound | no | BUG:oob_read |
| 1806 | Critical | 330 | F | add_promisc_qp | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | loop bound | no | BUG:oob_read |
| 1807 | Critical | 330 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | subscript (callee) | yes? | BUG:stack_overflow |
| 1808 | Critical | 330 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | subscript (callee) | yes? | BUG:stack_overflow |
| 1809 | Critical | 330 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | subscript (callee) | yes? | BUG:stack_overflow |
| 1810 | Critical | 330 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | subscript (callee) | yes? | BUG:stack_overflow |
| 1811 | Critical | 330 | F | altera_execute | drivers/misc/altera-stapl/altera.c | action_count | loop bound | no | BUG:oob_read |
| 1812 | Critical | 330 | F | altera_execute | drivers/misc/altera-stapl/altera.c | var_size | loop bound | no | BUG:oob_read |
| 1813 | Critical | 330 | F | altera_execute | drivers/misc/altera-stapl/altera.c | i | loop bound | no | BUG:oob_read |
| 1814 | Critical | 330 | F | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx | loop bound | yes? | BUG:oob_write |
| 1815 | Critical | 330 | F | altera_execute | drivers/misc/altera-stapl/altera.c | i | loop bound | no | BUG:oob_read |
| 1816 | Critical | 330 | F | altera_execute | drivers/misc/altera-stapl/altera.c | i | loop bound | no | BUG:oob_read |
| 1817 | Critical | 330 | F | altera_get_act_info | drivers/misc/altera-stapl/altera.c | act_proc_id | loop bound | no | BUG:oob_read |
| 1818 | Critical | 330 | E | amdgpu_atombios_encoder_get_lcd_info | drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | fake_edid_record | fake_edid_record->ucFakeEDIDLength | yes? | BUG:oob_read |
| 1819 | Critical | 330 | E | amdgpu_atombios_encoder_get_lcd_info | drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | fake_edid_record | fake_edid_record->ucFakeEDIDLength | yes? | BUG:oob_read |
| 1820 | Critical | 330 | F | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path_obj | loop bound | no | BUG:oob_read |
| 1821 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usDeviceTag | yes? | BUG:oob_read |
| 1822 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usDeviceTag | yes? | BUG:oob_read |
| 1823 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usSize | yes? | BUG:oob_read |
| 1824 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usGraphicObjIds | yes? | BUG:oob_read |
| 1825 | Critical | 330 | F | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | enc_obj | loop bound | no | BUG:oob_read |
| 1826 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usGraphicObjIds | yes? | BUG:oob_read |
| 1827 | Critical | 330 | F | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | loop bound | no | BUG:oob_read |
| 1828 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usDeviceTag | yes? | BUG:oob_read |
| 1829 | Critical | 330 | F | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | router_obj | loop bound | no | BUG:oob_read |
| 1830 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usGraphicObjIds | yes? | BUG:oob_read |
| 1831 | Critical | 330 | F | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | num_dst_objs | loop bound | no | BUG:oob_read |
| 1832 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usConnObjectId | yes? | BUG:oob_read |
| 1833 | Critical | 330 | F | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | loop bound | no | BUG:oob_read |
| 1834 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usDeviceTag | yes? | BUG:oob_read |
| 1835 | Critical | 330 | F | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | con_obj | loop bound | no | BUG:oob_read |
| 1836 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usConnObjectId | yes? | BUG:oob_read |
| 1837 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | con_obj | con_obj->asObjects | yes? | BUG:oob_read |
| 1838 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | con_obj | con_obj->asObjects | yes? | BUG:oob_read |
| 1839 | Critical | 330 | F | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | record | loop bound | no | BUG:oob_read |
| 1840 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usConnObjectId | yes? | BUG:oob_read |
| 1841 | Critical | 330 | E | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | path->usDeviceTag | yes? | BUG:oob_read |
| 1842 | Critical | 330 | F | amdgpu_atombios_lookup_voltage_object_v3 | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | size | loop bound | no | BUG:oob_read |
| 1843 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_1 | yes? | BUG:oob_read |
| 1844 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_1 | yes? | BUG:oob_read |
| 1845 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_1 | yes? | BUG:oob_read |
| 1846 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_2 | yes? | BUG:oob_read |
| 1847 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_2 | yes? | BUG:oob_read |
| 1848 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_2 | yes? | BUG:oob_read |
| 1849 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_2 | yes? | BUG:oob_read |
| 1850 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_2 | yes? | BUG:oob_read |
| 1851 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_2 | yes? | BUG:oob_read |
| 1852 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_2 | yes? | BUG:oob_read |
| 1853 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_2 | yes? | BUG:oob_read |
| 1854 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_3 | yes? | BUG:oob_read |
| 1855 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_3 | yes? | BUG:oob_read |
| 1856 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_3 | yes? | BUG:oob_read |
| 1857 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_3 | yes? | BUG:oob_read |
| 1858 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_3 | yes? | BUG:oob_read |
| 1859 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_3 | yes? | BUG:oob_read |
| 1860 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_3 | yes? | BUG:oob_read |
| 1861 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1_3 | yes? | BUG:oob_read |
| 1862 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2_1 | yes? | BUG:oob_read |
| 1863 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2_1 | yes? | BUG:oob_read |
| 1864 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2_1 | yes? | BUG:oob_read |
| 1865 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2_1 | yes? | BUG:oob_read |
| 1866 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2_1 | yes? | BUG:oob_read |
| 1867 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2_1 | yes? | BUG:oob_read |
| 1868 | Critical | 330 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v2_1 | yes? | BUG:oob_read |
| 1869 | Critical | 330 | F | amdgpu_discovery_read_harvest_bit_per_ip | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | num_dies | loop bound | no | BUG:oob_read |
| 1870 | Critical | 330 | F | amdgpu_discovery_read_harvest_bit_per_ip | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | num_ips | loop bound | no | BUG:oob_read |
| 1871 | Critical | 330 | E | amdgpu_discovery_read_harvest_bit_per_ip | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->num_base_address | yes? | BUG:oob_read |
| 1872 | Critical | 330 | F | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | num_dies | loop bound | no | BUG:oob_read |
| 1873 | Critical | 330 | F | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | num_ips | loop bound | no | BUG:oob_read |
| 1874 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->revision | yes? | BUG:oob_read |
| 1875 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->instance_number | yes? | BUG:oob_read |
| 1876 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->instance_number | yes? | BUG:oob_read |
| 1877 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->revision | yes? | BUG:oob_read |
| 1878 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | yes? | BUG:oob_read |
| 1879 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->instance_number | yes? | BUG:oob_read |
| 1880 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->instance_number | yes? | BUG:oob_read |
| 1881 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->major | yes? | BUG:oob_read |
| 1882 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->revision | yes? | BUG:oob_read |
| 1883 | Critical | 330 | F | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | num_base_address | loop bound | no | BUG:oob_read |
| 1884 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->base_address | yes? | BUG:oob_read |
| 1885 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->sub_revision | yes? | BUG:oob_read |
| 1886 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->variant | yes? | BUG:oob_read |
| 1887 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->major | yes? | BUG:oob_read |
| 1888 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->minor | yes? | BUG:oob_read |
| 1889 | Critical | 330 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->revision | yes? | BUG:oob_read |
| 1890 | Critical | 330 | F | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | num_ips | loop bound | no | BUG:oob_read |
| 1891 | Critical | 330 | F | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | loop bound | no | BUG:oob_read |
| 1892 | Critical | 330 | F | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | num_dies | loop bound | no | BUG:oob_read |
| 1893 | Critical | 330 | E | amdgpu_discovery_verify_npsinfo | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | nhdr | nhdr->size_bytes | yes? | BUG:oob_read |
| 1894 | Critical | 330 | F | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | dep_table | loop bound | no | BUG:oob_read |
| 1895 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan2 | yes? | BUG:oob_read |
| 1896 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan3 | yes? | BUG:oob_read |
| 1897 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan3 | yes? | BUG:oob_read |
| 1898 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | fan_info | fan_info->fan3 | yes? | BUG:oob_read |
| 1899 | Critical | 330 | F | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | psl | loop bound | no | BUG:oob_read |
| 1900 | Critical | 330 | F | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | cac_table | loop bound | no | BUG:oob_read |
| 1901 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usVCETableOffset | yes? | BUG:oob_read |
| 1902 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usVCETableOffset | yes? | BUG:oob_read |
| 1903 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | BUG:undersized_alloc |
| 1904 | Critical | 330 | F | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | loop bound | no | BUG:oob_read |
| 1905 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usSize | yes? | BUG:oob_read |
| 1906 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usUVDTableOffset | yes? | BUG:oob_read |
| 1907 | Critical | 330 | F | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | loop bound | no | BUG:oob_read |
| 1908 | Critical | 330 | F | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | loop bound | no | BUG:oob_read |
| 1909 | Critical | 330 | F | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | loop bound | no | BUG:oob_read |
| 1910 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usPowerTuneTableOffset | yes? | BUG:oob_read |
| 1911 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usPowerTuneTableOffset | yes? | BUG:oob_read |
| 1912 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usPowerTuneTableOffset | yes? | BUG:oob_read |
| 1913 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usSize | yes? | BUG:oob_read |
| 1914 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usSclkVddgfxTableOffset | yes? | BUG:oob_read |
| 1915 | Critical | 330 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usSclkVddgfxTableOffset | yes? | BUG:oob_read |
| 1916 | Critical | 330 | F | amdgpu_si_load_smc_ucode | drivers/gpu/drm/amd/pm/legacy-dpm/si_smc.c | ucode_size | loop bound | no | BUG:oob_read |
| 1917 | Critical | 330 | F | amdgpu_ucode_print_psp_hdr | drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | (inline) | loop bound | no | BUG:oob_read |
| 1918 | Critical | 330 | F | amt_lookup_act_srcs | drivers/net/amt.c | nsrcs | loop bound | no | BUG:oob_read |
| 1919 | Critical | 330 | F | amt_lookup_act_srcs | drivers/net/amt.c | nsrcs | loop bound | no | BUG:oob_read |
| 1920 | Critical | 330 | F | amt_lookup_act_srcs | drivers/net/amt.c | nsrcs | loop bound | no | BUG:oob_read |
| 1921 | Critical | 330 | F | amt_lookup_act_srcs | drivers/net/amt.c | nsrcs | loop bound | no | BUG:oob_read |
| 1922 | Critical | 330 | F | asic_internal_ss_get_ss_asignment | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | (inline) | loop bound | no | BUG:oob_read |
| 1923 | Critical | 330 | F | ath12k_dbring_buffer_release_event | drivers/net/wireless/ath/ath12k/dbring.c | num_entry | loop bound | no | BUG:oob_read |
| 1924 | Critical | 330 | F | ath12k_htt_print_pdev_rtt_tbr_cmd_res_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | (inline) | loop bound | no | BUG:oob_read |
| 1925 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_brp_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1926 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_brp_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1927 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_brp_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1928 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_brp_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1929 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_brp_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1930 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_ndp_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1931 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_ndp_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1932 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_ndp_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1933 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_ndp_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1934 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_ndpa_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1935 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_ndpa_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1936 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_ndpa_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1937 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_ndpa_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1938 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_steer_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1939 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_steer_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1940 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_steer_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1941 | Critical | 330 | F | ath12k_htt_print_txbf_ofdma_ax_steer_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | num_elements | loop bound | no | BUG:oob_read |
| 1942 | Critical | 330 | F | ath12k_pull_mac_phy_cap_svc_ready_ext | drivers/net/wireless/ath/ath12k/wmi.c | (inline) | loop bound | no | BUG:oob_read |
| 1943 | Critical | 330 | F | ath12k_wmi_process_csa_switch_count_event | drivers/net/wireless/ath/ath12k/wmi.c | num_vdevs | loop bound | no | BUG:oob_read |
| 1944 | Critical | 330 | F | ath6kl_read_fwlogs | drivers/net/wireless/ath/ath6kl/main.c | length | loop bound | yes? | BUG:oob_write |
| 1945 | Critical | 330 | F | ath6kl_roam_table_read | drivers/net/wireless/ath/ath6kl/debug.c | num_entries | loop bound | no | BUG:oob_read |
| 1946 | Critical | 330 | F | atom_lookup_voltage_object_v1 | drivers/gpu/drm/radeon/radeon_atombios.c | size | loop bound | no | BUG:oob_read |
| 1947 | Critical | 330 | F | atom_lookup_voltage_object_v2 | drivers/gpu/drm/radeon/radeon_atombios.c | size | loop bound | no | BUG:oob_read |
| 1948 | Critical | 330 | F | atom_lookup_voltage_object_v3 | drivers/gpu/drm/radeon/radeon_atombios.c | size | loop bound | no | BUG:oob_read |
| 1949 | Critical | 330 | F | atomctrl_lookup_gpio_pin | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | size | loop bound | no | BUG:oob_read |
| 1950 | Critical | 330 | F | atomctrl_lookup_voltage_type_v3 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | size | loop bound | no | BUG:oob_read |
| 1951 | Critical | 330 | F | atomctrl_set_mc_reg_address_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | num_entries | loop bound | no | BUG:oob_read |
| 1952 | Critical | 330 | F | bcm3510_download_firmware | drivers/media/dvb-frontends/bcm3510.c | len | loop bound | no | BUG:oob_read |
| 1953 | Critical | 330 | F | be_cmd_get_fw_log_level | drivers/net/ethernet/emulex/benet/be_cmds.c | (inline) | loop bound | no | BUG:oob_read |
| 1954 | Critical | 330 | F | be_cmd_get_profile_config | drivers/net/ethernet/emulex/benet/be_cmds.c | desc_count | loop bound | no | BUG:oob_read |
| 1955 | Critical | 330 | F | be_cmd_get_profile_config | drivers/net/ethernet/emulex/benet/be_cmds.c | desc_count | loop bound | no | BUG:oob_read |
| 1956 | Critical | 330 | F | be_cmd_get_profile_config | drivers/net/ethernet/emulex/benet/be_cmds.c | desc_count | loop bound | no | BUG:oob_read |
| 1957 | Critical | 330 | F | be_flash_skyhawk | drivers/net/ethernet/emulex/benet/be_cmds.c | (inline) | loop bound | no | BUG:oob_read |
| 1958 | Critical | 330 | F | be_fw_download | drivers/net/ethernet/emulex/benet/be_cmds.c | num_imgs | loop bound | no | BUG:oob_read |
| 1959 | Critical | 330 | F | bfa_fcs_lport_scn_process_rscn | drivers/scsi/bfa/bfa_fcs_lport.c | num_entries | loop bound | no | BUG:oob_read |
| 1960 | Critical | 330 | E | bios_parser_get_connector_id | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | tbl | tbl->asObjects | yes? | BUG:oob_read |
| 1961 | Critical | 330 | F | bios_parser_get_gpio_pin_info | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | count | loop bound | no | BUG:oob_read |
| 1962 | Critical | 330 | F | bitmap_flush_work | drivers/md/dm-integrity.c | limit | loop bound | no | BUG:oob_read |
| 1963 | Critical | 330 | F | bitmap_flush_work | drivers/md/dm-integrity.c | limit | loop bound | yes? | BUG:oob_write |
| 1964 | Critical | 330 | F | bitmap_flush_work | drivers/md/dm-integrity.c | limit | loop bound | yes? | BUG:oob_write |
| 1965 | Critical | 330 | F | bitmap_flush_work | drivers/md/dm-integrity.c | limit | loop bound | yes? | BUG:oob_write |
| 1966 | Critical | 330 | F | bitmap_flush_work | drivers/md/dm-integrity.c | limit | loop bound | yes? | BUG:oob_write |
| 1967 | Critical | 330 | F | bnx2x_rx_int | drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | pages | loop bound | no | BUG:oob_read |
| 1968 | Critical | 330 | B | brcmf_sdio_dump_console | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | console_size | console_size + 1 | yes? | BUG:undersized_alloc |
| 1969 | Critical | 330 | F | btmtk_setup_firmware_79xx | drivers/bluetooth/btmtk.c | section_num | loop bound | no | BUG:oob_read |
| 1970 | Critical | 330 | F | ci_load_smc_ucode | drivers/gpu/drm/radeon/ci_smc.c | ucode_size | loop bound | no | BUG:oob_read |
| 1971 | Critical | 330 | F | ci_mc_load_microcode | drivers/gpu/drm/radeon/cik.c | regs_size | loop bound | no | BUG:oob_read |
| 1972 | Critical | 330 | F | ci_mc_load_microcode | drivers/gpu/drm/radeon/cik.c | ucode_size | loop bound | no | BUG:oob_read |
| 1973 | Critical | 330 | F | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | state_array | loop bound | no | BUG:oob_read |
| 1974 | Critical | 330 | F | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | power_state | loop bound | no | BUG:oob_read |
| 1975 | Critical | 330 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | BUG:oob_read |
| 1976 | Critical | 330 | F | cik_cp_compute_load_microcode | drivers/gpu/drm/radeon/cik.c | fw_size | loop bound | no | BUG:oob_read |
| 1977 | Critical | 330 | F | cik_cp_compute_load_microcode | drivers/gpu/drm/radeon/cik.c | fw_size | loop bound | no | BUG:oob_read |
| 1978 | Critical | 330 | F | cik_cp_gfx_load_microcode | drivers/gpu/drm/radeon/cik.c | fw_size | loop bound | no | BUG:oob_read |
| 1979 | Critical | 330 | F | cik_cp_gfx_load_microcode | drivers/gpu/drm/radeon/cik.c | fw_size | loop bound | no | BUG:oob_read |
| 1980 | Critical | 330 | F | cik_cp_gfx_load_microcode | drivers/gpu/drm/radeon/cik.c | fw_size | loop bound | no | BUG:oob_read |
| 1981 | Critical | 330 | F | cik_init_cp_pg_table | drivers/gpu/drm/radeon/cik.c | table_size | loop bound | no | BUG:oob_read |
| 1982 | Critical | 330 | F | cik_rlc_resume | drivers/gpu/drm/radeon/cik.c | size | loop bound | no | BUG:oob_read |
| 1983 | Critical | 330 | F | cik_sdma_load_microcode | drivers/gpu/drm/radeon/cik_sdma.c | fw_size | loop bound | no | BUG:oob_read |
| 1984 | Critical | 330 | F | cik_sdma_load_microcode | drivers/gpu/drm/radeon/cik_sdma.c | fw_size | loop bound | no | BUG:oob_read |
| 1985 | Critical | 330 | F | cik_sdma_load_microcode | drivers/gpu/drm/amd/amdgpu/cik_sdma.c | fw_size | loop bound | no | BUG:oob_read |
| 1986 | Critical | 330 | F | cmd_db_debugfs_dump | drivers/soc/qcom/cmd-db.c | (inline) | loop bound | no | BUG:oob_read |
| 1987 | Critical | 330 | F | cmd_db_get_header | drivers/soc/qcom/cmd-db.c | (inline) | loop bound | no | BUG:oob_read |
| 1988 | Critical | 330 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->? | yes? | BUG:oob_read |
| 1989 | Critical | 330 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->? | yes? | BUG:oob_read |
| 1990 | Critical | 330 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->? | yes? | BUG:oob_read |
| 1991 | Critical | 330 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->? | yes? | BUG:oob_read |
| 1992 | Critical | 330 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->? | yes? | BUG:oob_read |
| 1993 | Critical | 330 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->? | yes? | BUG:oob_read |
| 1994 | Critical | 330 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->? | yes? | BUG:oob_read |
| 1995 | Critical | 330 | E | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | ip | ip->saddr | yes? | BUG:oob_read |
| 1996 | Critical | 330 | A | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | ip | memcpy() | yes? | BUG:oob_read |
| 1997 | Critical | 330 | E | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | ip | ip->saddr | yes? | BUG:oob_read |
| 1998 | Critical | 330 | A | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | ip | memcpy() | yes? | BUG:oob_read |
| 1999 | Critical | 330 | E | cxgb_get_4tuple | drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | ip | ip->daddr | yes? | BUG:oob_read |
| 2000 | Critical | 330 | F | cxl_clear_event_record | drivers/cxl/core/mbox.c | total | loop bound | no | BUG:oob_read |
| 2001 | Critical | 330 | F | cxl_enumerate_cmds | drivers/cxl/core/mbox.c | (inline) | loop bound | no | BUG:oob_read |
| 2002 | Critical | 330 | F | cxl_mem_get_poison | drivers/cxl/core/mbox.c | (inline) | loop bound | no | BUG:oob_read |
| 2003 | Critical | 330 | F | cxl_mem_get_records_log | drivers/cxl/core/mbox.c | nr_rec | loop bound | no | BUG:oob_read |
| 2004 | Critical | 330 | F | cyapa_pip_check_fw | drivers/input/mouse/cyapa_gen5.c | fw_app_len | loop bound | no | BUG:oob_read |
| 2005 | Critical | 330 | F | efx_tc_rx_version_1 | drivers/net/ethernet/sfc/tc_counters.c | n_counters | loop bound | no | BUG:oob_read |
| 2006 | Critical | 330 | F | efx_tc_rx_version_2 | drivers/net/ethernet/sfc/tc_counters.c | n_counters | loop bound | no | BUG:oob_read |
| 2007 | Critical | 330 | E | erdma_poll_single_cmd_completion | drivers/infiniband/hw/erdma/erdma_cmdq.c | comp_wait | comp_wait->wait_event | yes? | BUG:oob_read |
| 2008 | Critical | 330 | F | es58x_fd_echo_msg | drivers/net/can/usb/etas_es58x/es58x_fd.c | num_element | loop bound | yes? | BUG:oob_write |
| 2009 | Critical | 330 | E | esas2r_read_image_type | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->code_type | yes? | BUG:oob_read |
| 2010 | Critical | 330 | E | esas2r_read_image_type | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->image_length | yes? | BUG:oob_read |
| 2011 | Critical | 330 | E | esas2r_read_image_type | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->indicator | yes? | BUG:oob_read |
| 2012 | Critical | 330 | F | fbnic_tlv_parser_test | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | le16_to_cpu(attr->hdr.len) / sizeof(u32) - 1 | loop bound | no | BUG:oob_read |
| 2013 | Critical | 330 | F | fcoe_ctlr_recv_clr_vlink | drivers/scsi/fcoe/fcoe_ctlr.c | rlen | loop bound | no | BUG:oob_read |
| 2014 | Critical | 330 | F | fnic_fcoe_process_cvl | drivers/scsi/fnic/fip.c | (inline) | loop bound | no | BUG:oob_read |
| 2015 | Critical | 330 | F | fnic_fcoe_process_vlan_resp | drivers/scsi/fnic/fip.c | desc_len | loop bound | no | BUG:oob_read |
| 2016 | Critical | 330 | F | fw_cfg_register_dir_entries | drivers/firmware/qemu_fw_cfg.c | count | loop bound | no | BUG:oob_read |
| 2017 | Critical | 330 | F | gb_generate_enum_strings | drivers/staging/greybus/audio_topology.c | items | loop bound | no | BUG:oob_read |
| 2018 | Critical | 330 | F | gelic_wl_translate_scan | drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | data_len | loop bound | no | BUG:oob_read |
| 2019 | Critical | 330 | F | geni_load_se_fw | drivers/soc/qcom/qcom-geni-se.c | (inline) | loop bound | no | BUG:oob_read |
| 2020 | Critical | 330 | E | get_acp_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pExtendedHeader | pExtendedHeader->usACPTableOffset | yes? | BUG:oob_read |
| 2021 | Critical | 330 | F | get_bios_object | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | tbl | loop bound | no | BUG:oob_read |
| 2022 | Critical | 330 | E | get_cacp_tdp_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pExtendedHeader | pExtendedHeader->usPowerTuneTableOffset | yes? | BUG:oob_read |
| 2023 | Critical | 330 | E | get_hpd_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | header | header->record_size | yes? | BUG:oob_read |
| 2024 | Critical | 330 | E | get_hpd_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | header | header->record_type | yes? | BUG:oob_read |
| 2025 | Critical | 330 | E | get_hpd_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | header | header->record_size | yes? | BUG:oob_read |
| 2026 | Critical | 330 | E | get_hpd_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | header | header->record_size | yes? | BUG:oob_read |
| 2027 | Critical | 330 | E | get_hpd_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | yes? | BUG:oob_read |
| 2028 | Critical | 330 | E | get_samu_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | extended_header | extended_header->usSAMUTableOffset | yes? | BUG:oob_read |
| 2029 | Critical | 330 | E | get_sclk_vdd_gfx_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pExtendedHeader | pExtendedHeader->usSclkVddgfxTableOffset | yes? | BUG:oob_read |
| 2030 | Critical | 330 | F | get_ss_entry_number_from_internal_ss_info_tbl_V3_1 | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | size | loop bound | no | BUG:oob_read |
| 2031 | Critical | 330 | F | get_ss_entry_number_from_internal_ss_info_tbl_v2_1 | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | size | loop bound | no | BUG:oob_read |
| 2032 | Critical | 330 | F | get_ss_entry_number_from_ss_info_tbl | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | table_size | loop bound | no | BUG:oob_read |
| 2033 | Critical | 330 | F | get_ss_info_from_internal_ss_info_tbl_V2_1 | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | tbl_size | loop bound | no | BUG:oob_read |
| 2034 | Critical | 330 | F | get_ss_info_from_ss_info_table | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | table_size | loop bound | no | BUG:oob_read |
| 2035 | Critical | 330 | F | get_ss_info_v3_1 | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | table_size | loop bound | no | BUG:oob_read |
| 2036 | Critical | 330 | E | get_uvd_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | extended_header | extended_header->usUVDTableOffset | yes? | BUG:oob_read |
| 2037 | Critical | 330 | E | get_vce_table_offset | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | extended_header | extended_header->usVCETableOffset | yes? | BUG:oob_read |
| 2038 | Critical | 330 | F | gfx_v10_0_rlc_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2039 | Critical | 330 | F | gfx_v11_0_load_rlc_iram_dram_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2040 | Critical | 330 | F | gfx_v11_0_load_rlc_iram_dram_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2041 | Critical | 330 | F | gfx_v11_0_load_rlcg_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2042 | Critical | 330 | F | gfx_v11_0_load_rlcp_rlcv_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2043 | Critical | 330 | F | gfx_v11_0_load_rlcp_rlcv_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2044 | Critical | 330 | F | gfx_v12_0_load_rlc_iram_dram_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2045 | Critical | 330 | F | gfx_v12_0_load_rlc_iram_dram_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2046 | Critical | 330 | F | gfx_v12_0_load_rlcg_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2047 | Critical | 330 | F | gfx_v12_1_xcc_load_rlc_iram_dram_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_size | loop bound | no | BUG:oob_read |
| 2048 | Critical | 330 | F | gfx_v12_1_xcc_load_rlc_iram_dram_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_size | loop bound | no | BUG:oob_read |
| 2049 | Critical | 330 | F | gfx_v12_1_xcc_load_rlcg_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_size | loop bound | no | BUG:oob_read |
| 2050 | Critical | 330 | F | gfx_v6_0_cp_gfx_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2051 | Critical | 330 | F | gfx_v6_0_cp_gfx_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2052 | Critical | 330 | F | gfx_v6_0_cp_gfx_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2053 | Critical | 330 | F | gfx_v6_0_rlc_resume | drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2054 | Critical | 330 | F | gfx_v7_0_cp_compute_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2055 | Critical | 330 | F | gfx_v7_0_cp_compute_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2056 | Critical | 330 | F | gfx_v7_0_cp_gfx_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2057 | Critical | 330 | F | gfx_v7_0_cp_gfx_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2058 | Critical | 330 | F | gfx_v7_0_cp_gfx_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2059 | Critical | 330 | F | gfx_v7_0_rlc_resume | drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2060 | Critical | 330 | F | gfx_v9_0_cp_gfx_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2061 | Critical | 330 | F | gfx_v9_0_cp_gfx_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2062 | Critical | 330 | F | gfx_v9_0_cp_gfx_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2063 | Critical | 330 | F | gfx_v9_0_rlc_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2064 | Critical | 330 | F | gfx_v9_4_3_xcc_rlc_load_microcode | drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | fw_size | loop bound | no | BUG:oob_read |
| 2065 | Critical | 330 | F | gmc_v6_0_mc_load_microcode | drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | regs_size | loop bound | no | BUG:oob_read |
| 2066 | Critical | 330 | F | gmc_v6_0_mc_load_microcode | drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | ucode_size | loop bound | no | BUG:oob_read |
| 2067 | Critical | 330 | F | gmc_v7_0_mc_load_microcode | drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | regs_size | loop bound | no | BUG:oob_read |
| 2068 | Critical | 330 | F | gmc_v7_0_mc_load_microcode | drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | ucode_size | loop bound | no | BUG:oob_read |
| 2069 | Critical | 330 | F | gmc_v8_0_polaris_mc_load_microcode | drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | regs_size | loop bound | no | BUG:oob_read |
| 2070 | Critical | 330 | F | gmc_v8_0_polaris_mc_load_microcode | drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | ucode_size | loop bound | no | BUG:oob_read |
| 2071 | Critical | 330 | F | gmc_v8_0_tonga_mc_load_microcode | drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | regs_size | loop bound | no | BUG:oob_read |
| 2072 | Critical | 330 | F | gmc_v8_0_tonga_mc_load_microcode | drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | ucode_size | loop bound | no | BUG:oob_read |
| 2073 | Critical | 330 | E | goodix_hid_irq | drivers/hid/hid-goodix-spi.c | pkg | pkg->size | no | BUG:integer_overflow |
| 2074 | Critical | 330 | F | handle_login_rsp | drivers/net/ethernet/ibm/ibmvnic.c | num_tx_pools | loop bound | no | BUG:oob_read |
| 2075 | Critical | 330 | F | handle_login_rsp | drivers/net/ethernet/ibm/ibmvnic.c | num_rx_pools | loop bound | no | BUG:oob_read |
| 2076 | Critical | 330 | F | hpsa_debug_map_buff | drivers/scsi/hpsa.c | map_cnt | loop bound | no | BUG:oob_read |
| 2077 | Critical | 330 | F | hpsa_debug_map_buff | drivers/scsi/hpsa.c | row_cnt | loop bound | no | BUG:oob_read |
| 2078 | Critical | 330 | F | hpsa_debug_map_buff | drivers/scsi/hpsa.c | disks_per_row | loop bound | no | BUG:oob_read |
| 2079 | Critical | 330 | F | hpsa_debug_map_buff | drivers/scsi/hpsa.c | disks_per_row | loop bound | no | BUG:oob_read |
| 2080 | Critical | 330 | F | hpsa_ext_ctrl_present | drivers/scsi/hpsa.c | nphysicals | loop bound | no | BUG:oob_read |
| 2081 | Critical | 330 | F | hpsa_get_sas_address_from_report_physical | drivers/scsi/hpsa.c | nphysicals | loop bound | no | BUG:oob_read |
| 2082 | Critical | 330 | F | i40e_aq_discover_capabilities | drivers/net/ethernet/intel/i40e/i40e_common.c | le32_to_cpu(cmd->count) | loop bound | no | BUG:oob_read |
| 2083 | Critical | 330 | F | i40e_fetch_switch_configuration | drivers/net/ethernet/intel/i40e/i40e_main.c | num_reported | loop bound | no | BUG:oob_read |
| 2084 | Critical | 330 | F | i40e_parse_ieee_app_tlv | drivers/net/ethernet/intel/i40e/i40e_dcb.c | length | loop bound | no | BUG:oob_read |
| 2085 | Critical | 330 | F | ice_chk_pkg_compat | drivers/net/ethernet/intel/ice/ice_ddp.c | (inline) | loop bound | no | BUG:oob_read |
| 2086 | Critical | 330 | F | ice_download_pkg_sig_seg | drivers/net/ethernet/intel/ice/ice_ddp.c | le32_to_cpu(seg->buf_tbl.buf_count) | loop bound | no | BUG:oob_read |
| 2087 | Critical | 330 | F | ice_download_pkg_with_sig_seg | drivers/net/ethernet/intel/ice/ice_ddp.c | (inline) | loop bound | no | BUG:oob_read |
| 2088 | Critical | 330 | F | ice_find_seg_in_pkg | drivers/net/ethernet/intel/ice/ice_ddp.c | (inline) | loop bound | no | BUG:oob_read |
| 2089 | Critical | 330 | F | ice_get_pkg_info | drivers/net/ethernet/intel/ice/ice_ddp.c | (inline) | loop bound | no | BUG:oob_read |
| 2090 | Critical | 330 | F | ice_parse_ieee_app_tlv | drivers/net/ethernet/intel/ice/ice_dcb.c | len | loop bound | no | BUG:oob_read |
| 2091 | Critical | 330 | F | ice_sched_init_port | drivers/net/ethernet/intel/ice/ice_sched.c | num_elems | loop bound | no | BUG:oob_read |
| 2092 | Critical | 330 | F | idpf_get_reg_intr_vecs | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | num_vchunks | loop bound | no | BUG:oob_read |
| 2093 | Critical | 330 | F | idpf_get_vec_ids | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | num_chunks | loop bound | no | BUG:oob_read |
| 2094 | Critical | 330 | F | idpf_ptp_get_tx_tstamp_async_handler | drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c | num_latches | loop bound | no | BUG:oob_read |
| 2095 | Critical | 330 | F | il3945_dump_nic_error_log | drivers/net/wireless/intel/iwlegacy/3945-mac.c | count | loop bound | no | BUG:oob_read |
| 2096 | Critical | 330 | F | imu_v11_0_load_microcode | drivers/gpu/drm/amd/amdgpu/imu_v11_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2097 | Critical | 330 | F | imu_v11_0_load_microcode | drivers/gpu/drm/amd/amdgpu/imu_v11_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2098 | Critical | 330 | F | imu_v12_0_load_microcode | drivers/gpu/drm/amd/amdgpu/imu_v12_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2099 | Critical | 330 | F | imu_v12_0_load_microcode | drivers/gpu/drm/amd/amdgpu/imu_v12_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2100 | Critical | 330 | F | imu_v12_1_xcc_load_microcode | drivers/gpu/drm/amd/amdgpu/imu_v12_1.c | fw_size | loop bound | no | BUG:oob_read |
| 2101 | Critical | 330 | F | imu_v12_1_xcc_load_microcode | drivers/gpu/drm/amd/amdgpu/imu_v12_1.c | fw_size | loop bound | no | BUG:oob_read |
| 2102 | Critical | 330 | F | inc_children | drivers/md/persistent-data/dm-btree.c | nr_entries | loop bound | no | BUG:oob_read |
| 2103 | Critical | 330 | F | init_clock_voltage_dependency | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | mm_dependency_table | loop bound | no | BUG:oob_read |
| 2104 | Critical | 330 | F | init_clock_voltage_dependency | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | sclk_dep_table | loop bound | no | BUG:oob_read |
| 2105 | Critical | 330 | F | init_clock_voltage_dependency | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | sclk_dep_table | loop bound | no | BUG:oob_read |
| 2106 | Critical | 330 | F | init_clock_voltage_dependency | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | mclk_dep_table | loop bound | no | BUG:oob_read |
| 2107 | Critical | 330 | F | init_clock_voltage_dependency | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | pcie_table | loop bound | no | BUG:oob_read |
| 2108 | Critical | 330 | F | init_dpm2_parameters | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pCAC_leakage_table | loop bound | no | BUG:oob_read |
| 2109 | Critical | 330 | E | init_dpm2_parameters | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | extended_header | extended_header->usPPMTableOffset | yes? | BUG:oob_read |
| 2110 | Critical | 330 | E | init_over_drive_limits | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | gfxclk_dep_table | gfxclk_dep_table->entries | yes? | BUG:oob_read |
| 2111 | Critical | 330 | E | init_over_drive_limits | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | gfxclk_dep_table | gfxclk_dep_table->ucNumEntries | yes? | BUG:oob_read |
| 2112 | Critical | 330 | F | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | table | loop bound | no | BUG:oob_read |
| 2113 | Critical | 330 | F | init_powerplay_extended_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | mm_dependency_table | loop bound | no | BUG:oob_read |
| 2114 | Critical | 330 | F | init_powerplay_extended_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | socclk_dep_table | loop bound | no | BUG:oob_read |
| 2115 | Critical | 330 | F | init_powerplay_extended_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | mclk_dep_table | loop bound | no | BUG:oob_read |
| 2116 | Critical | 330 | F | init_powerplay_extended_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | gfxclk_dep_table | loop bound | no | BUG:oob_read |
| 2117 | Critical | 330 | F | init_powerplay_extended_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | gfxclk_dep_table | loop bound | no | BUG:oob_read |
| 2118 | Critical | 330 | F | init_powerplay_extended_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | pixclk_dep_table | loop bound | no | BUG:oob_read |
| 2119 | Critical | 330 | F | init_powerplay_extended_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | phyclk_dep_table | loop bound | no | BUG:oob_read |
| 2120 | Critical | 330 | F | init_powerplay_extended_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | dispclk_dep_table | loop bound | no | BUG:oob_read |
| 2121 | Critical | 330 | F | init_powerplay_extended_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | dcefclk_dep_table | loop bound | no | BUG:oob_read |
| 2122 | Critical | 330 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | header | header->ucRevId | yes? | BUG:oob_read |
| 2123 | Critical | 330 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fan_table | fan_table->ucRevId | yes? | BUG:oob_read |
| 2124 | Critical | 330 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->ucTHyst | yes? | BUG:oob_read |
| 2125 | Critical | 330 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->usTMin | yes? | BUG:oob_read |
| 2126 | Critical | 330 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->usTMed | yes? | BUG:oob_read |
| 2127 | Critical | 330 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->usTHigh | yes? | BUG:oob_read |
| 2128 | Critical | 330 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->usPWMMin | yes? | BUG:oob_read |
| 2129 | Critical | 330 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->usPWMMed | yes? | BUG:oob_read |
| 2130 | Critical | 330 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->usPWMHigh | yes? | BUG:oob_read |
| 2131 | Critical | 330 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | fan_table | fan_table->ucFanTableFormat | yes? | BUG:oob_read |
| 2132 | Critical | 330 | E | ipc_mux_get_payload_from_adb | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->table_length | yes? | BUG:oob_read |
| 2133 | Critical | 330 | E | ipc_mux_get_payload_from_adb | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->dg | yes? | BUG:oob_read |
| 2134 | Critical | 330 | E | ipc_mux_get_payload_from_adb | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | dg | dg->datagram_length | yes? | BUG:oob_read |
| 2135 | Critical | 330 | E | ipc_mux_get_payload_from_adb | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->next_table_index | yes? | BUG:oob_read |
| 2136 | Critical | 330 | F | ipr_init_res_table | drivers/scsi/ipr.c | entries | loop bound | no | BUG:oob_read |
| 2137 | Critical | 330 | F | ipr_log_config_error | drivers/scsi/ipr.c | errors_logged | loop bound | no | BUG:oob_read |
| 2138 | Critical | 330 | F | ipr_log_enhanced_config_error | drivers/scsi/ipr.c | errors_logged | loop bound | no | BUG:oob_read |
| 2139 | Critical | 330 | F | ipr_log_sis64_config_error | drivers/scsi/ipr.c | errors_logged | loop bound | no | BUG:oob_read |
| 2140 | Critical | 330 | F | ipr_store_update_fw | drivers/scsi/ipr.c | dnld_size | loop bound | no | BUG:oob_read |
| 2141 | Critical | 330 | F | iwl_dbg_tlv_apply_config | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | len | loop bound | no | BUG:oob_read |
| 2142 | Critical | 330 | F | iwl_dbg_tlv_apply_config | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | len | loop bound | no | BUG:oob_read |
| 2143 | Critical | 330 | F | iwl_dbg_tlv_apply_config | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | len | loop bound | no | BUG:oob_read |
| 2144 | Critical | 330 | F | iwl_dbg_tlv_apply_config | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | len | loop bound | no | BUG:oob_read |
| 2145 | Critical | 330 | B | iwl_dbg_tlv_override_trig_node | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | size | sizeof(*node) + size | yes? | BUG:undersized_alloc |
| 2146 | Critical | 330 | F | iwl_dump_ini_mem | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | (inline) | loop bound | no | BUG:oob_read |
| 2147 | Critical | 330 | F | iwl_dump_ini_mon_dram_get_size | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | fw_mon | loop bound | no | BUG:oob_read |
| 2148 | Critical | 330 | F | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | state_array | loop bound | no | BUG:oob_read |
| 2149 | Critical | 330 | F | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | power_state | loop bound | no | BUG:oob_read |
| 2150 | Critical | 330 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | BUG:oob_read |
| 2151 | Critical | 330 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | clock_info_array | clock_info_array->ucEntrySize | yes? | BUG:oob_read |
| 2152 | Critical | 330 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | BUG:oob_read |
| 2153 | Critical | 330 | F | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | state_array | loop bound | no | BUG:oob_read |
| 2154 | Critical | 330 | F | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | power_state | loop bound | no | BUG:oob_read |
| 2155 | Critical | 330 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | BUG:oob_read |
| 2156 | Critical | 330 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | clock_info_array | clock_info_array->ucEntrySize | yes? | BUG:oob_read |
| 2157 | Critical | 330 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | BUG:oob_read |
| 2158 | Critical | 330 | A | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | memcpy() | yes? | BUG:oob_read |
| 2159 | Critical | 330 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->eth803_hdr | yes? | BUG:oob_read |
| 2160 | Critical | 330 | A | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | memcpy() | yes? | BUG:oob_read |
| 2161 | Critical | 330 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->eth803_hdr | yes? | BUG:oob_read |
| 2162 | Critical | 330 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->rfc1042_hdr | yes? | BUG:oob_read |
| 2163 | Critical | 330 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->rfc1042_hdr | yes? | BUG:oob_read |
| 2164 | Critical | 330 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->eth803_hdr | yes? | BUG:oob_read |
| 2165 | Critical | 330 | F | lbs_ret_scan | drivers/net/wireless/marvell/libertas/cfg.c | bsssize | loop bound | no | BUG:oob_read |
| 2166 | Critical | 330 | F | lbs_ret_scan | drivers/net/wireless/marvell/libertas/cfg.c | left | loop bound | no | BUG:oob_read |
| 2167 | Critical | 330 | F | libie_aq_fwlog_get | drivers/net/ethernet/intel/libie/fwlog.c | module_id_cnt | loop bound | no | BUG:oob_read |
| 2168 | Critical | 330 | F | load_application_firmware | drivers/usb/serial/io_edgeport.c | be16_to_cpu(rec->len) | loop bound | no | BUG:oob_read |
| 2169 | Critical | 330 | F | load_cpu_fw | drivers/net/ethernet/broadcom/bnx2.c | len | loop bound | no | BUG:oob_read |
| 2170 | Critical | 330 | F | load_cpu_fw | drivers/net/ethernet/broadcom/bnx2.c | len | loop bound | no | BUG:oob_read |
| 2171 | Critical | 330 | F | load_cpu_fw | drivers/net/ethernet/broadcom/bnx2.c | len | loop bound | no | BUG:oob_read |
| 2172 | Critical | 330 | F | load_rv2p_fw | drivers/net/ethernet/broadcom/bnx2.c | rv2p_code_len | loop bound | no | BUG:oob_read |
| 2173 | Critical | 330 | F | load_version20 | drivers/md/dm-vdo/indexer/open-chapter.c | record_count | loop bound | no | BUG:oob_read |
| 2174 | Critical | 330 | F | load_waveform | drivers/video/fbdev/metronomefb.c | wfm_idx | loop bound | yes? | BUG:oob_write |
| 2175 | Critical | 330 | F | lpfc_els_rcv_fpin_li | drivers/scsi/lpfc/lpfc_els.c | cnt | loop bound | no | BUG:oob_read |
| 2176 | Critical | 330 | F | lpfc_els_rcv_fpin_peer_cgn | drivers/scsi/lpfc/lpfc_els.c | cnt | loop bound | no | BUG:oob_read |
| 2177 | Critical | 330 | F | lpfc_els_rcv_rscn | drivers/scsi/lpfc/lpfc_els.c | payload_len | loop bound | no | BUG:oob_read |
| 2178 | Critical | 330 | F | lpfc_els_rcv_rscn | drivers/scsi/lpfc/lpfc_els.c | i | loop bound | no | BUG:oob_read |
| 2179 | Critical | 330 | E | megasas_complete_r1_command | drivers/scsi/megaraid/megaraid_sas_fusion.c | rctx_g35 | rctx_g35->status | yes? | BUG:oob_read |
| 2180 | Critical | 330 | E | megasas_complete_r1_command | drivers/scsi/megaraid/megaraid_sas_fusion.c | rctx_g35 | rctx_g35->ex_status | yes? | BUG:oob_read |
| 2181 | Critical | 330 | F | megasas_ld_list_query | drivers/scsi/megaraid/megaraid_sas_base.c | tgtid_count | loop bound | yes? | BUG:oob_write |
| 2182 | Critical | 330 | F | mlx4_MAD_IFC_wrapper | drivers/net/ethernet/mellanox/mlx4/cmd.c | index | loop bound | no | BUG:oob_read |
| 2183 | Critical | 330 | F | mlx4_opreq_action | drivers/net/ethernet/mellanox/mlx4/fw.c | num_qps | loop bound | no | BUG:oob_read |
| 2184 | Critical | 330 | F | mlx4_qp_detach_common | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | loop bound | no | BUG:oob_read |
| 2185 | Critical | 330 | E | modify_device_id | drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | pcir_header | pcir_header->code_type | yes? | BUG:oob_read |
| 2186 | Critical | 330 | F | mpf_ops_parse_header | drivers/fpga/microchip-spi.c | components_num | loop bound | no | BUG:oob_read |
| 2187 | Critical | 330 | F | mpi_smp_completion | drivers/scsi/pm8001/pm80xx_hwi.c | param | loop bound | no | BUG:oob_read |
| 2188 | Critical | 330 | F | mpt3sas_config_get_volume_handle | drivers/scsi/mpt3sas/mpt3sas_config.c | config_page | loop bound | no | BUG:oob_read |
| 2189 | Critical | 330 | F | mpt_display_event_info | drivers/message/fusion/mptbase.c | (inline) | loop bound | no | BUG:oob_read |
| 2190 | Critical | 330 | A | mptscsih_io_done | drivers/message/fusion/mptscsih.c | sc | memcpy() in mptscsih_copy_sense_data() | yes? | BUG:oob_read |
| 2191 | Critical | 330 | E | ms_lib_process_bootblock | drivers/usb/storage/ene_ub6250.c | idi | idi->wIDIbytesPerSector | yes? | BUG:oob_read |
| 2192 | Critical | 330 | F | mt7603_fill_txs | drivers/net/wireless/mediatek/mt76/mt7603/mac.c | last_idx | loop bound | no | BUG:oob_read |
| 2193 | Critical | 330 | E | mt7603_fill_txs | drivers/net/wireless/mediatek/mt76/mt7603/mac.c | cur_rate | cur_rate->flags | yes? | BUG:oob_read |
| 2194 | Critical | 330 | F | mt7615_fill_txs | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | last_idx | loop bound | no | BUG:oob_read |
| 2195 | Critical | 330 | E | mt7615_fill_txs | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | cur_rate | cur_rate->flags | yes? | BUG:oob_read |
| 2196 | Critical | 330 | F | mt76_connac2_load_patch | drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | len | loop bound | no | BUG:oob_read |
| 2197 | Critical | 330 | F | mt76_connac2_load_patch | drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | (inline) | loop bound | no | BUG:oob_read |
| 2198 | Critical | 330 | F | mt76_connac_mcu_send_ram_firmware | drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | len | loop bound | no | BUG:oob_read |
| 2199 | Critical | 330 | F | mt76x0u_upload_firmware | drivers/net/wireless/mediatek/mt76/mt76x0/usb_mcu.c | ilm_len | loop bound | no | BUG:oob_read |
| 2200 | Critical | 330 | F | mt76x0u_upload_firmware | drivers/net/wireless/mediatek/mt76/mt76x0/usb_mcu.c | dlm_len | loop bound | no | BUG:oob_read |
| 2201 | Critical | 330 | E | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | hdr_gap | hdr_gap->? | yes? | BUG:oob_read |
| 2202 | Critical | 330 | E | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | hdr_gap | hdr_gap->? | yes? | BUG:oob_read |
| 2203 | Critical | 330 | F | mt7925_mcu_rssi_monitor_event | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | (inline) | loop bound | no | BUG:oob_read |
| 2204 | Critical | 330 | F | mt7925_mcu_tx_done_event | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | (inline) | loop bound | no | BUG:oob_read |
| 2205 | Critical | 330 | F | mt7925_mcu_uni_debug_msg_event | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | nr_val | loop bound | no | BUG:oob_read |
| 2206 | Critical | 330 | F | mt7925_scan_work | drivers/net/wireless/mediatek/mt76/mt7925/main.c | (inline) | loop bound | no | BUG:oob_read |
| 2207 | Critical | 330 | F | mt792x_get_offload_capability | drivers/net/wireless/mediatek/mt76/mt792x_core.c | end | loop bound | no | BUG:oob_read |
| 2208 | Critical | 330 | F | mt7996_load_patch | drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | len | loop bound | no | BUG:oob_read |
| 2209 | Critical | 330 | F | mt7996_load_patch | drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | (inline) | loop bound | no | BUG:oob_read |
| 2210 | Critical | 330 | E | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | hdr_gap | hdr_gap->? | yes? | BUG:oob_read |
| 2211 | Critical | 330 | F | mt7996_mcu_rx_all_sta_info_event | drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | (inline) | loop bound | no | BUG:oob_read |
| 2212 | Critical | 330 | F | mt7996_mcu_send_ram_firmware | drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | len | loop bound | no | BUG:oob_read |
| 2213 | Critical | 330 | F | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | ind_count | loop bound | no | BUG:oob_read |
| 2214 | Critical | 330 | F | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | count | loop bound | no | BUG:oob_read |
| 2215 | Critical | 330 | F | mwifiex_check_ibss_peer_capabilities | drivers/net/wireless/marvell/mwifiex/sta_event.c | evt_len | loop bound | no | BUG:oob_read |
| 2216 | Critical | 330 | F | mwifiex_ret_802_11_scan_ext | drivers/net/wireless/marvell/mwifiex/scan.c | buf_left | loop bound | no | BUG:oob_read |
| 2217 | Critical | 330 | F | mwifiex_ret_chan_region_cfg | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | tlv_buf_left | loop bound | no | BUG:oob_read |
| 2218 | Critical | 330 | F | mwifiex_ret_get_hw_spec | drivers/net/wireless/marvell/mwifiex/cmdevt.c | left_len | loop bound | no | BUG:oob_read |
| 2219 | Critical | 330 | F | mwifiex_ret_tx_rate_cfg | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | tlv_buf_left | loop bound | no | BUG:oob_read |
| 2220 | Critical | 330 | F | mwifiex_ret_uap_sta_list | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | (inline) | loop bound | no | BUG:oob_read |
| 2221 | Critical | 330 | F | mwifiex_ret_wmm_get_status | drivers/net/wireless/marvell/mwifiex/wmm.c | resp_len | loop bound | no | BUG:oob_read |
| 2222 | Critical | 330 | F | mwifiex_update_autoindex_ies | drivers/net/wireless/marvell/mwifiex/ie.c | input_len | loop bound | no | BUG:oob_read |
| 2223 | Critical | 330 | F | mwifiex_update_chan_statistics | drivers/net/wireless/marvell/mwifiex/scan.c | num_chan | loop bound | no | BUG:oob_read |
| 2224 | Critical | 330 | E | nand_flash_detect_ext_param_page | drivers/mtd/nand/raw/nand_onfi.c | s | s->length | yes? | BUG:oob_read |
| 2225 | Critical | 330 | F | nfp_bpf_ctrl_op_cache_get | drivers/net/ethernet/netronome/nfp/bpf/cmsg.c | count | loop bound | no | BUG:oob_read |
| 2226 | Critical | 330 | F | nfp_dump_specific_level | drivers/net/ethernet/netronome/nfp/nfp_net_debugdump.c | be32_to_cpu(dump_level->length) | loop bound | no | BUG:oob_read |
| 2227 | Critical | 330 | F | nfp_hwinfo_lookup | drivers/net/ethernet/netronome/nfp/nfpcore/nfp_hwinfo.c | end | loop bound | no | BUG:oob_read |
| 2228 | Critical | 330 | B | node_copy | drivers/md/persistent-data/dm-btree-remove.c | value_size | shift * value_size | yes? | BUG:integer_overflow |
| 2229 | Critical | 330 | B | node_copy | drivers/md/persistent-data/dm-btree-remove.c | value_size | shift * value_size | yes? | BUG:integer_overflow |
| 2230 | Critical | 330 | F | nvme_ns_report_zones | drivers/nvme/host/zns.c | nz | loop bound | no | BUG:oob_read |
| 2231 | Critical | 330 | E | nvme_query_fdp_granularity | drivers/nvme/host/core.c | desc | desc->runs | yes? | BUG:oob_read |
| 2232 | Critical | 330 | F | nvmet_file_execute_discard | drivers/nvme/target/io-cmd-file.c | (inline) | loop bound | no | BUG:oob_read |
| 2233 | Critical | 330 | F | nvmet_rdma_map_sgl_inline | drivers/nvme/target/rdma.c | off | loop bound | yes? | BUG:oob_write |
| 2234 | Critical | 330 | F | nx_fw_cmd_create_rx_ctx | drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c | (inline) | loop bound | no | BUG:oob_read |
| 2235 | Critical | 330 | F | nx_fw_cmd_create_rx_ctx | drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c | (inline) | loop bound | no | BUG:oob_read |
| 2236 | Critical | 330 | F | octeon_download_firmware | drivers/net/ethernet/cavium/liquidio/octeon_console.c | (inline) | loop bound | no | BUG:oob_read |
| 2237 | Critical | 330 | F | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | curve_data | loop bound | yes? | BUG:oob_write |
| 2238 | Critical | 330 | F | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | curve_data | loop bound | yes? | BUG:oob_write |
| 2239 | Critical | 330 | F | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | curve_data | loop bound | yes? | BUG:oob_write |
| 2240 | Critical | 330 | F | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | curve_data | loop bound | yes? | BUG:oob_write |
| 2241 | Critical | 330 | F | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | tmp | loop bound | no | BUG:oob_read |
| 2242 | Critical | 330 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | exp_if | exp_if->variant | yes? | BUG:oob_read |
| 2243 | Critical | 330 | F | p54_parse_firmware | drivers/net/wireless/intersil/p54/fwio.c | len | loop bound | no | BUG:oob_read |
| 2244 | Critical | 330 | F | p8_i2c_occ_send_cmd | drivers/hwmon/occ/p8_i2c.c | data_length | loop bound | yes? | BUG:oob_write |
| 2245 | Critical | 330 | F | parse_cede_parameters | drivers/cpuidle/cpuidle-pseries.c | nr_xcede_records | loop bound | no | BUG:oob_read |
| 2246 | Critical | 330 | F | parse_ta_v2_microcode | drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | (inline) | loop bound | no | BUG:oob_read |
| 2247 | Critical | 330 | F | pcan_usb_pro_wait_rsp | drivers/net/can/usb/peak_usb/pcan_usb_pro.c | rec_cnt | loop bound | no | BUG:oob_read |
| 2248 | Critical | 330 | F | pdsfc_free_operations | drivers/fwctl/pds/main.c | num_endpoints | loop bound | no | BUG:oob_read |
| 2249 | Critical | 330 | F | pdsfc_init_endpoints | drivers/fwctl/pds/main.c | num_endpoints | loop bound | no | BUG:oob_read |
| 2250 | Critical | 330 | F | pdsfc_validate_rpc | drivers/fwctl/pds/main.c | num_entries | loop bound | no | BUG:oob_read |
| 2251 | Critical | 330 | F | pdsfc_validate_rpc | drivers/fwctl/pds/main.c | num_entries | loop bound | no | BUG:oob_read |
| 2252 | Critical | 330 | F | pm8001_update_flash | drivers/scsi/pm8001/pm8001_ctl.c | loopcount | loop bound | no | BUG:oob_read |
| 2253 | Critical | 330 | F | pmcraid_init_res_table | drivers/scsi/pmcraid.c | (inline) | loop bound | no | BUG:oob_read |
| 2254 | Critical | 330 | F | pn533_std_rx_frame_is_valid | drivers/nfc/pn533/pn533.c | be16_to_cpu(eif->datalen) | loop bound | no | BUG:oob_read |
| 2255 | Critical | 330 | F | port100_rx_frame_is_valid | drivers/nfc/port100.c | le16_to_cpu(frame->datalen) | loop bound | no | BUG:oob_read |
| 2256 | Critical | 330 | F | pp_atomfwctrl_lookup_voltage_type_v4 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomfwctrl.c | size | loop bound | no | BUG:oob_read |
| 2257 | Critical | 330 | E | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pstate_arrays | pstate_arrays->? | yes? | BUG:oob_read |
| 2258 | Critical | 330 | F | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pstate_entry_v2 | loop bound | no | BUG:oob_read |
| 2259 | Critical | 330 | F | ppl_load_distributed | drivers/md/raid5-ppl.c | (inline) | loop bound | no | BUG:oob_read |
| 2260 | Critical | 330 | F | ppl_recover | drivers/md/raid5-ppl.c | (inline) | loop bound | no | BUG:oob_read |
| 2261 | Critical | 330 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | mclk_dep_table | mclk_dep_table->ucNumEntries | yes? | BUG:oob_read |
| 2262 | Critical | 330 | F | pqi_host_free_buffer | drivers/scsi/smartpqi/smartpqi_init.c | num_memory_descriptors | loop bound | no | BUG:oob_read |
| 2263 | Critical | 330 | F | pqi_report_phys_luns | drivers/scsi/smartpqi/smartpqi_init.c | num_physicals | loop bound | no | BUG:oob_read |
| 2264 | Critical | 330 | F | prefetch_values | drivers/md/persistent-data/dm-btree.c | nr | loop bound | no | BUG:oob_read |
| 2265 | Critical | 330 | F | promisc_steering_entry | drivers/net/ethernet/mellanox/mlx4/mcg.c | m_count | loop bound | no | BUG:oob_read |
| 2266 | Critical | 330 | F | pscsi_get_inquiry_vpd_device_ident | drivers/target/target_core_pscsi.c | page_len | loop bound | no | BUG:oob_read |
| 2267 | Critical | 330 | F | qca8k_rw_reg_ack_handler | drivers/net/dsa/qca/qca8k-8xxx.c | data_len | loop bound | no | BUG:oob_read |
| 2268 | Critical | 330 | F | qcom_add_minidump_segments | drivers/remoteproc/qcom_common.c | seg_cnt | loop bound | no | BUG:oob_read |
| 2269 | Critical | 330 | B | qcom_glink_rx_data | drivers/rpmsg/qcom_glink_native.c | chunk_size | chunk_size + left_size | yes? | BUG:undersized_alloc |
| 2270 | Critical | 330 | F | qcom_llcc_get_fw_config | drivers/soc/qcom/llcc-qcom.c | sz | loop bound | no | BUG:oob_read |
| 2271 | Critical | 330 | F | qcom_smd_rpm_callback | drivers/soc/qcom/smd-rpm.c | end | loop bound | no | BUG:oob_read |
| 2272 | Critical | 330 | F | qcom_smem_enumerate_partitions | drivers/soc/qcom/smem.c | (inline) | loop bound | no | BUG:oob_read |
| 2273 | Critical | 330 | F | qdma_queue_isr | drivers/dma/amd/qdma/qdma.c | comp_desc | loop bound | no | BUG:oob_read |
| 2274 | Critical | 330 | F | qe_upload_microcode | drivers/soc/fsl/qe/qe.c | (inline) | loop bound | no | BUG:oob_read |
| 2275 | Critical | 330 | F | qed_init_cmd_wr | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | le16_to_cpu(arg->runtime.size) | loop bound | no | BUG:oob_read |
| 2276 | Critical | 330 | F | qed_init_cmd_wr | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | le16_to_cpu(arg->runtime.size) | loop bound | no | BUG:oob_read |
| 2277 | Critical | 330 | F | qede_selftest_receive_traffic | drivers/net/ethernet/qlogic/qede/qede_ethtool.c | len | loop bound | no | BUG:oob_read |
| 2278 | Critical | 330 | F | qedf_fcoe_process_vlan_resp | drivers/scsi/qedf/qedf_fip.c | rlen | loop bound | no | BUG:oob_read |
| 2279 | Critical | 330 | F | qedf_fip_recv | drivers/scsi/qedf/qedf_fip.c | rlen | loop bound | no | BUG:oob_read |
| 2280 | Critical | 330 | F | qla24xx_load_risc_blob | drivers/scsi/qla2xxx/qla_init.c | dlen | loop bound | no | BUG:oob_read |
| 2281 | Critical | 330 | F | qla24xx_load_risc_blob | drivers/scsi/qla2xxx/qla_init.c | risc_size | loop bound | no | BUG:oob_read |
| 2282 | Critical | 330 | F | qla4_83xx_minidump_process_rdrom | drivers/scsi/qla4xxx/ql4_nx.c | u32_count | loop bound | yes? | BUG:oob_write |
| 2283 | Critical | 330 | F | qla4_83xx_minidump_process_rdrom | drivers/scsi/qla4xxx/ql4_nx.c | u32_count | loop bound | yes? | BUG:oob_write |
| 2284 | Critical | 330 | F | qla82xx_get_table_desc | drivers/scsi/qla2xxx/qla_nx.c | entries | loop bound | no | BUG:oob_read |
| 2285 | Critical | 330 | F | qla82xx_set_product_offset | drivers/scsi/qla2xxx/qla_nx.c | entries | loop bound | no | BUG:oob_read |
| 2286 | Critical | 330 | F | qlcnic_82xx_fw_cmd_create_rx_ctx | drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c | (inline) | loop bound | no | BUG:oob_read |
| 2287 | Critical | 330 | F | qlcnic_82xx_fw_cmd_create_rx_ctx | drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c | (inline) | loop bound | no | BUG:oob_read |
| 2288 | Critical | 330 | F | qlcnic_get_table_desc | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | entries | loop bound | no | BUG:oob_read |
| 2289 | Critical | 330 | F | r5l_recovery_verify_data_checksum_for_mb | drivers/md/raid5-cache.c | (inline) | loop bound | no | BUG:oob_read |
| 2290 | Critical | 330 | F | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | dep_table | loop bound | no | BUG:oob_read |
| 2291 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan2 | yes? | BUG:oob_read |
| 2292 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan3 | yes? | BUG:oob_read |
| 2293 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan3 | yes? | BUG:oob_read |
| 2294 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | fan_info | fan_info->fan3 | yes? | BUG:oob_read |
| 2295 | Critical | 330 | F | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | psl | loop bound | no | BUG:oob_read |
| 2296 | Critical | 330 | F | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | cac_table | loop bound | no | BUG:oob_read |
| 2297 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usVCETableOffset | yes? | BUG:oob_read |
| 2298 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usVCETableOffset | yes? | BUG:oob_read |
| 2299 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usVCETableOffset | yes? | BUG:oob_read |
| 2300 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usVCETableOffset | yes? | BUG:oob_read |
| 2301 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | limits->numEntries | no | BUG:undersized_alloc |
| 2302 | Critical | 330 | F | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | loop bound | no | BUG:oob_read |
| 2303 | Critical | 330 | F | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | states | loop bound | no | BUG:oob_read |
| 2304 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usSize | yes? | BUG:oob_read |
| 2305 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usUVDTableOffset | yes? | BUG:oob_read |
| 2306 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usUVDTableOffset | yes? | BUG:oob_read |
| 2307 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usUVDTableOffset | yes? | BUG:oob_read |
| 2308 | Critical | 330 | F | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | loop bound | no | BUG:oob_read |
| 2309 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usSize | yes? | BUG:oob_read |
| 2310 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usSAMUTableOffset | yes? | BUG:oob_read |
| 2311 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usSAMUTableOffset | yes? | BUG:oob_read |
| 2312 | Critical | 330 | F | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | loop bound | no | BUG:oob_read |
| 2313 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usSize | yes? | BUG:oob_read |
| 2314 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usPPMTableOffset | yes? | BUG:oob_read |
| 2315 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usPPMTableOffset | yes? | BUG:oob_read |
| 2316 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usSize | yes? | BUG:oob_read |
| 2317 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usACPTableOffset | yes? | BUG:oob_read |
| 2318 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usACPTableOffset | yes? | BUG:oob_read |
| 2319 | Critical | 330 | F | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | limits | loop bound | no | BUG:oob_read |
| 2320 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usSize | yes? | BUG:oob_read |
| 2321 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usPowerTuneTableOffset | yes? | BUG:oob_read |
| 2322 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usPowerTuneTableOffset | yes? | BUG:oob_read |
| 2323 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usPowerTuneTableOffset | yes? | BUG:oob_read |
| 2324 | Critical | 330 | E | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | ext_hdr | ext_hdr->usPowerTuneTableOffset | yes? | BUG:oob_read |
| 2325 | Critical | 330 | E | radeon_atombios_get_lvds_info | drivers/gpu/drm/radeon/radeon_atombios.c | fake_edid_record | fake_edid_record->ucFakeEDIDLength | yes? | BUG:oob_read |
| 2326 | Critical | 330 | E | radeon_atombios_get_lvds_info | drivers/gpu/drm/radeon/radeon_atombios.c | fake_edid_record | fake_edid_record->ucFakeEDIDLength | yes? | BUG:oob_read |
| 2327 | Critical | 330 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | state_array | state_array->ucNumEntries | yes? | BUG:oob_read |
| 2328 | Critical | 330 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | state_array | state_array->states | yes? | BUG:oob_read |
| 2329 | Critical | 330 | E | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | state_array | state_array->ucNumEntries | yes? | BUG:oob_read |
| 2330 | Critical | 330 | F | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | power_state | loop bound | no | BUG:oob_read |
| 2331 | Critical | 330 | F | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path_obj | loop bound | no | BUG:oob_read |
| 2332 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usSize | yes? | BUG:oob_read |
| 2333 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usGraphicObjIds | yes? | BUG:oob_read |
| 2334 | Critical | 330 | F | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | enc_obj | loop bound | no | BUG:oob_read |
| 2335 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usGraphicObjIds | yes? | BUG:oob_read |
| 2336 | Critical | 330 | F | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | loop bound | no | BUG:oob_read |
| 2337 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usDeviceTag | yes? | BUG:oob_read |
| 2338 | Critical | 330 | F | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | router_obj | loop bound | no | BUG:oob_read |
| 2339 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usGraphicObjIds | yes? | BUG:oob_read |
| 2340 | Critical | 330 | F | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | num_dst_objs | loop bound | no | BUG:oob_read |
| 2341 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usConnObjectId | yes? | BUG:oob_read |
| 2342 | Critical | 330 | F | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | loop bound | no | BUG:oob_read |
| 2343 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usDeviceTag | yes? | BUG:oob_read |
| 2344 | Critical | 330 | F | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | con_obj | loop bound | no | BUG:oob_read |
| 2345 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usConnObjectId | yes? | BUG:oob_read |
| 2346 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | con_obj | con_obj->asObjects | yes? | BUG:oob_read |
| 2347 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | con_obj | con_obj->asObjects | yes? | BUG:oob_read |
| 2348 | Critical | 330 | F | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | record | loop bound | no | BUG:oob_read |
| 2349 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usConnObjectId | yes? | BUG:oob_read |
| 2350 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usDeviceTag | yes? | BUG:oob_read |
| 2351 | Critical | 330 | E | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | path->usDeviceTag | yes? | BUG:oob_read |
| 2352 | Critical | 330 | F | redrat3_process_ir_data | drivers/media/rc/redrat3.c | sig_size | loop bound | no | BUG:oob_read |
| 2353 | Critical | 330 | F | register_entries | drivers/firmware/efi/esrt.c | (inline) | loop bound | no | BUG:oob_read |
| 2354 | Critical | 330 | F | remove_promisc_qp | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | loop bound | no | BUG:oob_read |
| 2355 | Critical | 330 | F | resp_worker | drivers/accel/qaic/qaic_control.c | msg_count | loop bound | no | BUG:oob_read |
| 2356 | Critical | 330 | F | rmi_f34v7_parse_image_header_10 | drivers/input/rmi4/rmi_f34v7.c | num_of_containers | loop bound | no | BUG:oob_read |
| 2357 | Critical | 330 | F | rpaphp_check_drc_props_v1 | drivers/pci/hotplug/rpaphp_core.c | (inline) | loop bound | no | BUG:oob_read |
| 2358 | Critical | 330 | F | rpaphp_drc_add_slot | drivers/pci/hotplug/rpaphp_core.c | (inline) | loop bound | no | BUG:oob_read |
| 2359 | Critical | 330 | F | rtl_p2p_action_ie | drivers/net/wireless/realtek/rtlwifi/ps.c | noa_num | loop bound | no | BUG:oob_read |
| 2360 | Critical | 330 | F | rtl_p2p_noa_ie | drivers/net/wireless/realtek/rtlwifi/ps.c | noa_num | loop bound | no | BUG:oob_read |
| 2361 | Critical | 330 | F | rtw89_build_phy_tbl_from_elm | drivers/net/wireless/realtek/rtw89/fw.c | n_regs | loop bound | no | BUG:oob_read |
| 2362 | Critical | 330 | F | rtw89_mac_diag_iter_all | drivers/net/wireless/realtek/rtw89/debug.c | rule_end | loop bound | no | BUG:oob_read |
| 2363 | Critical | 330 | F | rtw89_phy_c2h_rfk_tas_pwr | drivers/net/wireless/realtek/rtw89/phy.c | cur_idx | loop bound | no | BUG:oob_read |
| 2364 | Critical | 330 | F | rtw89_phy_init_bb_afe | drivers/net/wireless/realtek/rtw89/phy.c | n | loop bound | no | BUG:oob_read |
| 2365 | Critical | 330 | E | rx_urb_complete | drivers/net/wireless/purelifi/plfxlc/usb.c | length | length->? | yes? | BUG:oob_read |
| 2366 | Critical | 330 | F | sbp_calc_data_length_direction | drivers/target/sbp/sbp_target.c | data_size | loop bound | no | BUG:oob_read |
| 2367 | Critical | 330 | F | sdma_v4_0_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2368 | Critical | 330 | F | sdma_v4_4_2_inst_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | fw_size | loop bound | no | BUG:oob_read |
| 2369 | Critical | 330 | F | sdma_v5_0_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2370 | Critical | 330 | F | sdma_v5_2_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | fw_size | loop bound | no | BUG:oob_read |
| 2371 | Critical | 330 | F | sdma_v6_0_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2372 | Critical | 330 | F | sdma_v6_0_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2373 | Critical | 330 | F | sdma_v6_0_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2374 | Critical | 330 | F | sdma_v6_0_load_microcode | drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | fw_size | loop bound | no | BUG:oob_read |
| 2375 | Critical | 330 | F | si_cp_load_microcode | drivers/gpu/drm/radeon/si.c | fw_size | loop bound | no | BUG:oob_read |
| 2376 | Critical | 330 | F | si_cp_load_microcode | drivers/gpu/drm/radeon/si.c | fw_size | loop bound | no | BUG:oob_read |
| 2377 | Critical | 330 | F | si_cp_load_microcode | drivers/gpu/drm/radeon/si.c | fw_size | loop bound | no | BUG:oob_read |
| 2378 | Critical | 330 | F | si_load_smc_ucode | drivers/gpu/drm/radeon/si_smc.c | ucode_size | loop bound | no | BUG:oob_read |
| 2379 | Critical | 330 | F | si_mc_load_microcode | drivers/gpu/drm/radeon/si.c | regs_size | loop bound | no | BUG:oob_read |
| 2380 | Critical | 330 | F | si_mc_load_microcode | drivers/gpu/drm/radeon/si.c | ucode_size | loop bound | no | BUG:oob_read |
| 2381 | Critical | 330 | F | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | state_array | loop bound | no | BUG:oob_read |
| 2382 | Critical | 330 | F | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | power_state | loop bound | no | BUG:oob_read |
| 2383 | Critical | 330 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | BUG:oob_read |
| 2384 | Critical | 330 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | clock_info_array | clock_info_array->ucEntrySize | yes? | BUG:oob_read |
| 2385 | Critical | 330 | F | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | state_array | loop bound | no | BUG:oob_read |
| 2386 | Critical | 330 | F | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | power_state | loop bound | no | BUG:oob_read |
| 2387 | Critical | 330 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | BUG:oob_read |
| 2388 | Critical | 330 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | clock_info_array | clock_info_array->ucEntrySize | yes? | BUG:oob_read |
| 2389 | Critical | 330 | E | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | BUG:oob_read |
| 2390 | Critical | 330 | F | si_rlc_resume | drivers/gpu/drm/radeon/si.c | fw_size | loop bound | no | BUG:oob_read |
| 2391 | Critical | 330 | E | smu7_get_pp_table_entry_callback_func_v1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | sclk_dep_table | sclk_dep_table->entries | yes? | BUG:oob_read |
| 2392 | Critical | 330 | E | smu7_get_pp_table_entry_callback_func_v1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | sclk_dep_table | sclk_dep_table->ucRevId | yes? | BUG:oob_read |
| 2393 | Critical | 330 | E | smu7_get_pp_table_entry_callback_func_v1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | sclk_dep_table | sclk_dep_table->entries | yes? | BUG:oob_read |
| 2394 | Critical | 330 | E | smu7_get_pp_table_entry_callback_func_v1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | sclk_dep_table | sclk_dep_table->entries | yes? | BUG:oob_read |
| 2395 | Critical | 330 | E | smu7_get_pp_table_entry_callback_func_v1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | sclk_dep_table | sclk_dep_table->ucRevId | yes? | BUG:oob_read |
| 2396 | Critical | 330 | E | smu7_get_pp_table_entry_callback_func_v1 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | sclk_dep_table | sclk_dep_table->entries | yes? | BUG:oob_read |
| 2397 | Critical | 330 | F | smu_v11_0_set_pptable_v2_1 | drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | pptable_count | loop bound | no | BUG:oob_read |
| 2398 | Critical | 330 | F | smu_v13_0_6_init_microcode | drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | p2stable_count | loop bound | no | BUG:oob_read |
| 2399 | Critical | 330 | F | smu_v13_0_set_pptable_v2_1 | drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | pptable_count | loop bound | no | BUG:oob_read |
| 2400 | Critical | 330 | F | smu_v14_0_set_pptable_v2_1 | drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | pptable_count | loop bound | no | BUG:oob_read |
| 2401 | Critical | 330 | F | smu_v15_0_set_pptable_v2_1 | drivers/gpu/drm/amd/pm/swsmu/smu15/smu_v15_0.c | pptable_count | loop bound | no | BUG:oob_read |
| 2402 | Critical | 330 | F | st_lsm6dsx_read_fifo | drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | fifo_len | loop bound | no | BUG:oob_read |
| 2403 | Critical | 330 | F | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | state_array | loop bound | no | BUG:oob_read |
| 2404 | Critical | 330 | F | sumo_parse_power_table | drivers/gpu/drm/radeon/sumo_dpm.c | power_state | loop bound | no | BUG:oob_read |
| 2405 | Critical | 330 | F | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | state_array | loop bound | no | BUG:oob_read |
| 2406 | Critical | 330 | F | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | power_state | loop bound | no | BUG:oob_read |
| 2407 | Critical | 330 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | BUG:oob_read |
| 2408 | Critical | 330 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | clock_info_array | clock_info_array->ucEntrySize | yes? | BUG:oob_read |
| 2409 | Critical | 330 | E | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | BUG:oob_read |
| 2410 | Critical | 330 | F | typhoon_download_firmware | drivers/net/ethernet/3com/typhoon.c | numSections | loop bound | no | BUG:oob_read |
| 2411 | Critical | 330 | E | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | resp | resp->cmd | yes? | BUG:oob_read |
| 2412 | Critical | 330 | E | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | resp | resp->cmd | yes? | BUG:oob_read |
| 2413 | Critical | 330 | E | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | resp | resp->numDesc | yes? | BUG:oob_read |
| 2414 | Critical | 330 | E | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | resp | resp->parm1 | yes? | BUG:oob_read |
| 2415 | Critical | 330 | E | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | resp | resp->parm2 | yes? | BUG:oob_read |
| 2416 | Critical | 330 | E | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | resp | resp->parm3 | yes? | BUG:oob_read |
| 2417 | Critical | 330 | F | ucan_tx_complete_msg | drivers/net/can/usb/ucan.c | count | loop bound | no | BUG:oob_read |
| 2418 | Critical | 330 | F | uea_load_page_e1 | drivers/usb/atm/ueagle-atm.c | blockcount | loop bound | no | BUG:oob_read |
| 2419 | Critical | 330 | F | uea_load_page_e4 | drivers/usb/atm/ueagle-atm.c | (inline) | loop bound | no | BUG:oob_read |
| 2420 | Critical | 330 | F | valid_csum | drivers/usb/serial/io_ti.c | (inline) | loop bound | no | BUG:oob_read |
| 2421 | Critical | 330 | F | vce_v1_0_load_fw | drivers/gpu/drm/radeon/vce_v1_0.c | (inline) | loop bound | no | BUG:oob_read |
| 2422 | Critical | 330 | F | vce_v1_0_load_fw | drivers/gpu/drm/amd/amdgpu/vce_v1_0.c | sign | loop bound | no | BUG:oob_read |
| 2423 | Critical | 330 | E | vce_v1_0_load_fw | drivers/gpu/drm/amd/amdgpu/vce_v1_0.c | sign | sign->number | yes? | BUG:oob_read |
| 2424 | Critical | 330 | E | vce_v1_0_load_fw | drivers/gpu/drm/amd/amdgpu/vce_v1_0.c | sign | sign->val | yes? | BUG:oob_read |
| 2425 | Critical | 330 | E | vce_v1_0_load_fw | drivers/gpu/drm/amd/amdgpu/vce_v1_0.c | sign | sign->val | yes? | BUG:oob_read |
| 2426 | Critical | 330 | E | vega10_get_pp_table_entry_callback_func | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | gfxclk_dep_table | gfxclk_dep_table->entries | yes? | BUG:oob_read |
| 2427 | Critical | 330 | E | vega10_get_pp_table_entry_callback_func | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | gfxclk_dep_table | gfxclk_dep_table->entries | yes? | BUG:oob_read |
| 2428 | Critical | 330 | E | vega10_get_pp_table_entry_callback_func | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | gfxclk_dep_table | gfxclk_dep_table->ucRevId | yes? | BUG:oob_read |
| 2429 | Critical | 330 | E | vega10_get_pp_table_entry_callback_func | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | gfxclk_dep_table | gfxclk_dep_table->entries | yes? | BUG:oob_read |
| 2430 | Critical | 330 | E | vsc_identify_ace_image | drivers/misc/mei/vsc-fw-loader.c | sign | sign->image | yes? | BUG:oob_read |
| 2431 | Critical | 330 | E | vsc_identify_ace_image | drivers/misc/mei/vsc-fw-loader.c | sign | sign->image_size | yes? | BUG:oob_read |
| 2432 | Critical | 330 | F | walk_ablock | drivers/md/persistent-data/dm-array.c | nr_entries | loop bound | no | BUG:oob_read |
| 2433 | Critical | 330 | F | walk_node | drivers/md/persistent-data/dm-btree.c | nr | loop bound | no | BUG:oob_read |
| 2434 | Critical | 330 | F | wil_cfg80211_iface_combinations_from_fw | drivers/net/wireless/ath/wil6210/cfg80211.c | n_combos | loop bound | no | BUG:oob_read |
| 2435 | Critical | 330 | F | wlcore_tx_complete | drivers/net/wireless/ti/wlcore/tx.c | count | loop bound | no | BUG:oob_read |
| 2436 | Critical | 330 | F | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | len | loop bound | no | BUG:oob_read |
| 2437 | Critical | 330 | F | zfcp_dbf_san_res_cap_len_if_gpn_ft | drivers/s390/scsi/zfcp_dbf.c | max_entries | loop bound | no | BUG:oob_read |
| 2438 | Critical | 320 | B | __mt7925_mcu_set_clc | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | le16_to_cpu(req.size) + sizeof(req) | memset() in __mt76_mcu_msg_alloc() | no | BUG:undersized_alloc |
| 2439 | Critical | 320 | C | aac_src_intr_message | drivers/scsi/aacraid/src.c | handle | subscript (callee) | yes? | BUG:oob_read |
| 2440 | Critical | 320 | B | acm_ctrl_irq | drivers/usb/class/cdc-acm.c | alloc_size | krealloc() | no | BUG:undersized_alloc |
| 2441 | Critical | 320 | F | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | loop bound | yes? | BUG:stack_overflow |
| 2442 | Critical | 320 | B | altera_execute | drivers/misc/altera-stapl/altera.c | proc_count | kzalloc() | no | BUG:undersized_alloc |
| 2443 | Critical | 320 | B | altera_execute | drivers/misc/altera-stapl/altera.c | uncomp_size | kzalloc() | no | BUG:undersized_alloc |
| 2444 | Critical | 320 | B | altera_execute | drivers/misc/altera-stapl/altera.c | size | kzalloc() | no | BUG:undersized_alloc |
| 2445 | Critical | 320 | B | altera_execute | drivers/misc/altera-stapl/altera.c | long_tmp | kzalloc() | no | BUG:undersized_alloc |
| 2446 | Critical | 320 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx | subscript | yes? | BUG:oob_read |
| 2447 | Critical | 320 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx2 | subscript | yes? | BUG:oob_read |
| 2448 | Critical | 320 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx2 | subscript | yes? | BUG:oob_read |
| 2449 | Critical | 320 | C | altera_get_act_info | drivers/misc/altera-stapl/altera.c | str_table | subscript | yes? | BUG:oob_read |
| 2450 | Critical | 320 | B | amdgpu_atombios_allocate_fb_scratch | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | usage_bytes | kzalloc() | no | BUG:undersized_alloc |
| 2451 | Critical | 320 | H | amdgpu_atombios_init_mc_reg_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | num_entries | truncation | no | BUG:oob_read |
| 2452 | Critical | 320 | B | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | dep_table | kzalloc() in amdgpu_parse_clk_voltage_dep_table() | no | BUG:undersized_alloc |
| 2453 | Critical | 320 | B | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | size | kzalloc() | no | BUG:undersized_alloc |
| 2454 | Critical | 320 | B | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | size | kzalloc() | no | BUG:undersized_alloc |
| 2455 | Critical | 320 | B | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | size | kzalloc() | no | BUG:undersized_alloc |
| 2456 | Critical | 320 | B | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | size | kzalloc() | no | BUG:undersized_alloc |
| 2457 | Critical | 320 | B | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | size | kzalloc() | no | BUG:undersized_alloc |
| 2458 | Critical | 320 | B | ar5523_read_reply | drivers/net/wireless/ath/ar5523/ar5523.c | olen | memcpy() | yes? | BUG:oob_read |
| 2459 | Critical | 320 | C | ath10k_htt_rx_tx_mode_switch_ind | drivers/net/wireless/ath/ath10k/htt_rx.c | peer_id | subscript (callee) | yes? | BUG:oob_read |
| 2460 | Critical | 320 | C | ath10k_htt_rx_tx_mode_switch_ind | drivers/net/wireless/ath/ath10k/htt_rx.c | tid | subscript (callee) | yes? | BUG:oob_read |
| 2461 | Critical | 320 | B | ath12k_tpc_get_ctl_pwr_tbl | drivers/net/wireless/ath/ath12k/wmi.c | ctl_array_len | kzalloc() | no | BUG:undersized_alloc |
| 2462 | Critical | 320 | B | ath12k_tpc_get_rate_array | drivers/net/wireless/ath/ath12k/wmi.c | rate_array_len | kzalloc() | no | BUG:undersized_alloc |
| 2463 | Critical | 320 | B | ath12k_tpc_get_reg_pwr | drivers/net/wireless/ath/ath12k/wmi.c | le32_to_cpu(reg_pwr->tpc_reg_pwr.reg_arr | kzalloc() | no | BUG:integer_overflow |
| 2464 | Critical | 320 | B | ath9k_hif_usb_rx_stream | drivers/net/wireless/ath/ath9k/hif_usb.c | pkt_len | memcpy() | yes? | BUG:oob_read |
| 2465 | Critical | 320 | B | atom_allocate_fb_scratch | drivers/gpu/drm/radeon/atom.c | usage_bytes | kzalloc() | no | BUG:undersized_alloc |
| 2466 | Critical | 320 | G2 | atomisp_gdc_cac_table | drivers/staging/media/atomisp/pci/atomisp_cmd.c | config->height * config->width *
sizeof(*config->coordinates_x[i]) | copy_from_user() unvalidated size | no | BUG:integer_overflow |
| 2467 | Critical | 320 | G2 | atomisp_gdc_cac_table | drivers/staging/media/atomisp/pci/atomisp_cmd.c | config->height * config->width *
sizeof(*config->coordinates_y[i]) | copy_from_user() unvalidated size | no | BUG:integer_overflow |
| 2468 | Critical | 320 | B | bcm4377_handle_completion | drivers/bluetooth/hci_bcm4377.c | data_len | memcpy() in bcm4377_handle_event() | yes? | BUG:oob_read |
| 2469 | Critical | 320 | C | be_async_port_misconfig_event_process | drivers/net/ethernet/emulex/benet/be_cmds.c | new_phy_state | subscript | yes? | BUG:oob_read |
| 2470 | Critical | 320 | C | bnx2x_handle_classification_eqe | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | cid | subscript | yes? | BUG:oob_read |
| 2471 | Critical | 320 | C | brcm_nvram_parse | drivers/nvmem/brcm_nvram.c | len | subscript (callee) | yes? | BUG:oob_read |
| 2472 | Critical | 320 | B | btmtk_submit_intr_urb | drivers/bluetooth/btmtk.c | size | kmalloc() | no | BUG:undersized_alloc |
| 2473 | Critical | 320 | B | btusb_submit_intr_urb | drivers/bluetooth/btusb.c | size | kmalloc() | no | BUG:undersized_alloc |
| 2474 | Critical | 320 | B | btusb_submit_isoc_urb | drivers/bluetooth/btusb.c | size | kmalloc() | no | BUG:integer_overflow |
| 2475 | Critical | 320 | G2 | ccdc_config | drivers/media/platform/ti/omap3isp/ispccdc.c | size | copy_from_user() unvalidated size | no | BUG:integer_overflow |
| 2476 | Critical | 320 | H | cdns3_ep0_feature_handle_endpoint | drivers/usb/cdns3/cdns3-ep0.c | index | truncation | no | BUG:oob_read |
| 2477 | Critical | 320 | C | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | clock_array_index | subscript | yes? | BUG:oob_read |
| 2478 | Critical | 320 | C | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | subscript (callee) | yes? | BUG:oob_read |
| 2479 | Critical | 320 | B | cs_dsp_load | drivers/firmware/cirrus/cs_dsp.c | region_len | memcpy() | yes? | BUG:oob_read |
| 2480 | Critical | 320 | C | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | port_id | subscript (callee) | yes? | BUG:oob_read |
| 2481 | Critical | 320 | C | cxgb4_dcb_handle_fw_update | drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | dcb_running_version | subscript | yes? | BUG:oob_read |
| 2482 | Critical | 320 | B | cxl_enumerate_cmds | drivers/cxl/core/mbox.c | size | kvmalloc() | no | BUG:undersized_alloc |
| 2483 | Critical | 320 | B | cyapa_pip_retrieve_data_structure | drivers/input/mouse/cyapa_gen6.c | read_len | memcpy() | yes? | BUG:oob_read |
| 2484 | Critical | 320 | C | cyttsp5_validate_cmd_response | drivers/input/touchscreen/cyttsp5.c | size | subscript | yes? | BUG:oob_read |
| 2485 | Critical | 320 | B | e1000_clean_jumbo_rx_irq | drivers/net/ethernet/intel/e1000/e1000_main.c | length | memcpy() | yes? | BUG:oob_read |
| 2486 | Critical | 320 | C | ep0_handle_feature | drivers/usb/gadget/udc/bdc/bdc_ep.c | epnum | subscript | yes? | BUG:oob_read |
| 2487 | Critical | 320 | H | erdma_poll_one_cqe | drivers/infiniband/hw/erdma/erdma_cq.c | wqe_idx | truncation | no | BUG:oob_read |
| 2488 | Critical | 320 | H | erdma_poll_one_cqe | drivers/infiniband/hw/erdma/erdma_cq.c | opcode | truncation | no | BUG:oob_read |
| 2489 | Critical | 320 | H | erdma_poll_single_cmd_completion | drivers/infiniband/hw/erdma/erdma_cmdq.c | ctx_id | truncation | no | BUG:oob_read |
| 2490 | Critical | 320 | G2 | ethosu_ioctl_submit | drivers/accel/ethosu/ethosu_job.c | args->job_count * sizeof(*jobs) | copy_from_user() unvalidated size | no | BUG:integer_overflow |
| 2491 | Critical | 320 | C | fbnic_tlv_attr_validate | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | len | subscript | yes? | BUG:oob_read |
| 2492 | Critical | 320 | B | fm10k_fetch_rx_buffer | drivers/net/ethernet/intel/fm10k/fm10k_main.c | size | memcpy() in fm10k_add_rx_frag() | yes? | BUG:oob_read |
| 2493 | Critical | 320 | B | fun_data_from_rq | drivers/net/ethernet/fungible/funcore/fun_queue.c | total_len | kmalloc() | no | BUG:undersized_alloc |
| 2494 | Critical | 320 | B | fw_cfg_register_dir_entries | drivers/firmware/qemu_fw_cfg.c | dir_size | kmalloc() | no | BUG:integer_overflow |
| 2495 | Critical | 320 | B | gb_generate_enum_strings | drivers/staging/greybus/audio_topology.c | items | devm_kcalloc() | no | BUG:undersized_alloc |
| 2496 | Critical | 320 | B | gb_loopback_request_handler | drivers/staging/greybus/loopback.c | len | memcpy() | yes? | BUG:oob_read |
| 2497 | Critical | 320 | C | gen5_cmd_resp_header_parse | drivers/input/mouse/cyapa_gen5.c | length | subscript | yes? | BUG:oob_read |
| 2498 | Critical | 320 | B | hinic3_send_mbox_to_mgmt | drivers/net/ethernet/huawei/hinic3/hinic3_mbox.c | msg_len | memcpy() | yes? | BUG:oob_read |
| 2499 | Critical | 320 | B | hso_create_shared_int | drivers/net/usb/hso.c | le16_to_cpu(mux->intr_endp->wMaxPacketSi | kzalloc() | no | BUG:undersized_alloc |
| 2500 | Critical | 320 | B | i2c_atmel_recv | drivers/char/tpm/tpm_i2c_atmel.c | expected_len | memcpy() | yes? | BUG:oob_read |
| 2501 | Critical | 320 | C | ibmvmc_recv_msg | drivers/misc/ibmvmc.c | buffer_id | subscript | yes? | BUG:oob_read |
| 2502 | Critical | 320 | C | init_over_drive_limits | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | gfxclk_dep_table | subscript | yes? | BUG:oob_read |
| 2503 | Critical | 320 | C | iwl_dbg_tlv_ver_support | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tlv_idx | subscript | yes? | BUG:oob_read |
| 2504 | Critical | 320 | C | iwl_mvm_flush_sta_tids | drivers/net/wireless/intel/iwlwifi/mvm/tx.c | tid | subscript (callee) | yes? | BUG:oob_read |
| 2505 | Critical | 320 | C | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | clock_array_index | subscript | yes? | BUG:oob_read |
| 2506 | Critical | 320 | C | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | clock_array_index | subscript | yes? | BUG:oob_read |
| 2507 | Critical | 320 | C | load_waveform | drivers/video/fbdev/metronomefb.c | wfm_idx | subscript | yes? | BUG:oob_read |
| 2508 | Critical | 320 | C | load_waveform | drivers/video/fbdev/metronomefb.c | wfm_idx | subscript | yes? | BUG:oob_read |
| 2509 | Critical | 320 | B | lpfc_els_rcv_rscn | drivers/scsi/lpfc/lpfc_els.c | payload_len | memcpy() | yes? | BUG:oob_read |
| 2510 | Critical | 320 | B | mes_v11_0_allocate_ucode_data_buffer | drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | fw_size | memcpy() | yes? | BUG:oob_read |
| 2511 | Critical | 320 | C | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | port | subscript | yes? | BUG:oob_read |
| 2512 | Critical | 320 | C | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | port | subscript | yes? | BUG:oob_read |
| 2513 | Critical | 320 | C | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | port | subscript | yes? | BUG:oob_read |
| 2514 | Critical | 320 | B | mpt3sas_config_get_volume_handle | drivers/scsi/mpt3sas/mpt3sas_config.c | config_page_sz | kmalloc() | no | BUG:undersized_alloc |
| 2515 | Critical | 320 | B | mpt3sas_scsih_event_callback | drivers/scsi/mpt3sas/mpt3sas_scsih.c | sz | kzalloc() in alloc_fw_event_work() | no | BUG:integer_overflow |
| 2516 | Critical | 320 | C | mptscsih_io_done | drivers/message/fusion/mptscsih.c | req_idx | subscript (callee) | yes? | BUG:oob_read |
| 2517 | Critical | 320 | C | mptscsih_io_done | drivers/message/fusion/mptscsih.c | req_idx | subscript (callee) | yes? | BUG:oob_read |
| 2518 | Critical | 320 | C | msb_ftl_scan | drivers/memstick/core/ms_block.c | lba | subscript | yes? | BUG:oob_read |
| 2519 | Critical | 320 | C | msb_ftl_scan | drivers/memstick/core/ms_block.c | lba | subscript | yes? | BUG:oob_read |
| 2520 | Critical | 320 | B | mt7921_load_clc | drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | le32_to_cpu(clc->len) | devm_kmalloc() in devm_kmemdup() | no | BUG:undersized_alloc |
| 2521 | Critical | 320 | H | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | hdr_gap | truncation | no | BUG:oob_read |
| 2522 | Critical | 320 | B | mt7925_load_clc | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | le32_to_cpu(clc->len) | devm_kmalloc() in devm_kmemdup() | no | BUG:undersized_alloc |
| 2523 | Critical | 320 | H | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | seq_id | truncation | no | BUG:oob_read |
| 2524 | Critical | 320 | H | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | ind_count | truncation | no | BUG:oob_read |
| 2525 | Critical | 320 | H | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | count | truncation | no | BUG:oob_read |
| 2526 | Critical | 320 | B | mwifiex_pcie_process_event_ready | drivers/net/wireless/marvell/mwifiex/pcie.c | evt_len | memcpy() | yes? | BUG:oob_read |
| 2527 | Critical | 320 | C | mwifiex_update_autoindex_ies | drivers/net/wireless/marvell/mwifiex/ie.c | index | subscript (callee) | yes? | BUG:oob_read |
| 2528 | Critical | 320 | C | nfp_bpf_event_output | drivers/net/ethernet/netronome/nfp/bpf/offload.c | pkt_size | subscript | yes? | BUG:oob_read |
| 2529 | Critical | 320 | B | nvme_pr_read_reservation | drivers/nvme/host/pr.c | rse_len | kzalloc() | no | BUG:undersized_alloc |
| 2530 | Critical | 320 | B | nvmet_pci_epf_get_sgl_segment | drivers/nvme/target/pci-epf.c | length | kmalloc() | no | BUG:undersized_alloc |
| 2531 | Critical | 320 | C | nvmet_pci_epf_get_sgl_segment | drivers/nvme/target/pci-epf.c | nr_descs | subscript | yes? | BUG:oob_read |
| 2532 | Critical | 320 | C | nvmet_pci_epf_get_sgl_segment | drivers/nvme/target/pci-epf.c | nr_descs | subscript | yes? | BUG:oob_read |
| 2533 | Critical | 320 | C | ocrdma_poll_hwcq | drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | qpn | subscript | yes? | BUG:oob_read |
| 2534 | Critical | 320 | B | pci_epf_test_copy | drivers/pci/endpoint/functions/pci-epf-test.c | copy_size | kzalloc() | no | BUG:undersized_alloc |
| 2535 | Critical | 320 | C | pci_epf_test_disable_doorbell | drivers/pci/endpoint/functions/pci-epf-test.c | bar | subscript (callee) | yes? | BUG:oob_read |
| 2536 | Critical | 320 | C | pci_epf_test_disable_doorbell | drivers/pci/endpoint/functions/pci-epf-test.c | bar | subscript (callee) | yes? | BUG:oob_read |
| 2537 | Critical | 320 | C | pci_epf_test_disable_doorbell | drivers/pci/endpoint/functions/pci-epf-test.c | bar | subscript (callee) | yes? | BUG:oob_read |
| 2538 | Critical | 320 | C | pci_epf_test_disable_doorbell | drivers/pci/endpoint/functions/pci-epf-test.c | bar | subscript | yes? | BUG:oob_read |
| 2539 | Critical | 320 | B | pci_epf_test_read | drivers/pci/endpoint/functions/pci-epf-test.c | src_size | kzalloc() | no | BUG:undersized_alloc |
| 2540 | Critical | 320 | B | pci_epf_test_write | drivers/pci/endpoint/functions/pci-epf-test.c | dst_size | kzalloc() | no | BUG:undersized_alloc |
| 2541 | Critical | 320 | B | pds_vfio_dirty_alloc_regions | drivers/vfio/pci/pds/dirty.c | page_count | vzalloc() in pds_vfio_dirty_alloc_bitmaps() | no | BUG:undersized_alloc |
| 2542 | Critical | 320 | B | pds_vfio_dirty_alloc_regions | drivers/vfio/pci/pds/dirty.c | page_count | vzalloc() in pds_vfio_dirty_alloc_bitmaps() | no | BUG:undersized_alloc |
| 2543 | Critical | 320 | B | pds_vfio_dirty_alloc_regions | drivers/vfio/pci/pds/dirty.c | page_count | kzalloc() in pds_vfio_dirty_alloc_sgl() | no | BUG:integer_overflow |
| 2544 | Critical | 320 | B | pqi_raid_maps_equal | drivers/scsi/smartpqi/smartpqi_init.c | raid_map1_size | memcmp() | yes? | BUG:oob_read |
| 2545 | Critical | 320 | B | pqi_report_phys_logical_luns | drivers/scsi/smartpqi/smartpqi_init.c | lun_data_length | kmalloc() | no | BUG:integer_overflow |
| 2546 | Critical | 320 | C | qed_iwarp_process_mpa_pkt | drivers/net/ethernet/qlogic/qed/qed_iwarp.c | cid | subscript (callee) | yes? | BUG:oob_read |
| 2547 | Critical | 320 | H | qed_iwarp_process_mpa_pkt | drivers/net/ethernet/qlogic/qed/qed_iwarp.c | cid | truncation | no | BUG:oob_read |
| 2548 | Critical | 320 | B | qtnf_event_parse | drivers/net/wireless/quantenna/qtnfmac/event.c | event_len | kzalloc() in qtnf_event_handle_update_owe() | no | BUG:undersized_alloc |
| 2549 | Critical | 320 | B | quicki2c_alloc_report_buf | drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | le16_to_cpu(qcdev->dev_desc.report_desc_ | devm_kzalloc() | no | BUG:undersized_alloc |
| 2550 | Critical | 320 | B | quickspi_alloc_report_buf | drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | le16_to_cpu(qsdev->dev_desc.rep_desc_len | devm_kzalloc() | no | BUG:undersized_alloc |
| 2551 | Critical | 320 | B | quickspi_alloc_report_buf | drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | max_input_len | devm_kzalloc() | no | BUG:undersized_alloc |
| 2552 | Critical | 320 | B | quickspi_alloc_report_buf | drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | max_report_len | devm_kzalloc() | no | BUG:undersized_alloc |
| 2553 | Critical | 320 | B | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | size | kzalloc() | no | BUG:undersized_alloc |
| 2554 | Critical | 320 | B | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | size | kzalloc() | no | BUG:undersized_alloc |
| 2555 | Critical | 320 | B | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | size | kzalloc() | no | BUG:undersized_alloc |
| 2556 | Critical | 320 | B | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | size | kzalloc() | no | BUG:undersized_alloc |
| 2557 | Critical | 320 | B | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | size | kzalloc() | no | BUG:undersized_alloc |
| 2558 | Critical | 320 | H | radeon_atom_init_mc_reg_table | drivers/gpu/drm/radeon/radeon_atombios.c | num_entries | truncation | no | BUG:oob_read |
| 2559 | Critical | 320 | C | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | con_obj_id | subscript | yes? | BUG:oob_read |
| 2560 | Critical | 320 | C | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | con_obj_id | subscript | yes? | BUG:oob_read |
| 2561 | Critical | 320 | G2 | resume_queues | drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | num_queues * sizeof(uint32_t) | copy_to_user() unvalidated size | no | BUG:integer_overflow |
| 2562 | Critical | 320 | B | rtw89_fw_log_create_fmts_dict | drivers/net/wireless/realtek/rtw89/fw.c | fmt_count | kcalloc() | no | BUG:undersized_alloc |
| 2563 | Critical | 320 | C | rtw89_phy_c2h_rfk_run_log | drivers/net/wireless/realtek/rtw89/phy.c | offset | subscript | yes? | BUG:oob_read |
| 2564 | Critical | 320 | B | sbp_fetch_page_table | drivers/target/sbp/sbp_target.c | pg_tbl_sz | kmalloc() | no | BUG:integer_overflow |
| 2565 | Critical | 320 | B | sd_init | drivers/media/usb/gspca/vicam.c | len | memcpy() | yes? | BUG:oob_read |
| 2566 | Critical | 320 | B | si470x_usb_driver_probe | drivers/media/radio/si470x/radio-si470x-usb.c | int_end_size | kmalloc() | no | BUG:undersized_alloc |
| 2567 | Critical | 320 | C | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | clock_array_index | subscript | yes? | BUG:oob_read |
| 2568 | Critical | 320 | C | si_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | clock_array_index | subscript | yes? | BUG:oob_read |
| 2569 | Critical | 320 | C | smp_snoop | drivers/infiniband/hw/mlx4/mad.c | bn | subscript | yes? | BUG:oob_read |
| 2570 | Critical | 320 | B | smu_sat_get_sdb_partition | drivers/macintosh/windfarm_smu_sat.c | len | kmalloc() | no | BUG:undersized_alloc |
| 2571 | Critical | 320 | H | stex_ss_mu_intr | drivers/scsi/stex.c | tag | truncation | no | BUG:oob_read |
| 2572 | Critical | 320 | B | surface_hid_parse | drivers/hid/surface-hid/surface_hid_core.c | len | kzalloc() | no | BUG:undersized_alloc |
| 2573 | Critical | 320 | H | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | id | truncation | no | BUG:oob_read |
| 2574 | Critical | 320 | B | tpm2_load_context | drivers/char/tpm/tpm2-space.c | body_size | memcpy() in tpm_buf_append() | yes? | BUG:oob_read |
| 2575 | Critical | 320 | C | trinity_parse_power_table | drivers/gpu/drm/radeon/trinity_dpm.c | clock_array_index | subscript | yes? | BUG:oob_read |
| 2576 | Critical | 320 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript (callee) | yes? | BUG:oob_read |
| 2577 | Critical | 320 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript (callee) | yes? | BUG:oob_read |
| 2578 | Critical | 320 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript (callee) | yes? | BUG:oob_read |
| 2579 | Critical | 320 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript (callee) | yes? | BUG:oob_read |
| 2580 | Critical | 320 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript | yes? | BUG:oob_read |
| 2581 | Critical | 320 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript | yes? | BUG:oob_read |
| 2582 | Critical | 320 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript | yes? | BUG:oob_read |
| 2583 | Critical | 320 | C | twl_interrupt | drivers/scsi/3w-sas.c | request_id | subscript | yes? | BUG:oob_read |
| 2584 | Critical | 320 | C | ubi_eba_copy_leb | drivers/mtd/ubi/eba.c | lnum | subscript | yes? | BUG:oob_read |
| 2585 | Critical | 320 | C | ubi_eba_copy_leb | drivers/mtd/ubi/eba.c | lnum | subscript | yes? | BUG:oob_read |
| 2586 | Critical | 320 | B | ufshcd_copy_query_response | drivers/ufs/core/ufshcd.c | resp_len | memcpy() | yes? | BUG:oob_read |
| 2587 | Critical | 320 | B | ufshcd_issue_devman_upiu_cmd | drivers/ufs/core/ufshcd.c | resp_len | memcpy() | yes? | BUG:oob_read |
| 2588 | Critical | 320 | H | vfio_pci_igd_opregion_init | drivers/vfio/pci/vfio_pci_igd.c | addr | truncation | no | BUG:oob_read |
| 2589 | Critical | 320 | B | wfx_hif_generic_confirm | drivers/net/wireless/silabs/wfx/hif_rx.c | len | memcpy() | yes? | BUG:oob_read |
| 2590 | Critical | 320 | B | wilc_wlan_cfg_get_val | drivers/net/wireless/microchip/wilc1000/wlan_cfg.c | size | memcpy() | yes? | BUG:oob_read |
| 2591 | Critical | 320 | H | xgene_dma_cleanup_descriptors | drivers/dma/xgene-dma.c | status | truncation | no | BUG:oob_read |
| 2592 | Critical | 310 | F | altera_execute | drivers/misc/altera-stapl/altera.c | sym_count | loop bound | yes? | BUG:oob_read |
| 2593 | Critical | 310 | D | altera_execute | drivers/misc/altera-stapl/altera.c | name | strlen() | no | BUG:oob_read |
| 2594 | Critical | 310 | F | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | loop bound | yes? | BUG:oob_read |
| 2595 | Critical | 310 | F | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx | loop bound | yes? | BUG:oob_read |
| 2596 | Critical | 310 | F | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx | loop bound | yes? | BUG:oob_read |
| 2597 | Critical | 310 | F | altera_get_note | drivers/misc/altera-stapl/altera.c | note_count | loop bound | yes? | BUG:oob_read |
| 2598 | Critical | 310 | D | altera_get_note | drivers/misc/altera-stapl/altera.c | key_ptr | strlen() | no | BUG:oob_read |
| 2599 | Critical | 310 | F | alua_rtpg | drivers/scsi/device_handler/scsi_dh_alua.c | len | loop bound | yes? | BUG:oob_read |
| 2600 | Critical | 310 | F | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | path | loop bound | yes? | BUG:oob_read |
| 2601 | Critical | 310 | F | amdgpu_atombios_init_mc_reg_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | num_entries | loop bound | yes? | BUG:oob_read |
| 2602 | Critical | 310 | F | ath12k_debugfs_htt_ext_stats_handler | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | len | loop bound | yes? | BUG:oob_read |
| 2603 | Critical | 310 | F | ath12k_htt_pull_ppdu_stats | drivers/net/wireless/ath/ath12k/dp_htt.c | ppdu_info | loop bound | yes? | BUG:oob_read |
| 2604 | Critical | 310 | F | ath12k_tpc_stats_print | drivers/net/wireless/ath/ath12k/debugfs.c | nss | loop bound | no | BUG:integer_overflow |
| 2605 | Critical | 310 | F | ath12k_wmi_wow_wakeup_host_parse | drivers/net/wireless/ath/ath12k/wmi.c | pf_len | loop bound | yes? | BUG:oob_read |
| 2606 | Critical | 310 | F | bfa_fcs_lport_ms_gmal_response | drivers/scsi/bfa/bfa_fcs_lport.c | num_entries | loop bound | yes? | BUG:oob_read |
| 2607 | Critical | 310 | F | bitmap_flush_work | drivers/md/dm-integrity.c | limit | loop bound | yes? | BUG:oob_read |
| 2608 | Critical | 310 | F | bitmap_flush_work | drivers/md/dm-integrity.c | limit | loop bound | yes? | BUG:oob_read |
| 2609 | Critical | 310 | F | bitmap_flush_work | drivers/md/dm-integrity.c | limit | loop bound | yes? | BUG:oob_read |
| 2610 | Critical | 310 | F | brcm_nvram_parse | drivers/nvmem/brcm_nvram.c | len | loop bound | yes? | BUG:oob_read |
| 2611 | Critical | 310 | F | brcm_nvram_parse | drivers/nvmem/brcm_nvram.c | len | loop bound | yes? | BUG:oob_read |
| 2612 | Critical | 310 | F | brcmf_construct_chaninfo | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | total | loop bound | yes? | BUG:oob_read |
| 2613 | Critical | 310 | F | btmtk_setup_firmware_79xx | drivers/bluetooth/btmtk.c | dl_size | loop bound | yes? | BUG:oob_read |
| 2614 | Critical | 310 | F | cyapa_gen5_read_idac_data | drivers/input/mouse/cyapa_gen5.c | read_len | loop bound | yes? | BUG:oob_read |
| 2615 | Critical | 310 | F | cyapa_gen5_read_panel_scan_raw_data | drivers/input/mouse/cyapa_gen5.c | read_elements | loop bound | yes? | BUG:oob_read |
| 2616 | Critical | 310 | F | init_clock_voltage_dependency | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | table | loop bound | yes? | BUG:oob_read |
| 2617 | Critical | 310 | F | ipc_mux_get_payload_from_adb | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | nr_of_dg | loop bound | yes? | BUG:oob_read |
| 2618 | Critical | 310 | F | ipr_log_dual_ioa_error | drivers/scsi/ipr.c | be32_to_cpu(hostrcb->hcam.length) -
(offsetof(struct ipr | loop bound | yes? | BUG:oob_read |
| 2619 | Critical | 310 | F | ipr_log_enhanced_dual_ioa_error | drivers/scsi/ipr.c | be32_to_cpu(hostrcb->hcam.length) -
(offsetof(struct ipr | loop bound | yes? | BUG:oob_read |
| 2620 | Critical | 310 | F | ipr_log_fabric_error | drivers/scsi/ipr.c | add_len | loop bound | yes? | BUG:oob_read |
| 2621 | Critical | 310 | F | ipr_log_generic_error | drivers/scsi/ipr.c | be32_to_cpu(hostrcb->hcam.length) | loop bound | yes? | BUG:oob_read |
| 2622 | Critical | 310 | F | ipr_log_sis64_device_error | drivers/scsi/ipr.c | be32_to_cpu(error->length_of_error) | loop bound | yes? | BUG:oob_read |
| 2623 | Critical | 310 | F | ipr_log_sis64_fabric_error | drivers/scsi/ipr.c | add_len | loop bound | yes? | BUG:oob_read |
| 2624 | Critical | 310 | F | ipr_log_sis64_service_required_error | drivers/scsi/ipr.c | be32_to_cpu(hostrcb->hcam.length) -
(offsetof(struct ipr | loop bound | yes? | BUG:oob_read |
| 2625 | Critical | 310 | F | lbs_ret_scan | drivers/net/wireless/marvell/libertas/cfg.c | i | loop bound | yes? | BUG:oob_read |
| 2626 | Critical | 310 | F | load_waveform | drivers/video/fbdev/metronomefb.c | wfm_idx | loop bound | yes? | BUG:oob_read |
| 2627 | Critical | 310 | F | mt7921_load_clc | drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | len | loop bound | yes? | BUG:oob_read |
| 2628 | Critical | 310 | F | mt7925_load_clc | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | len | loop bound | yes? | BUG:oob_read |
| 2629 | Critical | 310 | F | mtk_wed_update_rx_stats | drivers/net/ethernet/mediatek/mtk_wed_mcu.c | count | loop bound | yes? | BUG:oob_read |
| 2630 | Critical | 310 | F | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | bytes_left | loop bound | yes? | BUG:oob_read |
| 2631 | Critical | 310 | F | mwifiex_ret_802_11_scan | drivers/net/wireless/marvell/mwifiex/scan.c | bytes_left | loop bound | yes? | BUG:oob_read |
| 2632 | Critical | 310 | F | ncm_unwrap_ntb | drivers/usb/gadget/function/f_ncm.c | ndp_len | loop bound | yes? | BUG:oob_read |
| 2633 | Critical | 310 | F | ppl_recover_entry | drivers/md/raid5-ppl.c | strip_sectors | loop bound | no | BUG:integer_overflow |
| 2634 | Critical | 310 | F | ppl_recover_entry | drivers/md/raid5-ppl.c | data_disks | loop bound | no | BUG:integer_overflow |
| 2635 | Critical | 310 | F | pqi_raid_maps_equal | drivers/scsi/smartpqi/smartpqi_init.c | raid_map1_size | loop bound | yes? | BUG:oob_read |
| 2636 | Critical | 310 | F | psp_init_sos_microcode | drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | fw_bin_count | loop bound | yes? | BUG:oob_read |
| 2637 | Critical | 310 | F | qlcnic_validate_product_offs | drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | entries | loop bound | no | BUG:integer_overflow |
| 2638 | Critical | 310 | F | radeon_atom_init_mc_reg_table | drivers/gpu/drm/radeon/radeon_atombios.c | num_entries | loop bound | yes? | BUG:oob_read |
| 2639 | Critical | 310 | F | radeon_atombios_parse_power_table_6 | drivers/gpu/drm/radeon/radeon_atombios.c | state_array | loop bound | yes? | BUG:oob_read |
| 2640 | Critical | 310 | F | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | path | loop bound | yes? | BUG:oob_read |
| 2641 | Critical | 310 | F | rndis_query_response | drivers/usb/gadget/function/rndis.c | BufLength | loop bound | yes? | BUG:oob_read |
| 2642 | Critical | 310 | F | rndis_set_response | drivers/usb/gadget/function/rndis.c | BufLength | loop bound | yes? | BUG:oob_read |
| 2643 | Critical | 310 | F | rndis_set_response | drivers/usb/gadget/function/rndis.c | BufLength | loop bound | yes? | BUG:oob_read |
| 2644 | Critical | 310 | F | snic_report_tgt_cmpl_handler | drivers/scsi/snic/snic_disc.c | tgt_cnt | loop bound | yes? | BUG:oob_read |
| 2645 | Critical | 310 | F | tpm_buf_check_hmac_response | drivers/char/tpm/tpm2-sessions.c | i | loop bound | yes? | BUG:oob_read |
| 2646 | Critical | 310 | F | zfcp_fc_incoming_rscn | drivers/s390/scsi/zfcp_fc.c | no_entries | loop bound | yes? | BUG:oob_read |
| 2647 | Critical | 300 | H | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | ld_count | truncation | no | BUG:integer_overflow |
| 2648 | Critical | 300 | H | __ffs_data_do_os_desc | drivers/usb/gadget/function/f_fs.c | length | truncation | no | BUG:integer_overflow |
| 2649 | Critical | 300 | H | __get_sta_eht_pkt_padding | drivers/net/wireless/realtek/rtw89/fw.c | n | truncation | no | BUG:integer_overflow |
| 2650 | Critical | 300 | B | altera_execute | drivers/misc/altera-stapl/altera.c | sym_count | kzalloc() | yes? | BUG:undersized_alloc |
| 2651 | Critical | 300 | B | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | kzalloc() | yes? | BUG:undersized_alloc |
| 2652 | Critical | 300 | B | altera_execute | drivers/misc/altera-stapl/altera.c | long_tmp | kzalloc() | yes? | BUG:undersized_alloc |
| 2653 | Critical | 300 | B | altera_execute | drivers/misc/altera-stapl/altera.c | long_tmp | kzalloc() | yes? | BUG:undersized_alloc |
| 2654 | Critical | 300 | B | alua_rtpg | drivers/scsi/device_handler/scsi_dh_alua.c | bufflen | kmalloc() | yes? | BUG:undersized_alloc |
| 2655 | Critical | 300 | H | ath12k_dbring_buffer_release_event | drivers/net/wireless/ath/ath12k/dbring.c | pdev_idx | truncation | no | BUG:integer_overflow |
| 2656 | Critical | 300 | H | ath12k_tpc_stats_print | drivers/net/wireless/ath/ath12k/debugfs.c | nss | truncation | no | BUG:integer_overflow |
| 2657 | Critical | 300 | H | ath12k_tpc_stats_print | drivers/net/wireless/ath/ath12k/debugfs.c | nss | truncation | no | BUG:integer_overflow |
| 2658 | Critical | 300 | H | atomctrl_initialize_mc_reg_table_v2_2 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | reg_block | truncation | no | BUG:integer_overflow |
| 2659 | Critical | 300 | H | atomctrl_set_mc_reg_address_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | num_entries | truncation | no | BUG:integer_overflow |
| 2660 | Critical | 300 | G2 | cfam_read | drivers/fsi/fsi-core.c | read_len | copy_to_user() unvalidated size | no | BUG:info_disclosure |
| 2661 | Critical | 300 | B | cs_dsp_load | drivers/firmware/cirrus/cs_dsp.c | buf_len | vmalloc() | yes? | BUG:integer_overflow |
| 2662 | Critical | 300 | G2 | fastrpc_put_args | drivers/misc/fastrpc.c | len | copy_to_user() unvalidated size | no | BUG:info_disclosure |
| 2663 | Critical | 300 | B | gb_audio_gb_get_topology | drivers/staging/greybus/audio_gb.c | size | kzalloc() | yes? | BUG:undersized_alloc |
| 2664 | Critical | 300 | H | i40e_handle_lan_overflow_event | drivers/net/ethernet/intel/i40e/i40e_main.c | vf_id | truncation | yes? | BUG:oob_read |
| 2665 | Critical | 300 | H | ims_pcu_flash_firmware | drivers/input/misc/ims-pcu.c | len | truncation | no | BUG:integer_overflow |
| 2666 | Critical | 300 | H | iwl_dbg_tlv_send_hcmds | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | hcmd_len | truncation | no | BUG:integer_overflow |
| 2667 | Critical | 300 | G2 | kioc_to_mimd | drivers/scsi/megaraid/megaraid_mm.c | kioc->user_data_len | copy_to_user() unvalidated size | no | BUG:info_disclosure |
| 2668 | Critical | 300 | B | lpfc_els_rcv_rpl | drivers/scsi/lpfc/lpfc_els.c | cmdsize | memcpy() in lpfc_els_rsp_rpl_acc() | no | BUG:info_disclosure |
| 2669 | Critical | 300 | H | mlx4_WRITE_MTT_wrapper | drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | start | truncation | no | BUG:integer_overflow |
| 2670 | Critical | 300 | H | ms_lib_process_bootblock | drivers/usb/storage/ene_ub6250.c | PageNumber | truncation | yes? | BUG:oob_read |
| 2671 | Critical | 300 | H | ms_lib_process_bootblock | drivers/usb/storage/ene_ub6250.c | PrevPageNumber | truncation | yes? | BUG:oob_read |
| 2672 | Critical | 300 | B | mspro_block_read_attributes | drivers/memstick/core/mspro_block.c | attr_len | kmalloc() | yes? | BUG:integer_overflow |
| 2673 | Critical | 300 | H | mwifiex_process_uap_rx_packet | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | pkt_type | truncation | no | BUG:integer_overflow |
| 2674 | Critical | 300 | H | mwifiex_ret_802_11d_domain_info | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | no_of_triplet | truncation | no | BUG:integer_overflow |
| 2675 | Critical | 300 | H | mwifiex_update_chan_statistics | drivers/net/wireless/marvell/mwifiex/scan.c | num_chan | truncation | no | BUG:integer_overflow |
| 2676 | Critical | 300 | H | nd_pfn_clear_memmap_errors | drivers/nvdimm/pfn_devs.c | meta_num | truncation | no | BUG:integer_overflow |
| 2677 | Critical | 300 | H | nvme_ns_report_zones | drivers/nvme/host/zns.c | nz | truncation | no | BUG:integer_overflow |
| 2678 | Critical | 300 | B | nvme_query_fdp_granularity | drivers/nvme/host/core.c | size | kvmalloc() | yes? | BUG:integer_overflow |
| 2679 | Critical | 300 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | curve_data | kmalloc() in p54_convert_rev0() | yes? | BUG:integer_overflow |
| 2680 | Critical | 300 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | curve_data | kzalloc() in p54_convert_rev1() | yes? | BUG:integer_overflow |
| 2681 | Critical | 300 | H | par_io_of_config | drivers/soc/fsl/qe/qe_io.c | port | truncation | no | BUG:integer_overflow |
| 2682 | Critical | 300 | H | par_io_of_config | drivers/soc/fsl/qe/qe_io.c | pin | truncation | no | BUG:integer_overflow |
| 2683 | Critical | 300 | B | ppp_rx | drivers/net/wan/hdlc_ppp.c | len | kmalloc() in ppp_cp_parse_cr() | yes? | BUG:undersized_alloc |
| 2684 | Critical | 300 | B | pqi_get_raid_map | drivers/scsi/smartpqi/smartpqi_init.c | raid_map_size | kmalloc() | yes? | BUG:undersized_alloc |
| 2685 | Critical | 300 | H | qed_iwarp_async_event | drivers/net/ethernet/qlogic/qed/qed_iwarp.c | cid | truncation | no | BUG:integer_overflow |
| 2686 | Critical | 300 | H | qed_iwarp_async_event | drivers/net/ethernet/qlogic/qed/qed_iwarp.c | srq_id | truncation | no | BUG:integer_overflow |
| 2687 | Critical | 300 | H | qed_iwarp_async_event | drivers/net/ethernet/qlogic/qed/qed_iwarp.c | srq_id | truncation | no | BUG:integer_overflow |
| 2688 | Critical | 300 | H | qla4_84xx_minidump_process_rdmdio | drivers/scsi/qla4xxx/ql4_nx.c | stride1 | truncation | no | BUG:integer_overflow |
| 2689 | Critical | 300 | H | qla4_84xx_minidump_process_rdmdio | drivers/scsi/qla4xxx/ql4_nx.c | stride2 | truncation | no | BUG:integer_overflow |
| 2690 | Critical | 300 | H | qla4_84xx_minidump_process_rdmdio | drivers/scsi/qla4xxx/ql4_nx.c | count | truncation | no | BUG:integer_overflow |
| 2691 | Critical | 300 | H | qla83xx_minidump_process_pollrd | drivers/scsi/qla4xxx/ql4_nx.c | s_stride | truncation | no | BUG:integer_overflow |
| 2692 | Critical | 300 | H | qlafx00_multistatus_entry | drivers/scsi/qla2xxx/qla_mr.c | que | truncation | no | BUG:integer_overflow |
| 2693 | Critical | 300 | H | reshape_request | drivers/md/raid10.c | sb_reshape_pos | truncation | no | BUG:integer_overflow |
| 2694 | Critical | 300 | H | scmi_common_fastchannel_init | drivers/firmware/arm_scmi/driver.c | size | truncation | no | BUG:undersized_alloc |
| 2695 | Critical | 300 | H | scmi_common_fastchannel_init | drivers/firmware/arm_scmi/driver.c | size | truncation | no | BUG:undersized_alloc |
| 2696 | Critical | 300 | B | ssp_irq_msg | drivers/iio/common/ssp_sensors/ssp_spi.c | length | kmalloc() | yes? | BUG:undersized_alloc |
| 2697 | Critical | 300 | B | ssp_irq_msg | drivers/iio/common/ssp_sensors/ssp_spi.c | length | kzalloc() | yes? | BUG:undersized_alloc |
| 2698 | Critical | 300 | H | st_nci_i2c_read | drivers/nfc/st-nci/i2c.c | len | truncation | no | BUG:integer_overflow |
| 2699 | Critical | 300 | H | st_nci_spi_read | drivers/nfc/st-nci/spi.c | len | truncation | no | BUG:integer_overflow |
| 2700 | Critical | 300 | G2 | uvio_get_list | drivers/s390/char/uvdevice.c | copy_len | copy_to_user() unvalidated size | no | BUG:info_disclosure |
| 2701 | Critical | 290 | G1 | ami_get_var_cursorinfo | drivers/video/fbdev/amifb.c | | put_user() retval discarded | no | BUG:info_disclosure |
| 2702 | Critical | 290 | G1 | anslcd_ioctl | drivers/macintosh/ans-lcd.c | | __get_user() retval discarded | no | BUG:info_disclosure |
| 2703 | Critical | 290 | G1 | anslcd_ioctl | drivers/macintosh/ans-lcd.c | | __get_user() retval discarded | no | BUG:info_disclosure |
| 2704 | Critical | 290 | G1 | ch_gstatus | drivers/scsi/ch.c | | put_user() retval discarded | no | BUG:info_disclosure |
| 2705 | Critical | 290 | G1 | comp_read | drivers/most/most_cdev.c | not_copied | copy_to_user() retval unchecked | no | BUG:info_disclosure |
| 2706 | Critical | 290 | G1 | dsp56k_read | drivers/char/dsp56k.c | | put_user() retval discarded | no | BUG:info_disclosure |
| 2707 | Critical | 290 | G1 | dsp56k_read | drivers/char/dsp56k.c | | put_user() retval discarded | no | BUG:info_disclosure |
| 2708 | Critical | 290 | G1 | dsp56k_upload | drivers/char/dsp56k.c | | get_user() retval discarded | no | BUG:info_disclosure |
| 2709 | Critical | 290 | G1 | dsp56k_upload | drivers/char/dsp56k.c | | get_user() retval discarded | no | BUG:info_disclosure |
| 2710 | Critical | 290 | G1 | dsp56k_upload | drivers/char/dsp56k.c | | get_user() retval discarded | no | BUG:info_disclosure |
| 2711 | Critical | 290 | G1 | dsp56k_write | drivers/char/dsp56k.c | | get_user() retval discarded | no | BUG:info_disclosure |
| 2712 | Critical | 290 | G1 | dsp56k_write | drivers/char/dsp56k.c | | get_user() retval discarded | no | BUG:info_disclosure |
| 2713 | Critical | 290 | G1 | envctrl_ioctl | drivers/sbus/char/envctrl.c | | get_user() retval discarded | no | BUG:info_disclosure |
| 2714 | Critical | 290 | G1 | genwqe_ioctl | drivers/misc/genwqe/card_dev.c | | put_user() retval discarded | no | BUG:info_disclosure |
| 2715 | Critical | 290 | G1 | genwqe_ioctl | drivers/misc/genwqe/card_dev.c | | put_user() retval discarded | no | BUG:info_disclosure |
| 2716 | Critical | 290 | G1 | genwqe_ioctl | drivers/misc/genwqe/card_dev.c | | put_user() retval discarded | no | BUG:info_disclosure |
| 2717 | Critical | 290 | F | nvmet_rdma_map_sgl_inline | drivers/nvme/target/rdma.c | len | loop bound | yes? | BUG:integer_overflow |
| 2718 | Critical | 290 | D | rtw89_fw_log_create_fmts_dict | drivers/net/wireless/realtek/rtw89/fw.c | fmts_ptr | strlen() | yes? | BUG:oob_read |
| 2719 | Critical | 290 | G1 | send_exception_work_handler | drivers/gpu/drm/amd/amdkfd/kfd_process.c | | get_user() retval discarded | no | BUG:info_disclosure |
| 2720 | Critical | 290 | G1 | send_exception_work_handler | drivers/gpu/drm/amd/amdkfd/kfd_process.c | | get_user() retval discarded | no | BUG:info_disclosure |
| 2721 | Critical | 290 | G1 | send_exception_work_handler | drivers/gpu/drm/amd/amdkfd/kfd_process.c | | get_user() retval discarded | no | BUG:info_disclosure |
| 2722 | Critical | 280 | H | lpfc_els_rcv_rpl | drivers/scsi/lpfc/lpfc_els.c | cmdsize | truncation | yes? | BUG:integer_overflow |
| 2723 | Critical | 280 | H | rtl_p2p_action_ie | drivers/net/wireless/realtek/rtlwifi/ps.c | noa_num | truncation | yes? | BUG:integer_overflow |
| 2724 | Critical | 280 | H | tsi721_omsg_handler | drivers/rapidio/devices/tsi721.c | tx_slot | truncation | yes? | BUG:integer_overflow |
| 2725 | Critical | 250 | G1 | dp_sdp_message_debugfs_write | drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | r | copy_from_user() retval unchecked | no | BUG |
| 2726 | High | 240 | H | iwl_mld_rx_mgmt_prot | drivers/net/wireless/intel/iwlwifi/mld/rx.c | keyidx | truncation | no | BUG |
| 2727 | High | 240 | H | qla4_84xx_minidump_process_rddfe | drivers/scsi/qla4xxx/ql4_nx.c | stride | truncation | no | BUG |
| 2728 | High | 240 | H | qla4_84xx_minidump_process_rddfe | drivers/scsi/qla4xxx/ql4_nx.c | stride2 | truncation | no | BUG |
| 2729 | High | 110 | G2 | i2cdev_ioctl_smbus | drivers/i2c/i2c-dev.c | datasize | copy_from_user() unvalidated size | no | ? |
| 2730 | High | 110 | G2 | i2cdev_ioctl_smbus | drivers/i2c/i2c-dev.c | datasize | copy_to_user() unvalidated size | no | ? |
| 2731 | Medium | 90 | B | btree_split_beneath | drivers/md/persistent-data/dm-btree.c | nr_left | nr_left * sizeof(pn->keys[0]) | no | FP |
| 2732 | Medium | 90 | B | btree_split_beneath | drivers/md/persistent-data/dm-btree.c | nr_left | nr_left * size | no | FP |
| 2733 | Medium | 90 | B | btree_split_beneath | drivers/md/persistent-data/dm-btree.c | nr_right | nr_right * sizeof(pn->keys[0]) | no | FP |
| 2734 | Medium | 90 | B | btree_split_beneath | drivers/md/persistent-data/dm-btree.c | nr_right | nr_right * size | no | FP |
| 2735 | Medium | 90 | B | delete_at | drivers/md/persistent-data/dm-btree-remove.c | nr_to_copy | nr_to_copy * sizeof(__le64) | no | FP |
| 2736 | Medium | 90 | B | delete_at | drivers/md/persistent-data/dm-btree-remove.c | nr_to_copy | nr_to_copy * value_size | no | FP |
| 2737 | Medium | 90 | B | erdma_recv_mpa_rr | drivers/infiniband/hw/erdma/erdma_cm.c | pd_len | pd_len + 4 | no | FP |
| 2738 | Medium | 90 | B | move_entries | drivers/md/persistent-data/dm-btree.c | value_size | count * value_size | no | FP |
| 2739 | Medium | 90 | B | node_shift | drivers/md/persistent-data/dm-btree-remove.c | nr_entries | (nr_entries - shift) * sizeof(__le64) | no | FP |
| 2740 | Medium | 90 | B | node_shift | drivers/md/persistent-data/dm-btree-remove.c | nr_entries | (nr_entries - shift) * value_size | no | FP |
| 2741 | Medium | 90 | B | node_shift | drivers/md/persistent-data/dm-btree-remove.c | nr_entries | nr_entries * sizeof(__le64) | no | FP |
| 2742 | Medium | 90 | B | node_shift | drivers/md/persistent-data/dm-btree-remove.c | nr_entries | nr_entries * value_size | no | FP |
| 2743 | Medium | 90 | B | p54_convert_db | drivers/net/wireless/intersil/p54/eeprom.c | dst | sizeof(*dst) + payload_len | no | FP |
| 2744 | Medium | 90 | C | sbefifo_parse_status | drivers/fsi/fsi-sbefifo.c | dh | subscript | yes? | ? |
| 2745 | Medium | 90 | C | sbefifo_parse_status | drivers/fsi/fsi-sbefifo.c | dh | subscript | yes? | ? |
| 2746 | Medium | 90 | C | sbefifo_parse_status | drivers/fsi/fsi-sbefifo.c | dh | subscript | yes? | ? |
| 2747 | Medium | 90 | B | siw_recv_mpa_rr | drivers/infiniband/sw/siw/siw_cm.c | pd_len | pd_len + 4 | no | FP |
| 2748 | Medium | 90 | B | wmi_marshal_string | drivers/platform/wmi/marshalling.c | chars | chars + 1 | no | FP |
| 2749 | Medium | 90 | B | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | len | ALIGN(offsetof(struct pending_wmi_event,
event.wmi + len | no | FP |
| 2750 | Medium | 80 | F | resp_get_stream_status | drivers/scsi/scsi_debug.c | alloc_len | loop bound | yes? | ? |
| 2751 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2752 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2753 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2754 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2755 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2756 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2757 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2758 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2759 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2760 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2761 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2762 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2763 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2764 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2765 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2766 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2767 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2768 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2769 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2770 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2771 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2772 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2773 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2774 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2775 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2776 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2777 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2778 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2779 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2780 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2781 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2782 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2783 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2784 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2785 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2786 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2787 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2788 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2789 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2790 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2791 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2792 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2793 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2794 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2795 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2796 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2797 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2798 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2799 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2800 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2801 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2802 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2803 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2804 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2805 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2806 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2807 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2808 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2809 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2810 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2811 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2812 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2813 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2814 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2815 | Medium | 70 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | no | FP |
| 2816 | Medium | 70 | B | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | ld_count | sizeof(struct MR_LD_SPAN_MAP) * ld_count | yes? | FP |
| 2817 | Medium | 70 | E | __mt7921_mcu_set_clc | drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | le16_to_cpu(req.len) | le16_to_cpu(req.len)->? | no | FP |
| 2818 | Medium | 70 | E | __mt7925_mcu_set_clc | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | le16_to_cpu(req.size) + sizeof(req) | le16_to_cpu(req.size) + sizeof(req)->? | no | FP |
| 2819 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->empty_cnt | no | FP |
| 2820 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->retry_cnt | no | FP |
| 2821 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_rate | no | FP |
| 2822 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_cnt | no | FP |
| 2823 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->ack_cnt | no | FP |
| 2824 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->nack_cnt | no | FP |
| 2825 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->empty_cnt | no | FP |
| 2826 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->retry_cnt | no | FP |
| 2827 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_rate | no | FP |
| 2828 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_cnt | no | FP |
| 2829 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->ack_cnt | no | FP |
| 2830 | Medium | 70 | E | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->nack_cnt | no | FP |
| 2831 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->empty_cnt | no | FP |
| 2832 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->retry_cnt | no | FP |
| 2833 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_rate | no | FP |
| 2834 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_cnt | no | FP |
| 2835 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->ack_cnt | no | FP |
| 2836 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->nack_cnt | no | FP |
| 2837 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->empty_cnt | no | FP |
| 2838 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->retry_cnt | no | FP |
| 2839 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_rate | no | FP |
| 2840 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_cnt | no | FP |
| 2841 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->ack_cnt | no | FP |
| 2842 | Medium | 70 | E | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->nack_cnt | no | FP |
| 2843 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->empty_cnt | no | FP |
| 2844 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->retry_cnt | no | FP |
| 2845 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_rate | no | FP |
| 2846 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_cnt | no | FP |
| 2847 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->ack_cnt | no | FP |
| 2848 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->nack_cnt | no | FP |
| 2849 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->empty_cnt | no | FP |
| 2850 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->retry_cnt | no | FP |
| 2851 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_rate | no | FP |
| 2852 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->tx_cnt | no | FP |
| 2853 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->ack_cnt | no | FP |
| 2854 | Medium | 70 | E | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | a2dp_trx | a2dp_trx->nack_cnt | no | FP |
| 2855 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2856 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2857 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2858 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2859 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2860 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2861 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2862 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2863 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2864 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2865 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2866 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2867 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2868 | Medium | 70 | A | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | memcpy() in send_mpa_req() | no | FP |
| 2869 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2870 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2871 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | ep->? | no | FP |
| 2872 | Medium | 70 | E | act_establish | drivers/infiniband/hw/cxgb4/cm.c | atid | atid->? | no | FP |
| 2873 | Medium | 70 | E | act_open_rpl | drivers/infiniband/hw/cxgb4/cm.c | atid | atid->? | no | FP |
| 2874 | Medium | 70 | B | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | (long_count >> 3) + 1 | yes? | FP |
| 2875 | Medium | 70 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | FP |
| 2876 | Medium | 70 | E | amdgpu_discovery_get_gfx_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | gc_info | gc_info->v1 | no | FP |
| 2877 | Medium | 70 | E | amdgpu_discovery_get_nps_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | nps_info | nps_info->v1 | no | FP |
| 2878 | Medium | 70 | E | amdgpu_discovery_get_nps_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | nps_info | nps_info->v1 | no | FP |
| 2879 | Medium | 70 | E | amdgpu_discovery_get_nps_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | nps_info | nps_info->v1 | no | FP |
| 2880 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2881 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2882 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2883 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2884 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2885 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2886 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2887 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2888 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2889 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2890 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2891 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2892 | Medium | 70 | E | amdgpu_discovery_sysfs_recurse | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip_offset | ip_offset->? | no | FP |
| 2893 | Medium | 70 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | limits | limits->numEntries | no | FP |
| 2894 | Medium | 70 | A | amdgpu_ucode_init_single_fw | drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | ucode_addr | memcpy() | no | FP |
| 2895 | Medium | 70 | E | amt_igmpv3_report_handler | drivers/net/amt.c | grec | grec->grec_mca | no | FP |
| 2896 | Medium | 70 | E | amt_igmpv3_report_handler | drivers/net/amt.c | grec | grec->grec_type | no | FP |
| 2897 | Medium | 70 | E | amt_mldv2_report_handler | drivers/net/amt.c | grec | grec->grec_mca | no | FP |
| 2898 | Medium | 70 | E | amt_mldv2_report_handler | drivers/net/amt.c | grec | grec->grec_type | no | FP |
| 2899 | Medium | 70 | E | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | edb | edb->vaddr | no | FP |
| 2900 | Medium | 70 | E | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | edb | edb->vaddr | no | FP |
| 2901 | Medium | 70 | E | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | edb | edb->vaddr | no | FP |
| 2902 | Medium | 70 | E | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | ru | ru->status | no | FP |
| 2903 | Medium | 70 | E | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | ru | ru->datapres | no | FP |
| 2904 | Medium | 70 | E | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | fh | fh->tag | no | FP |
| 2905 | Medium | 70 | A | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | escb | memset() in asd_invalidate_edb() | no | FP |
| 2906 | Medium | 70 | E | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | escb | escb->? | no | FP |
| 2907 | Medium | 70 | E | ast_vhub_std_dev_request | drivers/usb/gadget/udc/aspeed-vhub/dev.c | wIndex | wIndex->? | no | FP |
| 2908 | Medium | 70 | E | ast_vhub_std_dev_request | drivers/usb/gadget/udc/aspeed-vhub/dev.c | wIndex | wIndex->? | no | FP |
| 2909 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2910 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2911 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2912 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2913 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2914 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2915 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2916 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2917 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2918 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2919 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2920 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2921 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2922 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2923 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2924 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2925 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2926 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2927 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2928 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2929 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2930 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2931 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2932 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2933 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2934 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2935 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2936 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2937 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2938 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2939 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2940 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2941 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2942 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2943 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2944 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2945 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2946 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2947 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2948 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2949 | Medium | 70 | E | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | hw_mode_id->? | no | FP |
| 2950 | Medium | 70 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | ar | ar->data_lock | no | FP |
| 2951 | Medium | 70 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | ar | ar->debug | no | FP |
| 2952 | Medium | 70 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | ar | ar->debug | no | FP |
| 2953 | Medium | 70 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | ar | ar->debug | no | FP |
| 2954 | Medium | 70 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | ar | ar->debug | no | FP |
| 2955 | Medium | 70 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | ar | ar->debug | no | FP |
| 2956 | Medium | 70 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | ar | ar->debug | no | FP |
| 2957 | Medium | 70 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | tpc_stats | tpc_stats->event_count | no | FP |
| 2958 | Medium | 70 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | ar | ar->debug | no | FP |
| 2959 | Medium | 70 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | ar | ar->data_lock | no | FP |
| 2960 | Medium | 70 | E | ath6kl_htc_rx_setup | drivers/net/wireless/ath/ath6kl/htc_mbox.c | packet | packet->list | no | FP |
| 2961 | Medium | 70 | E | ath6kl_htc_rx_setup | drivers/net/wireless/ath/ath6kl/htc_mbox.c | packet | packet->info | no | FP |
| 2962 | Medium | 70 | E | ath6kl_htc_rx_setup | drivers/net/wireless/ath/ath6kl/htc_mbox.c | packet | packet->info | no | FP |
| 2963 | Medium | 70 | E | ath6kl_htc_rx_setup | drivers/net/wireless/ath/ath6kl/htc_mbox.c | packet | packet->status | no | FP |
| 2964 | Medium | 70 | E | ath6kl_htc_rx_setup | drivers/net/wireless/ath/ath6kl/htc_mbox.c | packet | packet->info | no | FP |
| 2965 | Medium | 70 | E | ath6kl_htc_rx_setup | drivers/net/wireless/ath/ath6kl/htc_mbox.c | packet | packet->list | no | FP |
| 2966 | Medium | 70 | E | ath6kl_htc_rx_setup | drivers/net/wireless/ath/ath6kl/htc_mbox.c | packet | packet->info | no | FP |
| 2967 | Medium | 70 | E | ath6kl_htc_rx_setup | drivers/net/wireless/ath/ath6kl/htc_mbox.c | packet | packet->info | no | FP |
| 2968 | Medium | 70 | E | ath6kl_htc_rx_setup | drivers/net/wireless/ath/ath6kl/htc_mbox.c | packet | packet->info | no | FP |
| 2969 | Medium | 70 | E | ath6kl_htc_rx_setup | drivers/net/wireless/ath/ath6kl/htc_mbox.c | packet | packet->act_len | no | FP |
| 2970 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->sta_flags | no | FP |
| 2971 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->sta_flags | no | FP |
| 2972 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->sta_flags | no | FP |
| 2973 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->sta_flags | no | FP |
| 2974 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->sta_flags | no | FP |
| 2975 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->sta_flags | no | FP |
| 2976 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->psq_lock | no | FP |
| 2977 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->mgmt_psq_len | no | FP |
| 2978 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->mgmt_psq | no | FP |
| 2979 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | mgmt | mgmt->list | no | FP |
| 2980 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->mgmt_psq_len | no | FP |
| 2981 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->psq_lock | no | FP |
| 2982 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | mgmt | mgmt->id | no | FP |
| 2983 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | mgmt | mgmt->freq | no | FP |
| 2984 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | mgmt | mgmt->wait | no | FP |
| 2985 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | mgmt | mgmt->buf | no | FP |
| 2986 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | mgmt | mgmt->len | no | FP |
| 2987 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | mgmt | mgmt->no_cck | no | FP |
| 2988 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->psq_lock | no | FP |
| 2989 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->mgmt_psq_len | no | FP |
| 2990 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->psq | no | FP |
| 2991 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->psq_lock | no | FP |
| 2992 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->psq_lock | no | FP |
| 2993 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->apsdq | no | FP |
| 2994 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->apsdq | no | FP |
| 2995 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->psq_lock | no | FP |
| 2996 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->psq_lock | no | FP |
| 2997 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->psq_lock | no | FP |
| 2998 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->aid | no | FP |
| 2999 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->aid | no | FP |
| 3000 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | datap | datap->h_dest | no | FP |
| 3001 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | datap | datap->h_dest | no | FP |
| 3002 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | datap | datap->h_dest | no | FP |
| 3003 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | datap | datap->h_source | no | FP |
| 3004 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | conn->aggr_conn | no | FP |
| 3005 | Medium | 70 | E | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | datap | datap->h_dest | no | FP |
| 3006 | Medium | 70 | A | ath9k_hif_usb_rx_stream | drivers/net/wireless/ath/ath9k/hif_usb.c | nskb | memcpy() | no | FP |
| 3007 | Medium | 70 | E | ath9k_hif_usb_rx_stream | drivers/net/wireless/ath/ath9k/hif_usb.c | nskb | nskb->data | no | FP |
| 3008 | Medium | 70 | A | ath9k_hif_usb_rx_stream | drivers/net/wireless/ath/ath9k/hif_usb.c | nskb | memcpy() | no | FP |
| 3009 | Medium | 70 | E | ath9k_hif_usb_rx_stream | drivers/net/wireless/ath/ath9k/hif_usb.c | nskb | nskb->data | no | FP |
| 3010 | Medium | 70 | A | ax88179_rx_fixup | drivers/net/usb/ax88179_178a.c | ax_skb | memcpy() | no | FP |
| 3011 | Medium | 70 | E | ax88179_rx_fixup | drivers/net/usb/ax88179_178a.c | ax_skb | ax_skb->data | no | FP |
| 3012 | Medium | 70 | E | bcm4377_poll_completion_ring | drivers/bluetooth/hci_bcm4377.c | tail | tail->? | no | FP |
| 3013 | Medium | 70 | E | bcm4377_poll_completion_ring | drivers/bluetooth/hci_bcm4377.c | tail | tail->? | no | FP |
| 3014 | Medium | 70 | E | bcm4377_poll_completion_ring | drivers/bluetooth/hci_bcm4377.c | tail | tail->? | no | FP |
| 3015 | Medium | 70 | E | bcm4377_poll_completion_ring | drivers/bluetooth/hci_bcm4377.c | tail | tail->? | no | FP |
| 3016 | Medium | 70 | E | bcm4377_poll_completion_ring | drivers/bluetooth/hci_bcm4377.c | tail | tail->? | no | FP |
| 3017 | Medium | 70 | E | bcm4377_poll_completion_ring | drivers/bluetooth/hci_bcm4377.c | tail | tail->? | no | FP |
| 3018 | Medium | 70 | E | be_fw_download | drivers/net/ethernet/emulex/benet/be_cmds.c | num_imgs | num_imgs->? | no | FP |
| 3019 | Medium | 70 | E | be_fw_download | drivers/net/ethernet/emulex/benet/be_cmds.c | num_imgs | num_imgs->? | no | FP |
| 3020 | Medium | 70 | E | be_fw_download | drivers/net/ethernet/emulex/benet/be_cmds.c | num_imgs | num_imgs->? | no | FP |
| 3021 | Medium | 70 | E | be_fw_download | drivers/net/ethernet/emulex/benet/be_cmds.c | num_imgs | num_imgs->? | no | FP |
| 3022 | Medium | 70 | E | be_fw_download | drivers/net/ethernet/emulex/benet/be_cmds.c | num_imgs | num_imgs->? | no | FP |
| 3023 | Medium | 70 | E | be_fw_download | drivers/net/ethernet/emulex/benet/be_cmds.c | num_imgs | num_imgs->? | no | FP |
| 3024 | Medium | 70 | E | bios_parser_get_connector_id | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | tbl | tbl->ucNumberOfObjects | no | FP |
| 3025 | Medium | 70 | E | bios_parser_get_connectors_number | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | le16_to_cpu(bp->object_info_tbl.v1_1->usConnectorObjectTable | le16_to_cpu(bp->object_info_tbl.v1_1->usConnectorObjectTable->? | no | FP |
| 3026 | Medium | 70 | E | bios_parser_get_device_tag_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | no | FP |
| 3027 | Medium | 70 | E | bios_parser_get_device_tag_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordType | no | FP |
| 3028 | Medium | 70 | E | bios_parser_get_i2c_info | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordType | no | FP |
| 3029 | Medium | 70 | E | bnx2x_panic_dump | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | sw_bd | sw_bd->data | no | FP |
| 3030 | Medium | 70 | E | bnx2x_panic_dump | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | sw_page | sw_page->page | no | FP |
| 3031 | Medium | 70 | E | bnx2x_panic_dump | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | sw_bd | sw_bd->skb | no | FP |
| 3032 | Medium | 70 | E | bnx2x_panic_dump | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | sw_bd | sw_bd->first_bd | no | FP |
| 3033 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | usb_ext | usb_ext->bLength | no | FP |
| 3034 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | usb_ext | usb_ext->bDescriptorType | no | FP |
| 3035 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | usb_ext | usb_ext->bDevCapabilityType | no | FP |
| 3036 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | usb_ext | usb_ext->bmAttributes | no | FP |
| 3037 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ss_cap | ss_cap->bLength | no | FP |
| 3038 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ss_cap | ss_cap->bDescriptorType | no | FP |
| 3039 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ss_cap | ss_cap->bDevCapabilityType | no | FP |
| 3040 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ss_cap | ss_cap->bmAttributes | no | FP |
| 3041 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ss_cap | ss_cap->wSpeedSupported | no | FP |
| 3042 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ss_cap | ss_cap->bFunctionalitySupport | no | FP |
| 3043 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ss_cap | ss_cap->bU1devExitLat | no | FP |
| 3044 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ss_cap | ss_cap->bU2DevExitLat | no | FP |
| 3045 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ssp_cap | ssp_cap->bLength | no | FP |
| 3046 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ssp_cap | ssp_cap->bDescriptorType | no | FP |
| 3047 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ssp_cap | ssp_cap->bDevCapabilityType | no | FP |
| 3048 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ssp_cap | ssp_cap->bReserved | no | FP |
| 3049 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ssp_cap | ssp_cap->wReserved | no | FP |
| 3050 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ssp_cap | ssp_cap->bmAttributes | no | FP |
| 3051 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ssp_cap | ssp_cap->wFunctionalitySupport | no | FP |
| 3052 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | ssp_cap | ssp_cap->bmSublinkSpeedAttr | no | FP |
| 3053 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | webusb_cap | webusb_cap->CapabilityData | no | FP |
| 3054 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | webusb_cap | webusb_cap->bLength | no | FP |
| 3055 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | webusb_cap | webusb_cap->bDescriptorType | no | FP |
| 3056 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | webusb_cap | webusb_cap->bDevCapabilityType | no | FP |
| 3057 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | webusb_cap | webusb_cap->bReserved | no | FP |
| 3058 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | webusb_cap | webusb_cap->UUID | no | FP |
| 3059 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | webusb_cap_data | webusb_cap_data->bcdVersion | no | FP |
| 3060 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | webusb_cap_data | webusb_cap_data->bcdVersion | no | FP |
| 3061 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | webusb_cap_data | webusb_cap_data->bVendorCode | no | FP |
| 3062 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | webusb_cap_data | webusb_cap_data->iLandingPage | no | FP |
| 3063 | Medium | 70 | E | bos_desc | drivers/usb/gadget/composite.c | webusb_cap_data | webusb_cap_data->iLandingPage | no | FP |
| 3064 | Medium | 70 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | pfirst->data | no | FP |
| 3065 | Medium | 70 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | pfirst->data | no | FP |
| 3066 | Medium | 70 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | pfirst->data | no | FP |
| 3067 | Medium | 70 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | pfirst->len | no | FP |
| 3068 | Medium | 70 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | pfirst->len | no | FP |
| 3069 | Medium | 70 | E | cdc_ncm_ndp16 | drivers/net/usb/cdc_ncm.c | ndp16 | ndp16->dwSignature | no | FP |
| 3070 | Medium | 70 | E | cdc_ncm_ndp32 | drivers/net/usb/cdc_ncm.c | ndp32 | ndp32->dwSignature | no | FP |
| 3071 | Medium | 70 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->out_ctx | no | FP |
| 3072 | Medium | 70 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->signature | no | FP |
| 3073 | Medium | 70 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | clock_info_array | clock_info_array->ucNumEntries | no | FP |
| 3074 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->io_request | no | FP |
| 3075 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->scmd | no | FP |
| 3076 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | scsi_io_req | scsi_io_req->RaidContext | no | FP |
| 3077 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | scsi_io_req | scsi_io_req->RaidContext | no | FP |
| 3078 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->sense | no | FP |
| 3079 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | scsi_io_req | scsi_io_req->DataLength | no | FP |
| 3080 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | scsi_io_req | scsi_io_req->Function | no | FP |
| 3081 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->io_request | no | FP |
| 3082 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | mr_tm_req | mr_tm_req->TmRequest | no | FP |
| 3083 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | mpi_tm_req | mpi_tm_req->TaskType | no | FP |
| 3084 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->done | no | FP |
| 3085 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->status | no | FP |
| 3086 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | lbinfo | lbinfo->scsi_pending_cmds | no | FP |
| 3087 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->pd_r1_lb | no | FP |
| 3088 | Medium | 70 | E | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | cmd_fusion->status | no | FP |
| 3089 | Medium | 70 | A | copy_esn_pktxt | drivers/net/ethernet/chelsio/inline_crypto/ch_ipsec/chcr_ipsec.c | seqno | memcpy() | no | FP |
| 3090 | Medium | 70 | E | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | chcr_req->sec_cpl | no | FP |
| 3091 | Medium | 70 | E | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | chcr_req->sec_cpl | no | FP |
| 3092 | Medium | 70 | E | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | chcr_req->sec_cpl | no | FP |
| 3093 | Medium | 70 | E | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | chcr_req->sec_cpl | no | FP |
| 3094 | Medium | 70 | E | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | chcr_req->sec_cpl | no | FP |
| 3095 | Medium | 70 | E | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | chcr_req->sec_cpl | no | FP |
| 3096 | Medium | 70 | E | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | chcr_req->key_ctx | no | FP |
| 3097 | Medium | 70 | A | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | memcpy() | no | FP |
| 3098 | Medium | 70 | E | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | chcr_req->key_ctx | no | FP |
| 3099 | Medium | 70 | A | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | memcpy() | no | FP |
| 3100 | Medium | 70 | E | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | chcr_req->key_ctx | no | FP |
| 3101 | Medium | 70 | A | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | memcpy() | no | FP |
| 3102 | Medium | 70 | E | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | chcr_req | chcr_req->key_ctx | no | FP |
| 3103 | Medium | 70 | A | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | ivptr | memcpy() | no | FP |
| 3104 | Medium | 70 | A | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | ivptr | memcpy() | no | FP |
| 3105 | Medium | 70 | A | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | ivptr | memcpy() | no | FP |
| 3106 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | entry | entry->data | no | FP |
| 3107 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->lock | no | FP |
| 3108 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->desc | no | FP |
| 3109 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->state | no | FP |
| 3110 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->state | no | FP |
| 3111 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | skb | skb->len | no | FP |
| 3112 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | skb | skb->data | no | FP |
| 3113 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->cidx | no | FP |
| 3114 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->ndesc | no | FP |
| 3115 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->cred | no | FP |
| 3116 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->ncompl | no | FP |
| 3117 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->lock | no | FP |
| 3118 | Medium | 70 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->qresume_tsk | no | FP |
| 3119 | Medium | 70 | E | de_rx | drivers/net/ethernet/dec/tulip/de2104x.c | copy_skb | copy_skb->data | no | FP |
| 3120 | Medium | 70 | E | de_rx | drivers/net/ethernet/dec/tulip/de2104x.c | skb | skb->protocol | no | FP |
| 3121 | Medium | 70 | E | de_rx | drivers/net/ethernet/dec/tulip/de2104x.c | skb | skb->len | no | FP |
| 3122 | Medium | 70 | E | drm_mode_displayid_formula | drivers/gpu/drm/drm_edid.c | mode | mode->type | no | FP |
| 3123 | Medium | 70 | E | ep0_get_status | drivers/usb/mtu3/mtu3_gadget_ep0.c | mep | mep->desc | no | FP |
| 3124 | Medium | 70 | E | ep0_get_status | drivers/usb/mtu3/mtu3_gadget_ep0.c | mep | mep->flags | no | FP |
| 3125 | Medium | 70 | E | ep0_handle_feature | drivers/usb/mtu3/mtu3_gadget_ep0.c | mep | mep->desc | no | FP |
| 3126 | Medium | 70 | E | ep0_handle_feature | drivers/usb/mtu3/mtu3_gadget_ep0.c | mep | mep->flags | no | FP |
| 3127 | Medium | 70 | E | ep0_handle_status | drivers/usb/gadget/udc/bdc/bdc_ep.c | ep | ep->flags | no | FP |
| 3128 | Medium | 70 | E | ether3_rx | drivers/net/ethernet/seeq/ether3.c | skb | skb->protocol | no | FP |
| 3129 | Medium | 70 | A | fbnic_tlv_attr_get_string | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | len | memset() | no | FP |
| 3130 | Medium | 70 | E | fc_disc_recv_rscn_req | drivers/scsi/libfc/fc_disc.c | pp | pp->rscn_page_flags | no | FP |
| 3131 | Medium | 70 | E | fc_disc_recv_rscn_req | drivers/scsi/libfc/fc_disc.c | pp | pp->rscn_fid | no | FP |
| 3132 | Medium | 70 | E | fc_disc_recv_rscn_req | drivers/scsi/libfc/fc_disc.c | pp | pp->rscn_fid | no | FP |
| 3133 | Medium | 70 | E | fc_exch_recv_bls | drivers/scsi/libfc/fc_exch.c | (f_ctl & FC_FC_EX_CTX) ?
ntohs(fh->fh_ox_id) : ntohs(fh | (f_ctl & FC_FC_EX_CTX) ?
ntohs(fh->fh_ox_id) : ntohs(fh->? | no | FP |
| 3134 | Medium | 70 | E | fc_exch_recv_seq_resp | drivers/scsi/libfc/fc_exch.c | ntohs(fh->fh_ox_id) | ntohs(fh->fh_ox_id)->? | no | FP |
| 3135 | Medium | 70 | E | fc_seq_lookup_orig | drivers/scsi/libfc/fc_exch.c | xid | xid->? | no | FP |
| 3136 | Medium | 70 | E | fc_seq_lookup_recip | drivers/scsi/libfc/fc_exch.c | xid | xid->? | no | FP |
| 3137 | Medium | 70 | E | gem_rx | drivers/net/ethernet/sun/sungem.c | skb | skb->csum | no | FP |
| 3138 | Medium | 70 | E | gem_rx | drivers/net/ethernet/sun/sungem.c | skb | skb->ip_summed | no | FP |
| 3139 | Medium | 70 | E | gem_rx | drivers/net/ethernet/sun/sungem.c | skb | skb->protocol | no | FP |
| 3140 | Medium | 70 | E | get_encoder_cap_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | no | FP |
| 3141 | Medium | 70 | E | get_encoder_cap_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordType | no | FP |
| 3142 | Medium | 70 | E | get_hpd_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordType | no | FP |
| 3143 | Medium | 70 | E | handle_device_notification | drivers/usb/host/xhci-ring.c | udev | udev->? | no | FP |
| 3144 | Medium | 70 | E | handle_device_notification | drivers/usb/host/xhci-ring.c | udev | udev->? | no | FP |
| 3145 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->? | no | FP |
| 3146 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd_portnum | hcd_portnum->? | no | FP |
| 3147 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->? | no | FP |
| 3148 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd_portnum | hcd_portnum->? | no | FP |
| 3149 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->rhub | no | FP |
| 3150 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->self | no | FP |
| 3151 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->state | no | FP |
| 3152 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | vdev | vdev->flags | no | FP |
| 3153 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | vdev | vdev->flags | no | FP |
| 3154 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | bus_state | bus_state->port_remote_wakeup | no | FP |
| 3155 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->self | no | FP |
| 3156 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | bus_state | bus_state->resuming_ports | no | FP |
| 3157 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | bus_state | bus_state->resuming_ports | no | FP |
| 3158 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->flags | no | FP |
| 3159 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->rh_timer | no | FP |
| 3160 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->self | no | FP |
| 3161 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | bus_state | bus_state->port_remote_wakeup | no | FP |
| 3162 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->self | no | FP |
| 3163 | Medium | 70 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->speed | no | FP |
| 3164 | Medium | 70 | E | hfi1_rc_rcv | drivers/infiniband/hw/hfi1/rc.c | rkey | rkey->? | no | FP |
| 3165 | Medium | 70 | E | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | vaddr->? | no | FP |
| 3166 | Medium | 70 | E | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | vaddr->? | no | FP |
| 3167 | Medium | 70 | E | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | vaddr->? | no | FP |
| 3168 | Medium | 70 | E | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | vaddr->? | no | FP |
| 3169 | Medium | 70 | E | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | vaddr->? | no | FP |
| 3170 | Medium | 70 | E | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | vaddr->? | no | FP |
| 3171 | Medium | 70 | E | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | vaddr->? | no | FP |
| 3172 | Medium | 70 | E | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | vaddr->? | no | FP |
| 3173 | Medium | 70 | E | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | vaddr | vaddr->? | no | FP |
| 3174 | Medium | 70 | E | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | vaddr | vaddr->? | no | FP |
| 3175 | Medium | 70 | E | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | vaddr | vaddr->? | no | FP |
| 3176 | Medium | 70 | E | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | vaddr | vaddr->? | no | FP |
| 3177 | Medium | 70 | E | hl_irq_handler_cq | drivers/accel/habanalabs/common/irq.c | shadow_index | shadow_index->? | no | FP |
| 3178 | Medium | 70 | E | hl_irq_handler_cq | drivers/accel/habanalabs/common/irq.c | shadow_index | shadow_index->? | no | FP |
| 3179 | Medium | 70 | E | hl_irq_handler_cq | drivers/accel/habanalabs/common/irq.c | shadow_index | shadow_index->? | no | FP |
| 3180 | Medium | 70 | A | hns3_handle_rx_copybreak | drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | frag | memcpy() | no | FP |
| 3181 | Medium | 70 | E | i40e_clean_adminq_subtask | drivers/net/ethernet/intel/i40e/i40e_main.c | le16_to_cpu(event.desc.retval) | le16_to_cpu(event.desc.retval)->? | no | FP |
| 3182 | Medium | 70 | E | i40e_clean_adminq_subtask | drivers/net/ethernet/intel/i40e/i40e_main.c | le16_to_cpu(event.desc.retval) | le16_to_cpu(event.desc.retval)->? | no | FP |
| 3183 | Medium | 70 | E | i40e_dcb_config_to_lldp | drivers/net/ethernet/intel/i40e/i40e_dcb.c | tlv | tlv->typelength | no | FP |
| 3184 | Medium | 70 | E | ice_aq_add_rdma_qsets | drivers/net/ethernet/intel/ice/ice_common.c | list | list->rdma_qsets | no | FP |
| 3185 | Medium | 70 | E | ice_dcb_cfg_to_lldp | drivers/net/ethernet/intel/ice/ice_dcb.c | tlv | tlv->typelen | no | FP |
| 3186 | Medium | 70 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | table | table->count | no | FP |
| 3187 | Medium | 70 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | table | table->count | no | FP |
| 3188 | Medium | 70 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | table | table->entries | no | FP |
| 3189 | Medium | 70 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | table | table->entries | no | FP |
| 3190 | Medium | 70 | E | init_phase_shedding_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | table | table->entries | no | FP |
| 3191 | Medium | 70 | E | ionic_comp_msn | drivers/infiniband/hw/ionic/ionic_datapath.c | meta | meta->len | no | FP |
| 3192 | Medium | 70 | E | ionic_comp_msn | drivers/infiniband/hw/ionic/ionic_datapath.c | meta | meta->ibsts | no | FP |
| 3193 | Medium | 70 | E | ipc_mux_acb_add_cmd | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | cmdh | cmdh->signature | no | FP |
| 3194 | Medium | 70 | E | ipc_mux_acb_add_cmd | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | cmdh | cmdh->command_type | no | FP |
| 3195 | Medium | 70 | E | ipc_mux_acb_add_cmd | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | cmdh | cmdh->if_id | no | FP |
| 3196 | Medium | 70 | E | ipc_mux_acb_add_cmd | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | cmdh | cmdh->cmd_len | no | FP |
| 3197 | Medium | 70 | E | ipc_mux_acb_add_cmd | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | cmdh | cmdh->transaction_id | no | FP |
| 3198 | Medium | 70 | A | ipc_mux_acb_add_cmd | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | cmdh | memcpy() | no | FP |
| 3199 | Medium | 70 | E | ipc_mux_acb_add_cmd | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | cmdh | cmdh->param | no | FP |
| 3200 | Medium | 70 | E | ipc_mux_acb_add_cmd | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | cmdh | cmdh->cmd_len | no | FP |
| 3201 | Medium | 70 | E | iwl_dbg_tlv_override_trig_node | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tmp | tmp->list | no | FP |
| 3202 | Medium | 70 | E | iwl_dbg_tlv_override_trig_node | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tmp | tmp->tlv | no | FP |
| 3203 | Medium | 70 | E | iwl_dbg_tlv_override_trig_node | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | node_trig | node_trig->data | no | FP |
| 3204 | Medium | 70 | A | iwl_dbg_tlv_override_trig_node | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | node_trig | memcpy() | no | FP |
| 3205 | Medium | 70 | E | iwl_dbg_tlv_override_trig_node | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | node_trig | node_trig->regions_mask | no | FP |
| 3206 | Medium | 70 | E | iwl_dbg_tlv_override_trig_node | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | node_trig | node_trig->regions_mask | no | FP |
| 3207 | Medium | 70 | E | iwl_mei_handle_sap_data | drivers/net/wireless/intel/iwlwifi/mei/main.c | skb | skb->protocol | no | FP |
| 3208 | Medium | 70 | E | iwl_mei_handle_sap_data | drivers/net/wireless/intel/iwlwifi/mei/main.c | ethhdr | ethhdr->h_proto | no | FP |
| 3209 | Medium | 70 | E | iwl_mei_handle_sap_rx | drivers/net/wireless/intel/iwlwifi/mei/main.c | valid_rx_sz | valid_rx_sz->? | no | FP |
| 3210 | Medium | 70 | E | iwl_mld_rx_crypto | drivers/net/wireless/intel/iwlwifi/mld/rx.c | le16_to_cpu(desc->mpdu_len) | le16_to_cpu(desc->mpdu_len)->? | no | FP |
| 3211 | Medium | 70 | E | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | mvmsta | mvmsta->vif | no | FP |
| 3212 | Medium | 70 | E | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | mvmvif | mvmvif->authorized | no | FP |
| 3213 | Medium | 70 | E | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | mvmsta | mvmsta->vif | no | FP |
| 3214 | Medium | 70 | E | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | mvmvif | mvmvif->csa_target_freq | no | FP |
| 3215 | Medium | 70 | E | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | trig | trig->data | no | FP |
| 3216 | Medium | 70 | E | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | rssi_trig | rssi_trig->rssi | no | FP |
| 3217 | Medium | 70 | E | iwl_pcie_get_rxb | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c | rxb | rxb->invalid | no | FP |
| 3218 | Medium | 70 | E | iwl_pcie_get_rxb | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c | rxb | rxb->vid | no | FP |
| 3219 | Medium | 70 | E | iwl_pcie_get_rxb | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c | rxb | rxb->invalid | no | FP |
| 3220 | Medium | 70 | E | ixgbe_clean_rx_irq | drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | skb | skb->? | no | FP |
| 3221 | Medium | 70 | E | ixgbe_clean_rx_irq | drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | skb | skb->? | no | FP |
| 3222 | Medium | 70 | E | ixgbe_clean_rx_irq | drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | skb | skb->? | no | FP |
| 3223 | Medium | 70 | E | ixgbe_clean_rx_irq | drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | skb | skb->? | no | FP |
| 3224 | Medium | 70 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | clock_info_array | clock_info_array->ucNumEntries | no | FP |
| 3225 | Medium | 70 | E | kv_parse_power_table | drivers/gpu/drm/radeon/kv_dpm.c | state_array | state_array->ucNumEntries | no | FP |
| 3226 | Medium | 70 | E | kv_parse_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | state_array | state_array->ucNumEntries | no | FP |
| 3227 | Medium | 70 | A | lan78xx_rx | drivers/net/usb/lan78xx.c | skb2 | memcpy() | no | FP |
| 3228 | Medium | 70 | E | lan78xx_rx | drivers/net/usb/lan78xx.c | skb2 | skb2->data | no | FP |
| 3229 | Medium | 70 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->eth803_hdr | no | FP |
| 3230 | Medium | 70 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->eth803_hdr | no | FP |
| 3231 | Medium | 70 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_ethhdr | p_ethhdr->h_source | no | FP |
| 3232 | Medium | 70 | E | libipw_rx | drivers/net/wireless/intel/ipw2x00/libipw_rx.c | crypt | crypt->ops | no | FP |
| 3233 | Medium | 70 | E | libipw_rx | drivers/net/wireless/intel/ipw2x00/libipw_rx.c | crypt | crypt->decrypt_mpdu | no | FP |
| 3234 | Medium | 70 | A | libipw_rx | drivers/net/wireless/intel/ipw2x00/libipw_rx.c | payload | memcmp() | no | FP |
| 3235 | Medium | 70 | E | lpfc_send_rscn_event | drivers/scsi/lpfc/lpfc_els.c | rscn_event_data | rscn_event_data->event_type | no | FP |
| 3236 | Medium | 70 | E | lpfc_send_rscn_event | drivers/scsi/lpfc/lpfc_els.c | rscn_event_data | rscn_event_data->payload_length | no | FP |
| 3237 | Medium | 70 | A | lpfc_send_rscn_event | drivers/scsi/lpfc/lpfc_els.c | rscn_event_data | memcpy() | no | FP |
| 3238 | Medium | 70 | E | lpfc_send_rscn_event | drivers/scsi/lpfc/lpfc_els.c | rscn_event_data | rscn_event_data->rscn_payload | no | FP |
| 3239 | Medium | 70 | E | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | be32_to_cpu(eqe->event.srq.srqn) &
0xffffff | be32_to_cpu(eqe->event.srq.srqn) &
0xffffff->? | no | FP |
| 3240 | Medium | 70 | E | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | be32_to_cpu(eqe->event.srq.srqn) &
0xffffff | be32_to_cpu(eqe->event.srq.srqn) &
0xffffff->? | no | FP |
| 3241 | Medium | 70 | E | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | be32_to_cpu(eqe->event.srq.srqn) &
0xffffff | be32_to_cpu(eqe->event.srq.srqn) &
0xffffff->? | no | FP |
| 3242 | Medium | 70 | E | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | be32_to_cpu(eqe->event.srq.srqn) &
0xffffff | be32_to_cpu(eqe->event.srq.srqn) &
0xffffff->? | no | FP |
| 3243 | Medium | 70 | E | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | cqn | cqn->? | no | FP |
| 3244 | Medium | 70 | E | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | cqn | cqn->? | no | FP |
| 3245 | Medium | 70 | E | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | be32_to_cpu(eqe->event.cq_err.cqn)
& 0xffffff | be32_to_cpu(eqe->event.cq_err.cqn)
& 0xffffff->? | no | FP |
| 3246 | Medium | 70 | E | mlx5_fpga_conn_rq_cqe | drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c | buf | buf->sg | no | FP |
| 3247 | Medium | 70 | E | mlx5_fpga_conn_rq_cqe | drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c | buf | buf->sg | no | FP |
| 3248 | Medium | 70 | E | mlx5_fpga_conn_rq_cqe | drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c | buf | buf->sg | no | FP |
| 3249 | Medium | 70 | E | mlx5_fpga_conn_sq_cqe | drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c | buf | buf->complete | no | FP |
| 3250 | Medium | 70 | E | mlx5_fpga_conn_sq_cqe | drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c | buf | buf->complete | no | FP |
| 3251 | Medium | 70 | E | mlx5e_handle_rx_cqe_mpwrq_shampo | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | wi | wi->? | no | FP |
| 3252 | Medium | 70 | E | mlx5e_handle_rx_cqe_mpwrq_shampo | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | page_idx | page_idx->? | no | FP |
| 3253 | Medium | 70 | E | mlx5e_trap_handle_rx_cqe | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | wi | wi->? | no | FP |
| 3254 | Medium | 70 | E | mlxfw_mfa2_file_component_get | drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c | comp_data | comp_data->comp | no | FP |
| 3255 | Medium | 70 | E | mlxfw_mfa2_file_component_get | drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c | comp_data | comp_data->comp | no | FP |
| 3256 | Medium | 70 | E | mlxfw_mfa2_file_component_get | drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c | comp_data | comp_data->buff | no | FP |
| 3257 | Medium | 70 | A | mlxfw_mfa2_file_component_get | drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c | comp_data | memcmp() | no | FP |
| 3258 | Medium | 70 | E | mlxfw_mfa2_file_component_get | drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c | comp_data | comp_data->buff | no | FP |
| 3259 | Medium | 70 | E | mpi3mr_create_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3260 | Medium | 70 | E | mpi3mr_create_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3261 | Medium | 70 | E | mpi3mr_create_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3262 | Medium | 70 | E | mpi3mr_create_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3263 | Medium | 70 | E | mpi3mr_create_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3264 | Medium | 70 | E | mpi3mr_create_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3265 | Medium | 70 | E | mpi3mr_devinfochg_evt_bh | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3266 | Medium | 70 | E | mpi3mr_devinfochg_evt_bh | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3267 | Medium | 70 | E | mpi3mr_devinfochg_evt_bh | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3268 | Medium | 70 | E | mpi3mr_devinfochg_evt_bh | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3269 | Medium | 70 | E | mpi3mr_devinfochg_evt_bh | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3270 | Medium | 70 | E | mpi3mr_devinfochg_evt_bh | drivers/scsi/mpi3mr/mpi3mr_os.c | tgtdev | tgtdev->? | no | FP |
| 3271 | Medium | 70 | E | mpi3mr_process_op_reply_desc | drivers/scsi/mpi3mr/mpi3mr_os.c | host_tag | host_tag->? | no | FP |
| 3272 | Medium | 70 | E | mpi3mr_update_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tg | tg->id | no | FP |
| 3273 | Medium | 70 | E | mpi3mr_update_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tg | tg->high | no | FP |
| 3274 | Medium | 70 | E | mpi3mr_update_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tg | tg->low | no | FP |
| 3275 | Medium | 70 | E | mpi3mr_update_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tg | tg->qd_reduction | no | FP |
| 3276 | Medium | 70 | E | mpi3mr_update_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tg | tg->fw_qd | no | FP |
| 3277 | Medium | 70 | E | mpi3mr_update_tgtdev | drivers/scsi/mpi3mr/mpi3mr_os.c | tg | tg->modified_qd | no | FP |
| 3278 | Medium | 70 | E | mpt3sas_scsih_event_callback | drivers/scsi/mpt3sas/mpt3sas_scsih.c | sz | sz->? | no | FP |
| 3279 | Medium | 70 | A | mptscsih_scandv_complete | drivers/message/fusion/mptscsih.c | sense_data | memcpy() | no | FP |
| 3280 | Medium | 70 | E | mse102x_rx_pkt_spi | drivers/net/ethernet/vertexcom/mse102x.c | skb | skb->len | no | FP |
| 3281 | Medium | 70 | E | mse102x_rx_pkt_spi | drivers/net/ethernet/vertexcom/mse102x.c | skb | skb->protocol | no | FP |
| 3282 | Medium | 70 | E | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3283 | Medium | 70 | E | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3284 | Medium | 70 | E | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3285 | Medium | 70 | E | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3286 | Medium | 70 | E | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3287 | Medium | 70 | E | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3288 | Medium | 70 | E | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3289 | Medium | 70 | E | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3290 | Medium | 70 | E | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3291 | Medium | 70 | E | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3292 | Medium | 70 | E | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3293 | Medium | 70 | E | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3294 | Medium | 70 | E | mt7925_mcu_handle_mbmc_event | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | tlv | tlv->len | no | FP |
| 3295 | Medium | 70 | E | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3296 | Medium | 70 | E | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3297 | Medium | 70 | E | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3298 | Medium | 70 | E | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3299 | Medium | 70 | E | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | hdr_gap | hdr_gap->? | no | FP |
| 3300 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | disarm_cqn | disarm_cqn->? | no | FP |
| 3301 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | disarm_cqn | disarm_cqn->? | no | FP |
| 3302 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.cq_err.cqn) | be32_to_cpu(eqe->event.cq_err.cqn)->? | no | FP |
| 3303 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff->? | no | FP |
| 3304 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.cq_err.cqn) | be32_to_cpu(eqe->event.cq_err.cqn)->? | no | FP |
| 3305 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.cq_err.cqn) | be32_to_cpu(eqe->event.cq_err.cqn)->? | no | FP |
| 3306 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.cq_err.cqn) | be32_to_cpu(eqe->event.cq_err.cqn)->? | no | FP |
| 3307 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff->? | no | FP |
| 3308 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.cq_err.cqn) | be32_to_cpu(eqe->event.cq_err.cqn)->? | no | FP |
| 3309 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.cq_err.cqn) | be32_to_cpu(eqe->event.cq_err.cqn)->? | no | FP |
| 3310 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff->? | no | FP |
| 3311 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff->? | no | FP |
| 3312 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff->? | no | FP |
| 3313 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff->? | no | FP |
| 3314 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff | be32_to_cpu(eqe->event.qp.qpn) & 0xffffff->? | no | FP |
| 3315 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff->? | no | FP |
| 3316 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff->? | no | FP |
| 3317 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff->? | no | FP |
| 3318 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff->? | no | FP |
| 3319 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff->? | no | FP |
| 3320 | Medium | 70 | E | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff | be32_to_cpu(eqe->event.srq.srqn) & 0xffffff->? | no | FP |
| 3321 | Medium | 70 | E | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->if_id | no | FP |
| 3322 | Medium | 70 | E | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->signature | no | FP |
| 3323 | Medium | 70 | A | mwifiex_deaggr_sdio_pkt | drivers/net/wireless/marvell/mwifiex/sdio.c | skb_deaggr | memcpy() | no | FP |
| 3324 | Medium | 70 | E | mwifiex_deaggr_sdio_pkt | drivers/net/wireless/marvell/mwifiex/sdio.c | skb_deaggr | skb_deaggr->data | no | FP |
| 3325 | Medium | 70 | E | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | tlv | tlv->data | no | FP |
| 3326 | Medium | 70 | E | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | tlv | tlv->header | no | FP |
| 3327 | Medium | 70 | E | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | tlv | tlv->header | no | FP |
| 3328 | Medium | 70 | E | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | tlv | tlv->header | no | FP |
| 3329 | Medium | 70 | E | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | tlv | tlv->data | no | FP |
| 3330 | Medium | 70 | E | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | scan_info_tlv | scan_info_tlv->rssi | no | FP |
| 3331 | Medium | 70 | E | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | scan_info_tlv | scan_info_tlv->tsf | no | FP |
| 3332 | Medium | 70 | E | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | scan_info_tlv | scan_info_tlv->radio_type | no | FP |
| 3333 | Medium | 70 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | no | FP |
| 3334 | Medium | 70 | A | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | eth | memcpy() | no | FP |
| 3335 | Medium | 70 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | eth | eth->h_source | no | FP |
| 3336 | Medium | 70 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | eth | eth->h_source | no | FP |
| 3337 | Medium | 70 | A | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | eth | memcpy() | no | FP |
| 3338 | Medium | 70 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | eth | eth->h_dest | no | FP |
| 3339 | Medium | 70 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | eth | eth->h_dest | no | FP |
| 3340 | Medium | 70 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | no | FP |
| 3341 | Medium | 70 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | no | FP |
| 3342 | Medium | 70 | E | mwifiex_ret_802_11_scan | drivers/net/wireless/marvell/mwifiex/scan.c | tlv_data | tlv_data->? | no | FP |
| 3343 | Medium | 70 | E | mwifiex_ret_802_11_scan | drivers/net/wireless/marvell/mwifiex/scan.c | tlv_buf_size | tlv_buf_size->? | no | FP |
| 3344 | Medium | 70 | E | mwifiex_ret_802_11_scan_get_tlv_ptrs | drivers/net/wireless/marvell/mwifiex/scan.c | current_tlv | current_tlv->data | no | FP |
| 3345 | Medium | 70 | A | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | p_ethhdr | memcpy() | no | FP |
| 3346 | Medium | 70 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | p_ethhdr | p_ethhdr->h_source | no | FP |
| 3347 | Medium | 70 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | p_ethhdr | p_ethhdr->h_source | no | FP |
| 3348 | Medium | 70 | A | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | p_ethhdr | memcpy() | no | FP |
| 3349 | Medium | 70 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | p_ethhdr | p_ethhdr->h_dest | no | FP |
| 3350 | Medium | 70 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | p_ethhdr | p_ethhdr->h_dest | no | FP |
| 3351 | Medium | 70 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | src_node | src_node->stats | no | FP |
| 3352 | Medium | 70 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | src_node | src_node->stats | no | FP |
| 3353 | Medium | 70 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | src_node | src_node->stats | no | FP |
| 3354 | Medium | 70 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | src_node | src_node->stats | no | FP |
| 3355 | Medium | 70 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | src_node | src_node->stats | no | FP |
| 3356 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | txq | txq->len | no | FP |
| 3357 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tx | tx->data_rate | no | FP |
| 3358 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tx | tx->tx_priority | no | FP |
| 3359 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tx | tx->qos_control | no | FP |
| 3360 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tx | tx->pkt_phys_addr | no | FP |
| 3361 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tx | tx->pkt_len | no | FP |
| 3362 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tx | tx->rate_info | no | FP |
| 3363 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tx | tx->peer_id | no | FP |
| 3364 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tx | tx->peer_id | no | FP |
| 3365 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tx | tx->timestamp | no | FP |
| 3366 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tx | tx->timestamp | no | FP |
| 3367 | Medium | 70 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tx | tx->status | no | FP |
| 3368 | Medium | 70 | E | netdev_rx | drivers/net/ethernet/natsemi/natsemi.c | skb | skb->protocol | no | FP |
| 3369 | Medium | 70 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | ring->? | no | FP |
| 3370 | Medium | 70 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | ring->? | no | FP |
| 3371 | Medium | 70 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | ring->? | no | FP |
| 3372 | Medium | 70 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | ring->? | no | FP |
| 3373 | Medium | 70 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | ring->? | no | FP |
| 3374 | Medium | 70 | E | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | ring->? | no | FP |
| 3375 | Medium | 70 | B | nfp_dump_hwinfo_field | drivers/net/ethernet/netronome/nfp/nfp_net_debugdump.c | key_len | key_len + 1 | yes? | FP |
| 3376 | Medium | 70 | B | nfp_dump_single_rtsym | drivers/net/ethernet/netronome/nfp/nfp_net_debugdump.c | key_len | key_len + 1 | yes? | FP |
| 3377 | Medium | 70 | E | nvmet_execute_pr_report | drivers/nvme/target/pr.c | data | data->gen | no | FP |
| 3378 | Medium | 70 | E | nvmet_execute_pr_report | drivers/nvme/target/pr.c | data | data->ptpls | no | FP |
| 3379 | Medium | 70 | E | nvmet_execute_pr_report | drivers/nvme/target/pr.c | data | data->regctl_eds | no | FP |
| 3380 | Medium | 70 | E | nvmet_execute_pr_report | drivers/nvme/target/pr.c | data | data->rtype | no | FP |
| 3381 | Medium | 70 | E | p54_convert_db | drivers/net/wireless/intersil/p54/eeprom.c | dst | dst->entries | no | FP |
| 3382 | Medium | 70 | E | p54_convert_db | drivers/net/wireless/intersil/p54/eeprom.c | dst | dst->entry_size | no | FP |
| 3383 | Medium | 70 | E | p54_convert_db | drivers/net/wireless/intersil/p54/eeprom.c | dst | dst->offset | no | FP |
| 3384 | Medium | 70 | E | p54_convert_db | drivers/net/wireless/intersil/p54/eeprom.c | dst | dst->len | no | FP |
| 3385 | Medium | 70 | A | p54_convert_db | drivers/net/wireless/intersil/p54/eeprom.c | dst | memcpy() | no | FP |
| 3386 | Medium | 70 | E | p54_convert_db | drivers/net/wireless/intersil/p54/eeprom.c | dst | dst->data | no | FP |
| 3387 | Medium | 70 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->len | no | FP |
| 3388 | Medium | 70 | E | pagefault_data_segments | drivers/infiniband/hw/mlx5/odp.c | be32_to_cpu(key) | be32_to_cpu(key)->? | no | FP |
| 3389 | Medium | 70 | E | pcnet32_rx_entry | drivers/net/ethernet/amd/pcnet32.c | skb | skb->len | no | FP |
| 3390 | Medium | 70 | E | pcnet32_rx_entry | drivers/net/ethernet/amd/pcnet32.c | skb | skb->protocol | no | FP |
| 3391 | Medium | 70 | E | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | skb | skb->data | no | FP |
| 3392 | Medium | 70 | E | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | skb | skb->data | no | FP |
| 3393 | Medium | 70 | E | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | skb | skb->data | no | FP |
| 3394 | Medium | 70 | E | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | skb | skb->data | no | FP |
| 3395 | Medium | 70 | E | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | skb | skb->data | no | FP |
| 3396 | Medium | 70 | E | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | skb | skb->data | no | FP |
| 3397 | Medium | 70 | E | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | skb | skb->data | no | FP |
| 3398 | Medium | 70 | E | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | skb | skb->data | no | FP |
| 3399 | Medium | 70 | E | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | skb | skb->data | no | FP |
| 3400 | Medium | 70 | A | plfxlc_mac_rx | drivers/net/wireless/purelifi/plfxlc/mac.c | skb | memcpy() | no | FP |
| 3401 | Medium | 70 | A | pqi_get_device_lists | drivers/scsi/smartpqi/smartpqi_init.c | internal_logdev_list | memcpy() | no | FP |
| 3402 | Medium | 70 | A | pqi_get_device_lists | drivers/scsi/smartpqi/smartpqi_init.c | internal_logdev_list | memset() | no | FP |
| 3403 | Medium | 70 | E | pqi_get_device_lists | drivers/scsi/smartpqi/smartpqi_init.c | internal_logdev_list | internal_logdev_list->header | no | FP |
| 3404 | Medium | 70 | A | pqi_report_phys_logical_luns | drivers/scsi/smartpqi/smartpqi_init.c | lun_data | memcpy() | no | FP |
| 3405 | Medium | 70 | E | pqi_report_phys_logical_luns | drivers/scsi/smartpqi/smartpqi_init.c | lun_data | lun_data->list_length | no | FP |
| 3406 | Medium | 70 | E | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | phys_lun | phys_lun->lunid | no | FP |
| 3407 | Medium | 70 | A | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | scsi3addr | memcpy() | no | FP |
| 3408 | Medium | 70 | E | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | fl | fl->? | no | FP |
| 3409 | Medium | 70 | E | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | fl | fl->? | no | FP |
| 3410 | Medium | 70 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->upacket_count | no | FP |
| 3411 | Medium | 70 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->upacket_count | no | FP |
| 3412 | Medium | 70 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->st_count | no | FP |
| 3413 | Medium | 70 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->st_count | no | FP |
| 3414 | Medium | 70 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->buf | no | FP |
| 3415 | Medium | 70 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->packet_count | no | FP |
| 3416 | Medium | 70 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->upacket_count | no | FP |
| 3417 | Medium | 70 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->upacket_count | no | FP |
| 3418 | Medium | 70 | E | qcom_channel_scan_worker | drivers/rpmsg/qcom_smd.c | channel | channel->list | no | FP |
| 3419 | Medium | 70 | E | qcom_channel_scan_worker | drivers/rpmsg/qcom_smd.c | channel | channel->name | no | FP |
| 3420 | Medium | 70 | E | qed_init_cmd_array | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | hdr | hdr->raw | no | FP |
| 3421 | Medium | 70 | E | qed_init_cmd_wr | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | b_must_dmae | b_must_dmae->? | no | FP |
| 3422 | Medium | 70 | E | qed_ll2_lb_rxq_handler | drivers/net/ethernet/qlogic/qed/qed_ll2.c | cid | cid->? | no | FP |
| 3423 | Medium | 70 | E | qed_ll2_lb_rxq_handler | drivers/net/ethernet/qlogic/qed/qed_ll2.c | cid | cid->? | no | FP |
| 3424 | Medium | 70 | E | qed_ll2_lb_rxq_handler | drivers/net/ethernet/qlogic/qed/qed_ll2.c | cid | cid->? | no | FP |
| 3425 | Medium | 70 | E | qed_ll2_lb_rxq_handler | drivers/net/ethernet/qlogic/qed/qed_ll2.c | cid | cid->? | no | FP |
| 3426 | Medium | 70 | E | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | total_bytes->? | no | FP |
| 3427 | Medium | 70 | E | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | total_bytes->? | no | FP |
| 3428 | Medium | 70 | E | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | item | item->iocb | no | FP |
| 3429 | Medium | 70 | A | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | fpin_pkt | memcpy() | no | FP |
| 3430 | Medium | 70 | A | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | fpin_pkt | memcpy() | no | FP |
| 3431 | Medium | 70 | A | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | fpin_pkt | memcpy() | no | FP |
| 3432 | Medium | 70 | E | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | item | item->iocb | no | FP |
| 3433 | Medium | 70 | E | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | item | item->iocb | no | FP |
| 3434 | Medium | 70 | A | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | iocb_pkt | memcpy() | no | FP |
| 3435 | Medium | 70 | A | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | iocb_pkt | memcpy() | no | FP |
| 3436 | Medium | 70 | A | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | iocb_pkt | memcpy() | no | FP |
| 3437 | Medium | 70 | A | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | iocb_pkt | memcpy() | no | FP |
| 3438 | Medium | 70 | E | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | item | item->iocb | no | FP |
| 3439 | Medium | 70 | E | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | total_bytes->? | no | FP |
| 3440 | Medium | 70 | E | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | total_bytes->? | no | FP |
| 3441 | Medium | 70 | E | qla27xx_execute_fwdt_template | drivers/scsi/qla2xxx/qla_tmpl.c | len | len->? | no | FP |
| 3442 | Medium | 70 | E | qla27xx_fwdt_calculate_dump_size | drivers/scsi/qla2xxx/qla_tmpl.c | len | len->? | no | FP |
| 3443 | Medium | 70 | E | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | ring->? | no | FP |
| 3444 | Medium | 70 | E | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | sts_data0 | sts_data0->? | no | FP |
| 3445 | Medium | 70 | E | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | ring->? | no | FP |
| 3446 | Medium | 70 | E | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | ring->? | no | FP |
| 3447 | Medium | 70 | E | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | ring->? | no | FP |
| 3448 | Medium | 70 | E | qmimux_rx_fixup | drivers/net/usb/qmi_wwan.c | skbn | skbn->protocol | no | FP |
| 3449 | Medium | 70 | E | qmimux_rx_fixup | drivers/net/usb/qmi_wwan.c | skbn | skbn->protocol | no | FP |
| 3450 | Medium | 70 | E | r5c_recovery_rewrite_data_only_stripes | drivers/md/raid5-cache.c | payload | payload->header | no | FP |
| 3451 | Medium | 70 | E | r5c_recovery_rewrite_data_only_stripes | drivers/md/raid5-cache.c | payload | payload->size | no | FP |
| 3452 | Medium | 70 | E | r5c_recovery_rewrite_data_only_stripes | drivers/md/raid5-cache.c | payload | payload->location | no | FP |
| 3453 | Medium | 70 | E | r5c_recovery_rewrite_data_only_stripes | drivers/md/raid5-cache.c | payload | payload->checksum | no | FP |
| 3454 | Medium | 70 | E | radeon_atom_get_memory_info | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->usModuleSize | no | FP |
| 3455 | Medium | 70 | E | radeon_atom_get_memory_info | drivers/gpu/drm/radeon/radeon_atombios.c | vram_module | vram_module->usModuleSize | no | FP |
| 3456 | Medium | 70 | E | receive_Data | drivers/block/drbd/drbd_receiver.c | peer_req | peer_req->? | no | FP |
| 3457 | Medium | 70 | E | resp_close_zone | drivers/scsi/scsi_debug.c | zsp | zsp->z_start | no | FP |
| 3458 | Medium | 70 | E | resp_finish_zone | drivers/scsi/scsi_debug.c | zsp | zsp->z_start | no | FP |
| 3459 | Medium | 70 | E | resp_open_zone | drivers/scsi/scsi_debug.c | zsp | zsp->z_start | no | FP |
| 3460 | Medium | 70 | E | resp_report_zones | drivers/scsi/scsi_debug.c | lba | lba->? | no | FP |
| 3461 | Medium | 70 | E | resp_report_zones | drivers/scsi/scsi_debug.c | lba | lba->? | no | FP |
| 3462 | Medium | 70 | E | resp_rwp_zone | drivers/scsi/scsi_debug.c | zsp | zsp->z_start | no | FP |
| 3463 | Medium | 70 | A | resp_verify | drivers/scsi/scsi_debug.c | arr | memcpy() | no | FP |
| 3464 | Medium | 70 | A | resp_write_same_10 | drivers/scsi/scsi_debug.c | lba | memset() in resp_write_same() | no | FP |
| 3465 | Medium | 70 | A | resp_write_same_10 | drivers/scsi/scsi_debug.c | lba | memmove() in resp_write_same() | no | FP |
| 3466 | Medium | 70 | A | resp_write_same_16 | drivers/scsi/scsi_debug.c | lba | memset() in resp_write_same() | no | FP |
| 3467 | Medium | 70 | A | resp_write_same_16 | drivers/scsi/scsi_debug.c | lba | memmove() in resp_write_same() | no | FP |
| 3468 | Medium | 70 | E | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | new_zone | new_zone->? | no | FP |
| 3469 | Medium | 70 | E | rhine_rx | drivers/net/ethernet/via/via-rhine.c | skb | skb->protocol | no | FP |
| 3470 | Medium | 70 | E | rpaphp_drc_add_slot | drivers/pci/hotplug/rpaphp_core.c | slot | slot->type | no | FP |
| 3471 | Medium | 70 | E | rtl8139_rx | drivers/net/ethernet/realtek/8139too.c | skb | skb->protocol | no | FP |
| 3472 | Medium | 70 | A | rtlbt_parse_firmware | drivers/bluetooth/btrtl.c | buf | memcpy() | no | FP |
| 3473 | Medium | 70 | A | rtlbt_parse_firmware | drivers/bluetooth/btrtl.c | buf | memcpy() | no | FP |
| 3474 | Medium | 70 | E | rx_poll | drivers/net/ethernet/dlink/sundance.c | skb | skb->protocol | no | FP |
| 3475 | Medium | 70 | A | save_frame | drivers/media/usb/s2255/s2255drv.c | pdest | memcpy() | no | FP |
| 3476 | Medium | 70 | E | sd_read_cpr | drivers/scsi/sd.c | iars | iars->ia_range | no | FP |
| 3477 | Medium | 70 | E | sd_read_cpr | drivers/scsi/sd.c | iars | iars->ia_range | no | FP |
| 3478 | Medium | 70 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | state_array | state_array->ucNumEntries | no | FP |
| 3479 | Medium | 70 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | power_state | power_state->v2 | no | FP |
| 3480 | Medium | 70 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | power_state | power_state->v2 | no | FP |
| 3481 | Medium | 70 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | power_state | power_state->v2 | no | FP |
| 3482 | Medium | 70 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | state_array | state_array->ucNumEntries | no | FP |
| 3483 | Medium | 70 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | clock_info | clock_info->si | no | FP |
| 3484 | Medium | 70 | A | smsc75xx_rx_fixup | drivers/net/usb/smsc75xx.c | ax_skb | memcpy() | no | FP |
| 3485 | Medium | 70 | E | smsc75xx_rx_fixup | drivers/net/usb/smsc75xx.c | ax_skb | ax_skb->data | no | FP |
| 3486 | Medium | 70 | E | solos_bh | drivers/atm/solos-pci.c | skb | skb->truesize | no | FP |
| 3487 | Medium | 70 | E | solos_bh | drivers/atm/solos-pci.c | skb | skb->len | no | FP |
| 3488 | Medium | 70 | E | solos_bh | drivers/atm/solos-pci.c | skb | skb->dma_addr | no | FP |
| 3489 | Medium | 70 | E | solos_bh | drivers/atm/solos-pci.c | skb | skb->data | no | FP |
| 3490 | Medium | 70 | E | solos_bh | drivers/atm/solos-pci.c | skb | skb->dma_addr | no | FP |
| 3491 | Medium | 70 | A | sr_rx_fixup | drivers/net/usb/sr9800.c | sr_skb | memcpy() | no | FP |
| 3492 | Medium | 70 | E | sr_rx_fixup | drivers/net/usb/sr9800.c | sr_skb | sr_skb->data | no | FP |
| 3493 | Medium | 70 | E | switchtec_dma_cleanup_completed | drivers/dma/switchtec_dma.c | desc | desc->orig_size | no | FP |
| 3494 | Medium | 70 | E | switchtec_dma_cleanup_completed | drivers/dma/switchtec_dma.c | desc | desc->completed | no | FP |
| 3495 | Medium | 70 | E | switchtec_dma_cleanup_completed | drivers/dma/switchtec_dma.c | desc | desc->txd | no | FP |
| 3496 | Medium | 70 | E | switchtec_dma_cleanup_completed | drivers/dma/switchtec_dma.c | desc | desc->txd | no | FP |
| 3497 | Medium | 70 | E | switchtec_dma_cleanup_completed | drivers/dma/switchtec_dma.c | desc | desc->txd | no | FP |
| 3498 | Medium | 70 | E | switchtec_dma_cleanup_completed | drivers/dma/switchtec_dma.c | desc | desc->txd | no | FP |
| 3499 | Medium | 70 | E | switchtec_dma_cleanup_completed | drivers/dma/switchtec_dma.c | desc | desc->txd | no | FP |
| 3500 | Medium | 70 | E | switchtec_dma_cleanup_completed | drivers/dma/switchtec_dma.c | desc | desc->completed | no | FP |
| 3501 | Medium | 70 | E | switchtec_dma_cleanup_completed | drivers/dma/switchtec_dma.c | desc | desc->completed | no | FP |
| 3502 | Medium | 70 | E | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | bd | bd->BDCtl | no | FP |
| 3503 | Medium | 70 | E | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | bd | bd->BuffData | no | FP |
| 3504 | Medium | 70 | E | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | bd | bd->BDCtl | no | FP |
| 3505 | Medium | 70 | E | tulip_poll | drivers/net/ethernet/dec/tulip/interrupt.c | skb | skb->protocol | no | FP |
| 3506 | Medium | 70 | E | tulip_rx | drivers/net/ethernet/dec/tulip/interrupt.c | skb | skb->protocol | no | FP |
| 3507 | Medium | 70 | A | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | resp | memcpy() | no | FP |
| 3508 | Medium | 70 | E | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | rx | rx->addr | no | FP |
| 3509 | Medium | 70 | E | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | rx | rx->flags | no | FP |
| 3510 | Medium | 70 | E | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | rx | rx->frameLen | no | FP |
| 3511 | Medium | 70 | E | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | skb | skb->data | no | FP |
| 3512 | Medium | 70 | E | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | new_skb | new_skb->protocol | no | FP |
| 3513 | Medium | 70 | E | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | rx | rx->rxStatus | no | FP |
| 3514 | Medium | 70 | E | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | new_skb | new_skb->ip_summed | no | FP |
| 3515 | Medium | 70 | E | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | rx | rx->rxStatus | no | FP |
| 3516 | Medium | 70 | E | typhoon_rx | drivers/net/ethernet/3com/typhoon.c | rx | rx->vlanTag | no | FP |
| 3517 | Medium | 70 | E | uli526x_rx_packet | drivers/net/ethernet/dec/tulip/uli526x.c | skb | skb->protocol | no | FP |
| 3518 | Medium | 70 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->list | no | FP |
| 3519 | Medium | 70 | E | vic_provinfo_add_tlv | drivers/net/ethernet/cisco/enic/vnic_vic.c | tlv | tlv->type | no | FP |
| 3520 | Medium | 70 | E | vic_provinfo_add_tlv | drivers/net/ethernet/cisco/enic/vnic_vic.c | tlv | tlv->length | no | FP |
| 3521 | Medium | 70 | E | vic_provinfo_add_tlv | drivers/net/ethernet/cisco/enic/vnic_vic.c | tlv | tlv->value | no | FP |
| 3522 | Medium | 70 | E | virtio_gpu_cmd_get_edid_cb | drivers/gpu/drm/virtio/virtgpu_vq.c | output | output->conn | no | FP |
| 3523 | Medium | 70 | E | virtio_gpu_cmd_get_edid_cb | drivers/gpu/drm/virtio/virtgpu_vq.c | output | output->conn | no | FP |
| 3524 | Medium | 70 | E | virtio_gpu_cmd_get_edid_cb | drivers/gpu/drm/virtio/virtgpu_vq.c | output | output->drm_edid | no | FP |
| 3525 | Medium | 70 | E | virtio_gpu_cmd_get_edid_cb | drivers/gpu/drm/virtio/virtgpu_vq.c | output | output->drm_edid | no | FP |
| 3526 | Medium | 70 | E | vsc_identify_csi_image | drivers/misc/mei/vsc-fw-loader.c | sign | sign->image | no | FP |
| 3527 | Medium | 70 | E | w5100_rx_skb | drivers/net/ethernet/wiznet/w5100.c | skb | skb->protocol | no | FP |
| 3528 | Medium | 70 | E | wilc_gnrl_async_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | vif | vif->hif_drv | no | FP |
| 3529 | Medium | 70 | E | wilc_gnrl_async_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | hif_drv | hif_drv->conn_info | no | FP |
| 3530 | Medium | 70 | E | wilc_gnrl_async_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | vif | vif->ndev | no | FP |
| 3531 | Medium | 70 | E | wilc_gnrl_async_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | msg | msg->body | no | FP |
| 3532 | Medium | 70 | E | wilc_gnrl_async_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | vif | vif->ndev | no | FP |
| 3533 | Medium | 70 | E | wilc_network_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | vif | vif->hif_drv | no | FP |
| 3534 | Medium | 70 | E | wilc_network_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | vif | vif->ndev | no | FP |
| 3535 | Medium | 70 | E | wilc_network_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | msg | msg->body | no | FP |
| 3536 | Medium | 70 | E | wilc_network_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | msg | msg->body | no | FP |
| 3537 | Medium | 70 | E | wilc_network_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | msg | msg->body | no | FP |
| 3538 | Medium | 70 | E | wilc_network_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | msg | msg->body | no | FP |
| 3539 | Medium | 70 | E | wilc_network_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | msg | msg->body | no | FP |
| 3540 | Medium | 70 | E | wilc_network_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | vif | vif->ndev | no | FP |
| 3541 | Medium | 70 | E | wilc_network_info_received | drivers/net/wireless/microchip/wilc1000/hif.c | msg | msg->body | no | FP |
| 3542 | Medium | 70 | E | wilc_scan_complete_received | drivers/net/wireless/microchip/wilc1000/hif.c | vif | vif->hif_drv | no | FP |
| 3543 | Medium | 70 | E | wilc_scan_complete_received | drivers/net/wireless/microchip/wilc1000/hif.c | hif_drv | hif_drv->usr_scan_req | no | FP |
| 3544 | Medium | 70 | E | wilc_scan_complete_received | drivers/net/wireless/microchip/wilc1000/hif.c | vif | vif->ndev | no | FP |
| 3545 | Medium | 70 | E | wlcore_rx | drivers/net/wireless/ti/wlcore/rx.c | pkt_len | pkt_len->? | no | FP |
| 3546 | Medium | 70 | E | wlcore_rx | drivers/net/wireless/ti/wlcore/rx.c | pkt_len | pkt_len->? | no | FP |
| 3547 | Medium | 70 | E | wlcore_rx | drivers/net/wireless/ti/wlcore/rx.c | pkt_len | pkt_len->? | no | FP |
| 3548 | Medium | 70 | E | wlcore_rx | drivers/net/wireless/ti/wlcore/rx.c | pkt_len | pkt_len->? | no | FP |
| 3549 | Medium | 70 | E | wlcore_rx | drivers/net/wireless/ti/wlcore/rx.c | pkt_len | pkt_len->? | no | FP |
| 3550 | Medium | 70 | E | wlcore_rx | drivers/net/wireless/ti/wlcore/rx.c | pkt_len | pkt_len->? | no | FP |
| 3551 | Medium | 70 | E | wmi_evt_eapol_rx | drivers/net/wireless/ath/wil6210/wmi.c | eth | eth->h_dest | no | FP |
| 3552 | Medium | 70 | E | wmi_evt_eapol_rx | drivers/net/wireless/ath/wil6210/wmi.c | eth | eth->h_source | no | FP |
| 3553 | Medium | 70 | E | wmi_evt_eapol_rx | drivers/net/wireless/ath/wil6210/wmi.c | eth | eth->h_proto | no | FP |
| 3554 | Medium | 70 | E | wmi_evt_eapol_rx | drivers/net/wireless/ath/wil6210/wmi.c | skb | skb->protocol | no | FP |
| 3555 | Medium | 70 | E | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | evt | evt->event | no | FP |
| 3556 | Medium | 70 | E | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | evt | evt->event | no | FP |
| 3557 | Medium | 70 | E | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | evt | evt->event | no | FP |
| 3558 | Medium | 70 | E | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | wmi | wmi->command_id | no | FP |
| 3559 | Medium | 70 | E | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | wmi | wmi->mid | no | FP |
| 3560 | Medium | 70 | E | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | wmi | wmi->fw_timestamp | no | FP |
| 3561 | Medium | 70 | A | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | wmi | memcpy() | no | FP |
| 3562 | Medium | 70 | E | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | wmi | wmi->mid | no | FP |
| 3563 | Medium | 70 | E | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | evt | evt->event | no | FP |
| 3564 | Medium | 70 | E | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | evt | evt->list | no | FP |
| 3565 | Medium | 60 | B | <unknown> | drivers/scsi/qla1280.c | ha | kzalloc() in scsi_host_alloc() | no | FP |
| 3566 | Medium | 60 | C | <unknown> | drivers/scsi/qla1280.c | handle | subscript | no | FP |
| 3567 | Medium | 60 | B | <unknown> | drivers/scsi/qla1280.c | sense_sz | memcpy() | no | FP |
| 3568 | Medium | 60 | B | <unknown> | drivers/scsi/qla1280.c | sense_sz | memset() | no | FP |
| 3569 | Medium | 60 | C | <unknown> | drivers/scsi/qla1280.c | handle | subscript | no | FP |
| 3570 | Medium | 60 | G2 | ICACRT_msg_to_type50CRT_msg | drivers/s390/crypto/zcrypt_msgtype50.c | short_len | copy_from_user() unvalidated size | no | FP |
| 3571 | Medium | 60 | G2 | ICACRT_msg_to_type50CRT_msg | drivers/s390/crypto/zcrypt_msgtype50.c | short_len | copy_from_user() unvalidated size | no | FP |
| 3572 | Medium | 60 | G2 | ICACRT_msg_to_type50CRT_msg | drivers/s390/crypto/zcrypt_msgtype50.c | short_len | copy_from_user() unvalidated size | no | FP |
| 3573 | Medium | 60 | G2 | ICACRT_msg_to_type50CRT_msg | drivers/s390/crypto/zcrypt_msgtype50.c | short_len | copy_from_user() unvalidated size | no | FP |
| 3574 | Medium | 60 | G2 | ICACRT_msg_to_type50CRT_msg | drivers/s390/crypto/zcrypt_msgtype50.c | short_len | copy_from_user() unvalidated size | no | FP |
| 3575 | Medium | 60 | G2 | LoadBitmap | drivers/staging/media/av7110/av7110_hw.c | dx | copy_from_user() unvalidated size | no | FP |
| 3576 | Medium | 60 | C | NFTL_mount | drivers/mtd/nftlmount.c | chain_to_format | subscript (callee) | no | FP |
| 3577 | Medium | 60 | C | NFTL_mount | drivers/mtd/nftlmount.c | block | subscript | no | FP |
| 3578 | Medium | 60 | C | NFTL_mount | drivers/mtd/nftlmount.c | block | subscript | no | FP |
| 3579 | Medium | 60 | C | __bnxt_qplib_rcfw_send_message | drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | cookie | subscript (callee) | no | FP |
| 3580 | Medium | 60 | C | __bnxt_qplib_rcfw_send_message | drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | cookie | subscript (callee) | no | FP |
| 3581 | Medium | 60 | C | __bnxt_qplib_rcfw_send_message | drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | cookie | subscript (callee) | no | FP |
| 3582 | Medium | 60 | C | __bnxt_qplib_rcfw_send_message | drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | cookie | subscript | no | FP |
| 3583 | Medium | 60 | C | __elan_update_firmware | drivers/input/mouse/elan_i2c_core.c | i | subscript | no | FP |
| 3584 | Medium | 60 | G2 | __ffs_ep0_read_events | drivers/usb/gadget/function/f_fs.c | size | copy_to_user() unvalidated size | no | FP |
| 3585 | Medium | 60 | B | __mt7921_mcu_set_clc | drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | le16_to_cpu(req.len) | memset() in __mt76_mcu_msg_alloc() | no | FP |
| 3586 | Medium | 60 | G2 | __nd_ioctl | drivers/nvdimm/bus.c | copy | copy_from_user() unvalidated size | no | FP |
| 3587 | Medium | 60 | G2 | __nd_ioctl | drivers/nvdimm/bus.c | copy | copy_from_user() unvalidated size | no | FP |
| 3588 | Medium | 60 | C | __nfp_flower_update_merge_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | FP |
| 3589 | Medium | 60 | C | __nfp_flower_update_merge_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | FP |
| 3590 | Medium | 60 | C | __nfp_flower_update_merge_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | FP |
| 3591 | Medium | 60 | C | __nfp_flower_update_merge_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | FP |
| 3592 | Medium | 60 | C | __nfp_flower_update_merge_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | FP |
| 3593 | Medium | 60 | C | __nfp_flower_update_merge_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | FP |
| 3594 | Medium | 60 | C | __nfp_flower_update_merge_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | FP |
| 3595 | Medium | 60 | C | __nfp_flower_update_merge_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | FP |
| 3596 | Medium | 60 | C | __nfp_flower_update_merge_stats | drivers/net/ethernet/netronome/nfp/flower/offload.c | ctx_id | subscript | no | FP |
| 3597 | Medium | 60 | B | __qla_copy_purex_to_buffer | drivers/scsi/qla2xxx/qla_isr.c | no_bytes | memcpy() | no | FP |
| 3598 | Medium | 60 | G2 | __tun_chr_ioctl | drivers/net/tun.c | ifreq_len | copy_from_user() unvalidated size | no | FP |
| 3599 | Medium | 60 | G2 | __tun_chr_ioctl | drivers/net/tun.c | ifreq_len | copy_to_user() unvalidated size | no | FP |
| 3600 | Medium | 60 | G2 | __tun_chr_ioctl | drivers/net/tun.c | ifreq_len | copy_to_user() unvalidated size | no | FP |
| 3601 | Medium | 60 | G2 | __tun_chr_ioctl | drivers/net/tun.c | ifreq_len | copy_to_user() unvalidated size | no | FP |
| 3602 | Medium | 60 | G2 | __vb2_perform_fileio | drivers/media/common/videobuf2/videobuf2-core.c | count | copy_to_user() unvalidated size | no | FP |
| 3603 | Medium | 60 | G2 | __vb2_perform_fileio | drivers/media/common/videobuf2/videobuf2-core.c | count | copy_from_user() unvalidated size | no | FP |
| 3604 | Medium | 60 | C | __virtnet_get_hw_stats | drivers/net/virtio_net.c | qid | subscript (callee) | no | FP |
| 3605 | Medium | 60 | C | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | smid | subscript (callee) | no | FP |
| 3606 | Medium | 60 | C | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | smid | subscript (callee) | no | FP |
| 3607 | Medium | 60 | C | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | smid | subscript (callee) | no | FP |
| 3608 | Medium | 60 | C | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | smid | subscript (callee) | no | FP |
| 3609 | Medium | 60 | C | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | smid | subscript (callee) | no | FP |
| 3610 | Medium | 60 | C | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | smid | subscript (callee) | no | FP |
| 3611 | Medium | 60 | G2 | _ctl_diag_read_buffer | drivers/scsi/mpt3sas/mpt3sas_ctl.c | copy_size | copy_to_user() unvalidated size | no | FP |
| 3612 | Medium | 60 | G2 | _ctl_do_mpt_command | drivers/scsi/mpt3sas/mpt3sas_ctl.c | data_out_sz | copy_from_user() unvalidated size | no | FP |
| 3613 | Medium | 60 | G2 | _ctl_do_mpt_command | drivers/scsi/mpt3sas/mpt3sas_ctl.c | data_in_sz | copy_to_user() unvalidated size | no | FP |
| 3614 | Medium | 60 | G2 | _ctl_do_mpt_command | drivers/scsi/mpt3sas/mpt3sas_ctl.c | sz | copy_to_user() unvalidated size | no | FP |
| 3615 | Medium | 60 | G2 | _ctl_do_mpt_command | drivers/scsi/mpt3sas/mpt3sas_ctl.c | sz | copy_to_user() unvalidated size | no | FP |
| 3616 | Medium | 60 | G2 | _ctl_eventreport | drivers/scsi/mpt3sas/mpt3sas_ctl.c | number_bytes | copy_to_user() unvalidated size | no | FP |
| 3617 | Medium | 60 | G2 | _ctl_set_task_mid | drivers/scsi/mpt3sas/mpt3sas_ctl.c | sz | copy_to_user() unvalidated size | no | FP |
| 3618 | Medium | 60 | C | _cx18_process_idx_data | drivers/media/pci/cx18/cx18-ioctl.c | le32_to_cpu(e_buf->flags) & 0x7 | subscript | no | FP |
| 3619 | Medium | 60 | G2 | _hl_ioctl | drivers/accel/habanalabs/common/habanalabs_ioctl.c | usize | copy_from_user() unvalidated size | no | FP |
| 3620 | Medium | 60 | G2 | _hl_ioctl | drivers/accel/habanalabs/common/habanalabs_ioctl.c | usize | copy_to_user() unvalidated size | no | FP |
| 3621 | Medium | 60 | G2 | _ib_respond_udata | drivers/infiniband/core/ib_core_uverbs.c | copy_len | copy_to_user() unvalidated size | no | FP |
| 3622 | Medium | 60 | G2 | _picolcd_flash_write | drivers/hid/hid-picolcd_debugfs.c | raw_data[len_off] | copy_from_user() unvalidated size | no | FP |
| 3623 | Medium | 60 | B | _scsih_io_done | drivers/scsi/mpt3sas/mpt3sas_scsih.c | sz | memcpy() | no | FP |
| 3624 | Medium | 60 | B | _scsih_sas_pd_hide | drivers/scsi/mpt3sas/mpt3sas_scsih.c | handle | kmalloc() in mpt3sas_config_get_volume_handle() | no | FP |
| 3625 | Medium | 60 | C | _show_fbtc_cysta_v2 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3626 | Medium | 60 | C | _show_fbtc_cysta_v2 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3627 | Medium | 60 | C | _show_fbtc_cysta_v2 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3628 | Medium | 60 | C | _show_fbtc_cysta_v2 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3629 | Medium | 60 | C | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3630 | Medium | 60 | C | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3631 | Medium | 60 | C | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3632 | Medium | 60 | C | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3633 | Medium | 60 | C | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3634 | Medium | 60 | C | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3635 | Medium | 60 | C | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3636 | Medium | 60 | C | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3637 | Medium | 60 | C | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3638 | Medium | 60 | C | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3639 | Medium | 60 | C | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3640 | Medium | 60 | C | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | store_index | subscript | no | FP |
| 3641 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3642 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3643 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3644 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3645 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3646 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3647 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3648 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3649 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3650 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3651 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3652 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3653 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3654 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3655 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3656 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3657 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3658 | Medium | 60 | C | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | s_id | subscript | no | FP |
| 3659 | Medium | 60 | C | _show_fbtc_step_v3 | drivers/net/wireless/realtek/rtw89/coex.c | array_idx | subscript | no | FP |
| 3660 | Medium | 60 | C | _show_fbtc_step_v3 | drivers/net/wireless/realtek/rtw89/coex.c | array_idx | subscript | no | FP |
| 3661 | Medium | 60 | C | _show_fbtc_step_v3 | drivers/net/wireless/realtek/rtw89/coex.c | array_idx | subscript | no | FP |
| 3662 | Medium | 60 | B | aac_show_serial_number | drivers/scsi/aacraid/linit.c | len | memcmp() | no | FP |
| 3663 | Medium | 60 | C | aac_show_serial_number | drivers/scsi/aacraid/linit.c | len | subscript | no | FP |
| 3664 | Medium | 60 | B | aac_srb_callback | drivers/scsi/aacraid/aachba.c | len | memcpy() | no | FP |
| 3665 | Medium | 60 | B | aac_srb_callback | drivers/scsi/aacraid/aachba.c | len | memcpy() | no | FP |
| 3666 | Medium | 60 | G2 | aat2870_reg_write_file | drivers/mfd/aat2870-core.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 3667 | Medium | 60 | B | acm_ctrl_irq | drivers/usb/class/cdc-acm.c | copy_size | memcpy() | no | FP |
| 3668 | Medium | 60 | B | acm_setup | drivers/usb/gadget/function/f_acm.c | value | memcpy() | no | FP |
| 3669 | Medium | 60 | G2 | acpi_aml_read_user | drivers/acpi/acpi_dbg.c | n | copy_to_user() unvalidated size | no | FP |
| 3670 | Medium | 60 | G2 | acpi_aml_write_user | drivers/acpi/acpi_dbg.c | n | copy_from_user() unvalidated size | no | FP |
| 3671 | Medium | 60 | G2 | acpi_system_write_wakeup_device | drivers/acpi/proc.c | count | copy_from_user() unvalidated size | no | FP |
| 3672 | Medium | 60 | C | act_establish | drivers/infiniband/hw/cxgb4/cm.c | atid | subscript (callee) | no | FP |
| 3673 | Medium | 60 | C | act_establish | drivers/infiniband/hw/cxgb4/cm.c | tcp_opt | subscript (callee) | no | FP |
| 3674 | Medium | 60 | B | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | memcpy() in send_mpa_req() | no | FP |
| 3675 | Medium | 60 | B | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | memcpy() in send_mpa_req() | no | FP |
| 3676 | Medium | 60 | B | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | memcpy() in send_mpa_req() | no | FP |
| 3677 | Medium | 60 | B | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | memcpy() in connect_reply_upcall() | no | FP |
| 3678 | Medium | 60 | B | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | memcpy() in connect_reply_upcall() | no | FP |
| 3679 | Medium | 60 | C | act_establish | drivers/infiniband/hw/cxgb4/cm.c | atid | subscript (callee) | no | FP |
| 3680 | Medium | 60 | C | act_establish | drivers/infiniband/hw/cxgb4/cm.c | ep | subscript (callee) | no | FP |
| 3681 | Medium | 60 | C | act_open_rpl | drivers/infiniband/hw/cxgb4/cm.c | sin6 | subscript (callee) | no | FP |
| 3682 | Medium | 60 | C | act_open_rpl | drivers/infiniband/hw/cxgb4/cm.c | atid | subscript (callee) | no | FP |
| 3683 | Medium | 60 | C | act_open_rpl | drivers/infiniband/hw/cxgb4/cm.c | atid | subscript (callee) | no | FP |
| 3684 | Medium | 60 | G2 | adi_write | drivers/char/adi.c | ver_buf_sz | copy_from_user() unvalidated size | no | FP |
| 3685 | Medium | 60 | G2 | adu_read | drivers/usb/misc/adutux.c | amount | copy_to_user() unvalidated size | no | FP |
| 3686 | Medium | 60 | G2 | adu_write | drivers/usb/misc/adutux.c | bytes_to_write | copy_from_user() unvalidated size | no | FP |
| 3687 | Medium | 60 | G2 | afu_ioctl_dma_map | drivers/fpga/dfl-afu-main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 3688 | Medium | 60 | G2 | afu_ioctl_dma_unmap | drivers/fpga/dfl-afu-main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 3689 | Medium | 60 | G2 | afu_ioctl_get_info | drivers/fpga/dfl-afu-main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 3690 | Medium | 60 | G2 | afu_ioctl_get_region_info | drivers/fpga/dfl-afu-main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 3691 | Medium | 60 | G2 | aie2_get_aie_status | drivers/accel/amdxdna/aie2_pci.c | buf_sz | copy_from_user() unvalidated size | no | FP |
| 3692 | Medium | 60 | G2 | aie2_get_aie_status | drivers/accel/amdxdna/aie2_pci.c | buf_sz | copy_to_user() unvalidated size | no | FP |
| 3693 | Medium | 60 | G2 | aie2_get_aie_version | drivers/accel/amdxdna/aie2_pci.c | buf_sz | copy_to_user() unvalidated size | no | FP |
| 3694 | Medium | 60 | G2 | aie2_get_array_async_error | drivers/accel/amdxdna/aie2_error.c | args->element_size | copy_to_user() unvalidated size | no | FP |
| 3695 | Medium | 60 | G2 | aie2_get_clock_metadata | drivers/accel/amdxdna/aie2_pci.c | buf_sz | copy_to_user() unvalidated size | no | FP |
| 3696 | Medium | 60 | G2 | aie2_get_firmware_version | drivers/accel/amdxdna/aie2_pci.c | buf_sz | copy_to_user() unvalidated size | no | FP |
| 3697 | Medium | 60 | G2 | aie2_get_power_mode | drivers/accel/amdxdna/aie2_pci.c | buf_sz | copy_to_user() unvalidated size | no | FP |
| 3698 | Medium | 60 | G2 | aie2_get_preempt_state | drivers/accel/amdxdna/aie2_pci.c | buf_sz | copy_to_user() unvalidated size | no | FP |
| 3699 | Medium | 60 | G2 | aie2_hwctx_status_cb | drivers/accel/amdxdna/aie2_pci.c | size | copy_to_user() unvalidated size | no | FP |
| 3700 | Medium | 60 | G2 | aie2_query_resource_info | drivers/accel/amdxdna/aie2_pci.c | buf_sz | copy_to_user() unvalidated size | no | FP |
| 3701 | Medium | 60 | G2 | aie2_query_status | drivers/accel/amdxdna/aie2_message.c | size | copy_to_user() unvalidated size | no | FP |
| 3702 | Medium | 60 | G2 | aie2_query_telemetry | drivers/accel/amdxdna/aie2_message.c | size | copy_to_user() unvalidated size | no | FP |
| 3703 | Medium | 60 | C | airoha_qdma_rx_process | drivers/net/ethernet/airoha/airoha_eth.c | sptag | subscript | no | FP |
| 3704 | Medium | 60 | G2 | alloc_chan_prog | drivers/s390/char/vmur.c | reclen | copy_from_user() unvalidated size | no | FP |
| 3705 | Medium | 60 | C | altera_check_crc | drivers/misc/altera-stapl/altera.c | delta | subscript | no | FP |
| 3706 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | data_sect | subscript (callee) | no | FP |
| 3707 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | delta | subscript | no | FP |
| 3708 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | delta | subscript | no | FP |
| 3709 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | delta | subscript | no | FP |
| 3710 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | delta | subscript | no | FP |
| 3711 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | delta | subscript | no | FP |
| 3712 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | delta | subscript | no | FP |
| 3713 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | delta | subscript | no | FP |
| 3714 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | delta | subscript | no | FP |
| 3715 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | FP |
| 3716 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | FP |
| 3717 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | FP |
| 3718 | Medium | 60 | C | altera_execute | drivers/misc/altera-stapl/altera.c | i | subscript | no | FP |
| 3719 | Medium | 60 | G2 | amdgpu_bo_create_list_entry_array | drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | bytes | copy_from_user() unvalidated size | no | FP |
| 3720 | Medium | 60 | G2 | amdgpu_debugfs_mqd_read | drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | bytes | copy_to_user() unvalidated size | no | FP |
| 3721 | Medium | 60 | C | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | le16_to_cpu(ip->hw_id) | subscript | no | FP |
| 3722 | Medium | 60 | C | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | le16_to_cpu(ip->hw_id) | subscript | no | FP |
| 3723 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 4u) | copy_to_user() unvalidated size | no | FP |
| 3724 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 4u) | copy_to_user() unvalidated size | no | FP |
| 3725 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min_t(size_t, size, sizeof(ip)) | copy_to_user() unvalidated size | no | FP |
| 3726 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 4u) | copy_to_user() unvalidated size | no | FP |
| 3727 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 4u) | copy_to_user() unvalidated size | no | FP |
| 3728 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 8u) | copy_to_user() unvalidated size | no | FP |
| 3729 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(fw_info)) | copy_to_user() unvalidated size | no | FP |
| 3730 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 8u) | copy_to_user() unvalidated size | no | FP |
| 3731 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 8u) | copy_to_user() unvalidated size | no | FP |
| 3732 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 8u) | copy_to_user() unvalidated size | no | FP |
| 3733 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 8u) | copy_to_user() unvalidated size | no | FP |
| 3734 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 8u) | copy_to_user() unvalidated size | no | FP |
| 3735 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 8u) | copy_to_user() unvalidated size | no | FP |
| 3736 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(gds_info)) | copy_to_user() unvalidated size | no | FP |
| 3737 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(vram_gtt)) | copy_to_user() unvalidated size | no | FP |
| 3738 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(mem)) | copy_to_user() unvalidated size | no | FP |
| 3739 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, alloc_size) | copy_to_user() unvalidated size | no | FP |
| 3740 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(*dev_info)) | copy_to_user() unvalidated size | no | FP |
| 3741 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(vce_clk_table)) | copy_to_user() unvalidated size | no | FP |
| 3742 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(bios_size)) | copy_to_user() unvalidated size | no | FP |
| 3743 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(vbios_info)) | copy_to_user() unvalidated size | no | FP |
| 3744 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(handle)) | copy_to_user() unvalidated size | no | FP |
| 3745 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 4u) | copy_to_user() unvalidated size | no | FP |
| 3746 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min(size, 4u) | copy_to_user() unvalidated size | no | FP |
| 3747 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min_t(u64, size, sizeof(ras_mask)) | copy_to_user() unvalidated size | no | FP |
| 3748 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(*caps)) | copy_to_user() unvalidated size | no | FP |
| 3749 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(max_ibs)) | copy_to_user() unvalidated size | no | FP |
| 3750 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(gpuvm_fault)) | copy_to_user() unvalidated size | no | FP |
| 3751 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(meta_info)) | copy_to_user() unvalidated size | no | FP |
| 3752 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(meta_info)) | copy_to_user() unvalidated size | no | FP |
| 3753 | Medium | 60 | G2 | amdgpu_info_ioctl | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | min((size_t)size, sizeof(meta_info)) | copy_to_user() unvalidated size | no | FP |
| 3754 | Medium | 60 | G2 | amdgpu_iomem_read | drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | bytes | copy_to_user() unvalidated size | no | FP |
| 3755 | Medium | 60 | G2 | amdgpu_iomem_write | drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | bytes | copy_from_user() unvalidated size | no | FP |
| 3756 | Medium | 60 | G2 | amdgpu_ras_debugfs_ctrl_parse_data | drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | s | copy_from_user() unvalidated size | no | FP |
| 3757 | Medium | 60 | G2 | amdgpu_ttm_vram_read | drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | bytes | copy_to_user() unvalidated size | no | FP |
| 3758 | Medium | 60 | G2 | amdgpu_userq_wait_return_fence_info | drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | cnt * sizeof(*fence_info) | copy_to_user() unvalidated size | no | FP |
| 3759 | Medium | 60 | G2 | amdgpu_virt_ras_get_cper_records | drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c | offset | copy_to_user() unvalidated size | no | FP |
| 3760 | Medium | 60 | G2 | amdxdna_drm_get_bo_usage | drivers/accel/amdxdna/amdxdna_gem.c | min_sz | copy_from_user() unvalidated size | no | FP |
| 3761 | Medium | 60 | G2 | amdxdna_drm_get_bo_usage | drivers/accel/amdxdna/amdxdna_gem.c | min_sz | copy_to_user() unvalidated size | no | FP |
| 3762 | Medium | 60 | G2 | amdxdna_get_metadata | drivers/accel/amdxdna/aie.c | buf_sz | copy_to_user() unvalidated size | no | FP |
| 3763 | Medium | 60 | G2 | amdxdna_get_ubuf | drivers/accel/amdxdna/amdxdna_ubuf.c | sizeof(*va_ent) * num_entries | copy_from_user() unvalidated size | no | FP |
| 3764 | Medium | 60 | G2 | aoechr_read | drivers/block/aoe/aoechr.c | len | copy_to_user() unvalidated size | no | FP |
| 3765 | Medium | 60 | C | aoecmd_ata_rsp | drivers/block/aoe/aoecmd.c | n | subscript (callee) | no | FP |
| 3766 | Medium | 60 | C | aoecmd_ata_rsp | drivers/block/aoe/aoecmd.c | f | subscript (callee) | no | FP |
| 3767 | Medium | 60 | C | aoecmd_ata_rsp | drivers/block/aoe/aoecmd.c | f | subscript (callee) | no | FP |
| 3768 | Medium | 60 | C | aoecmd_ata_rsp | drivers/block/aoe/aoecmd.c | f | subscript (callee) | no | FP |
| 3769 | Medium | 60 | C | aoecmd_ata_rsp | drivers/block/aoe/aoecmd.c | f | subscript (callee) | no | FP |
| 3770 | Medium | 60 | C | aoecmd_ata_rsp | drivers/block/aoe/aoecmd.c | f | subscript (callee) | no | FP |
| 3771 | Medium | 60 | C | aoecmd_ata_rsp | drivers/block/aoe/aoecmd.c | f | subscript (callee) | no | FP |
| 3772 | Medium | 60 | C | aoecmd_ata_rsp | drivers/block/aoe/aoecmd.c | f | subscript (callee) | no | FP |
| 3773 | Medium | 60 | C | aoenet_rcv | drivers/block/aoe/aoenet.c | n | subscript | no | FP |
| 3774 | Medium | 60 | G2 | append_to_buffer | drivers/scsi/st.c | cnt | copy_from_user() unvalidated size | no | FP |
| 3775 | Medium | 60 | C | aspeed_intc_populate_ranges | drivers/irqchip/irq-ast2700.c | be32_to_cpu(pvs[ASPEED_INTC_RANGE_OFF_PHANDLE]) | subscript (callee) | no | FP |
| 3776 | Medium | 60 | C | aspeed_intc_populate_ranges | drivers/irqchip/irq-ast2700.c | be32_to_cpu(pvs[ASPEED_INTC_RANGE_OFF_PHANDLE]) | subscript (callee) | no | FP |
| 3777 | Medium | 60 | C | aspeed_intc_populate_ranges | drivers/irqchip/irq-ast2700.c | be32_to_cpu(pvs[ASPEED_INTC_RANGE_OFF_PHANDLE]) | subscript (callee) | no | FP |
| 3778 | Medium | 60 | G2 | ata_cmd_ioctl | drivers/ata/libata-scsi.c | argsize | copy_to_user() unvalidated size | no | FP |
| 3779 | Medium | 60 | G2 | ata_get_identity | drivers/ata/libata-scsi.c | ATA_ID_WORDS * sizeof(u16) | copy_to_user() unvalidated size | no | FP |
| 3780 | Medium | 60 | G2 | ata_get_identity | drivers/ata/libata-scsi.c | ATA_ID_PROD_LEN | copy_to_user() unvalidated size | no | FP |
| 3781 | Medium | 60 | G2 | ata_get_identity | drivers/ata/libata-scsi.c | ATA_ID_FW_REV_LEN | copy_to_user() unvalidated size | no | FP |
| 3782 | Medium | 60 | G2 | ata_get_identity | drivers/ata/libata-scsi.c | ATA_ID_SERNO_LEN | copy_to_user() unvalidated size | no | FP |
| 3783 | Medium | 60 | B | ath10k_htt_rx_tx_fetch_ind | drivers/net/wireless/ath/ath10k/htt_rx.c | num_records | memcpy() in ath10k_htt_tx_fetch_resp() | no | FP |
| 3784 | Medium | 60 | G2 | ath10k_mem_value_read | drivers/net/wireless/ath/ath10k/debug.c | count | copy_to_user() unvalidated size | no | FP |
| 3785 | Medium | 60 | G2 | ath10k_mem_value_write | drivers/net/wireless/ath/ath10k/debug.c | count | copy_from_user() unvalidated size | no | FP |
| 3786 | Medium | 60 | G2 | ath11k_write_file_spec_scan_ctl | drivers/net/wireless/ath/ath11k/spectral.c | len | copy_from_user() unvalidated size | no | FP |
| 3787 | Medium | 60 | B | ath12k_chan_info_event | drivers/net/wireless/ath/ath12k/wmi.c | survey | memset() | no | FP |
| 3788 | Medium | 60 | C | ath12k_htt_print_chan_switch_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | i | subscript | no | FP |
| 3789 | Medium | 60 | C | ath12k_htt_print_chan_switch_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | i | subscript | no | FP |
| 3790 | Medium | 60 | C | ath12k_htt_print_chan_switch_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | i | subscript | no | FP |
| 3791 | Medium | 60 | C | ath12k_htt_print_chan_switch_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | i | subscript | no | FP |
| 3792 | Medium | 60 | C | ath12k_htt_print_chan_switch_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | i | subscript | no | FP |
| 3793 | Medium | 60 | C | ath12k_htt_print_chan_switch_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | i | subscript | no | FP |
| 3794 | Medium | 60 | C | ath12k_htt_print_chan_switch_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | i | subscript | no | FP |
| 3795 | Medium | 60 | C | ath12k_htt_print_chan_switch_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | i | subscript | no | FP |
| 3796 | Medium | 60 | C | ath12k_htt_pull_ppdu_stats | drivers/net/wireless/ath/ath12k/dp_htt.c | peer_id | subscript (callee) | no | FP |
| 3797 | Medium | 60 | B | ath12k_mgmt_tx_compl_event | drivers/net/wireless/ath/ath12k/wmi.c | ar | memset() in wmi_process_mgmt_tx_comp() | no | FP |
| 3798 | Medium | 60 | B | ath12k_mgmt_tx_compl_event | drivers/net/wireless/ath/ath12k/wmi.c | le32_to_cpu(tx_compl_param.desc_id) | memset() in wmi_process_mgmt_tx_comp() | no | FP |
| 3799 | Medium | 60 | B | ath12k_tpc_stats_print | drivers/net/wireless/ath/ath12k/debugfs.c | len | scnprintf() in ath12k_tpc_fill_pream() | no | FP |
| 3800 | Medium | 60 | B | ath12k_tpc_stats_print | drivers/net/wireless/ath/ath12k/debugfs.c | len | scnprintf() in ath12k_tpc_fill_pream() | no | FP |
| 3801 | Medium | 60 | B | ath12k_tpc_stats_print | drivers/net/wireless/ath/ath12k/debugfs.c | len | scnprintf() in ath12k_tpc_fill_pream() | no | FP |
| 3802 | Medium | 60 | B | ath12k_tpc_stats_print | drivers/net/wireless/ath/ath12k/debugfs.c | len | scnprintf() in ath12k_tpc_fill_pream() | no | FP |
| 3803 | Medium | 60 | B | ath12k_tpc_stats_print | drivers/net/wireless/ath/ath12k/debugfs.c | len | scnprintf() in ath12k_tpc_fill_pream() | no | FP |
| 3804 | Medium | 60 | C | ath12k_wifi7_dp_tx_completion_handler | drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c | tx_desc | subscript (callee) | no | FP |
| 3805 | Medium | 60 | C | ath12k_wifi7_dp_tx_completion_handler | drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c | tx_desc | subscript (callee) | no | FP |
| 3806 | Medium | 60 | C | ath12k_wifi7_dp_tx_completion_handler | drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c | tx_desc | subscript (callee) | no | FP |
| 3807 | Medium | 60 | C | ath5k_prepare_multicast | drivers/net/wireless/ath/ath5k/mac80211-ops.c | pos | subscript | no | FP |
| 3808 | Medium | 60 | G2 | ath6kl_bgscan_int_write | drivers/net/wireless/ath/ath6kl/debug.c | len | copy_from_user() unvalidated size | no | FP |
| 3809 | Medium | 60 | G2 | ath6kl_create_qos_write | drivers/net/wireless/ath/ath6kl/debug.c | len | copy_from_user() unvalidated size | no | FP |
| 3810 | Medium | 60 | G2 | ath6kl_delete_qos_write | drivers/net/wireless/ath/ath6kl/debug.c | len | copy_from_user() unvalidated size | no | FP |
| 3811 | Medium | 60 | G2 | ath6kl_force_roam_write | drivers/net/wireless/ath/ath6kl/debug.c | len | copy_from_user() unvalidated size | no | FP |
| 3812 | Medium | 60 | G2 | ath6kl_listen_int_write | drivers/net/wireless/ath/ath6kl/debug.c | len | copy_from_user() unvalidated size | no | FP |
| 3813 | Medium | 60 | G2 | ath6kl_power_params_write | drivers/net/wireless/ath/ath6kl/debug.c | len | copy_from_user() unvalidated size | no | FP |
| 3814 | Medium | 60 | G2 | ath6kl_regwrite_write | drivers/net/wireless/ath/ath6kl/debug.c | len | copy_from_user() unvalidated size | no | FP |
| 3815 | Medium | 60 | G2 | ath6kl_roam_mode_write | drivers/net/wireless/ath/ath6kl/debug.c | len | copy_from_user() unvalidated size | no | FP |
| 3816 | Medium | 60 | B | ath6kl_roam_table_read | drivers/net/wireless/ath/ath6kl/debug.c | buf_len | kzalloc() | no | FP |
| 3817 | Medium | 60 | B | ath6kl_roam_table_read | drivers/net/wireless/ath/ath6kl/debug.c | buf_len | scnprintf() | no | FP |
| 3818 | Medium | 60 | B | ath6kl_roam_table_read | drivers/net/wireless/ath/ath6kl/debug.c | buf_len | scnprintf() | no | FP |
| 3819 | Medium | 60 | C | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | aggr_conn | subscript (callee) | no | FP |
| 3820 | Medium | 60 | C | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | aggr_conn | subscript (callee) | no | FP |
| 3821 | Medium | 60 | C | ath6kl_wmi_implicit_create_pstream | drivers/net/wireless/ath/ath6kl/wmi.c | usr_pri | subscript | no | FP |
| 3822 | Medium | 60 | G2 | atomisp_gdc_cac_table | drivers/staging/media/atomisp/pci/atomisp_cmd.c | tab.height *
tab.width * sizeof(*tab.coordinates_x[i]) | copy_to_user() unvalidated size | no | FP |
| 3823 | Medium | 60 | G2 | atomisp_gdc_cac_table | drivers/staging/media/atomisp/pci/atomisp_cmd.c | tab.height *
tab.width * sizeof(*tab.coordinates_y[i]) | copy_to_user() unvalidated size | no | FP |
| 3824 | Medium | 60 | G2 | atomisp_set_shading_table | drivers/staging/media/atomisp/pci/atomisp_cmd.c | len_table | copy_from_user() unvalidated size | no | FP |
| 3825 | Medium | 60 | B | audio_get_intf_req | drivers/usb/gadget/function/f_uac1_legacy.c | len | memcpy() | no | FP |
| 3826 | Medium | 60 | G2 | axis_fifo_read | drivers/staging/axis-fifo/axis-fifo.c | copy * sizeof(u32) | copy_to_user() unvalidated size | no | FP |
| 3827 | Medium | 60 | G2 | bch_dump_read | drivers/md/bcache/debug.c | bytes | copy_to_user() unvalidated size | no | FP |
| 3828 | Medium | 60 | G2 | bcm_vk_read | drivers/misc/bcm-vk/bcm_vk_msg.c | rsp_length | copy_to_user() unvalidated size | no | FP |
| 3829 | Medium | 60 | G2 | bcm_vk_read | drivers/misc/bcm-vk/bcm_vk_msg.c | VK_MSGQ_BLK_SIZE | copy_to_user() unvalidated size | no | FP |
| 3830 | Medium | 60 | G2 | bcm_vk_write | drivers/misc/bcm-vk/bcm_vk_msg.c | count | copy_from_user() unvalidated size | no | FP |
| 3831 | Medium | 60 | C | bin_block_payload_len_garbage | drivers/firmware/cirrus/test/cs_dsp_test_bin_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 3832 | Medium | 60 | G2 | binder_alloc_copy_user_to_buffer | drivers/android/binder_alloc.c | size | copy_from_user() unvalidated size | no | FP |
| 3833 | Medium | 60 | G2 | binder_thread_read | drivers/android/binder.c | trsize | copy_to_user() unvalidated size | no | FP |
| 3834 | Medium | 60 | G2 | bits_from_user | drivers/input/evdev.c | len | copy_from_user() unvalidated size | no | FP |
| 3835 | Medium | 60 | G2 | bits_from_user | drivers/input/evdev.c | len | copy_from_user() unvalidated size | no | FP |
| 3836 | Medium | 60 | G2 | bits_from_user | drivers/input/evdev.c | len | copy_from_user() unvalidated size | no | FP |
| 3837 | Medium | 60 | G2 | bits_to_user | drivers/input/evdev.c | len | copy_to_user() unvalidated size | no | FP |
| 3838 | Medium | 60 | G2 | bits_to_user | drivers/input/evdev.c | len | copy_to_user() unvalidated size | no | FP |
| 3839 | Medium | 60 | G2 | bits_to_user | drivers/input/evdev.c | len | copy_to_user() unvalidated size | no | FP |
| 3840 | Medium | 60 | C | bme680_read_gas | drivers/iio/chemical/bme680_core.c | gas_range | subscript (callee) | no | FP |
| 3841 | Medium | 60 | C | bme680_trigger_handler | drivers/iio/chemical/bme680_core.c | gas_range | subscript (callee) | no | FP |
| 3842 | Medium | 60 | C | bng_re_rcfw_send_message | drivers/infiniband/hw/bng_re/bng_fw.c | cookie | subscript (callee) | no | FP |
| 3843 | Medium | 60 | C | bng_re_rcfw_send_message | drivers/infiniband/hw/bng_re/bng_fw.c | cookie | subscript | no | FP |
| 3844 | Medium | 60 | C | bnge_napi_poll | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | cpr | subscript (callee) | no | FP |
| 3845 | Medium | 60 | C | bnge_napi_poll | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | cpr | subscript (callee) | no | FP |
| 3846 | Medium | 60 | C | bnx2x_fill_frag_skb | drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | sge_idx | subscript (callee) | no | FP |
| 3847 | Medium | 60 | C | bnx2x_fill_frag_skb | drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | sge_idx | subscript (callee) | no | FP |
| 3848 | Medium | 60 | C | bnx2x_fill_frag_skb | drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | sge_idx | subscript | no | FP |
| 3849 | Medium | 60 | C | bnx2x_panic_dump | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | j | subscript | no | FP |
| 3850 | Medium | 60 | C | bnx2x_panic_dump | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | j | subscript | no | FP |
| 3851 | Medium | 60 | C | bnx2x_panic_dump | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | j | subscript | no | FP |
| 3852 | Medium | 60 | C | bnx2x_panic_dump | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | j | subscript | no | FP |
| 3853 | Medium | 60 | C | bnx2x_panic_dump | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | j | subscript | no | FP |
| 3854 | Medium | 60 | C | bnx2x_panic_dump | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | j | subscript | no | FP |
| 3855 | Medium | 60 | C | bnx2x_panic_dump | drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | j | subscript | no | FP |
| 3856 | Medium | 60 | G2 | bnxt_fill_cmdline | drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c | len | copy_from_user() unvalidated size | no | FP |
| 3857 | Medium | 60 | C | bnxt_qplib_cq_process_req | drivers/infiniband/hw/bnxt_re/qplib_fp.c | sq | subscript (callee) | no | FP |
| 3858 | Medium | 60 | C | bnxt_qplib_process_qp_event | drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | tbl_indx | subscript | no | FP |
| 3859 | Medium | 60 | B | bnxt_rx_pkt | drivers/net/ethernet/broadcom/bnxt/bnxt.c | skb | memset() | no | FP |
| 3860 | Medium | 60 | B | bos_descriptors_read | drivers/usb/core/sysfs.c | n | memcpy() | no | FP |
| 3861 | Medium | 60 | B | brcmf_cfg80211_mgmt_tx | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | le16_to_cpu(action_frame->len) | memcpy() | no | FP |
| 3862 | Medium | 60 | B | brcmf_cyw_mgmt_tx | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c | le16_to_cpu(mf_params->len) | memcpy() | no | FP |
| 3863 | Medium | 60 | B | brcmf_fweh_process_event | drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | event | memcpy() | no | FP |
| 3864 | Medium | 60 | C | brcmf_msgbuf_process_flow_ring_delete_response | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | flowid | subscript (callee) | no | FP |
| 3865 | Medium | 60 | C | brcmf_msgbuf_process_flow_ring_delete_response | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | flowid | subscript (callee) | no | FP |
| 3866 | Medium | 60 | B | brcmf_msgbuf_process_rx_complete | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | skb | memset() in brcmf_netif_mon_rx() | no | FP |
| 3867 | Medium | 60 | B | brcmf_msgbuf_process_rx_complete | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | skb | memset() in brcmf_netif_mon_rx() | no | FP |
| 3868 | Medium | 60 | B | brcmf_pcie_init_ringbuffers | drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | bufsz | memset() | no | FP |
| 3869 | Medium | 60 | B | brcmf_scan_params_v2_to_v1 | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | params_size | memcpy() | no | FP |
| 3870 | Medium | 60 | B | brcmf_sdio_dump_console | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | console_ptr | memcpy() in brcmf_sdiod_ramrw() | no | FP |
| 3871 | Medium | 60 | B | brcmf_sdio_dump_console | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | console_size | memcpy() in brcmf_sdiod_ramrw() | no | FP |
| 3872 | Medium | 60 | B | brcmf_sdio_dump_console | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | console_ptr | memcpy() in brcmf_sdiod_ramrw() | no | FP |
| 3873 | Medium | 60 | B | brcmf_sdio_dump_console | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | console_size | memcpy() in brcmf_sdiod_ramrw() | no | FP |
| 3874 | Medium | 60 | C | brcmf_sdio_dump_console | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | console_size | subscript | no | FP |
| 3875 | Medium | 60 | B | brcmf_sdio_readconsole | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | addr | memcpy() in brcmf_sdiod_ramrw() | no | FP |
| 3876 | Medium | 60 | B | brcmf_sdio_readconsole | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | addr | memcpy() in brcmf_sdiod_ramrw() | no | FP |
| 3877 | Medium | 60 | B | brcmf_sdio_readshared | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | addr | memcpy() in brcmf_sdiod_ramrw() | no | FP |
| 3878 | Medium | 60 | B | brcmf_sdio_readshared | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | addr | memcpy() in brcmf_sdiod_ramrw() | no | FP |
| 3879 | Medium | 60 | C | brcms_c_ampdu_add_frame | drivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c | fifo | subscript | no | FP |
| 3880 | Medium | 60 | C | brcms_c_ampdu_dotxstatus_complete | drivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c | mimoantsel | subscript (callee) | no | FP |
| 3881 | Medium | 60 | C | brcms_c_ampdu_dotxstatus_complete | drivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c | mimoantsel | subscript (callee) | no | FP |
| 3882 | Medium | 60 | C | brcms_c_ampdu_dotxstatus_complete | drivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c | index | subscript | no | FP |
| 3883 | Medium | 60 | C | brcms_c_ampdu_dotxstatus_complete | drivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c | index | subscript | no | FP |
| 3884 | Medium | 60 | C | brcms_c_ampdu_finalize | drivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c | fifo | subscript | no | FP |
| 3885 | Medium | 60 | C | bsearch | drivers/md/persistent-data/dm-btree.c | mid | subscript | no | FP |
| 3886 | Medium | 60 | G2 | bt_bmc_read | drivers/char/ipmi/bt-bmc.c | nread + len_byte | copy_to_user() unvalidated size | no | FP |
| 3887 | Medium | 60 | G2 | bt_bmc_write | drivers/char/ipmi/bt-bmc.c | nwritten | copy_from_user() unvalidated size | no | FP |
| 3888 | Medium | 60 | C | btt_freelist_init | drivers/nvdimm/btt.c | le32_to_cpu(log_new.seq) | subscript (callee) | no | FP |
| 3889 | Medium | 60 | C | bttv_risc_disasm | drivers/media/pci/bt8xx/bttv-driver.c | le32_to_cpu(risc->cpu[i]) | subscript (callee) | no | FP |
| 3890 | Medium | 60 | C | bttv_risc_disasm | drivers/media/pci/bt8xx/bttv-driver.c | le32_to_cpu(risc->cpu[i]) | subscript (callee) | no | FP |
| 3891 | Medium | 60 | B | btusb_generate_qca_nvm_name | drivers/bluetooth/btusb.c | len | snprintf() | no | FP |
| 3892 | Medium | 60 | B | btusb_generate_qca_nvm_name | drivers/bluetooth/btusb.c | len | snprintf() | no | FP |
| 3893 | Medium | 60 | B | btusb_generate_qca_nvm_name | drivers/bluetooth/btusb.c | len | snprintf() | no | FP |
| 3894 | Medium | 60 | G2 | buffer_from_user | drivers/staging/vme_user/vme_user.c | (unsigned long)count | copy_from_user() unvalidated size | no | FP |
| 3895 | Medium | 60 | G2 | buffer_to_user | drivers/staging/vme_user/vme_user.c | (unsigned long)count | copy_to_user() unvalidated size | no | FP |
| 3896 | Medium | 60 | C | build_maps | drivers/mtd/ftl.c | le16_to_cpu(header.LogicalEUN) | subscript | no | FP |
| 3897 | Medium | 60 | C | build_maps | drivers/mtd/ftl.c | le16_to_cpu(header.LogicalEUN) | subscript | no | FP |
| 3898 | Medium | 60 | C | build_maps | drivers/mtd/ftl.c | le16_to_cpu(header.LogicalEUN) | subscript | no | FP |
| 3899 | Medium | 60 | C | build_maps | drivers/mtd/ftl.c | BLOCK_NUMBER(le32_to_cpu(part->bam_cache | subscript | no | FP |
| 3900 | Medium | 60 | G2 | button_read | drivers/char/nwbutton.c | bcount | copy_to_user() unvalidated size | no | FP |
| 3901 | Medium | 60 | G2 | cadet_read | drivers/media/radio/radio-cadet.c | i | copy_to_user() unvalidated size | no | FP |
| 3902 | Medium | 60 | G2 | can327_ldisc_ioctl | drivers/net/can/can327.c | tmp | copy_to_user() unvalidated size | no | FP |
| 3903 | Medium | 60 | G2 | cap_ioctl | drivers/staging/greybus/authentication.c | size | copy_to_user() unvalidated size | no | FP |
| 3904 | Medium | 60 | G2 | cap_ioctl | drivers/staging/greybus/authentication.c | size | copy_to_user() unvalidated size | no | FP |
| 3905 | Medium | 60 | C | carl9170_ba_check | drivers/net/wireless/ath/carl9170/rx.c | queue | subscript | no | FP |
| 3906 | Medium | 60 | C | carl9170_ba_check | drivers/net/wireless/ath/carl9170/rx.c | queue | subscript | no | FP |
| 3907 | Medium | 60 | C | carl9170_ba_check | drivers/net/wireless/ath/carl9170/rx.c | queue | subscript | no | FP |
| 3908 | Medium | 60 | C | cdc_ncm_fill_tx_frame | drivers/net/usb/cdc_ncm.c | index | subscript | no | FP |
| 3909 | Medium | 60 | C | cdc_ncm_fill_tx_frame | drivers/net/usb/cdc_ncm.c | index | subscript | no | FP |
| 3910 | Medium | 60 | C | cdc_ncm_fill_tx_frame | drivers/net/usb/cdc_ncm.c | index | subscript | no | FP |
| 3911 | Medium | 60 | C | cdc_ncm_fill_tx_frame | drivers/net/usb/cdc_ncm.c | index | subscript | no | FP |
| 3912 | Medium | 60 | C | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | ep_trb_dma | subscript | no | FP |
| 3913 | Medium | 60 | G2 | cdrom_read_cdda_old | drivers/cdrom/cdrom.c | CD_FRAMESIZE_RAW * nr | copy_to_user() unvalidated size | no | FP |
| 3914 | Medium | 60 | G2 | chaoskey_read | drivers/usb/misc/chaoskey.c | this_time | copy_to_user() unvalidated size | no | FP |
| 3915 | Medium | 60 | C | chcr_ktls_cpl_act_open_rpl | drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | atid | subscript (callee) | no | FP |
| 3916 | Medium | 60 | G2 | chsc_ioctl_on_close_set | drivers/s390/cio/chsc_sch.c | PAGE_SIZE | copy_from_user() unvalidated size | no | FP |
| 3917 | Medium | 60 | G2 | chsc_ioctl_start | drivers/s390/cio/chsc_sch.c | PAGE_SIZE | copy_from_user() unvalidated size | no | FP |
| 3918 | Medium | 60 | G2 | chsc_ioctl_start | drivers/s390/cio/chsc_sch.c | PAGE_SIZE | copy_to_user() unvalidated size | no | FP |
| 3919 | Medium | 60 | G2 | chsc_ioctl_start_sync | drivers/s390/cio/chsc_sch.c | PAGE_SIZE | copy_from_user() unvalidated size | no | FP |
| 3920 | Medium | 60 | G2 | chsc_ioctl_start_sync | drivers/s390/cio/chsc_sch.c | PAGE_SIZE | copy_to_user() unvalidated size | no | FP |
| 3921 | Medium | 60 | G2 | ci_port_test_write | drivers/usb/chipidea/debug.c | count | copy_from_user() unvalidated size | no | FP |
| 3922 | Medium | 60 | C | cik_init_cp_pg_table | drivers/gpu/drm/radeon/cik.c | table_offset | subscript | no | FP |
| 3923 | Medium | 60 | C | cik_irq_process | drivers/gpu/drm/radeon/cik.c | src_id | subscript (callee) | no | FP |
| 3924 | Medium | 60 | G2 | clk_throttle_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(clk_throttle)) | copy_to_user() unvalidated size | no | FP |
| 3925 | Medium | 60 | G2 | cm_chan_msg_rcv | drivers/rapidio/rio_cm.c | msg_size | copy_to_user() unvalidated size | no | FP |
| 3926 | Medium | 60 | C | cm_recv_handler | drivers/infiniband/core/cm.c | attr_id | subscript | no | FP |
| 3927 | Medium | 60 | C | cm_send_handler | drivers/infiniband/core/cm.c | attr_index | subscript | no | FP |
| 3928 | Medium | 60 | C | cm_send_handler | drivers/infiniband/core/cm.c | attr_index | subscript | no | FP |
| 3929 | Medium | 60 | G2 | cobalt_lcdfb_read | drivers/video/fbdev/cobalt_lcdfb.c | len | copy_to_user() unvalidated size | no | FP |
| 3930 | Medium | 60 | G2 | comedi_buf_copy_from_user | drivers/comedi/comedi_fops.c | copy_amount | copy_from_user() unvalidated size | no | FP |
| 3931 | Medium | 60 | G2 | comedi_buf_copy_to_user | drivers/comedi/comedi_fops.c | copy_amount | copy_to_user() unvalidated size | no | FP |
| 3932 | Medium | 60 | G2 | command_file_read | drivers/misc/ibmasm/ibmasmfs.c | len | copy_to_user() unvalidated size | no | FP |
| 3933 | Medium | 60 | G2 | command_ioctl | drivers/gpib/common/gpib_os.c | (board->buffer_length < remain) ?
board->buffer_length : remain | copy_from_user() unvalidated size | no | FP |
| 3934 | Medium | 60 | G2 | comp_read | drivers/most/most_cdev.c | to_copy | copy_to_user() unvalidated size | no | FP |
| 3935 | Medium | 60 | G2 | comp_vdev_read | drivers/staging/most/video/video.c | cnt | copy_to_user() unvalidated size | no | FP |
| 3936 | Medium | 60 | G2 | comp_write | drivers/most/most_cdev.c | to_copy | copy_from_user() unvalidated size | no | FP |
| 3937 | Medium | 60 | C | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_mfi | subscript (callee) | no | FP |
| 3938 | Medium | 60 | C | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | device_id | subscript | no | FP |
| 3939 | Medium | 60 | C | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | subscript | no | FP |
| 3940 | Medium | 60 | C | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | subscript | no | FP |
| 3941 | Medium | 60 | C | complete_v3_hw | drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | slot | subscript (callee) | no | FP |
| 3942 | Medium | 60 | C | complete_v3_hw | drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | slot | subscript (callee) | no | FP |
| 3943 | Medium | 60 | B | complete_v3_hw | drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | slot | memset() in slot_complete_v3_hw() | no | FP |
| 3944 | Medium | 60 | B | complete_v3_hw | drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | slot | memcpy() in slot_complete_v3_hw() | no | FP |
| 3945 | Medium | 60 | B | composite_setup | drivers/usb/gadget/composite.c | value | memcpy() | no | FP |
| 3946 | Medium | 60 | B | composite_setup | drivers/usb/gadget/composite.c | value | memcpy() | no | FP |
| 3947 | Medium | 60 | B | composite_setup | drivers/usb/gadget/composite.c | landing_page_length | memcpy() | no | FP |
| 3948 | Medium | 60 | G2 | con_font_get | drivers/tty/vt/vt.c | c | copy_to_user() unvalidated size | no | FP |
| 3949 | Medium | 60 | G2 | con_get_unimap | drivers/tty/vt/consolemap.c | min(ect, ct) * sizeof(*unilist) | copy_to_user() unvalidated size | no | FP |
| 3950 | Medium | 60 | G2 | copy_arg_from_user | drivers/media/mc/mc-device.c | _IOC_SIZE(cmd) | copy_from_user() unvalidated size | no | FP |
| 3951 | Medium | 60 | G2 | copy_arg_to_user | drivers/media/mc/mc-device.c | _IOC_SIZE(cmd) | copy_to_user() unvalidated size | no | FP |
| 3952 | Medium | 60 | G2 | copy_from_buf | drivers/usb/mon/mon_bin.c | step_len | copy_to_user() unvalidated size | no | FP |
| 3953 | Medium | 60 | G2 | copy_from_compatible | drivers/staging/media/atomisp/pci/atomisp_cmd.c | n | copy_from_user() unvalidated size | no | FP |
| 3954 | Medium | 60 | G2 | copy_gid_entries_to_user | drivers/infiniband/core/uverbs_std_types_device.c | copy_len | copy_to_user() unvalidated size | no | FP |
| 3955 | Medium | 60 | G2 | copy_leftover_bytes | drivers/accel/ivpu/ivpu_ms.c | copy_bytes | copy_to_user() unvalidated size | no | FP |
| 3956 | Medium | 60 | G2 | copy_mask | drivers/gpu/drm/xe/xe_query.c | mask_size | copy_to_user() unvalidated size | no | FP |
| 3957 | Medium | 60 | G2 | copy_params | drivers/md/dm-ioctl.c | minimum_data_size - sizeof(param_kernel->version) | copy_from_user() unvalidated size | no | FP |
| 3958 | Medium | 60 | G2 | copy_query_item | drivers/gpu/drm/i915/i915_query.c | query_sz | copy_from_user() unvalidated size | no | FP |
| 3959 | Medium | 60 | G2 | copy_recv_mad | drivers/infiniband/core/user_mad.c | seg_payload | copy_to_user() unvalidated size | no | FP |
| 3960 | Medium | 60 | G2 | copy_send_mad | drivers/infiniband/core/user_mad.c | hdr_size(file) | copy_to_user() unvalidated size | no | FP |
| 3961 | Medium | 60 | G2 | copy_send_mad | drivers/infiniband/core/user_mad.c | packet->length | copy_to_user() unvalidated size | no | FP |
| 3962 | Medium | 60 | G2 | copy_signaled_event_data | drivers/gpu/drm/amd/amdkfd/kfd_events.c | size | copy_to_user() unvalidated size | no | FP |
| 3963 | Medium | 60 | G2 | copy_to_user_zero_pad | drivers/fwctl/main.c | copy_len | copy_to_user() unvalidated size | no | FP |
| 3964 | Medium | 60 | G2 | copy_ucs2_to_user_len | drivers/firmware/efi/test/efi_test.c | len | copy_to_user() unvalidated size | no | FP |
| 3965 | Medium | 60 | G2 | copy_urb_data_to_user | drivers/usb/core/devio.c | len | copy_to_user() unvalidated size | no | FP |
| 3966 | Medium | 60 | G2 | copy_urb_data_to_user | drivers/usb/core/devio.c | size | copy_to_user() unvalidated size | no | FP |
| 3967 | Medium | 60 | G2 | copydesc_user | drivers/vhost/vringh.c | len | copy_from_user() unvalidated size | no | FP |
| 3968 | Medium | 60 | G2 | copyout | drivers/sbus/char/openprom.c | len | copy_to_user() unvalidated size | no | FP |
| 3969 | Medium | 60 | C | cq_interrupt_v1_hw | drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | slot | subscript (callee) | no | FP |
| 3970 | Medium | 60 | C | cq_interrupt_v1_hw | drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | slot | subscript (callee) | no | FP |
| 3971 | Medium | 60 | B | cq_interrupt_v1_hw | drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | slot | memset() in slot_complete_v1_hw() | no | FP |
| 3972 | Medium | 60 | B | cq_interrupt_v1_hw | drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | slot | memcpy() in slot_complete_v1_hw() | no | FP |
| 3973 | Medium | 60 | C | cq_thread_v2_hw | drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | slot | subscript (callee) | no | FP |
| 3974 | Medium | 60 | C | cq_thread_v2_hw | drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | slot | subscript (callee) | no | FP |
| 3975 | Medium | 60 | B | cq_thread_v2_hw | drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | slot | memset() in slot_complete_v2_hw() | no | FP |
| 3976 | Medium | 60 | B | cq_thread_v2_hw | drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | slot | memcpy() in slot_complete_v2_hw() | no | FP |
| 3977 | Medium | 60 | C | cq_thread_v2_hw | drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | ncq_tag_count | subscript | no | FP |
| 3978 | Medium | 60 | B | create_authenc_wr | drivers/crypto/chelsio/chcr_algo.c | kctx_len | memcpy() | no | FP |
| 3979 | Medium | 60 | G2 | criu_checkpoint_bos | drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | num_bos * sizeof(*bo_buckets) | copy_to_user() unvalidated size | no | FP |
| 3980 | Medium | 60 | G2 | criu_checkpoint_bos | drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | num_bos * sizeof(*bo_privs) | copy_to_user() unvalidated size | no | FP |
| 3981 | Medium | 60 | G2 | criu_checkpoint_devices | drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | num_devices * sizeof(*device_buckets) | copy_to_user() unvalidated size | no | FP |
| 3982 | Medium | 60 | G2 | criu_checkpoint_devices | drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | num_devices * sizeof(*device_priv) | copy_to_user() unvalidated size | no | FP |
| 3983 | Medium | 60 | G2 | cros_ec_chardev_read | drivers/platform/chrome/cros_ec_chardev.c | count | copy_to_user() unvalidated size | no | FP |
| 3984 | Medium | 60 | G2 | cros_ec_chardev_read | drivers/platform/chrome/cros_ec_chardev.c | count | copy_to_user() unvalidated size | no | FP |
| 3985 | Medium | 60 | G2 | cs_counters_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(cs_counters)) | copy_to_user() unvalidated size | no | FP |
| 3986 | Medium | 60 | B | cs_dsp_adsp1_setup_algs | drivers/firmware/cirrus/cs_dsp.c | len | kzalloc() in cs_dsp_read_algs() | no | FP |
| 3987 | Medium | 60 | B | cs_dsp_adsp2_setup_algs | drivers/firmware/cirrus/cs_dsp.c | len | kzalloc() in cs_dsp_read_algs() | no | FP |
| 3988 | Medium | 60 | B | cs_dsp_halo_setup_algs | drivers/firmware/cirrus/cs_dsp.c | len | kzalloc() in cs_dsp_read_algs() | no | FP |
| 3989 | Medium | 60 | G2 | cs_ioctl_extract_signal_seq | drivers/accel/habanalabs/common/command_submission.c | size_to_copy | copy_from_user() unvalidated size | no | FP |
| 3990 | Medium | 60 | G2 | cs_timeout_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, max_size, sizeof(info)) | copy_to_user() unvalidated size | no | FP |
| 3991 | Medium | 60 | G2 | csio_mem_read | drivers/scsi/csiostor/csio_init.c | len | copy_to_user() unvalidated size | no | FP |
| 3992 | Medium | 60 | G2 | ctl_ioctl | drivers/md/dm-ioctl.c | param->data_size | copy_to_user() unvalidated size | no | FP |
| 3993 | Medium | 60 | G2 | cx18_copy_buf_to_user | drivers/media/pci/cx18/cx18-fileops.c | len | copy_to_user() unvalidated size | no | FP |
| 3994 | Medium | 60 | C | cx23885_risc_disasm | drivers/media/pci/cx23885/cx23885-core.c | le32_to_cpu(risc->cpu[i]) | subscript (callee) | no | FP |
| 3995 | Medium | 60 | C | cx23885_risc_disasm | drivers/media/pci/cx23885/cx23885-core.c | le32_to_cpu(risc->cpu[i]) | subscript (callee) | no | FP |
| 3996 | Medium | 60 | C | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eotid | subscript (callee) | no | FP |
| 3997 | Medium | 60 | C | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | subscript | no | FP |
| 3998 | Medium | 60 | G2 | cxgb_siocdevprivate | drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | chunk | copy_to_user() unvalidated size | no | FP |
| 3999 | Medium | 60 | C | cxgbit_pass_accept_req | drivers/target/iscsi/cxgbit/cxgbit_cm.c | stid | subscript (callee) | no | FP |
| 4000 | Medium | 60 | C | cxgbit_pass_accept_req | drivers/target/iscsi/cxgbit/cxgbit_cm.c | dst | subscript (callee) | no | FP |
| 4001 | Medium | 60 | C | cxgbit_pass_accept_req | drivers/target/iscsi/cxgbit/cxgbit_cm.c | dst | subscript (callee) | no | FP |
| 4002 | Medium | 60 | C | cxgbit_pass_accept_req | drivers/target/iscsi/cxgbit/cxgbit_cm.c | dst | subscript (callee) | no | FP |
| 4003 | Medium | 60 | C | cxgbit_pass_establish | drivers/target/iscsi/cxgbit/cxgbit_cm.c | tcp_opt | subscript (callee) | no | FP |
| 4004 | Medium | 60 | B | cxlctl_get_supported_features | drivers/cxl/core/features.c | out_size | kvzalloc() | no | FP |
| 4005 | Medium | 60 | G2 | dasd_eer_read | drivers/s390/block/dasd_eer.c | effective_count | copy_to_user() unvalidated size | no | FP |
| 4006 | Medium | 60 | G2 | dasd_ioctl_information | drivers/s390/block/dasd_ioctl.c | copy_size | copy_to_user() unvalidated size | no | FP |
| 4007 | Medium | 60 | G2 | dasd_ioctl_readall_cmb | drivers/s390/block/dasd_ioctl.c | min(size, sizeof(*argp)) | copy_to_user() unvalidated size | no | FP |
| 4008 | Medium | 60 | G2 | dax_ccb_exec | drivers/sbus/char/oradax.c | count | copy_from_user() unvalidated size | no | FP |
| 4009 | Medium | 60 | C | dcb_rpl | drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | dev | subscript (callee) | no | FP |
| 4010 | Medium | 60 | G2 | ddb_input_read | drivers/media/pci/ddbridge/ddbridge-core.c | free | copy_to_user() unvalidated size | no | FP |
| 4011 | Medium | 60 | C | ddcb_cmd_fixups | drivers/misc/genwqe/card_dev.c | page_offs | subscript | no | FP |
| 4012 | Medium | 60 | G2 | debug_coresight | drivers/accel/habanalabs/common/habanalabs_ioctl.c | args->input_size | copy_from_user() unvalidated size | no | FP |
| 4013 | Medium | 60 | G2 | debug_coresight | drivers/accel/habanalabs/common/habanalabs_ioctl.c | args->output_size | copy_to_user() unvalidated size | no | FP |
| 4014 | Medium | 60 | G2 | debug_level_proc_write | drivers/net/wireless/intel/ipw2x00/libipw_module.c | len | copy_from_user() unvalidated size | no | FP |
| 4015 | Medium | 60 | G2 | debugfs_store | drivers/firmware/tegra/bpmp-debugfs.c | count | copy_from_user() unvalidated size | no | FP |
| 4016 | Medium | 60 | G2 | dequeue_event | drivers/firewire/core-cdev.c | size | copy_to_user() unvalidated size | no | FP |
| 4017 | Medium | 60 | B | descriptors_read | drivers/usb/core/sysfs.c | n | memcpy() | no | FP |
| 4018 | Medium | 60 | G2 | dev_info_signed | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, max_size, sizeof(*info)) | copy_to_user() unvalidated size | no | FP |
| 4019 | Medium | 60 | G2 | dev_mem_alloc_page_sizes_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, max_size, sizeof(info)) | copy_to_user() unvalidated size | no | FP |
| 4020 | Medium | 60 | G2 | device_status_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t)size, sizeof(dev_stat)) | copy_to_user() unvalidated size | no | FP |
| 4021 | Medium | 60 | G2 | device_utilization | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(device_util)) | copy_to_user() unvalidated size | no | FP |
| 4022 | Medium | 60 | G2 | dfs_file_write | drivers/mtd/ubi/debug.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4023 | Medium | 60 | G2 | diag14_read | drivers/s390/char/vmur.c | len | copy_to_user() unvalidated size | no | FP |
| 4024 | Medium | 60 | G2 | dlfb_ops_ioctl | drivers/video/fbdev/udlfb.c | dlfb->edid_size | copy_to_user() unvalidated size | no | FP |
| 4025 | Medium | 60 | C | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | subscript (callee) | no | FP |
| 4026 | Medium | 60 | G2 | dma_heap_ioctl | drivers/dma-buf/dma-heap.c | in_size | copy_from_user() unvalidated size | no | FP |
| 4027 | Medium | 60 | G2 | dma_heap_ioctl | drivers/dma-buf/dma-heap.c | out_size | copy_to_user() unvalidated size | no | FP |
| 4028 | Medium | 60 | G2 | dmar_perf_latency_write | drivers/iommu/intel/debugfs.c | cnt | copy_from_user() unvalidated size | no | FP |
| 4029 | Medium | 60 | C | do_abort_req_rss | drivers/net/ethernet/chelsio/cxgb3/cxgb3_offload.c | hwtid | subscript (callee) | no | FP |
| 4030 | Medium | 60 | C | do_act_establish | drivers/net/ethernet/chelsio/cxgb3/cxgb3_offload.c | atid | subscript (callee) | no | FP |
| 4031 | Medium | 60 | C | do_act_open_rpl | drivers/net/ethernet/chelsio/cxgb3/cxgb3_offload.c | atid | subscript (callee) | no | FP |
| 4032 | Medium | 60 | G2 | do_chaninfo_ioctl | drivers/comedi/comedi_fops.c | s->n_chan * sizeof(unsigned int) | copy_to_user() unvalidated size | no | FP |
| 4033 | Medium | 60 | G2 | do_execute_ddcb | drivers/misc/genwqe/card_dev.c | sizeof(*cmd) - DDCB_ASIV_LENGTH | copy_to_user() unvalidated size | no | FP |
| 4034 | Medium | 60 | G2 | do_flash_read | drivers/misc/genwqe/card_dev.c | tocopy | copy_to_user() unvalidated size | no | FP |
| 4035 | Medium | 60 | G2 | do_flash_update | drivers/misc/genwqe/card_dev.c | tocopy | copy_from_user() unvalidated size | no | FP |
| 4036 | Medium | 60 | C | do_hwtid_rpl | drivers/net/ethernet/chelsio/cxgb3/cxgb3_offload.c | hwtid | subscript (callee) | no | FP |
| 4037 | Medium | 60 | G2 | do_insn_ioctl | drivers/comedi/comedi_fops.c | insn->n * sizeof(unsigned int) | copy_from_user() unvalidated size | no | FP |
| 4038 | Medium | 60 | G2 | do_insn_ioctl | drivers/comedi/comedi_fops.c | insn->n * sizeof(unsigned int) | copy_to_user() unvalidated size | no | FP |
| 4039 | Medium | 60 | G2 | do_insnlist_ioctl | drivers/comedi/comedi_fops.c | n * sizeof(unsigned int) | copy_from_user() unvalidated size | no | FP |
| 4040 | Medium | 60 | G2 | do_insnlist_ioctl | drivers/comedi/comedi_fops.c | n * sizeof(unsigned int) | copy_to_user() unvalidated size | no | FP |
| 4041 | Medium | 60 | G2 | do_kdgkb_ioctl | drivers/s390/char/keyboard.c | len | copy_to_user() unvalidated size | no | FP |
| 4042 | Medium | 60 | G2 | do_proc_bulk | drivers/usb/core/devio.c | len2 | copy_to_user() unvalidated size | no | FP |
| 4043 | Medium | 60 | G2 | do_proc_control | drivers/usb/core/devio.c | actlen | copy_to_user() unvalidated size | no | FP |
| 4044 | Medium | 60 | C | do_stid_rpl | drivers/net/ethernet/chelsio/cxgb3/cxgb3_offload.c | stid | subscript (callee) | no | FP |
| 4045 | Medium | 60 | G2 | do_subdinfo_ioctl | drivers/comedi/comedi_fops.c | dev->n_subdevices * sizeof(*tmp) | copy_to_user() unvalidated size | no | FP |
| 4046 | Medium | 60 | G2 | do_usercopy_page_span | drivers/misc/lkdtm/usercopy.c | unconst + (PAGE_SIZE / 2) | copy_to_user() unvalidated size | no | FP |
| 4047 | Medium | 60 | G2 | do_usercopy_page_span | drivers/misc/lkdtm/usercopy.c | unconst + PAGE_SIZE | copy_to_user() unvalidated size | no | FP |
| 4048 | Medium | 60 | G2 | do_usercopy_slab_size | drivers/misc/lkdtm/usercopy.c | size / 2 | copy_to_user() unvalidated size | no | FP |
| 4049 | Medium | 60 | G2 | do_usercopy_slab_size | drivers/misc/lkdtm/usercopy.c | size | copy_to_user() unvalidated size | no | FP |
| 4050 | Medium | 60 | G2 | do_usercopy_slab_size | drivers/misc/lkdtm/usercopy.c | size / 2 | copy_from_user() unvalidated size | no | FP |
| 4051 | Medium | 60 | G2 | do_usercopy_slab_size | drivers/misc/lkdtm/usercopy.c | size | copy_from_user() unvalidated size | no | FP |
| 4052 | Medium | 60 | G2 | do_usercopy_slab_whitelist | drivers/misc/lkdtm/usercopy.c | size | copy_to_user() unvalidated size | no | FP |
| 4053 | Medium | 60 | G2 | do_usercopy_slab_whitelist | drivers/misc/lkdtm/usercopy.c | size | copy_to_user() unvalidated size | no | FP |
| 4054 | Medium | 60 | G2 | do_usercopy_slab_whitelist | drivers/misc/lkdtm/usercopy.c | size | copy_from_user() unvalidated size | no | FP |
| 4055 | Medium | 60 | G2 | do_usercopy_slab_whitelist | drivers/misc/lkdtm/usercopy.c | size | copy_from_user() unvalidated size | no | FP |
| 4056 | Medium | 60 | G2 | do_usercopy_stack | drivers/misc/lkdtm/usercopy.c | unconst + sizeof(good_stack) | copy_to_user() unvalidated size | no | FP |
| 4057 | Medium | 60 | G2 | do_usercopy_stack | drivers/misc/lkdtm/usercopy.c | unconst + sizeof(good_stack) | copy_to_user() unvalidated size | no | FP |
| 4058 | Medium | 60 | G2 | do_usercopy_stack | drivers/misc/lkdtm/usercopy.c | unconst + sizeof(good_stack) | copy_from_user() unvalidated size | no | FP |
| 4059 | Medium | 60 | G2 | do_usercopy_stack | drivers/misc/lkdtm/usercopy.c | unconst + sizeof(good_stack) | copy_from_user() unvalidated size | no | FP |
| 4060 | Medium | 60 | G2 | dp_sdp_message_debugfs_write | drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | write_size | copy_from_user() unvalidated size | no | FP |
| 4061 | Medium | 60 | C | dr_parse_cqe | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c | idx | subscript | no | FP |
| 4062 | Medium | 60 | C | dr_parse_cqe | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c | idx | subscript | no | FP |
| 4063 | Medium | 60 | G2 | dram_pending_rows_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, max_size, sizeof(pend_rows_num)) | copy_to_user() unvalidated size | no | FP |
| 4064 | Medium | 60 | G2 | dram_replaced_rows_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, max_size, sizeof(info)) | copy_to_user() unvalidated size | no | FP |
| 4065 | Medium | 60 | G2 | dram_usage_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(dram_usage)) | copy_to_user() unvalidated size | no | FP |
| 4066 | Medium | 60 | G2 | drm_copy_field | drivers/gpu/drm/drm_ioctl.c | len | copy_to_user() unvalidated size | no | FP |
| 4067 | Medium | 60 | G2 | drm_ioctl | drivers/gpu/drm/drm_ioctl.c | in_size | copy_from_user() unvalidated size | no | FP |
| 4068 | Medium | 60 | G2 | drm_ioctl | drivers/gpu/drm/drm_ioctl.c | out_size | copy_to_user() unvalidated size | no | FP |
| 4069 | Medium | 60 | G2 | drm_mode_createblob_ioctl | drivers/gpu/drm/drm_property.c | out_resp->length | copy_from_user() unvalidated size | no | FP |
| 4070 | Medium | 60 | G2 | drm_mode_gamma_get_ioctl | drivers/gpu/drm/drm_color_mgmt.c | size | copy_to_user() unvalidated size | no | FP |
| 4071 | Medium | 60 | G2 | drm_mode_gamma_get_ioctl | drivers/gpu/drm/drm_color_mgmt.c | size | copy_to_user() unvalidated size | no | FP |
| 4072 | Medium | 60 | G2 | drm_mode_gamma_get_ioctl | drivers/gpu/drm/drm_color_mgmt.c | size | copy_to_user() unvalidated size | no | FP |
| 4073 | Medium | 60 | G2 | drm_mode_gamma_set_ioctl | drivers/gpu/drm/drm_color_mgmt.c | size | copy_from_user() unvalidated size | no | FP |
| 4074 | Medium | 60 | G2 | drm_mode_gamma_set_ioctl | drivers/gpu/drm/drm_color_mgmt.c | size | copy_from_user() unvalidated size | no | FP |
| 4075 | Medium | 60 | G2 | drm_mode_gamma_set_ioctl | drivers/gpu/drm/drm_color_mgmt.c | size | copy_from_user() unvalidated size | no | FP |
| 4076 | Medium | 60 | G2 | drm_mode_getproperty_ioctl | drivers/gpu/drm/drm_property.c | DRM_PROP_NAME_LEN | copy_to_user() unvalidated size | no | FP |
| 4077 | Medium | 60 | G2 | drm_syncobj_array_find | drivers/gpu/drm/drm_syncobj.c | sizeof(uint32_t) * count_handles | copy_from_user() unvalidated size | no | FP |
| 4078 | Medium | 60 | G2 | drm_syncobj_array_wait_timeout | drivers/gpu/drm/drm_syncobj.c | sizeof(uint64_t) * count | copy_from_user() unvalidated size | no | FP |
| 4079 | Medium | 60 | G2 | dtn_log_read | drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | to_copy | copy_to_user() unvalidated size | no | FP |
| 4080 | Medium | 60 | G2 | dvb_aplay | drivers/staging/media/av7110/av7110_av.c | n | copy_from_user() unvalidated size | no | FP |
| 4081 | Medium | 60 | G2 | dvb_play | drivers/staging/media/av7110/av7110_av.c | n | copy_from_user() unvalidated size | no | FP |
| 4082 | Medium | 60 | G2 | dvb_ringbuffer_pkt_read_user | drivers/media/dvb-core/dvb_ringbuffer.c | todo | copy_to_user() unvalidated size | no | FP |
| 4083 | Medium | 60 | G2 | dvb_ringbuffer_read_user | drivers/media/dvb-core/dvb_ringbuffer.c | todo | copy_to_user() unvalidated size | no | FP |
| 4084 | Medium | 60 | G2 | dvb_ringbuffer_write_user | drivers/media/dvb-core/dvb_ringbuffer.c | todo | copy_from_user() unvalidated size | no | FP |
| 4085 | Medium | 60 | G2 | dwc3_link_state_write | drivers/usb/dwc3/debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4086 | Medium | 60 | G2 | dwc3_lsp_write | drivers/usb/dwc3/debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4087 | Medium | 60 | G2 | dwc3_mode_write | drivers/usb/dwc3/debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4088 | Medium | 60 | G2 | dwc3_testmode_write | drivers/usb/dwc3/debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4089 | Medium | 60 | G2 | eb_copy_relocations | drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | len | __copy_from_user() unvalidated size | no | FP |
| 4090 | Medium | 60 | G2 | edt_ft5x06_debugfs_raw_data_read | drivers/input/touchscreen/edt-ft5x06.c | read | copy_to_user() unvalidated size | no | FP |
| 4091 | Medium | 60 | G2 | efi_capsule_write | drivers/firmware/efi/capsule-loader.c | write_byte | copy_from_user() unvalidated size | no | FP |
| 4092 | Medium | 60 | B | ehv_bc_tty_probe | drivers/tty/ehv_bytechan.c | bc | memset() in tty_port_init() | no | FP |
| 4093 | Medium | 60 | G2 | eisa_eeprom_read | drivers/parisc/eisa_eeprom.c | count | copy_to_user() unvalidated size | no | FP |
| 4094 | Medium | 60 | B | emi26_load_firmware | drivers/usb/misc/emi26.c | be16_to_cpu(rec->len) | memcpy() | no | FP |
| 4095 | Medium | 60 | G2 | envctrl_read | drivers/sbus/char/envctrl.c | ret | copy_to_user() unvalidated size | no | FP |
| 4096 | Medium | 60 | G2 | envctrl_read | drivers/sbus/char/envctrl.c | ret | copy_to_user() unvalidated size | no | FP |
| 4097 | Medium | 60 | G2 | envctrl_read | drivers/sbus/char/envctrl.c | ret | copy_to_user() unvalidated size | no | FP |
| 4098 | Medium | 60 | G2 | envctrl_read | drivers/sbus/char/envctrl.c | ret | copy_to_user() unvalidated size | no | FP |
| 4099 | Medium | 60 | G2 | envctrl_read | drivers/sbus/char/envctrl.c | ret | copy_to_user() unvalidated size | no | FP |
| 4100 | Medium | 60 | G2 | envctrl_read | drivers/sbus/char/envctrl.c | ret | copy_to_user() unvalidated size | no | FP |
| 4101 | Medium | 60 | G2 | envctrl_read | drivers/sbus/char/envctrl.c | ret | copy_to_user() unvalidated size | no | FP |
| 4102 | Medium | 60 | G2 | envctrl_read | drivers/sbus/char/envctrl.c | ret | copy_to_user() unvalidated size | no | FP |
| 4103 | Medium | 60 | G2 | envctrl_read | drivers/sbus/char/envctrl.c | ret | copy_to_user() unvalidated size | no | FP |
| 4104 | Medium | 60 | G2 | envctrl_read | drivers/sbus/char/envctrl.c | ret | copy_to_user() unvalidated size | no | FP |
| 4105 | Medium | 60 | G2 | ep0_write | drivers/usb/gadget/legacy/inode.c | len | copy_from_user() unvalidated size | no | FP |
| 4106 | Medium | 60 | C | erdma_poll_one_cqe | drivers/infiniband/hw/erdma/erdma_cq.c | wqe_idx | subscript | no | FP |
| 4107 | Medium | 60 | C | erdma_poll_one_cqe | drivers/infiniband/hw/erdma/erdma_cq.c | syndrome | subscript | no | FP |
| 4108 | Medium | 60 | C | erdma_poll_one_cqe | drivers/infiniband/hw/erdma/erdma_cq.c | syndrome | subscript | no | FP |
| 4109 | Medium | 60 | G2 | etb_read | drivers/hwtracing/coresight/coresight-etb10.c | len | copy_to_user() unvalidated size | no | FP |
| 4110 | Medium | 60 | G2 | evdev_do_ioctl | drivers/input/evdev.c | min_t(size_t,
size, sizeof(struct input_absinfo)) | copy_to_user() unvalidated size | no | FP |
| 4111 | Medium | 60 | G2 | evdev_do_ioctl | drivers/input/evdev.c | min_t(size_t,
size, sizeof(struct input_absinfo)) | copy_from_user() unvalidated size | no | FP |
| 4112 | Medium | 60 | G2 | event_read | drivers/platform/chrome/wilco_ec/event.c | n_bytes_written | copy_to_user() unvalidated size | no | FP |
| 4113 | Medium | 60 | G2 | evtchn_read | drivers/xen/evtchn.c | bytes1 | copy_to_user() unvalidated size | no | FP |
| 4114 | Medium | 60 | G2 | f_hidg_intout_read | drivers/usb/gadget/function/f_hid.c | count | copy_to_user() unvalidated size | no | FP |
| 4115 | Medium | 60 | G2 | f_hidg_ssreport_read | drivers/usb/gadget/function/f_hid.c | count | copy_to_user() unvalidated size | no | FP |
| 4116 | Medium | 60 | G2 | f_hidg_write | drivers/usb/gadget/function/f_hid.c | count | copy_from_user() unvalidated size | no | FP |
| 4117 | Medium | 60 | G2 | fan_proc_write | drivers/platform/x86/toshiba_acpi.c | len | copy_from_user() unvalidated size | no | FP |
| 4118 | Medium | 60 | G2 | fastrpc_get_args | drivers/misc/fastrpc.c | len | copy_from_user() unvalidated size | no | FP |
| 4119 | Medium | 60 | G2 | fastrpc_invoke | drivers/misc/fastrpc.c | nscalars * sizeof(*args) | copy_from_user() unvalidated size | no | FP |
| 4120 | Medium | 60 | G2 | fault_opcodes_write | drivers/infiniband/hw/hfi1/fault.c | copy | copy_from_user() unvalidated size | no | FP |
| 4121 | Medium | 60 | G2 | fb_io_read | drivers/video/fbdev/core/fb_io_fops.c | c | copy_to_user() unvalidated size | no | FP |
| 4122 | Medium | 60 | G2 | fb_io_write | drivers/video/fbdev/core/fb_io_fops.c | c | copy_from_user() unvalidated size | no | FP |
| 4123 | Medium | 60 | G2 | fb_sys_read | drivers/video/fbdev/core/fb_sys_fops.c | count | copy_to_user() unvalidated size | no | FP |
| 4124 | Medium | 60 | G2 | fb_sys_write | drivers/video/fbdev/core/fb_sys_fops.c | count | copy_from_user() unvalidated size | no | FP |
| 4125 | Medium | 60 | B | fbnic_tlv_attr_get_string | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | len | memset() | no | FP |
| 4126 | Medium | 60 | C | fbnic_tlv_attr_nest_start | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | le16_to_cpu(msg->hdr.len) | subscript | no | FP |
| 4127 | Medium | 60 | C | fbnic_tlv_attr_nest_stop | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | le16_to_cpu(msg->hdr.len) | subscript | no | FP |
| 4128 | Medium | 60 | C | fbnic_tlv_attr_put_flag | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | le16_to_cpu(msg->hdr.len) | subscript | no | FP |
| 4129 | Medium | 60 | C | fbnic_tlv_attr_put_value | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | le16_to_cpu(msg->hdr.len) | subscript | no | FP |
| 4130 | Medium | 60 | B | fc_exch_recv_bls | drivers/scsi/libfc/fc_exch.c | ep | memset() in fc_exch_recv_abts() | no | FP |
| 4131 | Medium | 60 | B | fc_rport_recv_prlo_req | drivers/scsi/libfc/fc_rport.c | len | memset() | no | FP |
| 4132 | Medium | 60 | C | fcoe_ctlr_recv_clr_vlink | drivers/scsi/fcoe/fcoe_ctlr.c | num_vlink_desc | subscript | no | FP |
| 4133 | Medium | 60 | G2 | fd_copyin | drivers/block/floppy.c | size | copy_from_user() unvalidated size | no | FP |
| 4134 | Medium | 60 | G2 | fd_copyout | drivers/block/floppy.c | size | copy_to_user() unvalidated size | no | FP |
| 4135 | Medium | 60 | C | fec_enet_select_queue | drivers/net/ethernet/freescale/fec_main.c | vlan_tag | subscript | no | FP |
| 4136 | Medium | 60 | B | ffs_ep0_read | drivers/usb/gadget/function/f_fs.c | len | kmalloc() | no | FP |
| 4137 | Medium | 60 | B | ffs_ep0_read | drivers/usb/gadget/function/f_fs.c | ret | copy_to_user() | no | FP |
| 4138 | Medium | 60 | C | ffs_func_req_match | drivers/usb/gadget/function/f_fs.c | le16_to_cpu(creq->wIndex) | subscript (callee) | no | FP |
| 4139 | Medium | 60 | C | ffs_func_setup | drivers/usb/gadget/function/f_fs.c | le16_to_cpu(creq->wIndex) | subscript (callee) | no | FP |
| 4140 | Medium | 60 | G2 | fill_art | drivers/thermal/intel/int340x_thermal/acpi_thermal_rel.c | art_len | copy_to_user() unvalidated size | no | FP |
| 4141 | Medium | 60 | G2 | fill_faults | drivers/gpu/drm/xe/xe_vm.c | args->size | copy_to_user() unvalidated size | no | FP |
| 4142 | Medium | 60 | G2 | fill_psvt | drivers/thermal/intel/int340x_thermal/acpi_thermal_rel.c | psvt_len | copy_to_user() unvalidated size | no | FP |
| 4143 | Medium | 60 | G2 | fill_readbuf | drivers/char/virtio_console.c | out_count | copy_to_user() unvalidated size | no | FP |
| 4144 | Medium | 60 | G2 | fill_topology_info | drivers/gpu/drm/i915/i915_query.c | slice_length | copy_to_user() unvalidated size | no | FP |
| 4145 | Medium | 60 | G2 | fill_trt | drivers/thermal/intel/int340x_thermal/acpi_thermal_rel.c | trt_len | copy_to_user() unvalidated size | no | FP |
| 4146 | Medium | 60 | G2 | flash_read | drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | len | copy_to_user() unvalidated size | no | FP |
| 4147 | Medium | 60 | C | fm10k_type_trans | drivers/net/ethernet/intel/fm10k/fm10k_main.c | idx | subscript | no | FP |
| 4148 | Medium | 60 | G2 | fme_pr | drivers/fpga/dfl-fme-pr.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4149 | Medium | 60 | G2 | fops_read | drivers/media/pci/saa7164/saa7164-vbi.c | cnt | copy_to_user() unvalidated size | no | FP |
| 4150 | Medium | 60 | G2 | fops_read | drivers/media/pci/saa7164/saa7164-encoder.c | cnt | copy_to_user() unvalidated size | no | FP |
| 4151 | Medium | 60 | G2 | from_buffer | drivers/scsi/st.c | cnt | copy_to_user() unvalidated size | no | FP |
| 4152 | Medium | 60 | B | ft_recv_write_data | drivers/target/tcm_fc/tfc_io.c | tlen | memcpy() | no | FP |
| 4153 | Medium | 60 | C | fun_abandon_admin_cmd | drivers/net/ethernet/fungible/funcore/fun_dev.c | cid | subscript | no | FP |
| 4154 | Medium | 60 | C | fun_handle_cqe_pkt | drivers/net/ethernet/fungible/funeth/funeth_rx.c | cv | subscript (callee) | no | FP |
| 4155 | Medium | 60 | B | fw_cfg_register_dir_entries | drivers/firmware/qemu_fw_cfg.c | dir_size | memset() in fw_cfg_read_blob() | no | FP |
| 4156 | Medium | 60 | G2 | fwctl_cmd_info | drivers/fwctl/main.c | cmd->device_data_len | clear_user() unvalidated size | no | FP |
| 4157 | Medium | 60 | C | gaudi_patch_cb | drivers/accel/habanalabs/gaudi/gaudi.c | pkt_id | subscript | no | FP |
| 4158 | Medium | 60 | B | gaudi_patch_cb | drivers/accel/habanalabs/gaudi/gaudi.c | pkt_size | memcpy() | no | FP |
| 4159 | Medium | 60 | C | gaudi_validate_cb | drivers/accel/habanalabs/gaudi/gaudi.c | pkt_id | subscript | no | FP |
| 4160 | Medium | 60 | B | gb_loopback_async_transfer_complete | drivers/staging/greybus/loopback.c | len | memcmp() | no | FP |
| 4161 | Medium | 60 | B | gb_pwm_probe | drivers/staging/greybus/pwm.c | npwm | kzalloc() in pwmchip_alloc() | no | FP |
| 4162 | Medium | 60 | G2 | gb_raw_send | drivers/staging/greybus/raw.c | len | copy_from_user() unvalidated size | no | FP |
| 4163 | Medium | 60 | G2 | genwqe_free_sync_sgl | drivers/misc/genwqe/card_utils.c | sgl->fpage_size | copy_to_user() unvalidated size | no | FP |
| 4164 | Medium | 60 | G2 | genwqe_free_sync_sgl | drivers/misc/genwqe/card_utils.c | sgl->lpage_size | copy_to_user() unvalidated size | no | FP |
| 4165 | Medium | 60 | G2 | get_clk_rate | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, max_size, sizeof(clk_rate)) | copy_to_user() unvalidated size | no | FP |
| 4166 | Medium | 60 | G2 | get_reset_count | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(reset_count)) | copy_to_user() unvalidated size | no | FP |
| 4167 | Medium | 60 | G2 | get_wave_state | drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | *ctl_stack_used_size | copy_to_user() unvalidated size | no | FP |
| 4168 | Medium | 60 | B | gfar_clean_rx_ring | drivers/net/ethernet/freescale/gianfar.c | skb | memset() in gfar_process_frame() | no | FP |
| 4169 | Medium | 60 | B | gfx_v10_0_rlc_backdoor_autoload_copy_gfx_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_size | memcpy() in gfx_v10_0_rlc_backdoor_autoload_copy_ucode() | no | FP |
| 4170 | Medium | 60 | B | gfx_v10_0_rlc_backdoor_autoload_copy_sdma_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_size | memcpy() in gfx_v10_0_rlc_backdoor_autoload_copy_ucode() | no | FP |
| 4171 | Medium | 60 | B | gfx_v11_0_rlc_backdoor_autoload_copy_gfx_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | memcpy() in gfx_v11_0_rlc_backdoor_autoload_copy_ucode() | no | FP |
| 4172 | Medium | 60 | B | gfx_v11_0_rlc_backdoor_autoload_copy_mes_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | memcpy() in gfx_v11_0_rlc_backdoor_autoload_copy_ucode() | no | FP |
| 4173 | Medium | 60 | B | gfx_v12_0_cp_compute_load_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_ucode_size | memcpy() | no | FP |
| 4174 | Medium | 60 | B | gfx_v12_0_cp_compute_load_microcode_rs64 | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_data_size | memcpy() | no | FP |
| 4175 | Medium | 60 | B | gfx_v12_0_rlc_backdoor_autoload_copy_gfx_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_size | memcpy() in gfx_v12_0_rlc_backdoor_autoload_copy_ucode() | no | FP |
| 4176 | Medium | 60 | B | gfx_v12_0_rlc_backdoor_autoload_copy_mes_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_size | memcpy() in gfx_v12_0_rlc_backdoor_autoload_copy_ucode() | no | FP |
| 4177 | Medium | 60 | B | gfx_v12_0_rlc_backdoor_autoload_copy_sdma_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_size | memcpy() in gfx_v12_0_rlc_backdoor_autoload_copy_ucode() | no | FP |
| 4178 | Medium | 60 | B | gfx_v12_1_rlc_backdoor_autoload_copy_gfx_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_size | memcpy() in gfx_v12_1_rlc_backdoor_autoload_copy_ucode() | no | FP |
| 4179 | Medium | 60 | B | gfx_v12_1_rlc_backdoor_autoload_copy_mes_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_size | memcpy() in gfx_v12_1_rlc_backdoor_autoload_copy_ucode() | no | FP |
| 4180 | Medium | 60 | B | gfx_v12_1_rlc_backdoor_autoload_copy_sdma_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_size | memcpy() in gfx_v12_1_rlc_backdoor_autoload_copy_ucode() | no | FP |
| 4181 | Medium | 60 | G2 | ggtt_write | drivers/gpu/drm/i915/i915_gem.c | length | copy_from_user() unvalidated size | no | FP |
| 4182 | Medium | 60 | B | gicv5_its_alloc_l2_devtab | drivers/irqchip/irq-gic-v5-its.c | span | kcalloc() | no | FP |
| 4183 | Medium | 60 | B | gicv5_its_alloc_l2_devtab | drivers/irqchip/irq-gic-v5-its.c | l2devtab | kcalloc() | no | FP |
| 4184 | Medium | 60 | G2 | gnss_write | drivers/gnss/core.c | n | copy_from_user() unvalidated size | no | FP |
| 4185 | Medium | 60 | C | goya_patch_cb | drivers/accel/habanalabs/goya/goya.c | pkt_id | subscript | no | FP |
| 4186 | Medium | 60 | B | goya_patch_cb | drivers/accel/habanalabs/goya/goya.c | pkt_size | memcpy() | no | FP |
| 4187 | Medium | 60 | B | goya_patch_cb | drivers/accel/habanalabs/goya/goya.c | pkt_size | memcpy() | no | FP |
| 4188 | Medium | 60 | C | goya_validate_cb | drivers/accel/habanalabs/goya/goya.c | pkt_id | subscript | no | FP |
| 4189 | Medium | 60 | G2 | gru_user_copy_handle | drivers/misc/sgi-gru/grukdump.c | GRU_HANDLE_BYTES | copy_to_user() unvalidated size | no | FP |
| 4190 | Medium | 60 | C | gsi_event_trans | drivers/net/ipa/gsi.c | tre_index | subscript (callee) | no | FP |
| 4191 | Medium | 60 | C | gtp0_udp_encap_recv | drivers/net/gtp.c | be64_to_cpu(gtp0->tid) | subscript (callee) | no | FP |
| 4192 | Medium | 60 | C | gtp1u_udp_encap_recv | drivers/net/gtp.c | ntohl(gtp1->tid) | subscript (callee) | no | FP |
| 4193 | Medium | 60 | G2 | gtt_user_read | drivers/gpu/drm/i915/i915_gem.c | length | copy_to_user() unvalidated size | no | FP |
| 4194 | Medium | 60 | C | gve_fill_ethtool_flow_spec | drivers/net/ethernet/google/gve/gve_flow_rule.c | be16_to_cpu(flow_rule->flow_type) | subscript | no | FP |
| 4195 | Medium | 60 | C | handle_cmd_completion | drivers/usb/host/xhci-ring.c | slot_id | subscript (callee) | no | FP |
| 4196 | Medium | 60 | C | handle_device_notification | drivers/usb/host/xhci-ring.c | udev | subscript (callee) | no | FP |
| 4197 | Medium | 60 | C | handle_device_notification | drivers/usb/host/xhci-ring.c | slot_id | subscript | no | FP |
| 4198 | Medium | 60 | C | handle_device_notification | drivers/usb/host/xhci-ring.c | slot_id | subscript | no | FP |
| 4199 | Medium | 60 | G2 | handle_mailbox_cmd_from_user | drivers/cxl/core/mbox.c | mbox_cmd->size_out | copy_to_user() unvalidated size | no | FP |
| 4200 | Medium | 60 | C | handle_port_status | drivers/usb/host/xhci-ring.c | hcd_portnum | subscript (callee) | no | FP |
| 4201 | Medium | 60 | C | handle_tx_event | drivers/usb/host/xhci-ring.c | ep_trb_dma | subscript (callee) | no | FP |
| 4202 | Medium | 60 | C | handle_tx_event | drivers/usb/host/xhci-ring.c | td | subscript (callee) | no | FP |
| 4203 | Medium | 60 | C | hash_filter_rpl | drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | ftid | subscript (callee) | no | FP |
| 4204 | Medium | 60 | C | hash_filter_rpl | drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | f | subscript (callee) | no | FP |
| 4205 | Medium | 60 | B | hash_filter_rpl | drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | f | memset() in clear_filter() | no | FP |
| 4206 | Medium | 60 | G2 | hdpvr_read | drivers/media/usb/hdpvr/hdpvr-video.c | cnt | copy_to_user() unvalidated size | no | FP |
| 4207 | Medium | 60 | C | hfi1_handle_kdeth_eflags | drivers/infiniband/hw/hfi1/tid_rdma.c | qp | subscript | no | FP |
| 4208 | Medium | 60 | C | hfi1_kdeth_eager_rcv | drivers/infiniband/hw/hfi1/verbs.c | opcode | subscript | no | FP |
| 4209 | Medium | 60 | C | hfi1_kdeth_expected_rcv | drivers/infiniband/hw/hfi1/verbs.c | opcode | subscript | no | FP |
| 4210 | Medium | 60 | C | hfi1_rc_rcv | drivers/infiniband/hw/hfi1/rc.c | rkey | subscript (callee) | no | FP |
| 4211 | Medium | 60 | C | hfi1_rc_rcv | drivers/infiniband/hw/hfi1/rc.c | rkey | subscript (callee) | no | FP |
| 4212 | Medium | 60 | C | hfi1_rc_rcv | drivers/infiniband/hw/hfi1/rc.c | rkey | subscript (callee) | no | FP |
| 4213 | Medium | 60 | C | hfi1_rc_rcv | drivers/infiniband/hw/hfi1/rc.c | rkey | subscript (callee) | no | FP |
| 4214 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | subscript (callee) | no | FP |
| 4215 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4216 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | subscript (callee) | no | FP |
| 4217 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4218 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | subscript (callee) | no | FP |
| 4219 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4220 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | subscript (callee) | no | FP |
| 4221 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4222 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_read_resp | drivers/infiniband/hw/hfi1/tid_rdma.c | req | subscript (callee) | no | FP |
| 4223 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_read_resp | drivers/infiniband/hw/hfi1/tid_rdma.c | req | subscript | no | FP |
| 4224 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | subscript (callee) | no | FP |
| 4225 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4226 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | subscript (callee) | no | FP |
| 4227 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4228 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | subscript (callee) | no | FP |
| 4229 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4230 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | subscript (callee) | no | FP |
| 4231 | Medium | 60 | C | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4232 | Medium | 60 | C | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | vaddr | subscript (callee) | no | FP |
| 4233 | Medium | 60 | C | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | rkey | subscript (callee) | no | FP |
| 4234 | Medium | 60 | C | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | vaddr | subscript (callee) | no | FP |
| 4235 | Medium | 60 | C | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | rkey | subscript (callee) | no | FP |
| 4236 | Medium | 60 | C | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | vaddr | subscript (callee) | no | FP |
| 4237 | Medium | 60 | C | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | rkey | subscript (callee) | no | FP |
| 4238 | Medium | 60 | C | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | vaddr | subscript (callee) | no | FP |
| 4239 | Medium | 60 | C | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | rkey | subscript (callee) | no | FP |
| 4240 | Medium | 60 | G2 | hfi1_user_exp_rcv_invalid | drivers/infiniband/hw/hfi1/user_exp_rcv.c | sizeof(*array) * tinfo->tidcnt | copy_to_user() unvalidated size | no | FP |
| 4241 | Medium | 60 | C | hfi1_user_sdma_process_request | drivers/infiniband/hw/hfi1/user_sdma.c | dlid | subscript (callee) | no | FP |
| 4242 | Medium | 60 | C | hfi1_user_sdma_process_request | drivers/infiniband/hw/hfi1/user_sdma.c | dlid | subscript (callee) | no | FP |
| 4243 | Medium | 60 | C | hfi1_user_sdma_process_request | drivers/infiniband/hw/hfi1/user_sdma.c | selector | subscript (callee) | no | FP |
| 4244 | Medium | 60 | G2 | hiddev_ioctl | drivers/hid/usbhid/hiddev.c | len | copy_to_user() unvalidated size | no | FP |
| 4245 | Medium | 60 | G2 | hiddev_ioctl | drivers/hid/usbhid/hiddev.c | len | copy_to_user() unvalidated size | no | FP |
| 4246 | Medium | 60 | G2 | hidraw_get_report | drivers/hid/hidraw.c | len | copy_to_user() unvalidated size | no | FP |
| 4247 | Medium | 60 | G2 | hidraw_read | drivers/hid/hidraw.c | len | copy_to_user() unvalidated size | no | FP |
| 4248 | Medium | 60 | G2 | hidraw_ro_variable_size_ioctl | drivers/hid/hidraw.c | len | copy_to_user() unvalidated size | no | FP |
| 4249 | Medium | 60 | G2 | hidraw_ro_variable_size_ioctl | drivers/hid/hidraw.c | len | copy_to_user() unvalidated size | no | FP |
| 4250 | Medium | 60 | G2 | hidraw_ro_variable_size_ioctl | drivers/hid/hidraw.c | len | copy_to_user() unvalidated size | no | FP |
| 4251 | Medium | 60 | G2 | hisi_acc_vf_precopy_ioctl | drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | offsetofend(struct vfio_precopy_info, dirty_bytes) | copy_to_user() unvalidated size | no | FP |
| 4252 | Medium | 60 | G2 | hisi_acc_vf_resume_write | drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | len | copy_from_user() unvalidated size | no | FP |
| 4253 | Medium | 60 | G2 | hisi_acc_vf_save_read | drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | len | copy_to_user() unvalidated size | no | FP |
| 4254 | Medium | 60 | C | hl_build_hwmon_channel_info | drivers/accel/habanalabs/common/hwmon.c | type | subscript | no | FP |
| 4255 | Medium | 60 | C | hl_build_hwmon_channel_info | drivers/accel/habanalabs/common/hwmon.c | type | subscript | no | FP |
| 4256 | Medium | 60 | G2 | hl_cs_copy_chunk_array | drivers/accel/habanalabs/common/command_submission.c | size_to_copy | copy_from_user() unvalidated size | no | FP |
| 4257 | Medium | 60 | C | hl_irq_handler_cq | drivers/accel/habanalabs/common/irq.c | shadow_index | subscript (callee) | no | FP |
| 4258 | Medium | 60 | G2 | hl_multi_cs_wait_ioctl | drivers/accel/habanalabs/common/command_submission.c | size_to_copy | copy_from_user() unvalidated size | no | FP |
| 4259 | Medium | 60 | G2 | hmcdrv_ftp_cmd | drivers/s390/char/hmcdrv_ftp.c | retlen | copy_to_user() unvalidated size | no | FP |
| 4260 | Medium | 60 | G2 | hmcdrv_ftp_cmd | drivers/s390/char/hmcdrv_ftp.c | ftp.len | copy_from_user() unvalidated size | no | FP |
| 4261 | Medium | 60 | B | hns3_handle_rx_copybreak | drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | frag_size | memcpy() | no | FP |
| 4262 | Medium | 60 | C | hns_roce_v2_aeq_int | drivers/infiniband/hw/hns/hns_roce_hw_v2.c | le16_to_cpu(aeqe->event.cmd.token) | subscript (callee) | no | FP |
| 4263 | Medium | 60 | G2 | hpsa_big_passthru_ioctl | drivers/scsi/hpsa.c | buff_size[i] | copy_to_user() unvalidated size | no | FP |
| 4264 | Medium | 60 | G2 | hw_events_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min(max_size, size) | copy_to_user() unvalidated size | no | FP |
| 4265 | Medium | 60 | G2 | hw_idle | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(hw_idle)) | copy_to_user() unvalidated size | no | FP |
| 4266 | Medium | 60 | G2 | hw_ip_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) size, sizeof(hw_ip)) | copy_to_user() unvalidated size | no | FP |
| 4267 | Medium | 60 | G2 | hwicap_read | drivers/char/xilinx_hwicap/xilinx_hwicap.c | bytes_to_read | copy_to_user() unvalidated size | no | FP |
| 4268 | Medium | 60 | G2 | hwicap_read | drivers/char/xilinx_hwicap/xilinx_hwicap.c | bytes_to_read | copy_to_user() unvalidated size | no | FP |
| 4269 | Medium | 60 | G2 | hwicap_write | drivers/char/xilinx_hwicap/xilinx_hwicap.c | len - (drvdata->write_buffer_in_use) | copy_from_user() unvalidated size | no | FP |
| 4270 | Medium | 60 | G2 | hwicap_write | drivers/char/xilinx_hwicap/xilinx_hwicap.c | len | copy_from_user() unvalidated size | no | FP |
| 4271 | Medium | 60 | C | hws_send_engine_poll_cq | drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c | wqe_cnt | subscript | no | FP |
| 4272 | Medium | 60 | G2 | i40e_dbg_command_write | drivers/net/ethernet/intel/i40e/i40e_debugfs.c | count | copy_from_user() unvalidated size | no | FP |
| 4273 | Medium | 60 | G2 | i40e_dbg_netdev_ops_write | drivers/net/ethernet/intel/i40e/i40e_debugfs.c | count | copy_from_user() unvalidated size | no | FP |
| 4274 | Medium | 60 | B | i40e_set_cld_element | drivers/net/ethernet/intel/i40e/i40e_main.c | ipa | memcpy() | no | FP |
| 4275 | Medium | 60 | G2 | i915_gem_execbuffer2_ioctl | drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | sizeof(*exec2_list) * count | copy_from_user() unvalidated size | no | FP |
| 4276 | Medium | 60 | G2 | i915_gem_object_pread_phys | drivers/gpu/drm/i915/gem/i915_gem_phys.c | args->size | copy_to_user() unvalidated size | no | FP |
| 4277 | Medium | 60 | G2 | i915_gem_object_pwrite_phys | drivers/gpu/drm/i915/gem/i915_gem_phys.c | args->size | copy_from_user() unvalidated size | no | FP |
| 4278 | Medium | 60 | G2 | ib_umad_write | drivers/infiniband/core/user_mad.c | hdr_len + data_len - copy_offset | copy_from_user() unvalidated size | no | FP |
| 4279 | Medium | 60 | G2 | ib_uverbs_event_read | drivers/infiniband/core/uverbs_main.c | eventsz | copy_to_user() unvalidated size | no | FP |
| 4280 | Medium | 60 | G2 | ib_uverbs_post_send | drivers/infiniband/core/uverbs_cmd.c | next->num_sge *
sizeof(struct ib_sge) | copy_from_user() unvalidated size | no | FP |
| 4281 | Medium | 60 | G2 | ib_uverbs_run_method | drivers/infiniband/core/uverbs_ioctl.c | uattrs_size | copy_from_user() unvalidated size | no | FP |
| 4282 | Medium | 60 | C | ibmvfc_tgt_prli_done | drivers/scsi/ibmvscsi/ibmvfc.c | index | subscript | no | FP |
| 4283 | Medium | 60 | C | ibmvfc_tgt_prli_done | drivers/scsi/ibmvscsi/ibmvfc.c | index | subscript | no | FP |
| 4284 | Medium | 60 | G2 | ibmvmc_ioctl_sethmcid | drivers/misc/ibmvmc.c | HMC_ID_LEN | copy_from_user() unvalidated size | no | FP |
| 4285 | Medium | 60 | G2 | ibmvmc_write | drivers/misc/ibmvmc.c | bytes | copy_from_user() unvalidated size | no | FP |
| 4286 | Medium | 60 | C | ibmvnic_poll | drivers/net/ethernet/ibm/ibmvnic.c | rx_buff | subscript (callee) | no | FP |
| 4287 | Medium | 60 | C | ibmvnic_poll | drivers/net/ethernet/ibm/ibmvnic.c | rx_buff | subscript (callee) | no | FP |
| 4288 | Medium | 60 | C | ibmvnic_tx_scrq_clean_buffer | drivers/net/ethernet/ibm/ibmvnic.c | index | subscript | no | FP |
| 4289 | Medium | 60 | C | ice_erase_nvm_module | drivers/net/ethernet/intel/ice/ice_fw_update.c | completion_retval | subscript (callee) | no | FP |
| 4290 | Medium | 60 | C | ice_erase_nvm_module | drivers/net/ethernet/intel/ice/ice_fw_update.c | completion_retval | subscript (callee) | no | FP |
| 4291 | Medium | 60 | C | ice_ptp_parse_sdp_entries | drivers/net/ethernet/intel/ice/ice_ptp.c | dir | subscript | no | FP |
| 4292 | Medium | 60 | C | ice_sched_add_node | drivers/net/ethernet/intel/ice/ice_sched.c | parent | subscript | no | FP |
| 4293 | Medium | 60 | C | ice_switch_flash_banks | drivers/net/ethernet/intel/ice/ice_fw_update.c | completion_retval | subscript (callee) | no | FP |
| 4294 | Medium | 60 | C | ice_switch_flash_banks | drivers/net/ethernet/intel/ice/ice_fw_update.c | completion_retval | subscript (callee) | no | FP |
| 4295 | Medium | 60 | C | ice_write_one_nvm_block | drivers/net/ethernet/intel/ice/ice_fw_update.c | completion_retval | subscript (callee) | no | FP |
| 4296 | Medium | 60 | C | ice_write_one_nvm_block | drivers/net/ethernet/intel/ice/ice_fw_update.c | completion_retval | subscript (callee) | no | FP |
| 4297 | Medium | 60 | C | idpf_tx_clean_complq | drivers/net/ethernet/intel/idpf/idpf_txrx.c | le16_to_cpu(hw_head) | subscript (callee) | no | FP |
| 4298 | Medium | 60 | G2 | idxd_copy_cr | drivers/dma/idxd/cdev.c | len - status_size | copy_to_user() unvalidated size | no | FP |
| 4299 | Medium | 60 | G2 | igd_opregion_shift_copy | drivers/vfio/pci/vfio_pci_igd.c | bytes | copy_to_user() unvalidated size | no | FP |
| 4300 | Medium | 60 | C | il4965_fill_txpower_tbl | drivers/net/wireless/intel/iwlegacy/4965.c | power_idx | subscript | no | FP |
| 4301 | Medium | 60 | C | il4965_fill_txpower_tbl | drivers/net/wireless/intel/iwlegacy/4965.c | power_idx | subscript | no | FP |
| 4302 | Medium | 60 | C | il4965_hdl_rx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | rate_n_flags | subscript (callee) | no | FP |
| 4303 | Medium | 60 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | txq_id | subscript (callee) | no | FP |
| 4304 | Medium | 60 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | tid | subscript (callee) | no | FP |
| 4305 | Medium | 60 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | tid | subscript (callee) | no | FP |
| 4306 | Medium | 60 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | txq_id | subscript (callee) | no | FP |
| 4307 | Medium | 60 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | txq_id | subscript (callee) | no | FP |
| 4308 | Medium | 60 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | txq_id | subscript (callee) | no | FP |
| 4309 | Medium | 60 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | txq_id | subscript (callee) | no | FP |
| 4310 | Medium | 60 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | agg | subscript (callee) | no | FP |
| 4311 | Medium | 60 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | txq_id | subscript (callee) | no | FP |
| 4312 | Medium | 60 | B | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | info | memset() | no | FP |
| 4313 | Medium | 60 | G2 | il4965_rs_sta_dbgfs_scale_table_write | drivers/net/wireless/intel/iwlegacy/4965-rs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4314 | Medium | 60 | C | il4965_send_tx_power | drivers/net/wireless/intel/iwlegacy/4965.c | le16_to_cpu(il->active.channel) | subscript (callee) | no | FP |
| 4315 | Medium | 60 | C | il4965_send_tx_power | drivers/net/wireless/intel/iwlegacy/4965.c | le16_to_cpu(il->active.channel) | subscript (callee) | no | FP |
| 4316 | Medium | 60 | B | il4965_tx_status_reply_compressed_ba | drivers/net/wireless/intel/iwlegacy/4965-mac.c | info | memset() | no | FP |
| 4317 | Medium | 60 | G2 | il_dbgfs_clear_traffic_stats_write | drivers/net/wireless/intel/iwlegacy/debug.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4318 | Medium | 60 | G2 | il_dbgfs_clear_ucode_stats_write | drivers/net/wireless/intel/iwlegacy/debug.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4319 | Medium | 60 | G2 | il_dbgfs_disable_ht40_write | drivers/net/wireless/intel/iwlegacy/debug.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4320 | Medium | 60 | G2 | il_dbgfs_interrupt_write | drivers/net/wireless/intel/iwlegacy/debug.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4321 | Medium | 60 | G2 | il_dbgfs_missed_beacon_write | drivers/net/wireless/intel/iwlegacy/debug.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4322 | Medium | 60 | G2 | il_dbgfs_sram_write | drivers/net/wireless/intel/iwlegacy/debug.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4323 | Medium | 60 | G2 | il_dbgfs_wd_timeout_write | drivers/net/wireless/intel/iwlegacy/debug.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4324 | Medium | 60 | C | il_tx_cmd_complete | drivers/net/wireless/intel/iwlegacy/common.c | cmd_idx | subscript | no | FP |
| 4325 | Medium | 60 | C | il_tx_cmd_complete | drivers/net/wireless/intel/iwlegacy/common.c | cmd_idx | subscript | no | FP |
| 4326 | Medium | 60 | G2 | ilo_read | drivers/misc/hpilo.c | len | copy_to_user() unvalidated size | no | FP |
| 4327 | Medium | 60 | G2 | ilo_write | drivers/misc/hpilo.c | len | copy_from_user() unvalidated size | no | FP |
| 4328 | Medium | 60 | B | in_rq_cur | drivers/usb/gadget/function/f_uac2.c | value | memcpy() | no | FP |
| 4329 | Medium | 60 | B | in_rq_cur | drivers/usb/gadget/function/f_uac2.c | value | memcpy() | no | FP |
| 4330 | Medium | 60 | B | in_rq_max | drivers/usb/gadget/function/f_uac1.c | value | memcpy() | no | FP |
| 4331 | Medium | 60 | B | in_rq_range | drivers/usb/gadget/function/f_uac2.c | value | memcpy() | no | FP |
| 4332 | Medium | 60 | B | in_rq_range | drivers/usb/gadget/function/f_uac2.c | value | memcpy() | no | FP |
| 4333 | Medium | 60 | B | init_powerplay_table_information | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_processpptables.c | power_saving_clock_count | kcalloc() in phm_copy_clock_limits_array() | no | FP |
| 4334 | Medium | 60 | B | init_powerplay_table_information | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_processpptables.c | od_setting_count | kcalloc() in phm_copy_overdrive_settings_limits_array() | no | FP |
| 4335 | Medium | 60 | B | init_powerplay_table_information | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_processpptables.c | od_feature_count | kzalloc() in copy_overdrive_feature_capabilities_array() | no | FP |
| 4336 | Medium | 60 | G2 | inject_data_ue_store | drivers/edac/versal_edac.c | len | copy_from_user() unvalidated size | no | FP |
| 4337 | Medium | 60 | G2 | inject_ue_write | drivers/edac/zynqmp_edac.c | len | copy_from_user() unvalidated size | no | FP |
| 4338 | Medium | 60 | G2 | intel_sseu_copy_eumask_to_user | drivers/gpu/drm/i915/gt/intel_sseu.c | len | copy_to_user() unvalidated size | no | FP |
| 4339 | Medium | 60 | G2 | intel_sseu_copy_ssmask_to_user | drivers/gpu/drm/i915/gt/intel_sseu.c | len | copy_to_user() unvalidated size | no | FP |
| 4340 | Medium | 60 | G2 | intel_vgpu_ioctl | drivers/gpu/drm/i915/gvt/kvmgt.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4341 | Medium | 60 | C | intr_handler | drivers/net/ethernet/adaptec/starfire.c | entry | subscript | no | FP |
| 4342 | Medium | 60 | G2 | ioctl_event_summary | drivers/pci/switch/switchtec.c | size | copy_to_user() unvalidated size | no | FP |
| 4343 | Medium | 60 | G2 | ioctl_get_info | drivers/firewire/core-cdev.c | min(want, have) | copy_to_user() unvalidated size | no | FP |
| 4344 | Medium | 60 | G2 | ioctl_probe | drivers/scsi/scsi_ioctl.c | len | copy_to_user() unvalidated size | no | FP |
| 4345 | Medium | 60 | G2 | iommufd_fault_fops_write | drivers/iommu/iommufd/eventq.c | response_size | copy_from_user() unvalidated size | no | FP |
| 4346 | Medium | 60 | G2 | iommufd_get_hw_info | drivers/iommu/iommufd/device.c | copy_len | copy_to_user() unvalidated size | no | FP |
| 4347 | Medium | 60 | G2 | iommufd_test_dirty | drivers/iommu/iommufd/selftest.c | DIV_ROUND_UP(max, BITS_PER_BYTE) | copy_from_user() unvalidated size | no | FP |
| 4348 | Medium | 60 | G2 | iommufd_ucmd_respond | drivers/iommu/iommufd/iommufd_private.h | min_t(size_t, ucmd->user_size, cmd_len) | copy_to_user() unvalidated size | no | FP |
| 4349 | Medium | 60 | G2 | iommufd_vfio_iommu_get_info | drivers/iommu/iommufd/vfio_compat.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4350 | Medium | 60 | G2 | iommufd_vfio_map_dma | drivers/iommu/iommufd/vfio_compat.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4351 | Medium | 60 | G2 | iommufd_vfio_unmap_dma | drivers/iommu/iommufd/vfio_compat.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4352 | Medium | 60 | B | ionic_admin_poll_locked | drivers/infiniband/hw/ionic/ionic_admin.c | stride_len | memcpy() | no | FP |
| 4353 | Medium | 60 | B | ionic_admin_poll_locked | drivers/infiniband/hw/ionic/ionic_admin.c | stride_len | memcpy() | no | FP |
| 4354 | Medium | 60 | C | ionic_comp_msn | drivers/infiniband/hw/ionic/ionic_datapath.c | cqe_seq | subscript | no | FP |
| 4355 | Medium | 60 | C | ionic_comp_msn | drivers/infiniband/hw/ionic/ionic_datapath.c | cqe_idx | subscript | no | FP |
| 4356 | Medium | 60 | B | ionic_map_disc_cmb | drivers/net/ethernet/pensando/ionic/ionic_dev.c | sz | kzalloc() | no | FP |
| 4357 | Medium | 60 | C | ionic_rx_filter_find | drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c | le16_to_cpu(ac->vlan.vlan) | subscript (callee) | no | FP |
| 4358 | Medium | 60 | B | ionic_rx_filter_save | drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c | f | devm_kzalloc() | no | FP |
| 4359 | Medium | 60 | B | ionic_rx_filter_save | drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c | f | memcpy() | no | FP |
| 4360 | Medium | 60 | C | ionic_rx_filter_save | drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c | key | subscript | no | FP |
| 4361 | Medium | 60 | C | ionic_rx_filter_save | drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c | key | subscript | no | FP |
| 4362 | Medium | 60 | C | ionic_rx_filter_save | drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c | le16_to_cpu(ac->vlan.vlan) | subscript (callee) | no | FP |
| 4363 | Medium | 60 | G2 | iopt_pages_rw_access | drivers/iommu/iommufd/pages.c | length | copy_to_user() unvalidated size | no | FP |
| 4364 | Medium | 60 | G2 | iopt_pages_rw_access | drivers/iommu/iommufd/pages.c | length | copy_from_user() unvalidated size | no | FP |
| 4365 | Medium | 60 | G2 | iowarrior_ioctl | drivers/usb/misc/iowarrior.c | dev->report_size | copy_to_user() unvalidated size | no | FP |
| 4366 | Medium | 60 | B | ipc_protocol_free_msg_get | drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | msg | memset() | no | FP |
| 4367 | Medium | 60 | C | ipr_dump_ioasa | drivers/scsi/ipr.c | error_index | subscript | no | FP |
| 4368 | Medium | 60 | B | ipr_get_autosense | drivers/scsi/ipr.c | min_t(u16, be16_to_cpu(ioasa64->auto_sen | memcpy() | no | FP |
| 4369 | Medium | 60 | B | ipr_get_autosense | drivers/scsi/ipr.c | min_t(u16, be16_to_cpu(ioasa->auto_sense | memcpy() | no | FP |
| 4370 | Medium | 60 | C | ipr_handle_log_data | drivers/scsi/ipr.c | error_index | subscript | no | FP |
| 4371 | Medium | 60 | C | ipr_handle_log_data | drivers/scsi/ipr.c | error_index | subscript | no | FP |
| 4372 | Medium | 60 | C | ipr_handle_log_data | drivers/scsi/ipr.c | error_index | subscript | no | FP |
| 4373 | Medium | 60 | C | ipr_process_hrrq | drivers/scsi/ipr.c | ipr_cmd | subscript (callee) | no | FP |
| 4374 | Medium | 60 | B | iscsit_setup_scsi_cmd | drivers/target/iscsi/iscsi_target.c | cdb_length | kmalloc() | no | FP |
| 4375 | Medium | 60 | B | iscsit_setup_scsi_cmd | drivers/target/iscsi/iscsi_target.c | cdb_length | memcpy() | no | FP |
| 4376 | Medium | 60 | G2 | isst_if_exec_multi_cmd | drivers/platform/x86/intel/speed_select_if/isst_if_common.c | cb->cmd_size | copy_from_user() unvalidated size | no | FP |
| 4377 | Medium | 60 | G2 | isst_if_exec_multi_cmd | drivers/platform/x86/intel/speed_select_if/isst_if_common.c | cb->cmd_size | copy_to_user() unvalidated size | no | FP |
| 4378 | Medium | 60 | G2 | ivpu_submit | drivers/accel/ivpu/ivpu_job.c | buffer_count * sizeof(u32) | copy_from_user() unvalidated size | no | FP |
| 4379 | Medium | 60 | G2 | ivtv_buf_copy_from_user | drivers/media/pci/ivtv/ivtv-queue.c | copybytes | copy_from_user() unvalidated size | no | FP |
| 4380 | Medium | 60 | G2 | ivtv_copy_buf_to_user | drivers/media/pci/ivtv/ivtv-fileops.c | len | copy_to_user() unvalidated size | no | FP |
| 4381 | Medium | 60 | G2 | ivtvfb_write | drivers/media/pci/ivtv/ivtvfb.c | lead | copy_from_user() unvalidated size | no | FP |
| 4382 | Medium | 60 | G2 | ivtvfb_write | drivers/media/pci/ivtv/ivtvfb.c | tail | copy_from_user() unvalidated size | no | FP |
| 4383 | Medium | 60 | B | iwl_dbg_tlv_add | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | node | memcpy() | no | FP |
| 4384 | Medium | 60 | B | iwl_dbg_tlv_add | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | len | memcpy() | no | FP |
| 4385 | Medium | 60 | C | iwl_dbg_tlv_alloc | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tlv_idx | subscript | no | FP |
| 4386 | Medium | 60 | G2 | iwl_dbgfs_calib_disabled_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4387 | Medium | 60 | G2 | iwl_dbgfs_clear_ucode_statistics_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4388 | Medium | 60 | G2 | iwl_dbgfs_disable_ht40_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4389 | Medium | 60 | G2 | iwl_dbgfs_echo_test_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4390 | Medium | 60 | G2 | iwl_dbgfs_log_event_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4391 | Medium | 60 | G2 | iwl_dbgfs_mem_write | drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | data_size | copy_from_user() unvalidated size | no | FP |
| 4392 | Medium | 60 | G2 | iwl_dbgfs_missed_beacon_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4393 | Medium | 60 | G2 | iwl_dbgfs_plcp_delta_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4394 | Medium | 60 | G2 | iwl_dbgfs_protection_mode_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4395 | Medium | 60 | G2 | iwl_dbgfs_rx_handlers_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4396 | Medium | 60 | G2 | iwl_dbgfs_sleep_level_override_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4397 | Medium | 60 | G2 | iwl_dbgfs_sram_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4398 | Medium | 60 | G2 | iwl_dbgfs_txfifo_flush_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4399 | Medium | 60 | G2 | iwl_dbgfs_ucode_tracing_write | drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4400 | Medium | 60 | C | iwl_mld_handle_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mld/scan.c | band | subscript (callee) | no | FP |
| 4401 | Medium | 60 | C | iwl_mld_handle_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mld/scan.c | band | subscript | no | FP |
| 4402 | Medium | 60 | C | iwl_mld_handle_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mld/scan.c | band | subscript | no | FP |
| 4403 | Medium | 60 | C | iwl_mld_handle_probe_resp_data_notif | drivers/net/wireless/intel/iwlwifi/mld/iface.c | le32_to_cpu(notif->mac_id) | subscript | no | FP |
| 4404 | Medium | 60 | B | iwl_mld_handle_session_prot_notif | drivers/net/wireless/intel/iwlwifi/mld/session-protect.c | session_protect | memset() | no | FP |
| 4405 | Medium | 60 | B | iwl_mld_handle_session_prot_notif | drivers/net/wireless/intel/iwlwifi/mld/session-protect.c | session_protect | memset() | no | FP |
| 4406 | Medium | 60 | C | iwl_mld_reorder | drivers/net/wireless/intel/iwlwifi/mld/agg.c | index | subscript | no | FP |
| 4407 | Medium | 60 | C | iwl_mvm_reorder | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | index | subscript | no | FP |
| 4408 | Medium | 60 | C | iwl_mvm_rx_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mvm/scan.c | band | subscript (callee) | no | FP |
| 4409 | Medium | 60 | C | iwl_mvm_rx_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mvm/scan.c | band | subscript | no | FP |
| 4410 | Medium | 60 | C | iwl_mvm_rx_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mvm/scan.c | band | subscript | no | FP |
| 4411 | Medium | 60 | C | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | sta | subscript (callee) | no | FP |
| 4412 | Medium | 60 | C | iwl_pcie_hcmd_complete | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx.c | cmd_index | subscript | no | FP |
| 4413 | Medium | 60 | C | iwl_pcie_hcmd_complete | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx.c | cmd_index | subscript | no | FP |
| 4414 | Medium | 60 | C | iwl_pcie_rx_handle_rb | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c | cmd_index | subscript | no | FP |
| 4415 | Medium | 60 | C | iwl_pcie_rx_handle_rb | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c | cmd_index | subscript | no | FP |
| 4416 | Medium | 60 | G2 | iwl_write_to_user_buf | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c | *size | copy_to_user() unvalidated size | no | FP |
| 4417 | Medium | 60 | C | iwlagn_rx_reply_rx | drivers/net/wireless/intel/iwlwifi/dvm/rx.c | rate_n_flags | subscript (callee) | no | FP |
| 4418 | Medium | 60 | C | ixgbe_clean_rx_irq | drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | skb | subscript (callee) | no | FP |
| 4419 | Medium | 60 | C | ixgbe_parse_e610_caps | drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | index | subscript | no | FP |
| 4420 | Medium | 60 | C | ixgbe_parse_e610_caps | drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | index | subscript | no | FP |
| 4421 | Medium | 60 | C | ixgbe_parse_e610_caps | drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | index | subscript | no | FP |
| 4422 | Medium | 60 | C | ixgbe_parse_e610_caps | drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | index | subscript | no | FP |
| 4423 | Medium | 60 | C | ixgbe_parse_e610_caps | drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | index | subscript | no | FP |
| 4424 | Medium | 60 | B | job_ready | drivers/media/test-drivers/vicodec/vicodec-core.c | copy | memcpy() | no | FP |
| 4425 | Medium | 60 | G2 | joydev_ioctl_common | drivers/input/joydev.c | sizeof(joydev->corr[0]) * joydev->nabs | copy_from_user() unvalidated size | no | FP |
| 4426 | Medium | 60 | G2 | joydev_ioctl_common | drivers/input/joydev.c | sizeof(joydev->corr[0]) * joydev->nabs | copy_to_user() unvalidated size | no | FP |
| 4427 | Medium | 60 | G2 | joydev_ioctl_common | drivers/input/joydev.c | len | copy_to_user() unvalidated size | no | FP |
| 4428 | Medium | 60 | G2 | joydev_ioctl_common | drivers/input/joydev.c | len | copy_to_user() unvalidated size | no | FP |
| 4429 | Medium | 60 | G2 | joydev_ioctl_common | drivers/input/joydev.c | len | copy_to_user() unvalidated size | no | FP |
| 4430 | Medium | 60 | G2 | kbd_ioctl | drivers/s390/char/keyboard.c | ct * sizeof(struct kbdiacruc) | copy_to_user() unvalidated size | no | FP |
| 4431 | Medium | 60 | G2 | keys_proc_write | drivers/platform/x86/toshiba_acpi.c | len | copy_from_user() unvalidated size | no | FP |
| 4432 | Medium | 60 | G2 | kfd_criu_checkpoint_events | drivers/gpu/drm/amd/amdkfd/kfd_events.c | num_events * sizeof(*ev_privs) | copy_to_user() unvalidated size | no | FP |
| 4433 | Medium | 60 | G2 | kfd_criu_checkpoint_svm | drivers/gpu/drm/amd/amdkfd/kfd_svm.c | svm_priv_data_size | copy_to_user() unvalidated size | no | FP |
| 4434 | Medium | 60 | G2 | kfd_dbg_trap_device_snapshot | drivers/gpu/drm/amd/amdkfd/kfd_debug.c | *entry_size | copy_to_user() unvalidated size | no | FP |
| 4435 | Medium | 60 | G2 | kfd_dbg_trap_enable | drivers/gpu/drm/amd/amdkfd/kfd_debug.c | copy_size | copy_to_user() unvalidated size | no | FP |
| 4436 | Medium | 60 | G2 | kfd_dbg_trap_query_exception_info | drivers/gpu/drm/amd/amdkfd/kfd_debug.c | copy_size | copy_to_user() unvalidated size | no | FP |
| 4437 | Medium | 60 | G2 | kfd_dbg_trap_query_exception_info | drivers/gpu/drm/amd/amdkfd/kfd_debug.c | copy_size | copy_to_user() unvalidated size | no | FP |
| 4438 | Medium | 60 | G2 | kfd_ioctl | drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | usize | copy_from_user() unvalidated size | no | FP |
| 4439 | Medium | 60 | G2 | kfd_ioctl_get_dmabuf_info | drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | args->metadata_size | copy_to_user() unvalidated size | no | FP |
| 4440 | Medium | 60 | G2 | kfd_ioctl_get_process_apertures_new | drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | (i * sizeof(struct kfd_process_device_apertures)) | copy_to_user() unvalidated size | no | FP |
| 4441 | Medium | 60 | G2 | kfd_ioctl_get_tile_config | drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | args->num_tile_configs * sizeof(uint32_t) | copy_to_user() unvalidated size | no | FP |
| 4442 | Medium | 60 | G2 | kfd_ioctl_get_tile_config | drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | args->num_macro_tile_configs * sizeof(uint32_t) | copy_to_user() unvalidated size | no | FP |
| 4443 | Medium | 60 | G2 | kfd_smi_ev_read | drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | to_copy | copy_to_user() unvalidated size | no | FP |
| 4444 | Medium | 60 | B | ksz8463_spi_read | drivers/net/dsa/microchip/ksz_spi.c | v | memcpy() | no | FP |
| 4445 | Medium | 60 | B | ksz8463_spi_read | drivers/net/dsa/microchip/ksz_spi.c | v | memcpy() | no | FP |
| 4446 | Medium | 60 | C | kvaser_usb_hydra_rx_msg_ext | drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | dlc | subscript (callee) | no | FP |
| 4447 | Medium | 60 | B | lan78xx_rx | drivers/net/usb/lan78xx.c | frame_len | memcpy() | no | FP |
| 4448 | Medium | 60 | G2 | last_err_open_dev_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, max_size, sizeof(info)) | copy_to_user() unvalidated size | no | FP |
| 4449 | Medium | 60 | B | lbs_hard_start_xmit | drivers/net/wireless/marvell/libertas/tx.c | le16_to_cpu(txpd->tx_packet_length) | memcpy() | no | FP |
| 4450 | Medium | 60 | B | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_ethhdr | memcpy() | no | FP |
| 4451 | Medium | 60 | B | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_ethhdr | memcpy() | no | FP |
| 4452 | Medium | 60 | G2 | lcd_ioctl | drivers/usb/misc/usblcd.c | strlen(buf) | copy_to_user() unvalidated size | no | FP |
| 4453 | Medium | 60 | G2 | lcd_proc_write | drivers/platform/x86/toshiba_acpi.c | len | copy_from_user() unvalidated size | no | FP |
| 4454 | Medium | 60 | G2 | ld_usb_read | drivers/usb/misc/ldusb.c | bytes_to_read | copy_to_user() unvalidated size | no | FP |
| 4455 | Medium | 60 | G2 | ld_usb_write | drivers/usb/misc/ldusb.c | bytes_to_write | copy_from_user() unvalidated size | no | FP |
| 4456 | Medium | 60 | C | libipw_rx | drivers/net/wireless/intel/ipw2x00/libipw_rx.c | keyidx | subscript | no | FP |
| 4457 | Medium | 60 | G2 | lima_ioctl_gem_submit | drivers/gpu/drm/lima/lima_drv.c | size | copy_from_user() unvalidated size | no | FP |
| 4458 | Medium | 60 | G2 | lkdtm_USERCOPY_KERNEL | drivers/misc/lkdtm/usercopy.c | unconst + sizeof(test_text) | copy_to_user() unvalidated size | no | FP |
| 4459 | Medium | 60 | G2 | lkdtm_USERCOPY_KERNEL | drivers/misc/lkdtm/usercopy.c | unconst + PAGE_SIZE | copy_to_user() unvalidated size | no | FP |
| 4460 | Medium | 60 | B | load_application_firmware | drivers/usb/serial/io_edgeport.c | be16_to_cpu(rec->len) | memcpy() in sram_write() | no | FP |
| 4461 | Medium | 60 | B | load_firmware | drivers/media/tuners/xc2028.c | len | memcpy() | no | FP |
| 4462 | Medium | 60 | C | load_waveform | drivers/video/fbdev/metronomefb.c | owfm_idx | subscript (callee) | no | FP |
| 4463 | Medium | 60 | G2 | lp_write | drivers/char/lp.c | copy_size | copy_from_user() unvalidated size | no | FP |
| 4464 | Medium | 60 | G2 | lpfc_debugfs_dif_err_write | drivers/scsi/lpfc/lpfc_debugfs.c | size | copy_from_user() unvalidated size | no | FP |
| 4465 | Medium | 60 | G2 | lpfc_debugfs_hdwqstat_write | drivers/scsi/lpfc/lpfc_debugfs.c | nbytes | copy_from_user() unvalidated size | no | FP |
| 4466 | Medium | 60 | G2 | lpfc_debugfs_ioktime_write | drivers/scsi/lpfc/lpfc_debugfs.c | nbytes | copy_from_user() unvalidated size | no | FP |
| 4467 | Medium | 60 | G2 | lpfc_debugfs_lockstat_write | drivers/scsi/lpfc/lpfc_debugfs.c | bsize | copy_from_user() unvalidated size | no | FP |
| 4468 | Medium | 60 | G2 | lpfc_debugfs_multixripools_write | drivers/scsi/lpfc/lpfc_debugfs.c | nbytes | copy_from_user() unvalidated size | no | FP |
| 4469 | Medium | 60 | G2 | lpfc_debugfs_nvmeio_trc_write | drivers/scsi/lpfc/lpfc_debugfs.c | nbytes | copy_from_user() unvalidated size | no | FP |
| 4470 | Medium | 60 | G2 | lpfc_debugfs_nvmestat_write | drivers/scsi/lpfc/lpfc_debugfs.c | nbytes | copy_from_user() unvalidated size | no | FP |
| 4471 | Medium | 60 | G2 | lpfc_debugfs_scsistat_write | drivers/scsi/lpfc/lpfc_debugfs.c | (nbytes >= sizeof(mybuf)) ?
(sizeof(mybuf) - 1) : nbytes | copy_from_user() unvalidated size | no | FP |
| 4472 | Medium | 60 | B | lpfc_handle_fcp_err | drivers/scsi/lpfc/lpfc_scsi.c | snslen | memcpy() | no | FP |
| 4473 | Medium | 60 | G2 | lpfc_idiag_cmd_get | drivers/scsi/lpfc/lpfc_debugfs.c | bsize | copy_from_user() unvalidated size | no | FP |
| 4474 | Medium | 60 | G2 | lpvo_write | drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c | count | copy_from_user() unvalidated size | no | FP |
| 4475 | Medium | 60 | B | mcp251xfd_regmap_nocrc_gather_write | drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c | len | memcpy() in _mcp251xfd_regmap_nocrc_gather_write() | no | FP |
| 4476 | Medium | 60 | G2 | megasas_compat_iocpacket_get_user | drivers/scsi/megaraid/megaraid_sas_base.c | size | copy_from_user() unvalidated size | no | FP |
| 4477 | Medium | 60 | G2 | mem_read | drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | count | copy_to_user() unvalidated size | no | FP |
| 4478 | Medium | 60 | B | mes_v11_0_allocate_ucode_buffer | drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | fw_size | memcpy() | no | FP |
| 4479 | Medium | 60 | B | mes_v12_1_allocate_ucode_buffer | drivers/gpu/drm/amd/amdgpu/mes_v12_1.c | fw_size | memcpy() | no | FP |
| 4480 | Medium | 60 | G2 | mhi_debugfs_device_wake_write | drivers/bus/mhi/host/debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4481 | Medium | 60 | C | mhi_mbim_rx | drivers/net/wwan/mhi_wwan_mbim.c | session | subscript (callee) | no | FP |
| 4482 | Medium | 60 | G2 | mimd_to_kioc | drivers/scsi/megaraid/megaraid_mm.c | kioc->xferlen | copy_from_user() unvalidated size | no | FP |
| 4483 | Medium | 60 | C | mlx4_MAD_IFC_wrapper | drivers/net/ethernet/mellanox/mlx4/cmd.c | vidx | subscript | no | FP |
| 4484 | Medium | 60 | C | mlx4_en_handle_err_cqe | drivers/net/ethernet/mellanox/mlx4/en_tx.c | wqe_index | subscript | no | FP |
| 4485 | Medium | 60 | C | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | be16_to_cpu(eqe->event.cmd.token) | subscript (callee) | no | FP |
| 4486 | Medium | 60 | C | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | flr_slave | subscript | no | FP |
| 4487 | Medium | 60 | C | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | flr_slave | subscript | no | FP |
| 4488 | Medium | 60 | C | mlx4_eq_int | drivers/net/ethernet/mellanox/mlx4/eq.c | flr_slave | subscript | no | FP |
| 4489 | Medium | 60 | G2 | mlx4_init_user_cqes | drivers/net/ethernet/mellanox/mlx4/cq.c | PAGE_SIZE | copy_to_user() unvalidated size | no | FP |
| 4490 | Medium | 60 | C | mlx5_fpga_conn_rq_cqe | drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c | ix | subscript | no | FP |
| 4491 | Medium | 60 | C | mlx5_fpga_conn_rq_cqe | drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c | ix | subscript | no | FP |
| 4492 | Medium | 60 | C | mlx5_fpga_conn_sq_cqe | drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c | ix | subscript | no | FP |
| 4493 | Medium | 60 | C | mlx5_fpga_conn_sq_cqe | drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c | ix | subscript | no | FP |
| 4494 | Medium | 60 | C | mlx5_poll_one | drivers/infiniband/hw/mlx5/cq.c | idx | subscript | no | FP |
| 4495 | Medium | 60 | C | mlx5_poll_one | drivers/infiniband/hw/mlx5/cq.c | idx | subscript | no | FP |
| 4496 | Medium | 60 | C | mlx5_poll_one | drivers/infiniband/hw/mlx5/cq.c | idx | subscript | no | FP |
| 4497 | Medium | 60 | C | mlx5_poll_one | drivers/infiniband/hw/mlx5/cq.c | idx | subscript | no | FP |
| 4498 | Medium | 60 | C | mlx5e_handle_rx_cqe | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | ci | subscript (callee) | no | FP |
| 4499 | Medium | 60 | C | mlx5e_handle_rx_cqe_rep | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | ci | subscript (callee) | no | FP |
| 4500 | Medium | 60 | C | mlx5e_ptp_handle_ts_cqe | drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | metadata_id | subscript (callee) | no | FP |
| 4501 | Medium | 60 | C | mlx5e_ptp_handle_ts_cqe | drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | metadata_id | subscript (callee) | no | FP |
| 4502 | Medium | 60 | C | mlx5e_ptp_handle_ts_cqe | drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | metadata_id | subscript (callee) | no | FP |
| 4503 | Medium | 60 | C | mlx5e_ptp_handle_ts_cqe | drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | metadata_id | subscript | no | FP |
| 4504 | Medium | 60 | C | mlx5e_tc_act_vlan_add_rewrite_action | drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/vlan_mangle.c | pedit_act | subscript (callee) | no | FP |
| 4505 | Medium | 60 | C | mlx5e_tc_act_vlan_add_rewrite_action | drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/vlan_mangle.c | pedit_act | subscript (callee) | no | FP |
| 4506 | Medium | 60 | C | mlx5e_trap_handle_rx_cqe | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | ci | subscript (callee) | no | FP |
| 4507 | Medium | 60 | C | mlx5e_txwqe_complete | drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | metadata_index | subscript (callee) | no | FP |
| 4508 | Medium | 60 | C | mlx5e_txwqe_complete | drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | metadata_index | subscript (callee) | no | FP |
| 4509 | Medium | 60 | C | mlx5i_handle_rx_cqe | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | ci | subscript (callee) | no | FP |
| 4510 | Medium | 60 | G2 | mlx5vf_append_page_to_mig_buf | drivers/vfio/pci/mlx5/main.c | page_len | copy_from_user() unvalidated size | no | FP |
| 4511 | Medium | 60 | G2 | mlx5vf_buf_read | drivers/vfio/pci/mlx5/main.c | page_len | copy_to_user() unvalidated size | no | FP |
| 4512 | Medium | 60 | G2 | mlx5vf_precopy_ioctl | drivers/vfio/pci/mlx5/main.c | offsetofend(struct vfio_precopy_info, dirty_bytes) | copy_to_user() unvalidated size | no | FP |
| 4513 | Medium | 60 | G2 | mlx5vf_resume_read_header | drivers/vfio/pci/mlx5/main.c | copy_len | copy_from_user() unvalidated size | no | FP |
| 4514 | Medium | 60 | C | mlx5vf_rq_cqe | drivers/vfio/pci/mlx5/cmd.c | ix | subscript (callee) | no | FP |
| 4515 | Medium | 60 | G2 | mmc_blk_ioctl_copy_to_user | drivers/mmc/core/block.c | idata->buf_bytes | copy_to_user() unvalidated size | no | FP |
| 4516 | Medium | 60 | G2 | mmc_ioctl_dvd_read_struct | drivers/cdrom/cdrom.c | size | copy_to_user() unvalidated size | no | FP |
| 4517 | Medium | 60 | G2 | mon_bin_get_event | drivers/usb/mon/mon_bin.c | hdrbytes | copy_to_user() unvalidated size | no | FP |
| 4518 | Medium | 60 | G2 | mon_bin_read | drivers/usb/mon/mon_bin.c | step_len | copy_to_user() unvalidated size | no | FP |
| 4519 | Medium | 60 | G2 | mon_read | drivers/s390/char/monreader.c | count | copy_to_user() unvalidated size | no | FP |
| 4520 | Medium | 60 | G2 | mon_read | drivers/s390/char/monreader.c | count | copy_to_user() unvalidated size | no | FP |
| 4521 | Medium | 60 | G2 | mon_text_copy_to_user | drivers/usb/mon/mon_text.c | togo | copy_to_user() unvalidated size | no | FP |
| 4522 | Medium | 60 | G2 | monwrite_write | drivers/s390/char/monwriter.c | len | copy_from_user() unvalidated size | no | FP |
| 4523 | Medium | 60 | G2 | monwrite_write | drivers/s390/char/monwriter.c | len | copy_from_user() unvalidated size | no | FP |
| 4524 | Medium | 60 | G2 | mousedev_read | drivers/input/mousedev.c | count | copy_to_user() unvalidated size | no | FP |
| 4525 | Medium | 60 | B | mpi3mr_encldev_add_chg_evt_bh | drivers/scsi/mpi3mr/mpi3mr_os.c | enclosure_dev | memcpy() | no | FP |
| 4526 | Medium | 60 | C | mpi3mr_process_admin_reply_desc | drivers/scsi/mpi3mr/mpi3mr_fw.c | host_tag | subscript (callee) | no | FP |
| 4527 | Medium | 60 | C | mpi3mr_process_admin_reply_desc | drivers/scsi/mpi3mr/mpi3mr_fw.c | host_tag | subscript (callee) | no | FP |
| 4528 | Medium | 60 | B | mpi_ssp_completion | drivers/scsi/pm8001/pm8001_hwi.c | t | memcpy() in sas_ssp_task_response() | no | FP |
| 4529 | Medium | 60 | B | mpt3sas_config_get_volume_handle | drivers/scsi/mpt3sas/mpt3sas_config.c | config_page_sz | memcpy() in _config_request() | no | FP |
| 4530 | Medium | 60 | B | mpt3sas_config_get_volume_handle | drivers/scsi/mpt3sas/mpt3sas_config.c | config_page_sz | memset() in _config_request() | no | FP |
| 4531 | Medium | 60 | B | mpt3sas_config_get_volume_handle | drivers/scsi/mpt3sas/mpt3sas_config.c | config_page_sz | memset() in _config_request() | no | FP |
| 4532 | Medium | 60 | B | mpt3sas_config_get_volume_handle | drivers/scsi/mpt3sas/mpt3sas_config.c | config_page_sz | memcpy() in _config_request() | no | FP |
| 4533 | Medium | 60 | C | mpt3sas_ctl_add_to_event_log | drivers/scsi/mpt3sas/mpt3sas_ctl.c | event | subscript (callee) | no | FP |
| 4534 | Medium | 60 | B | mpt3sas_ctl_done | drivers/scsi/mpt3sas/mpt3sas_ctl.c | sz | memcpy() | no | FP |
| 4535 | Medium | 60 | B | mpt3sas_ctl_done | drivers/scsi/mpt3sas/mpt3sas_ctl.c | sz | memcpy() | no | FP |
| 4536 | Medium | 60 | C | mpt3sas_setup_direct_io | drivers/scsi/mpt3sas/mpt3sas_warpdrive.c | column | subscript | no | FP |
| 4537 | Medium | 60 | C | mpt_lan_post_receive_buckets | drivers/message/fusion/mptlan.c | i | subscript | no | FP |
| 4538 | Medium | 60 | G2 | mptctl_do_fw_download | drivers/message/fusion/mptctl.c | bl->len | copy_from_user() unvalidated size | no | FP |
| 4539 | Medium | 60 | G2 | mptctl_eventreport | drivers/message/fusion/mptctl.c | numBytes | copy_to_user() unvalidated size | no | FP |
| 4540 | Medium | 60 | G2 | mptctl_gettargetinfo | drivers/message/fusion/mptctl.c | numBytes | copy_to_user() unvalidated size | no | FP |
| 4541 | Medium | 60 | C | mptscsih_qcmd | drivers/message/fusion/mptscsih.c | my_idx | subscript (callee) | no | FP |
| 4542 | Medium | 60 | C | mptscsih_qcmd | drivers/message/fusion/mptscsih.c | my_idx | subscript (callee) | no | FP |
| 4543 | Medium | 60 | C | mptscsih_qcmd | drivers/message/fusion/mptscsih.c | my_idx | subscript (callee) | no | FP |
| 4544 | Medium | 60 | G2 | mraid_mm_ioctl | drivers/scsi/megaraid/megaraid_mm.c | EXT_IOCTL_SIGN_SZ | copy_from_user() unvalidated size | no | FP |
| 4545 | Medium | 60 | C | msb_ftl_scan | drivers/memstick/core/ms_block.c | other_block | subscript | no | FP |
| 4546 | Medium | 60 | G2 | msc_single_to_user | drivers/hwtracing/intel_th/msu.c | tocopy | copy_to_user() unvalidated size | no | FP |
| 4547 | Medium | 60 | G2 | msc_single_to_user | drivers/hwtracing/intel_th/msu.c | tocopy | copy_to_user() unvalidated size | no | FP |
| 4548 | Medium | 60 | G2 | msc_single_to_user | drivers/hwtracing/intel_th/msu.c | rem | copy_to_user() unvalidated size | no | FP |
| 4549 | Medium | 60 | G2 | msc_win_to_user | drivers/hwtracing/intel_th/msu.c | len | copy_to_user() unvalidated size | no | FP |
| 4550 | Medium | 60 | G2 | msm_ioctl_perfcntr_config | drivers/gpu/drm/msm/msm_perfcntr.c | sz | copy_from_user() unvalidated size | no | FP |
| 4551 | Medium | 60 | G2 | msm_ioctl_perfcntr_config | drivers/gpu/drm/msm/msm_perfcntr.c | sz | copy_to_user() unvalidated size | no | FP |
| 4552 | Medium | 60 | G2 | msm_ioctl_perfcntr_config | drivers/gpu/drm/msm/msm_perfcntr.c | sz | copy_from_user() unvalidated size | no | FP |
| 4553 | Medium | 60 | G2 | msm_perfcntrs_stream_read | drivers/gpu/drm/msm/msm_perfcntr.c | count | copy_to_user() unvalidated size | no | FP |
| 4554 | Medium | 60 | G2 | msm_submitqueue_query_faults | drivers/gpu/drm/msm/msm_submitqueue.c | size | copy_to_user() unvalidated size | no | FP |
| 4555 | Medium | 60 | G2 | msm_syncobj_parse_deps | drivers/gpu/drm/msm/msm_syncobj.c | min(syncobj_stride, sizeof(syncobj_desc)) | copy_from_user() unvalidated size | no | FP |
| 4556 | Medium | 60 | G2 | msm_syncobj_parse_post_deps | drivers/gpu/drm/msm/msm_syncobj.c | min(syncobj_stride, sizeof(syncobj_desc)) | copy_from_user() unvalidated size | no | FP |
| 4557 | Medium | 60 | C | mt76_connac2_mac_fill_txs | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | mode | subscript | no | FP |
| 4558 | Medium | 60 | C | mt76_dma_get_rxdmad_c_buf | drivers/net/wireless/mediatek/mt76/dma.c | t | subscript | no | FP |
| 4559 | Medium | 60 | C | mt76_mac_process_rx | drivers/net/wireless/mediatek/mt7601u/mac.c | rate | subscript (callee) | no | FP |
| 4560 | Medium | 60 | C | mt76_rx_aggr_check_ctl | drivers/net/wireless/mediatek/mt76/agg-rx.c | tid | subscript (callee) | no | FP |
| 4561 | Medium | 60 | C | mt76_rx_aggr_check_ctl | drivers/net/wireless/mediatek/mt76/agg-rx.c | tidno | subscript | no | FP |
| 4562 | Medium | 60 | C | mt7915_mac_tx_free_v0 | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | count | subscript | no | FP |
| 4563 | Medium | 60 | C | mt7925_mac_add_txs_skb | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | mode | subscript | no | FP |
| 4564 | Medium | 60 | C | mt7996_mac_add_txs_skb | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | mode | subscript | no | FP |
| 4565 | Medium | 60 | C | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | skb | subscript (callee) | no | FP |
| 4566 | Medium | 60 | C | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | dma_addr | subscript (callee) | no | FP |
| 4567 | Medium | 60 | C | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | qid | subscript | no | FP |
| 4568 | Medium | 60 | G2 | mtdchar_ioctl | drivers/mtd/mtdchar.c | retlen | copy_to_user() unvalidated size | no | FP |
| 4569 | Medium | 60 | G2 | mtdchar_read | drivers/mtd/mtdchar.c | retlen | copy_to_user() unvalidated size | no | FP |
| 4570 | Medium | 60 | G2 | mtdchar_read_ioctl | drivers/mtd/mtdchar.c | ops.retlen | copy_to_user() unvalidated size | no | FP |
| 4571 | Medium | 60 | G2 | mtdchar_read_ioctl | drivers/mtd/mtdchar.c | ops.oobretlen | copy_to_user() unvalidated size | no | FP |
| 4572 | Medium | 60 | G2 | mtdchar_write | drivers/mtd/mtdchar.c | len | copy_from_user() unvalidated size | no | FP |
| 4573 | Medium | 60 | G2 | mtdchar_write_ioctl | drivers/mtd/mtdchar.c | ops.len | copy_from_user() unvalidated size | no | FP |
| 4574 | Medium | 60 | G2 | mtdchar_write_ioctl | drivers/mtd/mtdchar.c | ops.ooblen | copy_from_user() unvalidated size | no | FP |
| 4575 | Medium | 60 | C | mthca_eq_int | drivers/infiniband/hw/mthca/mthca_eq.c | be16_to_cpu(eqe->event.cmd.token) | subscript (callee) | no | FP |
| 4576 | Medium | 60 | C | mthca_poll_one | drivers/infiniband/hw/mthca/mthca_cq.c | be32_to_cpu(cqe->my_qpn) &
(dev->limits.num_qps - 1) | subscript (callee) | no | FP |
| 4577 | Medium | 60 | C | mthca_poll_one | drivers/infiniband/hw/mthca/mthca_cq.c | be32_to_cpu(cqe->my_qpn) &
(dev->limits.num_qps - 1) | subscript (callee) | no | FP |
| 4578 | Medium | 60 | G2 | mtip_block_compat_ioctl | drivers/block/mtip32xx/mtip32xx.c | compat_tasksize - (2 * sizeof(compat_long_t)) | copy_from_user() unvalidated size | no | FP |
| 4579 | Medium | 60 | G2 | mtip_block_compat_ioctl | drivers/block/mtip32xx/mtip32xx.c | compat_tasksize -
(2 * sizeof(compat_long_t)) | copy_to_user() unvalidated size | no | FP |
| 4580 | Medium | 60 | G2 | mtip_hw_ioctl | drivers/block/mtip32xx/mtip32xx.c | sizeof(u16) * ATA_ID_WORDS | copy_to_user() unvalidated size | no | FP |
| 4581 | Medium | 60 | G2 | mtip_hw_read_flags | drivers/block/mtip32xx/mtip32xx.c | *offset | copy_to_user() unvalidated size | no | FP |
| 4582 | Medium | 60 | G2 | mtip_hw_read_registers | drivers/block/mtip32xx/mtip32xx.c | *offset | copy_to_user() unvalidated size | no | FP |
| 4583 | Medium | 60 | G2 | mtu3_probe_write | drivers/usb/mtu3/mtu3_debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4584 | Medium | 60 | G2 | musb_softconnect_write | drivers/usb/musb/musb_debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4585 | Medium | 60 | G2 | musb_test_mode_write | drivers/usb/musb/musb_debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4586 | Medium | 60 | C | mvs_int_rx | drivers/scsi/mvsas/mv_sas.c | rx_desc | subscript (callee) | no | FP |
| 4587 | Medium | 60 | B | mvs_int_rx | drivers/scsi/mvsas/mv_sas.c | rx_desc | memset() in mvs_slot_complete() | no | FP |
| 4588 | Medium | 60 | B | mvs_int_rx | drivers/scsi/mvsas/mv_sas.c | rx_desc | memcpy() in mvs_slot_complete() | no | FP |
| 4589 | Medium | 60 | C | mwifiex_11n_rxba_sync_event | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | seq_num | subscript (callee) | no | FP |
| 4590 | Medium | 60 | C | mwifiex_11n_rxba_sync_event | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | seq_num | subscript (callee) | no | FP |
| 4591 | Medium | 60 | B | mwifiex_append_rsn_ie_wpa_wpa2 | drivers/net/wireless/marvell/mwifiex/join.c | le16_to_cpu(rsn_ie_tlv->header.len) | memcpy() | no | FP |
| 4592 | Medium | 60 | B | mwifiex_cmd_11n_addba_rsp_gen | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | win_size | kcalloc() in mwifiex_11n_create_rx_reorder_tbl() | no | FP |
| 4593 | Medium | 60 | B | mwifiex_cmd_append_11ac_tlv | drivers/net/wireless/marvell/mwifiex/11ac.c | le16_to_cpu(vht_cap->header.len) | memcpy() | no | FP |
| 4594 | Medium | 60 | B | mwifiex_cmd_append_11ac_tlv | drivers/net/wireless/marvell/mwifiex/11ac.c | le16_to_cpu(vht_op->header.len) | memcpy() | no | FP |
| 4595 | Medium | 60 | B | mwifiex_cmd_append_11n_tlv | drivers/net/wireless/marvell/mwifiex/11n.c | le16_to_cpu(ht_cap->header.len) | memcpy() | no | FP |
| 4596 | Medium | 60 | B | mwifiex_cmd_append_11n_tlv | drivers/net/wireless/marvell/mwifiex/11n.c | le16_to_cpu(ht_info->header.len) | memcpy() | no | FP |
| 4597 | Medium | 60 | B | mwifiex_cmd_append_11n_tlv | drivers/net/wireless/marvell/mwifiex/11n.c | le16_to_cpu(bss_co_2040->header.len) | memcpy() | no | FP |
| 4598 | Medium | 60 | B | mwifiex_cmd_append_vsie_tlv | drivers/net/wireless/marvell/mwifiex/scan.c | le16_to_cpu(vs_param_set->header.len) | memcpy() | no | FP |
| 4599 | Medium | 60 | B | mwifiex_deaggr_sdio_pkt | drivers/net/wireless/marvell/mwifiex/sdio.c | skb_deaggr | memset() in mwifiex_handle_rx_packet() | no | FP |
| 4600 | Medium | 60 | B | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | eth | memcpy() | no | FP |
| 4601 | Medium | 60 | B | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | eth | memcpy() | no | FP |
| 4602 | Medium | 60 | C | mwifiex_process_sta_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | seq_num | subscript (callee) | no | FP |
| 4603 | Medium | 60 | C | mwifiex_process_sta_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | seq_num | subscript (callee) | no | FP |
| 4604 | Medium | 60 | C | mwifiex_process_uap_rx_packet | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | le16_to_cpu(uap_rx_pd->seq_num) | subscript (callee) | no | FP |
| 4605 | Medium | 60 | C | mwifiex_process_uap_rx_packet | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | le16_to_cpu(uap_rx_pd->seq_num) | subscript (callee) | no | FP |
| 4606 | Medium | 60 | B | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | p_ethhdr | memcpy() | no | FP |
| 4607 | Medium | 60 | B | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | p_ethhdr | memcpy() | no | FP |
| 4608 | Medium | 60 | B | mwifiex_wmm_process_association_req | drivers/net/wireless/marvell/mwifiex/wmm.c | le16_to_cpu(wmm_tlv->header.len) | memcpy() | no | FP |
| 4609 | Medium | 60 | C | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tid | subscript (callee) | no | FP |
| 4610 | Medium | 60 | C | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tid | subscript (callee) | no | FP |
| 4611 | Medium | 60 | B | ncm_setup | drivers/usb/gadget/function/f_ncm.c | value | memcpy() | no | FP |
| 4612 | Medium | 60 | C | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | subscript | no | FP |
| 4613 | Medium | 60 | C | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | subscript | no | FP |
| 4614 | Medium | 60 | C | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | subscript | no | FP |
| 4615 | Medium | 60 | C | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | subscript | no | FP |
| 4616 | Medium | 60 | C | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | subscript | no | FP |
| 4617 | Medium | 60 | C | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | rds_ring | subscript (callee) | no | FP |
| 4618 | Medium | 60 | C | nexio_read_data | drivers/input/touchscreen/usbtouchscreen.c | y | subscript | no | FP |
| 4619 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4620 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4621 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4622 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4623 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4624 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4625 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4626 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4627 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4628 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4629 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4630 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4631 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4632 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4633 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4634 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4635 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4636 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4637 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4638 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4639 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4640 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4641 | Medium | 60 | C | nfp_fl_ct_sub_stats | drivers/net/ethernet/netronome/nfp/flower/conntrack.c | ctx_id | subscript | no | FP |
| 4642 | Medium | 60 | B | nfp_net_tls_rx_resync_req | drivers/net/ethernet/netronome/nfp/crypto/tls.c | ntls | memcmp() | no | FP |
| 4643 | Medium | 60 | G2 | nouveau_abi16_ioctl | drivers/gpu/drm/nouveau/nouveau_abi16.c | size | copy_from_user() unvalidated size | no | FP |
| 4644 | Medium | 60 | G2 | nouveau_abi16_ioctl | drivers/gpu/drm/nouveau/nouveau_abi16.c | size | copy_to_user() unvalidated size | no | FP |
| 4645 | Medium | 60 | G2 | nvgrace_gpu_map_and_read | drivers/vfio/pci/nvgrace-gpu/main.c | mem_count | copy_to_user() unvalidated size | no | FP |
| 4646 | Medium | 60 | G2 | nvgrace_gpu_map_and_write | drivers/vfio/pci/nvgrace-gpu/main.c | mem_count | copy_from_user() unvalidated size | no | FP |
| 4647 | Medium | 60 | G2 | nvgrace_gpu_read_config_emu | drivers/vfio/pci/nvgrace-gpu/main.c | copy_count | copy_to_user() unvalidated size | no | FP |
| 4648 | Medium | 60 | G2 | nvgrace_gpu_write_config_emu | drivers/vfio/pci/nvgrace-gpu/main.c | copy_count | copy_from_user() unvalidated size | no | FP |
| 4649 | Medium | 60 | B | nvme_init_subnqn | drivers/nvme/host/core.c | off | memset() | no | FP |
| 4650 | Medium | 60 | C | nvmet_execute_admin_connect | drivers/nvme/target/fabrics-cmd.c | ctrl | subscript (callee) | no | FP |
| 4651 | Medium | 60 | C | nvmet_execute_delete_cq | drivers/nvme/target/admin-cmd.c | cqid | subscript | no | FP |
| 4652 | Medium | 60 | B | nvmet_pci_epf_iod_parse_prp_list | drivers/nvme/target/pci-epf.c | nr_segs | krealloc() in nvmet_pci_epf_alloc_iod_data_segs() | no | FP |
| 4653 | Medium | 60 | G2 | occ_read | drivers/fsi/fsi-occ.c | rc | copy_to_user() unvalidated size | no | FP |
| 4654 | Medium | 60 | C | ocrdma_discard_cqes | drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | wqe_idx | subscript (callee) | no | FP |
| 4655 | Medium | 60 | G2 | open_stats_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(open_stats_info)) | copy_to_user() unvalidated size | no | FP |
| 4656 | Medium | 60 | G2 | opiocnextprop | drivers/sbus/char/openprom.c | len | copy_to_user() unvalidated size | no | FP |
| 4657 | Medium | 60 | C | otx2_add_flow_msg | drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c | vlan_prio | subscript (callee) | no | FP |
| 4658 | Medium | 60 | C | otx2_add_flow_msg | drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c | vlan_prio | subscript (callee) | no | FP |
| 4659 | Medium | 60 | B | output_store | drivers/w1/slaves/w1_ds2405.c | dev_addr | memcpy() | no | FP |
| 4660 | Medium | 60 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | le16_to_cpu(entry->code) | kzalloc() in p54_parse_rssical() | no | FP |
| 4661 | Medium | 60 | C | p54_parse_firmware | drivers/net/wireless/intersil/p54/fwio.c | len | subscript | no | FP |
| 4662 | Medium | 60 | C | p54p_refill_rx_ring | drivers/net/wireless/intersil/p54/p54pci.c | i | subscript | no | FP |
| 4663 | Medium | 60 | C | p54p_refill_rx_ring | drivers/net/wireless/intersil/p54/p54pci.c | i | subscript | no | FP |
| 4664 | Medium | 60 | C | p54p_tx | drivers/net/wireless/intersil/p54/p54pci.c | i | subscript | no | FP |
| 4665 | Medium | 60 | C | p54p_tx | drivers/net/wireless/intersil/p54/p54pci.c | i | subscript | no | FP |
| 4666 | Medium | 60 | G2 | packet_buffer_get | drivers/firewire/nosy.c | split | copy_to_user() unvalidated size | no | FP |
| 4667 | Medium | 60 | G2 | page_fault_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, max_size, sizeof(struct hl_page_fault_info)) | copy_to_user() unvalidated size | no | FP |
| 4668 | Medium | 60 | G2 | panfrost_copy_in_sync | drivers/gpu/drm/panfrost/panfrost_drv.c | in_fence_count * sizeof(u32) | copy_from_user() unvalidated size | no | FP |
| 4669 | Medium | 60 | G2 | panfrost_ioctl_sync_bo | drivers/gpu/drm/panfrost/panfrost_drv.c | args->op_count * sizeof(*ops) | copy_from_user() unvalidated size | no | FP |
| 4670 | Medium | 60 | G2 | parse_cmd_buffer_ctx | drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | *count | copy_from_user() unvalidated size | no | FP |
| 4671 | Medium | 60 | G2 | parse_resp_raw | drivers/misc/nsm.c | raw->response.len | copy_to_user() unvalidated size | no | FP |
| 4672 | Medium | 60 | G2 | parse_write_buffer_into_params | drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | wr_buf_size | copy_from_user() unvalidated size | no | FP |
| 4673 | Medium | 60 | C | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | dst | subscript (callee) | no | FP |
| 4674 | Medium | 60 | G2 | pci_counters_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(pci_counters)) | copy_to_user() unvalidated size | no | FP |
| 4675 | Medium | 60 | C | pci_epf_test_bar_subrange_clear | drivers/pci/endpoint/functions/pci-epf-test.c | bar | subscript (callee) | no | FP |
| 4676 | Medium | 60 | C | pci_epf_test_bar_subrange_setup | drivers/pci/endpoint/functions/pci-epf-test.c | bar | subscript (callee) | no | FP |
| 4677 | Medium | 60 | B | pci_epf_test_bar_subrange_setup | drivers/pci/endpoint/functions/pci-epf-test.c | sub_size | memset() | no | FP |
| 4678 | Medium | 60 | G2 | pds_vfio_restore_write | drivers/vfio/pci/pds/lm.c | page_len | copy_from_user() unvalidated size | no | FP |
| 4679 | Medium | 60 | G2 | pds_vfio_save_read | drivers/vfio/pci/pds/lm.c | page_len | copy_to_user() unvalidated size | no | FP |
| 4680 | Medium | 60 | G2 | picolcd_debug_eeprom_write | drivers/hid/hid-picolcd_debugfs.c | min((u8)20, raw_data[2]) | copy_from_user() unvalidated size | no | FP |
| 4681 | Medium | 60 | G2 | picolcd_debug_reset_write | drivers/hid/hid-picolcd_debugfs.c | cnt | copy_from_user() unvalidated size | no | FP |
| 4682 | Medium | 60 | G2 | pkey_ioctl_apqns4k | drivers/s390/crypto/pkey_api.c | len | copy_to_user() unvalidated size | no | FP |
| 4683 | Medium | 60 | G2 | pkey_ioctl_apqns4kt | drivers/s390/crypto/pkey_api.c | len | copy_to_user() unvalidated size | no | FP |
| 4684 | Medium | 60 | G2 | pkt_data_read | drivers/gpu/drm/xe/xe_sriov_packet.c | len | copy_to_user() unvalidated size | no | FP |
| 4685 | Medium | 60 | G2 | pkt_data_write | drivers/gpu/drm/xe/xe_sriov_packet.c | len | copy_from_user() unvalidated size | no | FP |
| 4686 | Medium | 60 | G2 | pkt_hdr_read | drivers/gpu/drm/xe/xe_sriov_packet.c | len | copy_to_user() unvalidated size | no | FP |
| 4687 | Medium | 60 | G2 | pkt_hdr_write | drivers/gpu/drm/xe/xe_sriov_packet.c | len | copy_from_user() unvalidated size | no | FP |
| 4688 | Medium | 60 | G2 | pll_frequency_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(freq_info)) | copy_to_user() unvalidated size | no | FP |
| 4689 | Medium | 60 | B | pmcraid_prepare_cancel_cmd | drivers/scsi/pmcraid.c | ioarcb_addr | memcpy() | no | FP |
| 4690 | Medium | 60 | C | pmic_glink_altmode_sc8180xp_notify | drivers/soc/qcom/pmic_glink_altmode.c | port | subscript | no | FP |
| 4691 | Medium | 60 | B | pms7003_receive_buf | drivers/iio/chemical/pms7003.c | num | memcpy() | no | FP |
| 4692 | Medium | 60 | G2 | pmu_options_proc_write | drivers/macintosh/via-pmu.c | count | copy_from_user() unvalidated size | no | FP |
| 4693 | Medium | 60 | G2 | pmu_read | drivers/macintosh/via-pmu.c | ret | copy_to_user() unvalidated size | no | FP |
| 4694 | Medium | 60 | G2 | port_fops_write | drivers/char/virtio_console.c | count | copy_from_user() unvalidated size | no | FP |
| 4695 | Medium | 60 | G2 | power_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(power_info)) | copy_to_user() unvalidated size | no | FP |
| 4696 | Medium | 60 | G2 | pp_write | drivers/char/ppdev.c | n | copy_from_user() unvalidated size | no | FP |
| 4697 | Medium | 60 | G2 | ppp_net_siocdevprivate | drivers/net/ppp/ppp_generic.c | strlen(vers) + 1 | copy_to_user() unvalidated size | no | FP |
| 4698 | Medium | 60 | B | pqi_process_aio_io_error | drivers/scsi/smartpqi/smartpqi_init.c | sense_data_length | memcpy() | no | FP |
| 4699 | Medium | 60 | B | pqi_process_raid_io_error | drivers/scsi/smartpqi/smartpqi_init.c | sense_data_length | memcpy() | no | FP |
| 4700 | Medium | 60 | B | pqi_start_io | drivers/scsi/smartpqi/smartpqi_init.c | iu_length | memcpy() | no | FP |
| 4701 | Medium | 60 | B | pqi_start_io | drivers/scsi/smartpqi/smartpqi_init.c | iu_length | memcpy() | no | FP |
| 4702 | Medium | 60 | B | pqi_submit_raid_request_synchronous | drivers/scsi/smartpqi/smartpqi_init.c | iu_length | memcpy() | no | FP |
| 4703 | Medium | 60 | C | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | i | subscript | no | FP |
| 4704 | Medium | 60 | G2 | pqm_get_queue_snapshot | drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | *entry_size | copy_to_user() unvalidated size | no | FP |
| 4705 | Medium | 60 | G2 | preview_config | drivers/media/platform/ti/omap3isp/isppreview.c | size | copy_from_user() unvalidated size | no | FP |
| 4706 | Medium | 60 | G2 | printer_read | drivers/usb/gadget/function/f_printer.c | size | copy_to_user() unvalidated size | no | FP |
| 4707 | Medium | 60 | G2 | printer_write | drivers/usb/gadget/function/f_printer.c | size | copy_from_user() unvalidated size | no | FP |
| 4708 | Medium | 60 | G2 | proc_bus_zorro_read | drivers/zorro/proc.c | nbytes | copy_to_user() unvalidated size | no | FP |
| 4709 | Medium | 60 | C | process_addba_req | drivers/staging/rtl8723bs/core/rtw_wlan_util.c | tid | subscript | no | FP |
| 4710 | Medium | 60 | C | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | fl | subscript (callee) | no | FP |
| 4711 | Medium | 60 | C | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | fl | subscript (callee) | no | FP |
| 4712 | Medium | 60 | C | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | ngathered | subscript (callee) | no | FP |
| 4713 | Medium | 60 | C | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | fl | subscript (callee) | no | FP |
| 4714 | Medium | 60 | C | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | fl | subscript | no | FP |
| 4715 | Medium | 60 | G2 | ps3flash_read | drivers/char/ps3flash.c | n | copy_to_user() unvalidated size | no | FP |
| 4716 | Medium | 60 | G2 | ps3flash_write | drivers/char/ps3flash.c | n | copy_from_user() unvalidated size | no | FP |
| 4717 | Medium | 60 | C | pt1_filter | drivers/media/pci/pt1/pt1.c | offset | subscript | no | FP |
| 4718 | Medium | 60 | C | pt1_filter | drivers/media/pci/pt1/pt1.c | offset | subscript | no | FP |
| 4719 | Medium | 60 | C | pt1_filter | drivers/media/pci/pt1/pt1.c | offset | subscript | no | FP |
| 4720 | Medium | 60 | G2 | ptr_to_user | drivers/media/v4l2-core/v4l2-ctrls-api.c | c->size | copy_to_user() unvalidated size | no | FP |
| 4721 | Medium | 60 | G2 | putused_user | drivers/vhost/vringh.c | sizeof(*dst) * num | copy_to_user() unvalidated size | no | FP |
| 4722 | Medium | 60 | G2 | pvr2_ioread_read | drivers/media/usb/pvrusb2/pvrusb2-ioread.c | bcnt | copy_to_user() unvalidated size | no | FP |
| 4723 | Medium | 60 | G2 | pvr_set_uobj_array | drivers/gpu/drm/imagination/pvr_drv.c | cpy_elem_size | copy_to_user() unvalidated size | no | FP |
| 4724 | Medium | 60 | G2 | qat_vf_precopy_ioctl | drivers/vfio/pci/qat/main.c | offsetofend(struct vfio_precopy_info, dirty_bytes) | copy_to_user() unvalidated size | no | FP |
| 4725 | Medium | 60 | G2 | qat_vf_resume_write | drivers/vfio/pci/qat/main.c | len | copy_from_user() unvalidated size | no | FP |
| 4726 | Medium | 60 | G2 | qat_vf_save_read | drivers/vfio/pci/qat/main.c | len | copy_to_user() unvalidated size | no | FP |
| 4727 | Medium | 60 | B | qcom_llcc_get_fw_config | drivers/soc/qcom/llcc-qcom.c | sz | devm_kcalloc() | no | FP |
| 4728 | Medium | 60 | G2 | qcom_rmtfs_mem_read | drivers/soc/qcom/rmtfs_mem.c | count | copy_to_user() unvalidated size | no | FP |
| 4729 | Medium | 60 | G2 | qcom_rmtfs_mem_write | drivers/soc/qcom/rmtfs_mem.c | count | copy_from_user() unvalidated size | no | FP |
| 4730 | Medium | 60 | C | qcom_show_pmic_model_array | drivers/soc/qcom/socinfo.c | model | subscript | no | FP |
| 4731 | Medium | 60 | B | qcom_smem_get_item_count | drivers/soc/qcom/smem.c | info | memcmp() | no | FP |
| 4732 | Medium | 60 | B | qcom_smem_partition_header | drivers/soc/qcom/smem.c | header | memcmp() | no | FP |
| 4733 | Medium | 60 | G2 | qcomtee_cb_params_from_args | drivers/tee/qcomtee/user_obj.c | u[i].b.size | copy_to_user() unvalidated size | no | FP |
| 4734 | Medium | 60 | G2 | qcomtee_prepare_msg | drivers/tee/qcomtee/core.c | u[i].b.size | copy_from_user() unvalidated size | no | FP |
| 4735 | Medium | 60 | C | qed_init_cmd_array | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | offset | subscript | no | FP |
| 4736 | Medium | 60 | C | qed_init_cmd_wr | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | b_must_dmae | subscript (callee) | no | FP |
| 4737 | Medium | 60 | B | qed_iwarp_ll2_slowpath | drivers/net/ethernet/qlogic/qed/qed_iwarp.c | fpdu | memset() | no | FP |
| 4738 | Medium | 60 | B | qed_iwarp_process_mpa_pkt | drivers/net/ethernet/qlogic/qed/qed_iwarp.c | fpdu | memset() | no | FP |
| 4739 | Medium | 60 | B | qed_iwarp_process_mpa_pkt | drivers/net/ethernet/qlogic/qed/qed_iwarp.c | fpdu | memset() | no | FP |
| 4740 | Medium | 60 | B | qla25xx_copy_fce | drivers/scsi/qla2xxx/qla_dbg.c | ntohl(fcec->size) | memcpy() | no | FP |
| 4741 | Medium | 60 | B | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | no_bytes | memcpy() | no | FP |
| 4742 | Medium | 60 | B | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | no_bytes | memcpy() | no | FP |
| 4743 | Medium | 60 | B | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | no_bytes | memcpy() | no | FP |
| 4744 | Medium | 60 | B | qla2x00_status_entry | drivers/scsi/qla2xxx/qla_isr.c | sense_len | memcpy() in qla2x00_handle_sense() | no | FP |
| 4745 | Medium | 60 | C | qla4xxx_passthru_status_entry | drivers/scsi/qla4xxx/ql4_isr.c | fw_ddb_index | subscript (callee) | no | FP |
| 4746 | Medium | 60 | C | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | rds_ring | subscript (callee) | no | FP |
| 4747 | Medium | 60 | C | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | subscript | no | FP |
| 4748 | Medium | 60 | C | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | subscript | no | FP |
| 4749 | Medium | 60 | C | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | subscript | no | FP |
| 4750 | Medium | 60 | C | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | subscript | no | FP |
| 4751 | Medium | 60 | C | qlcnic_send_filter | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | hindex | subscript | no | FP |
| 4752 | Medium | 60 | G2 | query_guc_submission_version | drivers/gpu/drm/i915/i915_query.c | size | copy_to_user() unvalidated size | no | FP |
| 4753 | Medium | 60 | B | quicki2c_alloc_report_buf | drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | max_report_len | devm_kzalloc() | no | FP |
| 4754 | Medium | 60 | B | quicki2c_alloc_report_buf | drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | max_report_len | devm_kzalloc() | no | FP |
| 4755 | Medium | 60 | C | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | sh | subscript (callee) | no | FP |
| 4756 | Medium | 60 | C | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | sh | subscript (callee) | no | FP |
| 4757 | Medium | 60 | C | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | sh | subscript (callee) | no | FP |
| 4758 | Medium | 60 | C | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | sh | subscript (callee) | no | FP |
| 4759 | Medium | 60 | C | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | sh | subscript | no | FP |
| 4760 | Medium | 60 | G2 | radeon_cs_parser_init | drivers/gpu/drm/radeon/radeon_cs.c | sizeof(uint64_t)*cs->num_chunks | copy_from_user() unvalidated size | no | FP |
| 4761 | Medium | 60 | G2 | radeon_cs_parser_init | drivers/gpu/drm/radeon/radeon_cs.c | size | copy_from_user() unvalidated size | no | FP |
| 4762 | Medium | 60 | G2 | radeon_info_ioctl | drivers/gpu/drm/radeon/radeon_kms.c | value_size | copy_to_user() unvalidated size | no | FP |
| 4763 | Medium | 60 | G2 | radeon_ttm_gtt_read | drivers/gpu/drm/radeon/radeon_ttm.c | cur_size | copy_to_user() unvalidated size | no | FP |
| 4764 | Medium | 60 | G2 | radeon_ttm_gtt_read | drivers/gpu/drm/radeon/radeon_ttm.c | cur_size | clear_user() unvalidated size | no | FP |
| 4765 | Medium | 60 | G2 | ras_cmd_get_cper_records | drivers/gpu/drm/amd/ras/rascore/ras_cmd.c | offset | copy_to_user() unvalidated size | no | FP |
| 4766 | Medium | 60 | G2 | raw_ioctl_ep0_read | drivers/usb/gadget/legacy/raw_gadget.c | length | copy_to_user() unvalidated size | no | FP |
| 4767 | Medium | 60 | G2 | raw_ioctl_ep_read | drivers/usb/gadget/legacy/raw_gadget.c | length | copy_to_user() unvalidated size | no | FP |
| 4768 | Medium | 60 | G2 | raw_ioctl_event_fetch | drivers/usb/gadget/legacy/raw_gadget.c | sizeof(*event) + length | copy_to_user() unvalidated size | no | FP |
| 4769 | Medium | 60 | G2 | razwi_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, max_size, sizeof(struct hl_info_razwi_event)) | copy_to_user() unvalidated size | no | FP |
| 4770 | Medium | 60 | B | rbd_header_from_disk | drivers/block/rbd.c | snap_count | kmalloc_array() | no | FP |
| 4771 | Medium | 60 | C | rbd_header_from_disk | drivers/block/rbd.c | snap_count | subscript | no | FP |
| 4772 | Medium | 60 | C | rc_rcv_error | drivers/infiniband/hw/hfi1/rc.c | rkey | subscript (callee) | no | FP |
| 4773 | Medium | 60 | C | rc_rcv_error | drivers/infiniband/hw/hfi1/rc.c | rkey | subscript (callee) | no | FP |
| 4774 | Medium | 60 | C | rc_rcv_error | drivers/infiniband/hw/hfi1/rc.c | rkey | subscript (callee) | no | FP |
| 4775 | Medium | 60 | C | rc_rcv_error | drivers/infiniband/hw/hfi1/rc.c | rkey | subscript (callee) | no | FP |
| 4776 | Medium | 60 | G2 | rd_read | drivers/gpu/drm/msm/msm_rd.c | n | copy_to_user() unvalidated size | no | FP |
| 4777 | Medium | 60 | G2 | read_block_state | drivers/block/zram/zram_drv.c | written | copy_to_user() unvalidated size | no | FP |
| 4778 | Medium | 60 | G2 | read_zero | drivers/char/mem.c | chunk | clear_user() unvalidated size | no | FP |
| 4779 | Medium | 60 | B | redistribute2 | drivers/md/persistent-data/dm-btree.c | delta | memcpy() in copy_entries() | no | FP |
| 4780 | Medium | 60 | B | redistribute2 | drivers/md/persistent-data/dm-btree.c | delta | memcpy() in copy_entries() | no | FP |
| 4781 | Medium | 60 | B | redistribute3 | drivers/md/persistent-data/dm-btree.c | left_short | memcpy() in copy_entries() | no | FP |
| 4782 | Medium | 60 | B | redistribute3 | drivers/md/persistent-data/dm-btree.c | target_center | memcpy() in copy_entries() | no | FP |
| 4783 | Medium | 60 | B | redistribute3 | drivers/md/persistent-data/dm-btree.c | left_to_center | memcpy() in copy_entries() | no | FP |
| 4784 | Medium | 60 | B | redistribute3 | drivers/md/persistent-data/dm-btree.c | right_short | memcpy() in copy_entries() | no | FP |
| 4785 | Medium | 60 | B | redistribute3 | drivers/md/persistent-data/dm-btree.c | left_short | memcpy() in copy_entries() | no | FP |
| 4786 | Medium | 60 | B | redistribute3 | drivers/md/persistent-data/dm-btree.c | target_center | memcpy() in copy_entries() | no | FP |
| 4787 | Medium | 60 | B | redistribute3 | drivers/md/persistent-data/dm-btree.c | left_to_center | memcpy() in copy_entries() | no | FP |
| 4788 | Medium | 60 | B | redistribute3 | drivers/md/persistent-data/dm-btree.c | right_short | memcpy() in copy_entries() | no | FP |
| 4789 | Medium | 60 | G2 | regmap_map_write_file | drivers/base/regmap/regmap-debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4790 | Medium | 60 | B | regmap_parse_16_be_inplace | drivers/base/regmap/regmap.c | v | memcpy() | no | FP |
| 4791 | Medium | 60 | B | regmap_parse_16_le_inplace | drivers/base/regmap/regmap.c | v | memcpy() | no | FP |
| 4792 | Medium | 60 | B | regmap_parse_32_be_inplace | drivers/base/regmap/regmap.c | v | memcpy() | no | FP |
| 4793 | Medium | 60 | B | regmap_parse_32_le_inplace | drivers/base/regmap/regmap.c | v | memcpy() | no | FP |
| 4794 | Medium | 60 | G2 | renesas_usb3_b_device_write | drivers/usb/gadget/udc/renesas_usb3.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4795 | Medium | 60 | C | replenish_rx_pool | drivers/net/ethernet/ibm/ibmvnic.c | bufidx | subscript | no | FP |
| 4796 | Medium | 60 | C | replenish_rx_pool | drivers/net/ethernet/ibm/ibmvnic.c | bufidx | subscript | no | FP |
| 4797 | Medium | 60 | G2 | resource_from_user | drivers/staging/vme_user/vme_user.c | (unsigned long)count | copy_from_user() unvalidated size | no | FP |
| 4798 | Medium | 60 | B | resp_comp_write | drivers/scsi/scsi_debug.c | lba | memcmp() in comp_write_worker() | no | FP |
| 4799 | Medium | 60 | B | resp_comp_write | drivers/scsi/scsi_debug.c | lba | memcmp() in comp_write_worker() | no | FP |
| 4800 | Medium | 60 | B | resp_comp_write | drivers/scsi/scsi_debug.c | lba | memcpy() in comp_write_worker() | no | FP |
| 4801 | Medium | 60 | B | resp_comp_write | drivers/scsi/scsi_debug.c | lba | memcpy() in comp_write_worker() | no | FP |
| 4802 | Medium | 60 | B | resp_report_zones | drivers/scsi/scsi_debug.c | arr_len | kzalloc() | no | FP |
| 4803 | Medium | 60 | B | resp_rsup_opcodes | drivers/scsi/scsi_debug.c | a_len | kzalloc() | no | FP |
| 4804 | Medium | 60 | B | resp_verify | drivers/scsi/scsi_debug.c | lba | memcmp() in comp_write_worker() | no | FP |
| 4805 | Medium | 60 | B | resp_verify | drivers/scsi/scsi_debug.c | lba | memcmp() in comp_write_worker() | no | FP |
| 4806 | Medium | 60 | B | resp_verify | drivers/scsi/scsi_debug.c | lba | memcpy() in comp_write_worker() | no | FP |
| 4807 | Medium | 60 | B | resp_verify | drivers/scsi/scsi_debug.c | lba | memcpy() in comp_write_worker() | no | FP |
| 4808 | Medium | 60 | B | rh_call_control | drivers/usb/core/hcd.c | tbuf_size | kzalloc() | no | FP |
| 4809 | Medium | 60 | B | rh_call_control | drivers/usb/core/hcd.c | len | memcpy() | no | FP |
| 4810 | Medium | 60 | G2 | rio_mport_maint_wr | drivers/rapidio/devices/rio_mport_cdev.c | length | copy_from_user() unvalidated size | no | FP |
| 4811 | Medium | 60 | G2 | rio_mport_transfer_ioctl | drivers/rapidio/devices/rio_mport_cdev.c | size | copy_from_user() unvalidated size | no | FP |
| 4812 | Medium | 60 | G2 | rio_mport_transfer_ioctl | drivers/rapidio/devices/rio_mport_cdev.c | size | copy_to_user() unvalidated size | no | FP |
| 4813 | Medium | 60 | G2 | rng_dev_read | drivers/char/hw_random/core.c | len | copy_to_user() unvalidated size | no | FP |
| 4814 | Medium | 60 | G2 | roccat_read | drivers/hid/hid-roccat.c | len | copy_to_user() unvalidated size | no | FP |
| 4815 | Medium | 60 | G2 | rs_sta_dbgfs_scale_table_write | drivers/net/wireless/intel/iwlwifi/dvm/rs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4816 | Medium | 60 | G2 | rs_sta_dbgfs_scale_table_write | drivers/net/wireless/intel/iwlwifi/mvm/rs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4817 | Medium | 60 | G2 | rt2x00debug_read_crypto_stats | drivers/net/wireless/ralink/rt2x00/rt2x00debug.c | size | copy_to_user() unvalidated size | no | FP |
| 4818 | Medium | 60 | G2 | rt2x00debug_read_queue_dump | drivers/net/wireless/ralink/rt2x00/rt2x00debug.c | status | copy_to_user() unvalidated size | no | FP |
| 4819 | Medium | 60 | G2 | rt2x00debug_read_queue_stats | drivers/net/wireless/ralink/rt2x00/rt2x00debug.c | size | copy_to_user() unvalidated size | no | FP |
| 4820 | Medium | 60 | C | rtl8180_handle_rx | drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | idx | subscript | no | FP |
| 4821 | Medium | 60 | G2 | rtl_debugfs_set_write_h2c | drivers/net/wireless/realtek/rtlwifi/debug.c | tmp_len | copy_from_user() unvalidated size | no | FP |
| 4822 | Medium | 60 | G2 | rtl_debugfs_set_write_reg | drivers/net/wireless/realtek/rtlwifi/debug.c | tmp_len | copy_from_user() unvalidated size | no | FP |
| 4823 | Medium | 60 | G2 | rtl_debugfs_set_write_rfreg | drivers/net/wireless/realtek/rtlwifi/debug.c | tmp_len | copy_from_user() unvalidated size | no | FP |
| 4824 | Medium | 60 | G2 | rtw89_debugfs_file_write | drivers/net/wireless/realtek/rtw89/debug.c | count | copy_from_user() unvalidated size | no | FP |
| 4825 | Medium | 60 | C | rtw89_phy_c2h_rfk_tas_pwr | drivers/net/wireless/realtek/rtw89/phy.c | txpwr | subscript (callee) | no | FP |
| 4826 | Medium | 60 | B | rtw89_recognize_regd_from_elm | drivers/net/wireless/realtek/rtw89/fw.c | p | devm_kzalloc() | no | FP |
| 4827 | Medium | 60 | G2 | rtw_debugfs_copy_from_user | drivers/net/wireless/realtek/rtw88/debug.c | tmp_len | copy_from_user() unvalidated size | no | FP |
| 4828 | Medium | 60 | G2 | rvu_dbg_lmtst_map_table_display | drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | ret | copy_to_user() unvalidated size | no | FP |
| 4829 | Medium | 60 | G2 | rvu_dbg_rsrc_attach_status | drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | off | copy_to_user() unvalidated size | no | FP |
| 4830 | Medium | 60 | G2 | rvu_dbg_rsrc_attach_status | drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | off | copy_to_user() unvalidated size | no | FP |
| 4831 | Medium | 60 | C | save_frame | drivers/media/usb/s2255/s2255drv.c | idx | subscript | no | FP |
| 4832 | Medium | 60 | B | sci_io_request_copy_response | drivers/scsi/isci/request.c | len | memcpy() | no | FP |
| 4833 | Medium | 60 | G2 | sclp_ctl_ioctl_sccb | drivers/s390/char/sclp_ctl.c | PAGE_SIZE | copy_from_user() unvalidated size | no | FP |
| 4834 | Medium | 60 | G2 | scsi_bsg_sg_io_fn | drivers/scsi/scsi_bsg.c | len | copy_to_user() unvalidated size | no | FP |
| 4835 | Medium | 60 | G2 | scsi_bsg_uring_task_cb | drivers/scsi/scsi_bsg.c | sense_len_wr | copy_to_user() unvalidated size | no | FP |
| 4836 | Medium | 60 | G2 | scsi_complete_sghdr_rq | drivers/scsi/scsi_ioctl.c | len | copy_to_user() unvalidated size | no | FP |
| 4837 | Medium | 60 | G2 | scsi_ioctl_get_pci | drivers/scsi/scsi_ioctl.c | strnlen(name, 20) | copy_to_user() unvalidated size | no | FP |
| 4838 | Medium | 60 | C | scsi_report_lun_scan | drivers/scsi/scsi_scan.c | num_luns | subscript | no | FP |
| 4839 | Medium | 60 | G2 | sec_attest_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, max_size, sizeof(*info)) | copy_to_user() unvalidated size | no | FP |
| 4840 | Medium | 60 | G2 | sev_ioctl_do_get_id | drivers/crypto/ccp/sev-dev.c | data->len | copy_to_user() unvalidated size | no | FP |
| 4841 | Medium | 60 | G2 | sfs_ioctl | drivers/crypto/ccp/sfs.c | PAGE_SIZE | copy_to_user() unvalidated size | no | FP |
| 4842 | Medium | 60 | G2 | sfs_ioctl | drivers/crypto/ccp/sfs.c | PAYLOAD_NAME_SIZE | copy_from_user() unvalidated size | no | FP |
| 4843 | Medium | 60 | G2 | sg_ioctl_common | drivers/scsi/sg.c | SZ_SG_REQ_INFO * SG_MAX_QUEUE | copy_to_user() unvalidated size | no | FP |
| 4844 | Medium | 60 | G2 | sg_new_read | drivers/scsi/sg.c | len | copy_to_user() unvalidated size | no | FP |
| 4845 | Medium | 60 | G2 | sg_scsi_ioctl | drivers/scsi/scsi_ioctl.c | cmdlen | copy_from_user() unvalidated size | no | FP |
| 4846 | Medium | 60 | G2 | sg_scsi_ioctl | drivers/scsi/scsi_ioctl.c | min(scmd->sense_len, 16U) | copy_to_user() unvalidated size | no | FP |
| 4847 | Medium | 60 | G2 | sg_write | drivers/scsi/sg.c | cmd_size | copy_from_user() unvalidated size | no | FP |
| 4848 | Medium | 60 | B | shift_down | drivers/md/persistent-data/dm-btree.c | le32_to_cpu(n->header.nr_entries) - count | memmove() in move_entries() | no | FP |
| 4849 | Medium | 60 | B | shift_down | drivers/md/persistent-data/dm-btree.c | le32_to_cpu(n->header.nr_entries) - count | memmove() in move_entries() | no | FP |
| 4850 | Medium | 60 | B | shift_up | drivers/md/persistent-data/dm-btree.c | le32_to_cpu(n->header.nr_entries) | memmove() in move_entries() | no | FP |
| 4851 | Medium | 60 | B | shift_up | drivers/md/persistent-data/dm-btree.c | le32_to_cpu(n->header.nr_entries) | memmove() in move_entries() | no | FP |
| 4852 | Medium | 60 | G2 | shmem_pread | drivers/gpu/drm/i915/i915_gem.c | len | __copy_to_user() unvalidated size | no | FP |
| 4853 | Medium | 60 | G2 | shmem_pwrite | drivers/gpu/drm/i915/i915_gem.c | len | __copy_from_user() unvalidated size | no | FP |
| 4854 | Medium | 60 | G2 | sisusb_recv_bulk_msg | drivers/usb/misc/sisusbvga/sisusbvga.c | thispass | copy_to_user() unvalidated size | no | FP |
| 4855 | Medium | 60 | G2 | sisusb_send_bulk_msg | drivers/usb/misc/sisusbvga/sisusbvga.c | passsize | copy_from_user() unvalidated size | no | FP |
| 4856 | Medium | 60 | G2 | skel_read | drivers/usb/usb-skeleton.c | chunk | copy_to_user() unvalidated size | no | FP |
| 4857 | Medium | 60 | G2 | skel_write | drivers/usb/usb-skeleton.c | writesize | copy_from_user() unvalidated size | no | FP |
| 4858 | Medium | 60 | G2 | skfp_siocdevprivate | drivers/net/fddi/skfp/skfddi.c | ioc.len | copy_to_user() unvalidated size | no | FP |
| 4859 | Medium | 60 | G2 | slcan_ioctl | drivers/net/can/slcan/slcan-core.c | tmp | copy_to_user() unvalidated size | no | FP |
| 4860 | Medium | 60 | G2 | smb_read | drivers/hwtracing/coresight/ultrasoc-smb.c | to_copy | copy_to_user() unvalidated size | no | FP |
| 4861 | Medium | 60 | G2 | smtcfb_read | drivers/video/fbdev/sm712fb.c | c | copy_to_user() unvalidated size | no | FP |
| 4862 | Medium | 60 | G2 | smtcfb_write | drivers/video/fbdev/sm712fb.c | c | copy_from_user() unvalidated size | no | FP |
| 4863 | Medium | 60 | G2 | snoop_file_read | drivers/soc/aspeed/aspeed-lpc-snoop.c | copied | copy_to_user() unvalidated size | no | FP |
| 4864 | Medium | 60 | C | solos_bh | drivers/atm/solos-pci.c | le16_to_cpu(header->vci) | subscript (callee) | no | FP |
| 4865 | Medium | 60 | G2 | speakup_file_write | drivers/accessibility/speakup/devsynth.c | bytes | copy_from_user() unvalidated size | no | FP |
| 4866 | Medium | 60 | G2 | speakup_file_writeu | drivers/accessibility/speakup/devsynth.c | bytes | copy_from_user() unvalidated size | no | FP |
| 4867 | Medium | 60 | G2 | spidev_message | drivers/spi/spidev.c | u_tmp->len | copy_from_user() unvalidated size | no | FP |
| 4868 | Medium | 60 | G2 | spidev_message | drivers/spi/spidev.c | u_tmp->len | copy_to_user() unvalidated size | no | FP |
| 4869 | Medium | 60 | B | spmi_read_cmd | drivers/spmi/hisi-spmi-controller.c | data | memcpy() | no | FP |
| 4870 | Medium | 60 | G2 | ssam_cdev_request | drivers/platform/surface/surface_aggregator_cdev.c | spec.length | copy_from_user() unvalidated size | no | FP |
| 4871 | Medium | 60 | G2 | ssam_cdev_request | drivers/platform/surface/surface_aggregator_cdev.c | rsp.length | copy_to_user() unvalidated size | no | FP |
| 4872 | Medium | 60 | G2 | ssusb_mode_write | drivers/usb/mtu3/mtu3_debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4873 | Medium | 60 | G2 | ssusb_vbus_write | drivers/usb/mtu3/mtu3_debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4874 | Medium | 60 | G2 | stm_char_policy_get_ioctl | drivers/hwtracing/stm/core.c | id.size | copy_to_user() unvalidated size | no | FP |
| 4875 | Medium | 60 | G2 | stm_char_write | drivers/hwtracing/stm/core.c | count | copy_from_user() unvalidated size | no | FP |
| 4876 | Medium | 60 | G2 | str_to_user | drivers/input/evdev.c | len | copy_to_user() unvalidated size | no | FP |
| 4877 | Medium | 60 | G2 | submit_copy_gather_data | drivers/gpu/drm/tegra/submit.c | copy_len | copy_from_user() unvalidated size | no | FP |
| 4878 | Medium | 60 | B | subn_get_opa_aggregate | drivers/infiniband/hw/hfi1/mad.c | agg_data_len | memset() | no | FP |
| 4879 | Medium | 60 | G2 | suspend_queues | drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | num_queues * sizeof(uint32_t) | copy_to_user() unvalidated size | no | FP |
| 4880 | Medium | 60 | C | switchtec_dma_cleanup_completed | drivers/dma/switchtec_dma.c | se_idx | subscript | no | FP |
| 4881 | Medium | 60 | G2 | sync_file_ioctl_fence_info | drivers/dma-buf/sync_file.c | size | copy_to_user() unvalidated size | no | FP |
| 4882 | Medium | 60 | G2 | sync_manager_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, (size_t) max_size,
sizeof(sm_info)) | copy_to_user() unvalidated size | no | FP |
| 4883 | Medium | 60 | G2 | ta_if_invoke_debugfs_write | drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | shared_buf_len | copy_to_user() unvalidated size | no | FP |
| 4884 | Medium | 60 | G2 | tap_ioctl | drivers/net/tap.c | IFNAMSIZ | copy_to_user() unvalidated size | no | FP |
| 4885 | Medium | 60 | G2 | tap_ioctl | drivers/net/tap.c | IFNAMSIZ | copy_to_user() unvalidated size | no | FP |
| 4886 | Medium | 60 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | cur_bd | subscript | no | FP |
| 4887 | Medium | 60 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | cur_bd | subscript | no | FP |
| 4888 | Medium | 60 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | cur_bd | subscript | no | FP |
| 4889 | Medium | 60 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | cur_bd | subscript | no | FP |
| 4890 | Medium | 60 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | cur_bd | subscript | no | FP |
| 4891 | Medium | 60 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | curid | subscript | no | FP |
| 4892 | Medium | 60 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | curid | subscript | no | FP |
| 4893 | Medium | 60 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | curid | subscript | no | FP |
| 4894 | Medium | 60 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | curid | subscript | no | FP |
| 4895 | Medium | 60 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | curid | subscript | no | FP |
| 4896 | Medium | 60 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | curid | subscript | no | FP |
| 4897 | Medium | 60 | G2 | tce_iommu_ioctl | drivers/vfio/vfio_iommu_spapr_tce.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4898 | Medium | 60 | C | tegra_xudc_ep0_get_status | drivers/usb/gadget/udc/tegra-xudc.c | ep | subscript | no | FP |
| 4899 | Medium | 60 | C | tegra_xudc_ep0_set_feature | drivers/usb/gadget/udc/tegra-xudc.c | ep | subscript | no | FP |
| 4900 | Medium | 60 | G2 | testmode_write | drivers/usb/dwc2/debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 4901 | Medium | 60 | C | tid_rdma_rcv_error | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4902 | Medium | 60 | C | tid_rdma_rcv_error | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4903 | Medium | 60 | C | tid_rdma_rcv_error | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4904 | Medium | 60 | C | tid_rdma_rcv_error | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | no | FP |
| 4905 | Medium | 60 | G2 | time_sync_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(time_sync)) | copy_to_user() unvalidated size | no | FP |
| 4906 | Medium | 60 | G2 | tool_peer_mw_read | drivers/ntb/test/ntb_tool.c | size | copy_to_user() unvalidated size | no | FP |
| 4907 | Medium | 60 | G2 | tool_peer_mw_trans_write | drivers/ntb/test/ntb_tool.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 4908 | Medium | 60 | G2 | tool_peer_mw_write | drivers/ntb/test/ntb_tool.c | size | copy_from_user() unvalidated size | no | FP |
| 4909 | Medium | 60 | G2 | total_energy_consumption_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min((size_t) max_size, sizeof(total_energy)) | copy_to_user() unvalidated size | no | FP |
| 4910 | Medium | 60 | G2 | tower_read | drivers/usb/misc/legousbtower.c | bytes_to_read | copy_to_user() unvalidated size | no | FP |
| 4911 | Medium | 60 | G2 | tower_write | drivers/usb/misc/legousbtower.c | bytes_to_write | copy_from_user() unvalidated size | no | FP |
| 4912 | Medium | 60 | G2 | tp_la_write | drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | size | copy_from_user() unvalidated size | no | FP |
| 4913 | Medium | 60 | G2 | trng_read | drivers/char/hw_random/s390-trng.c | n | copy_to_user() unvalidated size | no | FP |
| 4914 | Medium | 60 | G2 | ts_play | drivers/staging/media/av7110/av7110_av.c | TS_SIZE | copy_from_user() unvalidated size | no | FP |
| 4915 | Medium | 60 | C | txdesc_show | drivers/net/wireless/ath/wil6210/debugfs.c | buff_id | subscript | no | FP |
| 4916 | Medium | 60 | B | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | len | memcpy() | no | FP |
| 4917 | Medium | 60 | B | typhoon_process_response | drivers/net/ethernet/3com/typhoon.c | wrap_len | memcpy() | no | FP |
| 4918 | Medium | 60 | C | ubi_eba_copy_leb | drivers/mtd/ubi/eba.c | data_size | subscript (callee) | no | FP |
| 4919 | Medium | 60 | G2 | ubi_more_leb_change_data | drivers/mtd/ubi/upd.c | count | copy_from_user() unvalidated size | no | FP |
| 4920 | Medium | 60 | G2 | ubi_more_update_data | drivers/mtd/ubi/upd.c | len | copy_from_user() unvalidated size | no | FP |
| 4921 | Medium | 60 | G2 | ublk_batch_copy_io_tags | drivers/block/ublk_drv.c | len | copy_to_user() unvalidated size | no | FP |
| 4922 | Medium | 60 | G2 | ublk_ctrl_get_queue_affinity | drivers/block/ublk_drv.c | retlen | copy_to_user() unvalidated size | no | FP |
| 4923 | Medium | 60 | G2 | ublk_ctrl_reg_buf | drivers/block/ublk_drv.c | min_t(size_t, header->len, sizeof(buf_reg)) | copy_from_user() unvalidated size | no | FP |
| 4924 | Medium | 60 | G2 | ublk_walk_cmd_buf | drivers/block/ublk_drv.c | len | copy_from_user() unvalidated size | no | FP |
| 4925 | Medium | 60 | G2 | ucma_accept | drivers/infiniband/core/ucma.c | in_size | copy_from_user() unvalidated size | no | FP |
| 4926 | Medium | 60 | G2 | ucma_connect | drivers/infiniband/core/ucma.c | in_size | copy_from_user() unvalidated size | no | FP |
| 4927 | Medium | 60 | G2 | ucma_query_ib_service | drivers/infiniband/core/ucma.c | struct_size(resp, recs, n) | copy_to_user() unvalidated size | no | FP |
| 4928 | Medium | 60 | G2 | ucmd_respond | drivers/fwctl/main.c | min_t(size_t, ucmd->user_size, cmd_len) | copy_to_user() unvalidated size | no | FP |
| 4929 | Medium | 60 | B | ufshcd_prepare_utp_query_req_upiu | drivers/ufs/core/ufshcd.c | len | memcpy() | no | FP |
| 4930 | Medium | 60 | G2 | ufx_ops_ioctl | drivers/video/fbdev/smscufx.c | dev->edid_size | copy_to_user() unvalidated size | no | FP |
| 4931 | Medium | 60 | G2 | uhid_char_read | drivers/hid/uhid.c | len | copy_to_user() unvalidated size | no | FP |
| 4932 | Medium | 60 | G2 | uhid_event_from_user | drivers/hid/uhid.c | min(len, sizeof(*compat)) | copy_from_user() unvalidated size | no | FP |
| 4933 | Medium | 60 | G2 | uhid_event_from_user | drivers/hid/uhid.c | min(len, sizeof(*event)) | copy_from_user() unvalidated size | no | FP |
| 4934 | Medium | 60 | G2 | uhid_event_from_user | drivers/hid/uhid.c | min(len, sizeof(*event)) | copy_from_user() unvalidated size | no | FP |
| 4935 | Medium | 60 | G2 | uinput_str_to_user | drivers/input/misc/uinput.c | len | copy_to_user() unvalidated size | no | FP |
| 4936 | Medium | 60 | G2 | undefined_opcode_info | drivers/accel/habanalabs/common/habanalabs_ioctl.c | min_t(size_t, max_size, sizeof(info)) | copy_to_user() unvalidated size | no | FP |
| 4937 | Medium | 60 | B | usb_get_configuration | drivers/usb/core/config.c | length | kmalloc() | no | FP |
| 4938 | Medium | 60 | G2 | usbdev_read | drivers/usb/core/devio.c | len | copy_to_user() unvalidated size | no | FP |
| 4939 | Medium | 60 | B | usbdev_read | drivers/usb/core/devio.c | len | copy_to_user() | no | FP |
| 4940 | Medium | 60 | C | usblp_cache_device_id_string | drivers/usb/class/usblp.c | length | subscript | no | FP |
| 4941 | Medium | 60 | G2 | usblp_write | drivers/usb/class/usblp.c | transfer_length | copy_from_user() unvalidated size | no | FP |
| 4942 | Medium | 60 | G2 | usbtmc_generic_read | drivers/usb/class/usbtmc.c | this_part | copy_to_user() unvalidated size | no | FP |
| 4943 | Medium | 60 | G2 | usbtmc_generic_write | drivers/usb/class/usbtmc.c | this_part | copy_from_user() unvalidated size | no | FP |
| 4944 | Medium | 60 | G2 | usbtmc_write | drivers/usb/class/usbtmc.c | transfersize | copy_from_user() unvalidated size | no | FP |
| 4945 | Medium | 60 | G2 | userio_char_read | drivers/input/serio/userio.c | copylen | copy_to_user() unvalidated size | no | FP |
| 4946 | Medium | 60 | G2 | uverbs_copy_to | drivers/infiniband/core/ib_core_uverbs.c | min_size | copy_to_user() unvalidated size | no | FP |
| 4947 | Medium | 60 | G2 | uverbs_response | drivers/infiniband/core/uverbs_cmd.c | min(attrs->ucore.outlen, resp_len) | copy_to_user() unvalidated size | no | FP |
| 4948 | Medium | 60 | G2 | uvio_build_uvcb_attest | drivers/s390/char/uvdevice.c | uvio_attest->arcb_len | copy_from_user() unvalidated size | no | FP |
| 4949 | Medium | 60 | G2 | uvio_copy_attest_result_to_user | drivers/s390/char/uvdevice.c | uvio_attest->meas_len | copy_to_user() unvalidated size | no | FP |
| 4950 | Medium | 60 | G2 | uvio_copy_attest_result_to_user | drivers/s390/char/uvdevice.c | uvio_attest->add_data_len | copy_to_user() unvalidated size | no | FP |
| 4951 | Medium | 60 | G2 | uvio_get_list | drivers/s390/char/uvdevice.c | data_off | copy_to_user() unvalidated size | no | FP |
| 4952 | Medium | 60 | G2 | v3d_perfmon_get_values_ioctl | drivers/gpu/drm/v3d/v3d_perfmon.c | perfmon->ncounters * sizeof(u64) | copy_to_user() unvalidated size | no | FP |
| 4953 | Medium | 60 | G2 | v4l2_compat_get_array_args | drivers/media/v4l2-core/v4l2-compat-ioctl32.c | array_size | copy_from_user() unvalidated size | no | FP |
| 4954 | Medium | 60 | G2 | v4l2_compat_put_array_args | drivers/media/v4l2-core/v4l2-compat-ioctl32.c | size | copy_to_user() unvalidated size | no | FP |
| 4955 | Medium | 60 | G2 | v4l2_compat_put_array_args | drivers/media/v4l2-core/v4l2-compat-ioctl32.c | array_size | copy_to_user() unvalidated size | no | FP |
| 4956 | Medium | 60 | G2 | validate_and_copy_from_user | drivers/thunderbolt/debugfs.c | nbytes | copy_from_user() unvalidated size | no | FP |
| 4957 | Medium | 60 | G2 | vbg_misc_device_ioctl | drivers/virt/vboxguest/vboxguest_linux.c | returned_size | copy_to_user() unvalidated size | no | FP |
| 4958 | Medium | 60 | G2 | vc4_perfmon_get_values_ioctl | drivers/gpu/drm/vc4/vc4_perfmon.c | perfmon->ncounters * sizeof(u64) | copy_to_user() unvalidated size | no | FP |
| 4959 | Medium | 60 | G2 | vchiq_ioc_copy_element_data | drivers/platform/raspberrypi/vchiq-interface/vchiq_dev.c | bytes_this_round | copy_from_user() unvalidated size | no | FP |
| 4960 | Medium | 60 | G2 | vcs_read | drivers/tty/vt/vc_screen.c | this_round | copy_to_user() unvalidated size | no | FP |
| 4961 | Medium | 60 | G2 | vcs_write | drivers/tty/vt/vc_screen.c | this_round | copy_from_user() unvalidated size | no | FP |
| 4962 | Medium | 60 | G2 | vduse_dev_compat_ioctl | drivers/vdpa/vdpa_user/vduse_dev.c | _IOC_SIZE(cmd) | copy_from_user() unvalidated size | no | FP |
| 4963 | Medium | 60 | G2 | vduse_dev_compat_ioctl | drivers/vdpa/vdpa_user/vduse_dev.c | _IOC_SIZE(cmd) | copy_to_user() unvalidated size | no | FP |
| 4964 | Medium | 60 | G2 | vduse_dev_ioctl | drivers/vdpa/vdpa_user/vduse_dev.c | size | copy_from_user() unvalidated size | no | FP |
| 4965 | Medium | 60 | G2 | vduse_ioctl | drivers/vdpa/vdpa_user/vduse_dev.c | size | copy_from_user() unvalidated size | no | FP |
| 4966 | Medium | 60 | G2 | vduse_ioctl | drivers/vdpa/vdpa_user/vduse_dev.c | VDUSE_NAME_MAX | copy_from_user() unvalidated size | no | FP |
| 4967 | Medium | 60 | G2 | vfio_ap_get_irq_info | drivers/s390/crypto/vfio_ap_ops.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4968 | Medium | 60 | G2 | vfio_ap_irq_set_init | drivers/s390/crypto/vfio_ap_ops.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4969 | Medium | 60 | G2 | vfio_ap_mdev_get_device_info | drivers/s390/crypto/vfio_ap_ops.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4970 | Medium | 60 | G2 | vfio_ccw_mdev_ioctl | drivers/s390/cio/vfio_ccw_ops.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4971 | Medium | 60 | G2 | vfio_cdx_bm_ctrl | drivers/vfio/cdx/main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4972 | Medium | 60 | G2 | vfio_cdx_ioctl_get_info | drivers/vfio/cdx/main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4973 | Medium | 60 | G2 | vfio_cdx_ioctl_get_irq_info | drivers/vfio/cdx/main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4974 | Medium | 60 | G2 | vfio_cdx_ioctl_set_irqs | drivers/vfio/cdx/main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4975 | Medium | 60 | G2 | vfio_df_ioctl_attach_pt | drivers/vfio/device_cdev.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4976 | Medium | 60 | G2 | vfio_df_ioctl_detach_pt | drivers/vfio/device_cdev.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4977 | Medium | 60 | G2 | vfio_fsl_mc_ioctl | drivers/vfio/fsl-mc/vfio_fsl_mc.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4978 | Medium | 60 | G2 | vfio_get_region_info | drivers/vfio/vfio_main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4979 | Medium | 60 | G2 | vfio_group_ioctl_get_status | drivers/vfio/group.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4980 | Medium | 60 | G2 | vfio_ioctl_device_feature | drivers/vfio/vfio_main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4981 | Medium | 60 | G2 | vfio_ioctl_device_feature_logging_report | drivers/vfio/vfio_main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4982 | Medium | 60 | G2 | vfio_ioctl_device_feature_logging_start | drivers/vfio/vfio_main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4983 | Medium | 60 | G2 | vfio_ioctl_device_feature_mig_device_state | drivers/vfio/vfio_main.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4984 | Medium | 60 | G2 | vfio_iommu_type1_dirty_pages | drivers/vfio/vfio_iommu_type1.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4985 | Medium | 60 | G2 | vfio_iommu_type1_dma_rw_chunk | drivers/vfio/vfio_iommu_type1.c | count | copy_to_user() unvalidated size | no | FP |
| 4986 | Medium | 60 | G2 | vfio_iommu_type1_dma_rw_chunk | drivers/vfio/vfio_iommu_type1.c | count | copy_from_user() unvalidated size | no | FP |
| 4987 | Medium | 60 | G2 | vfio_iommu_type1_get_info | drivers/vfio/vfio_iommu_type1.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4988 | Medium | 60 | G2 | vfio_iommu_type1_map_dma | drivers/vfio/vfio_iommu_type1.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4989 | Medium | 60 | G2 | vfio_iommu_type1_unmap_dma | drivers/vfio/vfio_iommu_type1.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4990 | Medium | 60 | G2 | vfio_pci_igd_rw | drivers/vfio/pci/vfio_pci_igd.c | remaining | copy_to_user() unvalidated size | no | FP |
| 4991 | Medium | 60 | G2 | vfio_pci_ioctl_get_info | drivers/vfio/pci/vfio_pci_core.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4992 | Medium | 60 | G2 | vfio_pci_ioctl_get_irq_info | drivers/vfio/pci/vfio_pci_core.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4993 | Medium | 60 | G2 | vfio_pci_ioctl_get_pci_hot_reset_info | drivers/vfio/pci/vfio_pci_core.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4994 | Medium | 60 | G2 | vfio_pci_ioctl_get_pci_hot_reset_info | drivers/vfio/pci/vfio_pci_core.c | sizeof(*devices) * fill.count | copy_to_user() unvalidated size | no | FP |
| 4995 | Medium | 60 | G2 | vfio_pci_ioctl_ioeventfd | drivers/vfio/pci/vfio_pci_core.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4996 | Medium | 60 | G2 | vfio_pci_ioctl_pci_hot_reset | drivers/vfio/pci/vfio_pci_core.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4997 | Medium | 60 | G2 | vfio_pci_ioctl_set_irqs | drivers/vfio/pci/vfio_pci_core.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4998 | Medium | 60 | G2 | vfio_platform_ioctl | drivers/vfio/platform/vfio_platform_common.c | minsz | copy_from_user() unvalidated size | no | FP |
| 4999 | Medium | 60 | G2 | vfio_spapr_ioctl_eeh_pe_op | drivers/vfio/vfio_iommu_spapr_tce.c | minsz | copy_from_user() unvalidated size | no | FP |
| 5000 | Medium | 60 | G2 | vga_arb_read | drivers/pci/vgaarb.c | len | copy_to_user() unvalidated size | no | FP |
| 5001 | Medium | 60 | G2 | vga_switcheroo_debugfs_write | drivers/gpu/vga/vga_switcheroo.c | cnt | copy_from_user() unvalidated size | no | FP |
| 5002 | Medium | 60 | G2 | vhci_put_user | drivers/bluetooth/hci_vhci.c | len | copy_to_user() unvalidated size | no | FP |
| 5003 | Medium | 60 | G2 | vhost_copy_from_user | drivers/vhost/vhost.c | size | __copy_from_user() unvalidated size | no | FP |
| 5004 | Medium | 60 | G2 | vhost_copy_from_user | drivers/vhost/vhost.c | size | __copy_from_user() unvalidated size | no | FP |
| 5005 | Medium | 60 | G2 | vhost_copy_to_user | drivers/vhost/vhost.c | size | __copy_to_user() unvalidated size | no | FP |
| 5006 | Medium | 60 | G2 | vhost_copy_to_user | drivers/vhost/vhost.c | size | __copy_to_user() unvalidated size | no | FP |
| 5007 | Medium | 60 | G2 | vhost_net_ioctl | drivers/vhost/net.c | copied * sizeof(u64) | copy_to_user() unvalidated size | no | FP |
| 5008 | Medium | 60 | G2 | vhost_net_ioctl | drivers/vhost/net.c | size_mul(count - copied, sizeof(u64)) | clear_user() unvalidated size | no | FP |
| 5009 | Medium | 60 | G2 | vhost_net_ioctl | drivers/vhost/net.c | copied * sizeof(u64) | copy_from_user() unvalidated size | no | FP |
| 5010 | Medium | 60 | G2 | vhost_set_memory | drivers/vhost/vhost.c | size | copy_from_user() unvalidated size | no | FP |
| 5011 | Medium | 60 | G2 | vhost_vdpa_get_config | drivers/vhost/vdpa.c | size | copy_from_user() unvalidated size | no | FP |
| 5012 | Medium | 60 | G2 | vhost_vdpa_get_config | drivers/vhost/vdpa.c | config.len | copy_to_user() unvalidated size | no | FP |
| 5013 | Medium | 60 | G2 | vhost_vdpa_set_config | drivers/vhost/vdpa.c | size | copy_from_user() unvalidated size | no | FP |
| 5014 | Medium | 60 | G2 | viafb_dvp0_proc_write | drivers/video/fbdev/via/viafbdev.c | length | copy_from_user() unvalidated size | no | FP |
| 5015 | Medium | 60 | G2 | viafb_dvp1_proc_write | drivers/video/fbdev/via/viafbdev.c | length | copy_from_user() unvalidated size | no | FP |
| 5016 | Medium | 60 | G2 | viafb_vt1636_proc_write | drivers/video/fbdev/via/viafbdev.c | length | copy_from_user() unvalidated size | no | FP |
| 5017 | Medium | 60 | G2 | video_get_user | drivers/media/v4l2-core/v4l2-ioctl.c | n | copy_from_user() unvalidated size | no | FP |
| 5018 | Medium | 60 | G2 | video_usercopy | drivers/media/v4l2-core/v4l2-ioctl.c | array_size | copy_from_user() unvalidated size | no | FP |
| 5019 | Medium | 60 | G2 | video_usercopy | drivers/media/v4l2-core/v4l2-ioctl.c | array_size | copy_to_user() unvalidated size | no | FP |
| 5020 | Medium | 60 | G2 | vidi_connection_ioctl | drivers/gpu/drm/exynos/exynos_drm_vidi.c | size | copy_from_user() unvalidated size | no | FP |
| 5021 | Medium | 60 | G2 | virtio_gpu_get_caps_ioctl | drivers/gpu/drm/virtio/virtgpu_ioctl.c | size | copy_to_user() unvalidated size | no | FP |
| 5022 | Medium | 60 | G2 | virtio_gpu_init_submit_buflist | drivers/gpu/drm/virtio/virtgpu_submit.c | exbuf->num_bo_handles * sizeof(*bo_handles) | copy_from_user() unvalidated size | no | FP |
| 5023 | Medium | 60 | G2 | virtio_gpu_parse_deps | drivers/gpu/drm/virtio/virtgpu_submit.c | min(syncobj_stride, sizeof(syncobj_desc)) | copy_from_user() unvalidated size | no | FP |
| 5024 | Medium | 60 | G2 | virtio_gpu_parse_post_deps | drivers/gpu/drm/virtio/virtgpu_submit.c | min(syncobj_stride, sizeof(syncobj_desc)) | copy_from_user() unvalidated size | no | FP |
| 5025 | Medium | 60 | G2 | virtiovf_append_page_to_mig_buf | drivers/vfio/pci/virtio/migrate.c | page_len | copy_from_user() unvalidated size | no | FP |
| 5026 | Medium | 60 | G2 | virtiovf_buf_read | drivers/vfio/pci/virtio/migrate.c | page_len | copy_to_user() unvalidated size | no | FP |
| 5027 | Medium | 60 | G2 | virtiovf_pci_read_config | drivers/vfio/pci/virtio/legacy_io.c | copy_count | copy_to_user() unvalidated size | no | FP |
| 5028 | Medium | 60 | G2 | virtiovf_pci_read_config | drivers/vfio/pci/virtio/legacy_io.c | copy_count | copy_from_user() unvalidated size | no | FP |
| 5029 | Medium | 60 | G2 | virtiovf_pci_read_config | drivers/vfio/pci/virtio/legacy_io.c | copy_count | copy_to_user() unvalidated size | no | FP |
| 5030 | Medium | 60 | G2 | virtiovf_pci_read_config | drivers/vfio/pci/virtio/legacy_io.c | copy_count | copy_to_user() unvalidated size | no | FP |
| 5031 | Medium | 60 | G2 | virtiovf_pci_read_config | drivers/vfio/pci/virtio/legacy_io.c | copy_count | copy_to_user() unvalidated size | no | FP |
| 5032 | Medium | 60 | G2 | virtiovf_pci_read_config | drivers/vfio/pci/virtio/legacy_io.c | copy_count | copy_to_user() unvalidated size | no | FP |
| 5033 | Medium | 60 | G2 | virtiovf_pci_read_config | drivers/vfio/pci/virtio/legacy_io.c | copy_count | copy_to_user() unvalidated size | no | FP |
| 5034 | Medium | 60 | G2 | virtiovf_pci_write_config | drivers/vfio/pci/virtio/legacy_io.c | copy_count | copy_from_user() unvalidated size | no | FP |
| 5035 | Medium | 60 | G2 | virtiovf_pci_write_config | drivers/vfio/pci/virtio/legacy_io.c | copy_count | copy_from_user() unvalidated size | no | FP |
| 5036 | Medium | 60 | G2 | virtiovf_precopy_ioctl | drivers/vfio/pci/virtio/migrate.c | offsetofend(struct vfio_precopy_info, dirty_bytes) | copy_to_user() unvalidated size | no | FP |
| 5037 | Medium | 60 | G2 | virtiovf_resume_read_header | drivers/vfio/pci/virtio/migrate.c | copy_len | copy_from_user() unvalidated size | no | FP |
| 5038 | Medium | 60 | G2 | virtual_ncidev_read | drivers/nfc/virtual_ncidev.c | actual_len | copy_to_user() unvalidated size | no | FP |
| 5039 | Medium | 60 | G2 | virtual_ncidev_write | drivers/nfc/virtual_ncidev.c | count | copy_from_user() unvalidated size | no | FP |
| 5040 | Medium | 60 | G2 | vmci_host_do_receive_datagram | drivers/misc/vmw_vmci/vmci_host.c | VMCI_DG_SIZE(dg) | copy_to_user() unvalidated size | no | FP |
| 5041 | Medium | 60 | G2 | vmclock_miscdev_read | drivers/ptp/ptp_vmclock.c | count | copy_to_user() unvalidated size | no | FP |
| 5042 | Medium | 60 | G2 | vmlogrdr_read | drivers/s390/char/vmlogrdr.c | count | copy_to_user() unvalidated size | no | FP |
| 5043 | Medium | 60 | G2 | vmw_execbuf_process | drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | command_size | copy_from_user() unvalidated size | no | FP |
| 5044 | Medium | 60 | G2 | vmw_kms_update_layout_ioctl | drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | rects_size | copy_from_user() unvalidated size | no | FP |
| 5045 | Medium | 60 | G2 | vol_cdev_direct_write | drivers/mtd/ubi/cdev.c | len | copy_from_user() unvalidated size | no | FP |
| 5046 | Medium | 60 | G2 | vol_cdev_read | drivers/mtd/ubi/cdev.c | len | copy_to_user() unvalidated size | no | FP |
| 5047 | Medium | 60 | C | vs_head | drivers/net/vxlan/vxlan_private.h | hash_32(ntohs(port), PORT_HASH_BITS) | subscript | no | FP |
| 5048 | Medium | 60 | G2 | vt_do_kdgkbdiacr | drivers/tty/vt/keyboard.c | asize * sizeof(struct kbdiacr) | copy_to_user() unvalidated size | no | FP |
| 5049 | Medium | 60 | G2 | vt_do_kdgkbdiacruc | drivers/tty/vt/keyboard.c | asize * sizeof(struct kbdiacruc) | copy_to_user() unvalidated size | no | FP |
| 5050 | Medium | 60 | B | wdt87xx_get_feature | drivers/input/touchscreen/wdt87xx_i2c.c | rx_len | memcpy() | no | FP |
| 5051 | Medium | 60 | B | wdt87xx_write_firmware | drivers/input/touchscreen/wdt87xx_i2c.c | page_size | memcpy() in wdt87xx_write_data() | no | FP |
| 5052 | Medium | 60 | G2 | wiidebug_drm_write | drivers/hid/hid-wiimote-debug.c | len | copy_from_user() unvalidated size | no | FP |
| 5053 | Medium | 60 | C | wil_print_desc_edma | drivers/net/wireless/ath/wil6210/debugfs.c | buff_id | subscript | no | FP |
| 5054 | Medium | 60 | G2 | wil_read_file_ioblob | drivers/net/wireless/ath/wil6210/debugfs.c | count | copy_to_user() unvalidated size | no | FP |
| 5055 | Medium | 60 | C | wil_sring_reap_rx_edma | drivers/net/wireless/ath/wil6210/txrx_edma.c | buff_id | subscript | no | FP |
| 5056 | Medium | 60 | C | wil_sring_reap_rx_edma | drivers/net/wireless/ath/wil6210/txrx_edma.c | buff_id | subscript | no | FP |
| 5057 | Medium | 60 | C | wil_sring_reap_rx_edma | drivers/net/wireless/ath/wil6210/txrx_edma.c | buff_id | subscript | no | FP |
| 5058 | Medium | 60 | C | wil_sring_reap_rx_edma | drivers/net/wireless/ath/wil6210/txrx_edma.c | buff_id | subscript | no | FP |
| 5059 | Medium | 60 | B | wlcore_event_fw_logger | drivers/net/wireless/ti/wlcore/event.c | len | memcpy() in wl12xx_copy_fwlog() | no | FP |
| 5060 | Medium | 60 | C | wmfw_block_payload_len_garbage | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 5061 | Medium | 60 | C | wmfw_v1_alg_name_unterminated | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 5062 | Medium | 60 | B | wmfw_v1_alg_name_unterminated | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | alg_data | memset() | no | FP |
| 5063 | Medium | 60 | B | wmfw_v1_alg_name_unterminated | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | alg_data | memset() | no | FP |
| 5064 | Medium | 60 | B | wmfw_v1_alg_name_unterminated | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | alg_data | memset() | no | FP |
| 5065 | Medium | 60 | C | wmfw_v1_coeff_count_exceeds_block | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 5066 | Medium | 60 | C | wmfw_v1_coeff_name_unterminated | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 5067 | Medium | 60 | B | wmfw_v1_coeff_name_unterminated | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | coeff | memset() | no | FP |
| 5068 | Medium | 60 | B | wmfw_v1_coeff_name_unterminated | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | coeff | memset() | no | FP |
| 5069 | Medium | 60 | B | wmfw_v1_coeff_name_unterminated | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | coeff | memset() | no | FP |
| 5070 | Medium | 60 | C | wmfw_v2_alg_description_exceeds_block | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 5071 | Medium | 60 | C | wmfw_v2_alg_name_exceeds_block | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 5072 | Medium | 60 | C | wmfw_v2_coeff_block_size_exceeds_block | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 5073 | Medium | 60 | C | wmfw_v2_coeff_count_exceeds_block | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 5074 | Medium | 60 | C | wmfw_v2_coeff_description_exceeds_block | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 5075 | Medium | 60 | C | wmfw_v2_coeff_fullname_exceeds_block | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 5076 | Medium | 60 | C | wmfw_v2_coeff_shortname_exceeds_block | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | le32_to_cpu(header->len) | subscript | no | FP |
| 5077 | Medium | 60 | C | wmi_evt_reassoc_status | drivers/net/wireless/ath/wil6210/wmi.c | le16_to_cpu(data->reassoc_req_ie_len) +
| subscript | no | FP |
| 5078 | Medium | 60 | C | wmi_marshal_string | drivers/platform/wmi/marshalling.c | chars | subscript | no | FP |
| 5079 | Medium | 60 | G2 | write_file_ani | drivers/net/wireless/ath/ath5k/debug.c | count | copy_from_user() unvalidated size | no | FP |
| 5080 | Medium | 60 | G2 | write_file_antenna | drivers/net/wireless/ath/ath5k/debug.c | count | copy_from_user() unvalidated size | no | FP |
| 5081 | Medium | 60 | G2 | write_file_beacon | drivers/net/wireless/ath/ath5k/debug.c | count | copy_from_user() unvalidated size | no | FP |
| 5082 | Medium | 60 | G2 | write_file_bool_bmps | drivers/net/wireless/ath/wcn36xx/debug.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 5083 | Medium | 60 | G2 | write_file_debug | drivers/net/wireless/ath/ath5k/debug.c | count | copy_from_user() unvalidated size | no | FP |
| 5084 | Medium | 60 | G2 | write_file_dump | drivers/net/wireless/ath/wcn36xx/debug.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 5085 | Medium | 60 | G2 | write_file_frameerrors | drivers/net/wireless/ath/ath5k/debug.c | count | copy_from_user() unvalidated size | no | FP |
| 5086 | Medium | 60 | G2 | write_file_nf_override | drivers/net/wireless/ath/ath9k/debug.c | len | copy_from_user() unvalidated size | no | FP |
| 5087 | Medium | 60 | G2 | write_file_queue | drivers/net/wireless/ath/ath5k/debug.c | count | copy_from_user() unvalidated size | no | FP |
| 5088 | Medium | 60 | G2 | write_file_spec_scan_ctl | drivers/net/wireless/ath/ath10k/spectral.c | len | copy_from_user() unvalidated size | no | FP |
| 5089 | Medium | 60 | G2 | write_file_spec_scan_ctl | drivers/net/wireless/ath/ath9k/common-spectral.c | len | copy_from_user() unvalidated size | no | FP |
| 5090 | Medium | 60 | G2 | write_ioctl | drivers/gpib/common/gpib_os.c | (board->buffer_length < remain) ?
board->buffer_length : remain | copy_from_user() unvalidated size | no | FP |
| 5091 | Medium | 60 | G2 | write_mem | drivers/char/mem.c | sz | copy_from_user() unvalidated size | no | FP |
| 5092 | Medium | 60 | G2 | wwan_port_fops_read | drivers/net/wwan/wwan_core.c | copied | copy_to_user() unvalidated size | no | FP |
| 5093 | Medium | 60 | G2 | wwan_port_fops_write | drivers/net/wwan/wwan_core.c | frag_len | copy_from_user() unvalidated size | no | FP |
| 5094 | Medium | 60 | C | wx_rx_vlan | drivers/net/ethernet/wangxun/libwx/wx_lib.c | idx | subscript | no | FP |
| 5095 | Medium | 60 | G2 | xe_eu_stall_data_buf_read | drivers/gpu/drm/xe/xe_eu_stall.c | copy_size | copy_to_user() unvalidated size | no | FP |
| 5096 | Medium | 60 | G2 | xe_oa_copy_to_user | drivers/gpu/drm/xe/xe_oa.c | len | copy_to_user() unvalidated size | no | FP |
| 5097 | Medium | 60 | G2 | xe_vm_snapshot_capture_delayed | drivers/gpu/drm/xe/xe_vm.c | snap->snap[i].len | copy_from_user() unvalidated size | no | FP |
| 5098 | Medium | 60 | G2 | xenbus_file_read | drivers/xen/xenbus/xenbus_dev_frontend.c | sz | copy_to_user() unvalidated size | no | FP |
| 5099 | Medium | 60 | G2 | xfer_from_user | drivers/vhost/vringh.c | len | copy_from_user() unvalidated size | no | FP |
| 5100 | Medium | 60 | G2 | xfer_to_user | drivers/vhost/vringh.c | len | copy_to_user() unvalidated size | no | FP |
| 5101 | Medium | 60 | C | xgene_enet_rx_frame | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | skb_index | subscript | no | FP |
| 5102 | Medium | 60 | C | xgene_enet_rx_frame | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | skb_index | subscript | no | FP |
| 5103 | Medium | 60 | C | xgene_enet_tx_completion | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | skb_index | subscript | no | FP |
| 5104 | Medium | 60 | C | xgene_enet_tx_completion | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | skb_index | subscript | no | FP |
| 5105 | Medium | 60 | C | xgene_enet_tx_completion | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | mss_index | subscript | no | FP |
| 5106 | Medium | 60 | C | xhci_handle_cmd_reset_ep | drivers/usb/host/xhci-ring.c | ep_index | subscript (callee) | no | FP |
| 5107 | Medium | 60 | C | xhci_handle_cmd_set_deq | drivers/usb/host/xhci-ring.c | ep_index | subscript (callee) | no | FP |
| 5108 | Medium | 60 | C | xhci_handle_cmd_set_deq | drivers/usb/host/xhci-ring.c | stream_id | subscript | no | FP |
| 5109 | Medium | 60 | C | xhci_handle_cmd_stop_ep | drivers/usb/host/xhci-ring.c | ep_index | subscript (callee) | no | FP |
| 5110 | Medium | 60 | G2 | xhci_port_write | drivers/usb/host/xhci-debugfs.c | min_t(size_t, sizeof(buf) - 1, count) | copy_from_user() unvalidated size | no | FP |
| 5111 | Medium | 60 | C | xhci_set_usb2_hardware_lpm | drivers/usb/host/xhci.c | hird | subscript | no | FP |
| 5112 | Medium | 60 | G2 | xilly_copy_from_user | drivers/char/xillybus/xillyusb.c | n | copy_from_user() unvalidated size | no | FP |
| 5113 | Medium | 60 | G2 | xilly_copy_to_user | drivers/char/xillybus/xillyusb.c | n | copy_to_user() unvalidated size | no | FP |
| 5114 | Medium | 60 | G2 | xillybus_read | drivers/char/xillybus/xillybus_core.c | howmany | copy_to_user() unvalidated size | no | FP |
| 5115 | Medium | 60 | G2 | xillybus_write | drivers/char/xillybus/xillybus_core.c | howmany | copy_from_user() unvalidated size | no | FP |
| 5116 | Medium | 60 | G2 | z_copy_from_user | drivers/s390/crypto/zcrypt_api.h | n | copy_from_user() unvalidated size | no | FP |
| 5117 | Medium | 60 | G2 | z_copy_to_user | drivers/s390/crypto/zcrypt_api.h | n | copy_to_user() unvalidated size | no | FP |
| 5118 | Medium | 60 | G2 | zcrypt_type6_crt_key | drivers/s390/crypto/zcrypt_cca_key.h | long_len | copy_from_user() unvalidated size | no | FP |
| 5119 | Medium | 60 | G2 | zcrypt_type6_crt_key | drivers/s390/crypto/zcrypt_cca_key.h | short_len | copy_from_user() unvalidated size | no | FP |
| 5120 | Medium | 60 | G2 | zcrypt_type6_crt_key | drivers/s390/crypto/zcrypt_cca_key.h | long_len | copy_from_user() unvalidated size | no | FP |
| 5121 | Medium | 60 | G2 | zcrypt_type6_crt_key | drivers/s390/crypto/zcrypt_cca_key.h | short_len | copy_from_user() unvalidated size | no | FP |
| 5122 | Medium | 60 | G2 | zcrypt_type6_crt_key | drivers/s390/crypto/zcrypt_cca_key.h | long_len | copy_from_user() unvalidated size | no | FP |
| 5123 | Medium | 60 | G2 | zcrypt_unlocked_ioctl | drivers/s390/crypto/zcrypt_api.c | total_size | copy_to_user() unvalidated size | no | FP |
| 5124 | Medium | 60 | G2 | zcrypt_unlocked_ioctl | drivers/s390/crypto/zcrypt_api.c | sizeof(u32) * AP_DEVICES | copy_to_user() unvalidated size | no | FP |
| 5125 | Medium | 60 | G2 | zcrypt_unlocked_ioctl | drivers/s390/crypto/zcrypt_api.c | total_size | copy_to_user() unvalidated size | no | FP |
| 5126 | Medium | 60 | B | zfcp_fc_eval_fcp_rsp | drivers/s390/scsi/zfcp_fc.h | sense_len | memcpy() | no | FP |
| 5127 | Low | 50 | E | <unknown> | drivers/scsi/qla1280.c | ha | ha->? | yes? | FP |
| 5128 | Low | 50 | F | <unknown> | drivers/scsi/qla1280.c | cmd | loop bound | no | FP |
| 5129 | Low | 50 | F | MR_ValidateMapInfo | drivers/scsi/megaraid/megaraid_sas_fp.c | num_lds | loop bound | no | FP |
| 5130 | Low | 50 | F | NFTL_mount | drivers/mtd/nftlmount.c | block | loop bound | no | FP |
| 5131 | Low | 50 | F | __ffs_data_got_descs | drivers/usb/gadget/function/f_fs.c | os_descs_count | loop bound | no | FP |
| 5132 | Low | 50 | F | __qla_copy_purex_to_buffer | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | loop bound | no | FP |
| 5133 | Low | 50 | F | _base_get_event_diag_triggers | drivers/scsi/mpt3sas/mpt3sas_base.c | count | loop bound | no | FP |
| 5134 | Low | 50 | F | _base_get_mpi_diag_triggers | drivers/scsi/mpt3sas/mpt3sas_base.c | count | loop bound | no | FP |
| 5135 | Low | 50 | F | _base_get_scsi_diag_triggers | drivers/scsi/mpt3sas/mpt3sas_base.c | count | loop bound | no | FP |
| 5136 | Low | 50 | F | _scsih_expander_add | drivers/scsi/mpt3sas/mpt3sas_scsih.c | sas_expander | loop bound | no | FP |
| 5137 | Low | 50 | F | _scsih_expander_add | drivers/scsi/mpt3sas/mpt3sas_scsih.c | sas_expander | loop bound | no | FP |
| 5138 | Low | 50 | F | _scsih_sas_pd_hide | drivers/scsi/mpt3sas/mpt3sas_scsih.c | handle | loop bound | no | FP |
| 5139 | Low | 50 | F | _scsih_sas_topology_change_event | drivers/scsi/mpt3sas/mpt3sas_scsih.c | parent_handle | loop bound | no | FP |
| 5140 | Low | 50 | F | _scsih_scan_for_devices_after_reset | drivers/scsi/mpt3sas/mpt3sas_scsih.c | handle | loop bound | no | FP |
| 5141 | Low | 50 | F | _scsih_scan_for_devices_after_reset | drivers/scsi/mpt3sas/mpt3sas_scsih.c | expander_device | loop bound | no | FP |
| 5142 | Low | 50 | F | _show_fbtc_cysta_v2 | drivers/net/wireless/realtek/rtw89/coex.c | c_end | loop bound | no | FP |
| 5143 | Low | 50 | F | aac_show_serial_number | drivers/scsi/aacraid/linit.c | len | loop bound | no | FP |
| 5144 | Low | 50 | F | alloc_isoc_urb | drivers/bluetooth/btusb.c | le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize) | loop bound | no | FP |
| 5145 | Low | 50 | F | altera_check_crc | drivers/misc/altera-stapl/altera.c | crc_section | loop bound | no | FP |
| 5146 | Low | 50 | F | altera_execute | drivers/misc/altera-stapl/altera.c | var_size | loop bound | no | FP |
| 5147 | Low | 50 | F | altera_execute | drivers/misc/altera-stapl/altera.c | data_sect | loop bound | no | FP |
| 5148 | Low | 50 | F | altera_execute | drivers/misc/altera-stapl/altera.c | i | loop bound | no | FP |
| 5149 | Low | 50 | F | altera_execute | drivers/misc/altera-stapl/altera.c | i | loop bound | no | FP |
| 5150 | Low | 50 | F | altera_execute | drivers/misc/altera-stapl/altera.c | long_tmp | loop bound | no | FP |
| 5151 | Low | 50 | F | altera_execute | drivers/misc/altera-stapl/altera.c | i | loop bound | no | FP |
| 5152 | Low | 50 | F | altera_execute | drivers/misc/altera-stapl/altera.c | i | loop bound | no | FP |
| 5153 | Low | 50 | E | amdgpu_discovery_get_nps_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | nps_info | nps_info->v1 | yes? | FP |
| 5154 | Low | 50 | E | amdgpu_discovery_get_nps_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | nps_info | nps_info->v1 | yes? | FP |
| 5155 | Low | 50 | E | amdgpu_discovery_get_nps_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | nps_info | nps_info->v1 | yes? | FP |
| 5156 | Low | 50 | E | amdgpu_discovery_get_nps_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | nps_info | nps_info->v1 | yes? | FP |
| 5157 | Low | 50 | E | amdgpu_discovery_get_nps_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | nps_info | nps_info->v1 | yes? | FP |
| 5158 | Low | 50 | E | amdgpu_discovery_get_nps_info | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | nps_info | nps_info->v1 | yes? | FP |
| 5159 | Low | 50 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | dhdr | dhdr->die_id | yes? | FP |
| 5160 | Low | 50 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | dhdr | dhdr->die_id | yes? | FP |
| 5161 | Low | 50 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->hw_id | yes? | FP |
| 5162 | Low | 50 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->instance_number | yes? | FP |
| 5163 | Low | 50 | E | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | ip->instance_number | yes? | FP |
| 5164 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usVCETableOffset | yes? | FP |
| 5165 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usVCETableOffset | yes? | FP |
| 5166 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usUVDTableOffset | yes? | FP |
| 5167 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usUVDTableOffset | yes? | FP |
| 5168 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usSize | yes? | FP |
| 5169 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usSAMUTableOffset | yes? | FP |
| 5170 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usSAMUTableOffset | yes? | FP |
| 5171 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usSize | yes? | FP |
| 5172 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usPPMTableOffset | yes? | FP |
| 5173 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usPPMTableOffset | yes? | FP |
| 5174 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usSize | yes? | FP |
| 5175 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usACPTableOffset | yes? | FP |
| 5176 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usACPTableOffset | yes? | FP |
| 5177 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usSize | yes? | FP |
| 5178 | Low | 50 | E | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | ext_hdr | ext_hdr->usPowerTuneTableOffset | yes? | FP |
| 5179 | Low | 50 | G1 | ami_set_var_cursorinfo | drivers/video/fbdev/amifb.c | | get_user() retval discarded | no | FP |
| 5180 | Low | 50 | E | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | nSubframe_Length->? | yes? | FP |
| 5181 | Low | 50 | E | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | nSubframe_Length->? | yes? | FP |
| 5182 | Low | 50 | A | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | memcmp() in rtw_alloc_msdu_pkt() | yes? | FP |
| 5183 | Low | 50 | E | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | nSubframe_Length->? | yes? | FP |
| 5184 | Low | 50 | A | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | memcmp() in rtw_alloc_msdu_pkt() | yes? | FP |
| 5185 | Low | 50 | E | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | nSubframe_Length->? | yes? | FP |
| 5186 | Low | 50 | A | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | memcpy() in rtw_alloc_msdu_pkt() | yes? | FP |
| 5187 | Low | 50 | A | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | memcpy() in rtw_alloc_msdu_pkt() | yes? | FP |
| 5188 | Low | 50 | E | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | nSubframe_Length->? | yes? | FP |
| 5189 | Low | 50 | A | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | memcpy() in rtw_alloc_msdu_pkt() | yes? | FP |
| 5190 | Low | 50 | A | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | memcpy() in rtw_alloc_msdu_pkt() | yes? | FP |
| 5191 | Low | 50 | A | amsdu_to_msdu | drivers/staging/rtl8723bs/core/rtw_recv.c | nSubframe_Length | memcpy() in rtw_alloc_msdu_pkt() | yes? | FP |
| 5192 | Low | 50 | F | amt_add_srcs | drivers/net/amt.c | nsrcs | loop bound | no | FP |
| 5193 | Low | 50 | F | amt_igmpv3_report_handler | drivers/net/amt.c | grec | loop bound | no | FP |
| 5194 | Low | 50 | F | amt_igmpv3_report_handler | drivers/net/amt.c | ngrec | loop bound | no | FP |
| 5195 | Low | 50 | F | amt_mldv2_report_handler | drivers/net/amt.c | grec | loop bound | no | FP |
| 5196 | Low | 50 | F | amt_mldv2_report_handler | drivers/net/amt.c | ngrec | loop bound | no | FP |
| 5197 | Low | 50 | G1 | anslcd_write | drivers/macintosh/ans-lcd.c | | __get_user() retval discarded | no | FP |
| 5198 | Low | 50 | E | aoecmd_cfg_rsp | drivers/block/aoe/aoecmd.c | d | d->? | yes? | FP |
| 5199 | Low | 50 | E | aoecmd_cfg_rsp | drivers/block/aoe/aoecmd.c | d | d->? | yes? | FP |
| 5200 | Low | 50 | E | aoecmd_cfg_rsp | drivers/block/aoe/aoecmd.c | d | d->? | yes? | FP |
| 5201 | Low | 50 | F | aoecmd_cfg_rsp | drivers/block/aoe/aoecmd.c | t | loop bound | no | FP |
| 5202 | Low | 50 | E | asd_get_tmf_resp_tasklet | drivers/scsi/aic94xx/aic94xx_tmf.c | ru | ru->resp_data | yes? | FP |
| 5203 | Low | 50 | E | ast_vhub_std_dev_request | drivers/usb/gadget/udc/aspeed-vhub/dev.c | wIndex | wIndex->? | yes? | FP |
| 5204 | Low | 50 | E | ast_vhub_std_dev_request | drivers/usb/gadget/udc/aspeed-vhub/dev.c | wIndex | wIndex->? | yes? | FP |
| 5205 | Low | 50 | E | ast_vhub_std_dev_request | drivers/usb/gadget/udc/aspeed-vhub/dev.c | wIndex | wIndex->? | yes? | FP |
| 5206 | Low | 50 | E | ast_vhub_std_dev_request | drivers/usb/gadget/udc/aspeed-vhub/dev.c | wIndex | wIndex->? | yes? | FP |
| 5207 | Low | 50 | F | ath10k_htt_rx_tx_fetch_confirm | drivers/net/wireless/ath/ath10k/htt_rx.c | num_resp_ids | loop bound | no | FP |
| 5208 | Low | 50 | F | ath10k_htt_rx_tx_fetch_ind | drivers/net/wireless/ath/ath10k/htt_rx.c | num_resp_ids | loop bound | no | FP |
| 5209 | Low | 50 | F | ath10k_htt_rx_tx_fetch_ind | drivers/net/wireless/ath/ath10k/htt_rx.c | num_records | loop bound | no | FP |
| 5210 | Low | 50 | F | ath10k_htt_rx_tx_fetch_ind | drivers/net/wireless/ath/ath10k/htt_rx.c | max_num_msdus | loop bound | no | FP |
| 5211 | Low | 50 | F | ath10k_htt_rx_tx_mode_switch_ind | drivers/net/wireless/ath/ath10k/htt_rx.c | num_records | loop bound | no | FP |
| 5212 | Low | 50 | F | ath12k_chan_info_event | drivers/net/wireless/ath/ath12k/wmi.c | ar | loop bound | no | FP |
| 5213 | Low | 50 | F | ath12k_htt_print_puncture_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | subband_limit | loop bound | no | FP |
| 5214 | Low | 50 | F | ath12k_pdev_bss_chan_info_event | drivers/net/wireless/ath/ath12k/wmi.c | ar | loop bound | no | FP |
| 5215 | Low | 50 | F | ath12k_wifi7_dp_process_rx_err_buf | drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | rx_desc | loop bound | no | FP |
| 5216 | Low | 50 | F | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | loop bound | no | FP |
| 5217 | Low | 50 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | tpc_stats | tpc_stats->pdev_id | yes? | FP |
| 5218 | Low | 50 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | tpc_stats | tpc_stats->end_of_event | yes? | FP |
| 5219 | Low | 50 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | tpc_stats | tpc_stats->event_count | yes? | FP |
| 5220 | Low | 50 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | tpc_stats | tpc_stats->event_count | yes? | FP |
| 5221 | Low | 50 | E | ath12k_wmi_process_tpc_stats | drivers/net/wireless/ath/ath12k/wmi.c | tpc_stats | tpc_stats->end_of_event | yes? | FP |
| 5222 | Low | 50 | F | ath12k_wmi_tlv_fw_stats_data_parse | drivers/net/wireless/ath/ath12k/wmi.c | (inline) | loop bound | no | FP |
| 5223 | Low | 50 | F | ath12k_wmi_tlv_fw_stats_data_parse | drivers/net/wireless/ath/ath12k/wmi.c | (inline) | loop bound | no | FP |
| 5224 | Low | 50 | F | ath12k_wmi_tlv_fw_stats_data_parse | drivers/net/wireless/ath/ath12k/wmi.c | (inline) | loop bound | no | FP |
| 5225 | Low | 50 | F | ath12k_wmi_tlv_rssi_chain_parse | drivers/net/wireless/ath/ath12k/wmi.c | arsta | loop bound | no | FP |
| 5226 | Low | 50 | A | ath6kl_roam_table_read | drivers/net/wireless/ath/ath6kl/debug.c | buf | scnprintf() | yes? | FP |
| 5227 | Low | 50 | A | ath6kl_roam_table_read | drivers/net/wireless/ath/ath6kl/debug.c | buf | scnprintf() | yes? | FP |
| 5228 | Low | 50 | F | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | aggr_conn | loop bound | no | FP |
| 5229 | Low | 50 | F | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | conn | loop bound | no | FP |
| 5230 | Low | 50 | F | ath9k_hw_4k_check_eeprom | drivers/net/wireless/ath/ath9k/eeprom_4k.c | el | loop bound | no | FP |
| 5231 | Low | 50 | F | ath9k_hw_ar9287_check_eeprom | drivers/net/wireless/ath/ath9k/eeprom_9287.c | el | loop bound | no | FP |
| 5232 | Low | 50 | F | ath9k_hw_def_check_eeprom | drivers/net/wireless/ath/ath9k/eeprom_def.c | el | loop bound | no | FP |
| 5233 | Low | 50 | F | atomctrl_initialize_mc_reg_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | reg_block | loop bound | no | FP |
| 5234 | Low | 50 | F | b43_upload_initvals | drivers/net/wireless/broadcom/b43/main.c | count | loop bound | no | FP |
| 5235 | Low | 50 | F | b43_upload_initvals_band | drivers/net/wireless/broadcom/b43/main.c | count | loop bound | no | FP |
| 5236 | Low | 50 | F | b43legacy_upload_initvals | drivers/net/wireless/broadcom/b43legacy/main.c | count | loop bound | no | FP |
| 5237 | Low | 50 | F | be_fw_download | drivers/net/ethernet/emulex/benet/be_cmds.c | num_imgs | loop bound | no | FP |
| 5238 | Low | 50 | F | bin_err_bad_header_length | drivers/firmware/cirrus/test/cs_dsp_test_bin_error.c | real_len | loop bound | no | FP |
| 5239 | Low | 50 | F | bin_err_bad_header_length | drivers/firmware/cirrus/test/cs_dsp_test_bin_error.c | real_len | loop bound | no | FP |
| 5240 | Low | 50 | E | bios_parser_get_device_tag_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | yes? | FP |
| 5241 | Low | 50 | E | bios_parser_get_device_tag_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordType | yes? | FP |
| 5242 | Low | 50 | E | bios_parser_get_device_tag_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | yes? | FP |
| 5243 | Low | 50 | F | bios_parser_get_gpio_pin_info | drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | count | loop bound | no | FP |
| 5244 | Low | 50 | E | bios_parser_get_i2c_info | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | yes? | FP |
| 5245 | Low | 50 | E | bios_parser_get_i2c_info | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordType | yes? | FP |
| 5246 | Low | 50 | E | bios_parser_get_i2c_info | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | yes? | FP |
| 5247 | Low | 50 | E | bios_parser_get_i2c_info | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | yes? | FP |
| 5248 | Low | 50 | F | bios_parser_get_i2c_info | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | record | loop bound | no | FP |
| 5249 | Low | 50 | F | bnge_rx_pkt | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | agg_bufs | loop bound | no | FP |
| 5250 | Low | 50 | F | bnx2x_free_tx_pkt | drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | nbd | loop bound | no | FP |
| 5251 | Low | 50 | F | bnxt_get_regs | drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | len | loop bound | no | FP |
| 5252 | Low | 50 | F | bnxt_rx_pkt | drivers/net/ethernet/broadcom/bnxt/bnxt.c | agg_bufs | loop bound | no | FP |
| 5253 | Low | 50 | E | boomerang_rx | drivers/net/ethernet/3com/3c59x.c | skb | skb->protocol | yes? | FP |
| 5254 | Low | 50 | E | boomerang_rx | drivers/net/ethernet/3com/3c59x.c | skb | skb->ip_summed | yes? | FP |
| 5255 | Low | 50 | F | brcmf_cfg80211_del_pmksa | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | npmk | loop bound | no | FP |
| 5256 | Low | 50 | F | brcmf_cfg80211_set_pmksa | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | npmk | loop bound | no | FP |
| 5257 | Low | 50 | E | brcmf_notify_sched_scan_results | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | result_count | result_count->? | yes? | FP |
| 5258 | Low | 50 | E | brcmf_notify_sched_scan_results | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | result_count | result_count->? | yes? | FP |
| 5259 | Low | 50 | E | brcmf_notify_sched_scan_results | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | result_count | result_count->? | yes? | FP |
| 5260 | Low | 50 | F | brcmf_notify_sched_scan_results | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | request | loop bound | no | FP |
| 5261 | Low | 50 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pnext | pnext->data | yes? | FP |
| 5262 | Low | 50 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pnext | pnext->len | yes? | FP |
| 5263 | Low | 50 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pnext | pnext->len | yes? | FP |
| 5264 | Low | 50 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pnext | pnext->data | yes? | FP |
| 5265 | Low | 50 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pnext | pnext->data | yes? | FP |
| 5266 | Low | 50 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | pfirst->data | yes? | FP |
| 5267 | Low | 50 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | pfirst->len | yes? | FP |
| 5268 | Low | 50 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | pfirst->data | yes? | FP |
| 5269 | Low | 50 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | pfirst->len | yes? | FP |
| 5270 | Low | 50 | E | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | pfirst->prev | yes? | FP |
| 5271 | Low | 50 | F | brcmf_setup_wiphy | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | n_bands | loop bound | no | FP |
| 5272 | Low | 50 | F | brcmf_update_pmklist | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | npmk | loop bound | no | FP |
| 5273 | Low | 50 | F | bsearch | drivers/md/persistent-data/dm-btree.c | hi | loop bound | no | FP |
| 5274 | Low | 50 | F | btrtl_parse_section | drivers/bluetooth/btrtl.c | num_subsecs | loop bound | no | FP |
| 5275 | Low | 50 | F | bttv_risc_disasm | drivers/media/pci/bt8xx/bttv-driver.c | n | loop bound | no | FP |
| 5276 | Low | 50 | F | btusb_submit_isoc_urb | drivers/bluetooth/btusb.c | size | loop bound | no | FP |
| 5277 | Low | 50 | F | build_maps | drivers/mtd/ftl.c | (inline) | loop bound | no | FP |
| 5278 | Low | 50 | F | calc_sb_1_csum | drivers/md/md.c | size | loop bound | no | FP |
| 5279 | Low | 50 | F | carl9170_rx_stream | drivers/net/wireless/ath/carl9170/rx.c | clen | loop bound | no | FP |
| 5280 | Low | 50 | E | cdc_mbim_rx_fixup | drivers/net/usb/cdc_mbim.c | len | len->? | yes? | FP |
| 5281 | Low | 50 | E | cdc_mbim_rx_fixup | drivers/net/usb/cdc_mbim.c | len | len->? | yes? | FP |
| 5282 | Low | 50 | A | cdc_mbim_rx_fixup | drivers/net/usb/cdc_mbim.c | len | memcpy() in cdc_mbim_process_dgram() | yes? | FP |
| 5283 | Low | 50 | E | cdc_mbim_rx_fixup | drivers/net/usb/cdc_mbim.c | len | len->? | yes? | FP |
| 5284 | Low | 50 | E | cdc_ncm_ndp16 | drivers/net/usb/cdc_ncm.c | ndp16 | ndp16->wNextNdpIndex | yes? | FP |
| 5285 | Low | 50 | E | cdc_ncm_ndp16 | drivers/net/usb/cdc_ncm.c | ndp16 | ndp16->wNextNdpIndex | yes? | FP |
| 5286 | Low | 50 | E | cdc_ncm_ndp16 | drivers/net/usb/cdc_ncm.c | ndp16 | ndp16->dwSignature | yes? | FP |
| 5287 | Low | 50 | E | cdc_ncm_ndp16 | drivers/net/usb/cdc_ncm.c | ndp16 | ndp16->wLength | yes? | FP |
| 5288 | Low | 50 | E | cdc_ncm_ndp32 | drivers/net/usb/cdc_ncm.c | ndp32 | ndp32->dwNextNdpIndex | yes? | FP |
| 5289 | Low | 50 | E | cdc_ncm_ndp32 | drivers/net/usb/cdc_ncm.c | ndp32 | ndp32->dwNextNdpIndex | yes? | FP |
| 5290 | Low | 50 | E | cdc_ncm_ndp32 | drivers/net/usb/cdc_ncm.c | ndp32 | ndp32->dwSignature | yes? | FP |
| 5291 | Low | 50 | E | cdc_ncm_ndp32 | drivers/net/usb/cdc_ncm.c | ndp32 | ndp32->wLength | yes? | FP |
| 5292 | Low | 50 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->out_ctx | yes? | FP |
| 5293 | Low | 50 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->name | yes? | FP |
| 5294 | Low | 50 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->skip | yes? | FP |
| 5295 | Low | 50 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->skip | yes? | FP |
| 5296 | Low | 50 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->skip | yes? | FP |
| 5297 | Low | 50 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->skip | yes? | FP |
| 5298 | Low | 50 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->skip | yes? | FP |
| 5299 | Low | 50 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->skip | yes? | FP |
| 5300 | Low | 50 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->skip | yes? | FP |
| 5301 | Low | 50 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->skip | yes? | FP |
| 5302 | Low | 50 | E | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | pep->skip | yes? | FP |
| 5303 | Low | 50 | F | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | pep | loop bound | no | FP |
| 5304 | Low | 50 | F | cdnsp_handle_tx_nrdy | drivers/usb/cdns3/cdnsp-ring.c | pep | loop bound | no | FP |
| 5305 | Low | 50 | F | chcr_ktls_xmit | drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | record | loop bound | no | FP |
| 5306 | Low | 50 | F | chcr_ktls_xmit | drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | tcp_seq | loop bound | no | FP |
| 5307 | Low | 50 | F | check_dsp_e1 | drivers/usb/atm/ueagle-atm.c | blockcount | loop bound | no | FP |
| 5308 | Low | 50 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->signature | yes? | FP |
| 5309 | Low | 50 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->signature | yes? | FP |
| 5310 | Low | 50 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->signature | yes? | FP |
| 5311 | Low | 50 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->struct_length | yes? | FP |
| 5312 | Low | 50 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->class_code | yes? | FP |
| 5313 | Low | 50 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->class_code | yes? | FP |
| 5314 | Low | 50 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->class_code | yes? | FP |
| 5315 | Low | 50 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->code_type | yes? | FP |
| 5316 | Low | 50 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->code_type | yes? | FP |
| 5317 | Low | 50 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->code_type | yes? | FP |
| 5318 | Low | 50 | E | chk_boot | drivers/scsi/esas2r/esas2r_flash.c | bh | bh->code_type | yes? | FP |
| 5319 | Low | 50 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | FP |
| 5320 | Low | 50 | E | ci_parse_power_table | drivers/gpu/drm/radeon/ci_dpm.c | clock_info_array | clock_info_array->ucEntrySize | yes? | FP |
| 5321 | Low | 50 | F | cik_init_cp_pg_table | drivers/gpu/drm/radeon/cik.c | table_size | loop bound | no | FP |
| 5322 | Low | 50 | F | cik_rlc_resume | drivers/gpu/drm/radeon/cik.c | size | loop bound | no | FP |
| 5323 | Low | 50 | F | clear_hw_sgl_sge | drivers/crypto/hisilicon/sgl.c | entry_sum | loop bound | no | FP |
| 5324 | Low | 50 | F | context_run | drivers/firewire/ohci.c | le32_to_cpu(ctx->last->branch_address) | loop bound | no | FP |
| 5325 | Low | 50 | F | cs_dsp_adsp1_setup_algs | drivers/firmware/cirrus/cs_dsp.c | n_algs | loop bound | no | FP |
| 5326 | Low | 50 | F | cs_dsp_adsp2_setup_algs | drivers/firmware/cirrus/cs_dsp.c | n_algs | loop bound | no | FP |
| 5327 | Low | 50 | F | cs_dsp_halo_setup_algs | drivers/firmware/cirrus/cs_dsp.c | n_algs | loop bound | no | FP |
| 5328 | Low | 50 | F | cs_dsp_load_coeff | drivers/firmware/cirrus/cs_dsp.c | pos | loop bound | no | FP |
| 5329 | Low | 50 | F | cx23885_risc_disasm | drivers/media/pci/cx23885/cx23885-core.c | n | loop bound | no | FP |
| 5330 | Low | 50 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->cidx | yes? | FP |
| 5331 | Low | 50 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->state | yes? | FP |
| 5332 | Low | 50 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->state | yes? | FP |
| 5333 | Low | 50 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->state | yes? | FP |
| 5334 | Low | 50 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->completion | yes? | FP |
| 5335 | Low | 50 | E | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | eosw_txq | eosw_txq->netdev | yes? | FP |
| 5336 | Low | 50 | F | cxl_enumerate_cmds | drivers/cxl/core/mbox.c | size | loop bound | no | FP |
| 5337 | Low | 50 | F | cxl_event_trace_record | drivers/cxl/core/mbox.c | cxlr | loop bound | no | FP |
| 5338 | Low | 50 | F | dcb_rpl | drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | dev | loop bound | no | FP |
| 5339 | Low | 50 | F | dell_wmi_notify | drivers/platform/x86/dell/dell-wmi-base.c | buffer_end | loop bound | no | FP |
| 5340 | Low | 50 | E | dm9000_rx | drivers/net/ethernet/davicom/dm9000.c | skb | skb->protocol | yes? | FP |
| 5341 | Low | 50 | E | dm9000_rx | drivers/net/ethernet/davicom/dm9000.c | skb | skb->ip_summed | yes? | FP |
| 5342 | Low | 50 | F | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | loop bound | no | FP |
| 5343 | Low | 50 | F | dm_integrity_resume | drivers/md/dm-integrity.c | ic->provided_data_sectors - le64_to_cpu(ic->sb->recalc_secto | loop bound | no | FP |
| 5344 | Low | 50 | E | dmfe_rx_packet | drivers/net/ethernet/dec/tulip/dmfe.c | skb | skb->protocol | yes? | FP |
| 5345 | Low | 50 | F | do_verify | drivers/usb/gadget/function/f_mass_storage.c | amount_left | loop bound | no | FP |
| 5346 | Low | 50 | G1 | drv_cp_harray_to_user | drivers/misc/vmw_vmci/vmci_host.c | *retval | copy_to_user() retval unchecked | no | FP |
| 5347 | Low | 50 | F | dump_rxfd | drivers/net/ethernet/toshiba/tc35815.c | bd_count | loop bound | no | FP |
| 5348 | Low | 50 | G1 | eb_relocate_vma | drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | | __put_user() retval discarded | no | FP |
| 5349 | Low | 50 | F | emi26_load_firmware | drivers/usb/misc/emi26.c | (inline) | loop bound | no | FP |
| 5350 | Low | 50 | F | emi62_load_firmware | drivers/usb/misc/emi62.c | (inline) | loop bound | no | FP |
| 5351 | Low | 50 | F | es58x_fd_rx_can_msg | drivers/net/can/usb/etas_es58x/es58x_fd.c | rx_can_msg_buf_len | loop bound | no | FP |
| 5352 | Low | 50 | F | esas2r_ae_complete | drivers/scsi/esas2r/esas2r_int.c | last | loop bound | no | FP |
| 5353 | Low | 50 | F | fbnic_fw_parse_bmc_addrs | drivers/net/ethernet/meta/fbnic/fbnic_fw.c | attr_len | loop bound | no | FP |
| 5354 | Low | 50 | F | fbnic_fw_process_log_array | drivers/net/ethernet/meta/fbnic/fbnic_fw.c | attr_len | loop bound | no | FP |
| 5355 | Low | 50 | F | fbnic_tlv_msg_parse | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | le16_to_cpu(msg->hdr.len) - 1 | loop bound | no | FP |
| 5356 | Low | 50 | F | fbnic_tlv_parser_test_attr | drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | len | loop bound | no | FP |
| 5357 | Low | 50 | F | fc_fpin_li_stats_update | drivers/scsi/scsi_transport_fc.c | be32_to_cpu(li_desc->desc_len) | loop bound | no | FP |
| 5358 | Low | 50 | F | fc_fpin_li_stats_update | drivers/scsi/scsi_transport_fc.c | be32_to_cpu(li_desc->pname_count) | loop bound | no | FP |
| 5359 | Low | 50 | F | fc_fpin_peer_congn_stats_update | drivers/scsi/scsi_transport_fc.c | be32_to_cpu(pc_desc->desc_len) | loop bound | no | FP |
| 5360 | Low | 50 | F | fc_fpin_peer_congn_stats_update | drivers/scsi/scsi_transport_fc.c | be32_to_cpu(pc_desc->pname_count) | loop bound | no | FP |
| 5361 | Low | 50 | F | fc_host_fpin_rcv | drivers/scsi/scsi_transport_fc.c | bytes_remain | loop bound | no | FP |
| 5362 | Low | 50 | F | fcoe_ctlr_recv_clr_vlink | drivers/scsi/fcoe/fcoe_ctlr.c | num_vlink_desc | loop bound | no | FP |
| 5363 | Low | 50 | F | fw_handle_concurrency | drivers/net/wireless/ath/wil6210/fw_inc.c | n_combos | loop bound | no | FP |
| 5364 | Low | 50 | F | gaudi_hbm_read_interrupts | drivers/accel/habanalabs/gaudi/gaudi.c | ch | loop bound | no | FP |
| 5365 | Low | 50 | F | gb_loopback_async_transfer_complete | drivers/staging/greybus/loopback.c | len | loop bound | no | FP |
| 5366 | Low | 50 | F | gb_pwm_probe | drivers/staging/greybus/pwm.c | npwm | loop bound | no | FP |
| 5367 | Low | 50 | E | gem_rx | drivers/net/ethernet/sun/sungem.c | copy_skb | copy_skb->data | yes? | FP |
| 5368 | Low | 50 | E | get_encoder_cap_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | yes? | FP |
| 5369 | Low | 50 | E | get_encoder_cap_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordType | yes? | FP |
| 5370 | Low | 50 | E | get_encoder_cap_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | yes? | FP |
| 5371 | Low | 50 | F | get_gpio_i2c_info | drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | count | loop bound | no | FP |
| 5372 | Low | 50 | E | get_hpd_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | yes? | FP |
| 5373 | Low | 50 | E | get_hpd_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordType | yes? | FP |
| 5374 | Low | 50 | E | get_hpd_record | drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | header | header->ucRecordSize | yes? | FP |
| 5375 | Low | 50 | F | get_port_ssp_rate | drivers/usb/core/hub.c | ssac | loop bound | no | FP |
| 5376 | Low | 50 | F | get_port_ssp_rate | drivers/usb/core/hub.c | lse | loop bound | no | FP |
| 5377 | Low | 50 | F | gsc_hpdi_drain_dma | drivers/comedi/drivers/gsc_hpdi.c | start | loop bound | no | FP |
| 5378 | Low | 50 | F | gve_process_device_options | drivers/net/ethernet/google/gve/gve_adminq.c | num_options | loop bound | no | FP |
| 5379 | Low | 50 | F | handle_local_lock | drivers/firewire/ohci.c | lock_data | loop bound | no | FP |
| 5380 | Low | 50 | F | handle_local_lock | drivers/firewire/ohci.c | lock_arg | loop bound | no | FP |
| 5381 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->slot_id | yes? | FP |
| 5382 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->slot_id | yes? | FP |
| 5383 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->rhub | yes? | FP |
| 5384 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->hcd | yes? | FP |
| 5385 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->bus_state | yes? | FP |
| 5386 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->hcd_portnum | yes? | FP |
| 5387 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->resume_timestamp | yes? | FP |
| 5388 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->resume_timestamp | yes? | FP |
| 5389 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->u3exit_done | yes? | FP |
| 5390 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->slot_id | yes? | FP |
| 5391 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->rexit_active | yes? | FP |
| 5392 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->rexit_done | yes? | FP |
| 5393 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | port | port->rexit_active | yes? | FP |
| 5394 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->speed | yes? | FP |
| 5395 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->self | yes? | FP |
| 5396 | Low | 50 | E | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | hcd->flags | yes? | FP |
| 5397 | Low | 50 | E | handle_rx_packet | drivers/net/wireless/zydas/zd1211rw/zd_usb.c | k | k->? | yes? | FP |
| 5398 | Low | 50 | E | handle_rx_packet | drivers/net/wireless/zydas/zd1211rw/zd_usb.c | k | k->? | yes? | FP |
| 5399 | Low | 50 | E | handle_rx_packet | drivers/net/wireless/zydas/zd1211rw/zd_usb.c | k | k->? | yes? | FP |
| 5400 | Low | 50 | A | handle_rx_packet | drivers/net/wireless/zydas/zd1211rw/zd_usb.c | k | memcpy() in zd_mac_rx() | yes? | FP |
| 5401 | Low | 50 | F | handle_selfid_complete_event | drivers/firewire/ohci.c | be32_to_cpu(ohci->config_rom[2]) | loop bound | no | FP |
| 5402 | Low | 50 | F | handle_selfid_complete_event | drivers/firewire/ohci.c | be32_to_cpu(ohci->next_header) | loop bound | no | FP |
| 5403 | Low | 50 | F | hclge_comm_cmd_check_result | drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c | le16_to_cpu(desc->opcode) | loop bound | no | FP |
| 5404 | Low | 50 | F | hclge_dbg_get_imp_stats_info | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | bd_num | loop bound | no | FP |
| 5405 | Low | 50 | F | hclge_dbg_get_imp_stats_info | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | bd_num | loop bound | no | FP |
| 5406 | Low | 50 | F | hfi1_handle_kdeth_eflags | drivers/infiniband/hw/hfi1/tid_rdma.c | ibpsn | loop bound | no | FP |
| 5407 | Low | 50 | E | hfi1_rc_rcv | drivers/infiniband/hw/hfi1/rc.c | rkey | rkey->? | yes? | FP |
| 5408 | Low | 50 | F | hfi1_rc_rcv_tid_rdma_ack | drivers/infiniband/hw/hfi1/tid_rdma.c | ack_kpsn | loop bound | no | FP |
| 5409 | Low | 50 | F | hfi1_rc_rcv_tid_rdma_read_resp | drivers/infiniband/hw/hfi1/tid_rdma.c | req | loop bound | no | FP |
| 5410 | Low | 50 | F | hfi1_rc_rcv_tid_rdma_read_resp | drivers/infiniband/hw/hfi1/tid_rdma.c | ipsn | loop bound | no | FP |
| 5411 | Low | 50 | F | hpsa_figure_phys_disk_ptrs | drivers/scsi/hpsa.c | nraid_map_entries | loop bound | no | FP |
| 5412 | Low | 50 | F | ibmvscsis_cap_mad | drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | len | loop bound | no | FP |
| 5413 | Low | 50 | F | ice_aq_get_phy_caps | drivers/net/ethernet/intel/ice/ice_common.c | le64_to_cpu(pcaps->phy_type_low) | loop bound | no | FP |
| 5414 | Low | 50 | F | ice_aq_get_phy_caps | drivers/net/ethernet/intel/ice/ice_common.c | le64_to_cpu(pcaps->phy_type_high) | loop bound | no | FP |
| 5415 | Low | 50 | F | ice_gnss_read | drivers/net/ethernet/intel/ice/ice_gnss.c | bytes_read | loop bound | no | FP |
| 5416 | Low | 50 | F | ice_match_signing_seg | drivers/net/ethernet/intel/ice/ice_ddp.c | (inline) | loop bound | no | FP |
| 5417 | Low | 50 | E | ice_verify_pkg | drivers/net/ethernet/intel/ice/ice_ddp.c | seg | seg->seg_size | yes? | FP |
| 5418 | Low | 50 | F | idpf_get_reg_intr_vecs | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | num_vec | loop bound | no | FP |
| 5419 | Low | 50 | F | idpf_get_vec_ids | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | num_vec | loop bound | no | FP |
| 5420 | Low | 50 | F | idpf_ptp_get_vport_tstamps_caps | drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c | tstamp_caps | loop bound | no | FP |
| 5421 | Low | 50 | F | idpf_send_get_lan_memory_regions | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | num_regions | loop bound | no | FP |
| 5422 | Low | 50 | F | idpf_send_get_rx_ptype_msg | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | (inline) | loop bound | no | FP |
| 5423 | Low | 50 | F | idpf_vport_init_queue_reg_chunks | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | num_chunks | loop bound | no | FP |
| 5424 | Low | 50 | F | il4965_hdl_rx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | rate_n_flags | loop bound | no | FP |
| 5425 | Low | 50 | F | init_powerplay_extended_tables | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | pcie_table | loop bound | no | FP |
| 5426 | Low | 50 | F | init_powerplay_table_information | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_processpptables.c | power_saving_clock_count | loop bound | no | FP |
| 5427 | Low | 50 | F | init_powerplay_table_information | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_processpptables.c | od_setting_count | loop bound | no | FP |
| 5428 | Low | 50 | F | init_powerplay_table_information | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_processpptables.c | od_feature_count | loop bound | no | FP |
| 5429 | Low | 50 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c | header | header->ucRevId | yes? | FP |
| 5430 | Low | 50 | E | init_thermal_controller | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | fan_table | fan_table->ucRevId | yes? | FP |
| 5431 | Low | 50 | F | intr_handler | drivers/net/ethernet/adaptec/starfire.c | skb | loop bound | no | FP |
| 5432 | Low | 50 | E | investigate_read_descriptor | drivers/net/ethernet/dec/tulip/xircom_cb.c | skb | skb->protocol | yes? | FP |
| 5433 | Low | 50 | F | ionic_admin_poll_locked | drivers/infiniband/hw/ionic/ionic_admin.c | src_len | loop bound | no | FP |
| 5434 | Low | 50 | F | ionic_get_rxfh | drivers/net/ethernet/pensando/ionic/ionic_ethtool.c | tbl_sz | loop bound | no | FP |
| 5435 | Low | 50 | F | ionic_rx_clean | drivers/net/ethernet/pensando/ionic/ionic_txrx.c | len | loop bound | no | FP |
| 5436 | Low | 50 | F | ipr_dump_ioasa | drivers/scsi/ipr.c | data_len | loop bound | no | FP |
| 5437 | Low | 50 | F | ipr_get_ioa_dump | drivers/scsi/ipr.c | num_entries | loop bound | no | FP |
| 5438 | Low | 50 | F | ipr_get_unit_check_buffer | drivers/scsi/ipr.c | length | loop bound | no | FP |
| 5439 | Low | 50 | F | ipr_log_enhanced_array_error | drivers/scsi/ipr.c | num_entries | loop bound | no | FP |
| 5440 | Low | 50 | F | ipr_store_update_fw | drivers/scsi/ipr.c | sglist | loop bound | no | FP |
| 5441 | Low | 50 | F | ipw_load_firmware | drivers/net/wireless/intel/ipw2x00/ipw2200.c | nr | loop bound | no | FP |
| 5442 | Low | 50 | G1 | isapnp_proc_bus_read | drivers/pnp/isapnp/proc.c | | __put_user() retval discarded | no | FP |
| 5443 | Low | 50 | F | iscsit_handle_snack | drivers/target/iscsi/iscsi_target.c | be32_to_cpu(hdr->runlength) | loop bound | no | FP |
| 5444 | Low | 50 | A | iscsit_setup_scsi_cmd | drivers/target/iscsi/iscsi_target.c | cdb | memcpy() | yes? | FP |
| 5445 | Low | 50 | A | iscsit_setup_scsi_cmd | drivers/target/iscsi/iscsi_target.c | cdb | memcpy() | yes? | FP |
| 5446 | Low | 50 | F | iwl_dbg_tlv_alloc_fragments | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | pages | loop bound | no | FP |
| 5447 | Low | 50 | F | iwl_dbg_tlv_alloc_fragments | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | num_frags | loop bound | no | FP |
| 5448 | Low | 50 | E | iwl_dbg_tlv_override_trig_node | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | node_tlv | node_tlv->data | yes? | FP |
| 5449 | Low | 50 | E | iwl_dbg_tlv_override_trig_node | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | node_tlv | node_tlv->length | yes? | FP |
| 5450 | Low | 50 | F | iwl_dump_ini_mon_dram_ranges | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | fw_mon | loop bound | no | FP |
| 5451 | Low | 50 | F | iwl_dump_ini_prph_mac_block_iter | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | addr | loop bound | no | FP |
| 5452 | Low | 50 | F | iwl_dump_ini_prph_mac_iter | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | addr | loop bound | no | FP |
| 5453 | Low | 50 | F | iwl_dump_ini_prph_mac_iter_common | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | (inline) | loop bound | no | FP |
| 5454 | Low | 50 | F | iwl_dump_ini_prph_phy_block_iter | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | addr | loop bound | no | FP |
| 5455 | Low | 50 | F | iwl_dump_ini_prph_phy_iter | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | addr | loop bound | no | FP |
| 5456 | Low | 50 | F | iwl_dump_ini_prph_phy_iter_common | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | (inline) | loop bound | no | FP |
| 5457 | Low | 50 | F | iwl_fw_error_dump | drivers/net/wireless/intel/iwlwifi/fw/dbg-old.c | file_len | loop bound | no | FP |
| 5458 | Low | 50 | F | iwl_mei_handle_sap_rx | drivers/net/wireless/intel/iwlwifi/mei/main.c | valid_rx_sz | loop bound | no | FP |
| 5459 | Low | 50 | E | iwl_mei_handle_sap_rx | drivers/net/wireless/intel/iwlwifi/mei/main.c | rd | rd->? | yes? | FP |
| 5460 | Low | 50 | E | iwl_mei_handle_sap_rx | drivers/net/wireless/intel/iwlwifi/mei/main.c | wr | wr->? | yes? | FP |
| 5461 | Low | 50 | F | iwl_mei_handle_sap_rx | drivers/net/wireless/intel/iwlwifi/mei/main.c | valid_rx_sz | loop bound | no | FP |
| 5462 | Low | 50 | F | iwl_mld_handle_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mld/scan.c | band | loop bound | no | FP |
| 5463 | Low | 50 | F | iwl_mvm_rx_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mvm/scan.c | band | loop bound | no | FP |
| 5464 | Low | 50 | E | iwl_mvm_rx_crypto | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | status | status->? | yes? | FP |
| 5465 | Low | 50 | E | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | vif | vif->type | yes? | FP |
| 5466 | Low | 50 | F | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | mvmsta | loop bound | no | FP |
| 5467 | Low | 50 | E | iwl_read_external_nvm | drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | file_sec | file_sec->data | yes? | FP |
| 5468 | Low | 50 | G1 | iwl_write_to_user_buf | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c | *size | copy_to_user() retval unchecked | no | FP |
| 5469 | Low | 50 | F | iwlagn_rx_reply_rx | drivers/net/wireless/intel/iwlwifi/dvm/rx.c | rate_n_flags | loop bound | no | FP |
| 5470 | Low | 50 | G1 | keypad_read | drivers/auxdisplay/panel.c | | put_user() retval discarded | no | FP |
| 5471 | Low | 50 | F | lbs_associate | drivers/net/wireless/marvell/libertas/cfg.c | le16_to_cpu(cmd->hdr.size) | loop bound | no | FP |
| 5472 | Low | 50 | F | lbs_hard_start_xmit | drivers/net/wireless/marvell/libertas/tx.c | le16_to_cpu(txpd->tx_packet_length) | loop bound | no | FP |
| 5473 | Low | 50 | F | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | loop bound | no | FP |
| 5474 | Low | 50 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->eth803_hdr | yes? | FP |
| 5475 | Low | 50 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->eth803_hdr | yes? | FP |
| 5476 | Low | 50 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->eth803_hdr | yes? | FP |
| 5477 | Low | 50 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->eth803_hdr | yes? | FP |
| 5478 | Low | 50 | E | lbs_process_rxed_packet | drivers/net/wireless/marvell/libertas/rx.c | p_rx_pkt | p_rx_pkt->rfc1042_hdr | yes? | FP |
| 5479 | Low | 50 | F | lbs_set_11d_domain_info | drivers/net/wireless/marvell/libertas/cmd.c | le16_to_cpu(domain->header.len) | loop bound | no | FP |
| 5480 | Low | 50 | F | lbs_submit_command | drivers/net/wireless/marvell/libertas/cmd.c | cmdsize | loop bound | no | FP |
| 5481 | Low | 50 | A | libipw_rx | drivers/net/wireless/intel/ipw2x00/libipw_rx.c | payload | memcmp() | yes? | FP |
| 5482 | Low | 50 | F | lpfc_cmpl_els_disc_cmd | drivers/scsi/lpfc/lpfc_els.c | (inline) | loop bound | no | FP |
| 5483 | Low | 50 | F | lpfc_els_rcv_fpin | drivers/scsi/lpfc/lpfc_els.c | fpin_length | loop bound | no | FP |
| 5484 | Low | 50 | F | lpfc_els_rcv_fpin | drivers/scsi/lpfc/lpfc_els.c | bytes_remain | loop bound | no | FP |
| 5485 | Low | 50 | F | lpfc_prep_embed_io | drivers/scsi/lpfc/lpfc_sli.c | le32_to_cpu(sgl->sge_len) | loop bound | no | FP |
| 5486 | Low | 50 | F | megasas_get_pd_list | drivers/scsi/megaraid/megaraid_sas_base.c | (inline) | loop bound | no | FP |
| 5487 | Low | 50 | F | mlx5_ib_read_kernel_wqe_sq | drivers/infiniband/hw/mlx5/qp.c | wqe_length | loop bound | no | FP |
| 5488 | Low | 50 | F | mlx5e_handle_rx_cqe_mpwrq_shampo | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | wi | loop bound | no | FP |
| 5489 | Low | 50 | F | mlx5e_handle_rx_cqe_mpwrq_shampo | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | page_idx | loop bound | no | FP |
| 5490 | Low | 50 | F | mlx5e_handle_rx_cqe_mpwrq_shampo | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | wi | loop bound | no | FP |
| 5491 | Low | 50 | F | mlx5e_handle_rx_cqe_mpwrq_shampo | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | page_idx | loop bound | no | FP |
| 5492 | Low | 50 | F | mlx5e_handle_rx_cqe_mpwrq_shampo | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | wi | loop bound | no | FP |
| 5493 | Low | 50 | F | mlx5e_handle_rx_cqe_mpwrq_shampo | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | page_idx | loop bound | no | FP |
| 5494 | Low | 50 | F | mlx5e_trap_handle_rx_cqe | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | wi | loop bound | no | FP |
| 5495 | Low | 50 | F | mlx5e_trap_handle_rx_cqe | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | wi | loop bound | no | FP |
| 5496 | Low | 50 | A | mlx5i_handle_rx_cqe | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | skb | memcmp() in mlx5i_complete_rx_cqe() | yes? | FP |
| 5497 | Low | 50 | F | mlx5vf_rq_cqe | drivers/vfio/pci/mlx5/cmd.c | size | loop bound | no | FP |
| 5498 | Low | 50 | F | mlx5vf_rq_cqe | drivers/vfio/pci/mlx5/cmd.c | ix | loop bound | no | FP |
| 5499 | Low | 50 | E | mlxfw_mfa2_file_component_get | drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c | comp_data | comp_data->comp | yes? | FP |
| 5500 | Low | 50 | E | mlxfw_mfa2_file_component_get | drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c | comp_data | comp_data->comp | yes? | FP |
| 5501 | Low | 50 | F | mpi3mr_expander_add | drivers/scsi/mpi3mr/mpi3mr_transport.c | sas_expander | loop bound | no | FP |
| 5502 | Low | 50 | F | mpi3mr_expander_add | drivers/scsi/mpi3mr/mpi3mr_transport.c | sas_expander | loop bound | no | FP |
| 5503 | Low | 50 | F | mpi3mr_expander_add | drivers/scsi/mpi3mr/mpi3mr_transport.c | sas_expander | loop bound | no | FP |
| 5504 | Low | 50 | F | mpi3mr_fwevt_bh | drivers/scsi/mpi3mr/mpi3mr_os.c | handle | loop bound | no | FP |
| 5505 | Low | 50 | F | mpi3mr_refresh_expanders | drivers/scsi/mpi3mr/mpi3mr_transport.c | handle | loop bound | no | FP |
| 5506 | Low | 50 | F | mpt_host_page_alloc | drivers/message/fusion/mptbase.c | host_page_buffer_sz | loop bound | no | FP |
| 5507 | Low | 50 | F | mpt_lan_post_receive_buckets | drivers/message/fusion/mptlan.c | i | loop bound | no | FP |
| 5508 | Low | 50 | F | mptsas_send_expander_event | drivers/message/fusion/mptsas.c | port_info | loop bound | no | FP |
| 5509 | Low | 50 | F | mptsas_send_expander_event | drivers/message/fusion/mptsas.c | port_info | loop bound | no | FP |
| 5510 | Low | 50 | F | mptsas_send_expander_event | drivers/message/fusion/mptsas.c | port_info | loop bound | no | FP |
| 5511 | Low | 50 | F | mptsas_send_expander_event | drivers/message/fusion/mptsas.c | port_info | loop bound | no | FP |
| 5512 | Low | 50 | F | mptsas_send_expander_event | drivers/message/fusion/mptsas.c | port_info | loop bound | no | FP |
| 5513 | Low | 50 | E | mptscsih_io_done | drivers/message/fusion/mptscsih.c | req_idx | req_idx->? | yes? | FP |
| 5514 | Low | 50 | E | mptscsih_qcmd | drivers/message/fusion/mptscsih.c | my_idx | my_idx->? | yes? | FP |
| 5515 | Low | 50 | E | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | hdr_gap | hdr_gap->? | yes? | FP |
| 5516 | Low | 50 | F | mt76x2u_mcu_load_firmware | drivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c | ilm_len | loop bound | no | FP |
| 5517 | Low | 50 | F | mt76x2u_mcu_load_firmware | drivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c | dlm_len | loop bound | no | FP |
| 5518 | Low | 50 | E | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | hdr_gap | hdr_gap->? | yes? | FP |
| 5519 | Low | 50 | F | mt7915_mac_tx_free | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | v3 | loop bound | no | FP |
| 5520 | Low | 50 | F | mt7921_mcu_debug_msg_event | drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | len | loop bound | no | FP |
| 5521 | Low | 50 | F | mt7921_mcu_get_nic_capability | drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | (inline) | loop bound | no | FP |
| 5522 | Low | 50 | F | mt7925_mcu_get_nic_capability | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | (inline) | loop bound | no | FP |
| 5523 | Low | 50 | F | mt7925_mcu_handle_mbmc_event | drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | (inline) | loop bound | no | FP |
| 5524 | Low | 50 | F | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | idx | loop bound | no | FP |
| 5525 | Low | 50 | F | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | buf | loop bound | no | FP |
| 5526 | Low | 50 | F | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | skb | loop bound | no | FP |
| 5527 | Low | 50 | G1 | mtx1_wdt_ioctl | drivers/watchdog/mtx-1_wdt.c | | put_user() retval discarded | no | FP |
| 5528 | Low | 50 | E | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->table_length | yes? | FP |
| 5529 | Low | 50 | E | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->table_length | yes? | FP |
| 5530 | Low | 50 | E | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->table_length | yes? | FP |
| 5531 | Low | 50 | E | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->next_table_index | yes? | FP |
| 5532 | Low | 50 | E | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->next_table_index | yes? | FP |
| 5533 | Low | 50 | E | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->dg | yes? | FP |
| 5534 | Low | 50 | E | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | adth | adth->next_table_index | yes? | FP |
| 5535 | Low | 50 | F | mwifiex_cmd_11n_addba_rsp_gen | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | win_size | loop bound | no | FP |
| 5536 | Low | 50 | E | mwifiex_deaggr_sdio_pkt | drivers/net/wireless/marvell/mwifiex/sdio.c | pkt_len | pkt_len->? | yes? | FP |
| 5537 | Low | 50 | E | mwifiex_deaggr_sdio_pkt | drivers/net/wireless/marvell/mwifiex/sdio.c | pkt_len | pkt_len->? | yes? | FP |
| 5538 | Low | 50 | F | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | bytes_left_for_tlv | loop bound | no | FP |
| 5539 | Low | 50 | A | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | memcmp() | yes? | FP |
| 5540 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5541 | Low | 50 | A | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | memcmp() | yes? | FP |
| 5542 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5543 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5544 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5545 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5546 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5547 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5548 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5549 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5550 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5551 | Low | 50 | A | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | memcpy() | yes? | FP |
| 5552 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5553 | Low | 50 | A | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | memcpy() | yes? | FP |
| 5554 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5555 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5556 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5557 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5558 | Low | 50 | F | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | loop bound | no | FP |
| 5559 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5560 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5561 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5562 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5563 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5564 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5565 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5566 | Low | 50 | A | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | memcpy() in mwifiex_process_tdls_action_frame() | yes? | FP |
| 5567 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5568 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5569 | Low | 50 | A | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | memcpy() in mwifiex_process_tdls_action_frame() | yes? | FP |
| 5570 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5571 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5572 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5573 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5574 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5575 | Low | 50 | A | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | memcpy() in mwifiex_process_tdls_action_frame() | yes? | FP |
| 5576 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5577 | Low | 50 | A | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | memcpy() in mwifiex_process_tdls_action_frame() | yes? | FP |
| 5578 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5579 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5580 | Low | 50 | E | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | offset->? | yes? | FP |
| 5581 | Low | 50 | E | mwifiex_process_sta_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5582 | Low | 50 | E | mwifiex_process_sta_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5583 | Low | 50 | A | mwifiex_process_sta_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | memcpy() | yes? | FP |
| 5584 | Low | 50 | E | mwifiex_process_sta_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5585 | Low | 50 | E | mwifiex_process_uap_rx_packet | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5586 | Low | 50 | E | mwifiex_process_uap_rx_packet | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5587 | Low | 50 | F | mwifiex_ret_802_11_scan | drivers/net/wireless/marvell/mwifiex/scan.c | tlv_buf_size | loop bound | no | FP |
| 5588 | Low | 50 | E | mwifiex_ret_chan_region_cfg | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | tlv_buf_len | tlv_buf_len->? | yes? | FP |
| 5589 | Low | 50 | E | mwifiex_ret_chan_region_cfg | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | tlv_buf_len | tlv_buf_len->? | yes? | FP |
| 5590 | Low | 50 | E | mwifiex_ret_chan_region_cfg | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | tlv_buf_len | tlv_buf_len->? | yes? | FP |
| 5591 | Low | 50 | E | mwifiex_ret_chan_region_cfg | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | tlv_buf_len | tlv_buf_len->? | yes? | FP |
| 5592 | Low | 50 | E | mwifiex_ret_chan_region_cfg | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | tlv_buf_len | tlv_buf_len->? | yes? | FP |
| 5593 | Low | 50 | E | mwifiex_ret_chan_region_cfg | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | tlv_buf_len | tlv_buf_len->? | yes? | FP |
| 5594 | Low | 50 | A | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | memcmp() | yes? | FP |
| 5595 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5596 | Low | 50 | A | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | memcmp() | yes? | FP |
| 5597 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5598 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5599 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5600 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5601 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5602 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5603 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5604 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5605 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->rfc1042_hdr | yes? | FP |
| 5606 | Low | 50 | A | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | memcpy() | yes? | FP |
| 5607 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5608 | Low | 50 | A | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | memcpy() | yes? | FP |
| 5609 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5610 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5611 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5612 | Low | 50 | E | mwifiex_uap_queue_bridged_pkt | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | rx_pkt_hdr | rx_pkt_hdr->eth803_hdr | yes? | FP |
| 5613 | Low | 50 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | txq | txq->len | yes? | FP |
| 5614 | Low | 50 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | txq | txq->skb | yes? | FP |
| 5615 | Low | 50 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | txq | txq->skb | yes? | FP |
| 5616 | Low | 50 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | txq | txq->txd | yes? | FP |
| 5617 | Low | 50 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | txq | txq->len | yes? | FP |
| 5618 | Low | 50 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | txq | txq->tail | yes? | FP |
| 5619 | Low | 50 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | txq | txq->tail | yes? | FP |
| 5620 | Low | 50 | E | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | txq | txq->tail | yes? | FP |
| 5621 | Low | 50 | F | myri10ge_clean_rx_done | drivers/net/ethernet/myricom/myri10ge/myri10ge.c | length | loop bound | no | FP |
| 5622 | Low | 50 | F | netdev_rx | drivers/net/ethernet/natsemi/natsemi.c | desc_status | loop bound | no | FP |
| 5623 | Low | 50 | F | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | desc_cnt | loop bound | no | FP |
| 5624 | Low | 50 | F | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | loop bound | no | FP |
| 5625 | Low | 50 | F | nexio_read_data | drivers/input/touchscreen/usbtouchscreen.c | x_len | loop bound | no | FP |
| 5626 | Low | 50 | F | nexio_read_data | drivers/input/touchscreen/usbtouchscreen.c | data_len | loop bound | no | FP |
| 5627 | Low | 50 | F | nfp_calc_specific_level_size | drivers/net/ethernet/netronome/nfp/nfp_net_debugdump.c | be32_to_cpu(dump_level->length) | loop bound | no | FP |
| 5628 | Low | 50 | F | nfp_dump_csr_range | drivers/net/ethernet/netronome/nfp/nfp_net_debugdump.c | cpp_rd_addr | loop bound | no | FP |
| 5629 | Low | 50 | F | nfp_dump_indirect_csr_range | drivers/net/ethernet/netronome/nfp/nfp_net_debugdump.c | cpp_rd_addr | loop bound | no | FP |
| 5630 | Low | 50 | F | nfp_net_tls_rx_resync_req | drivers/net/ethernet/netronome/nfp/crypto/tls.c | ntls | loop bound | no | FP |
| 5631 | Low | 50 | F | nfp_nfdk_rx | drivers/net/ethernet/netronome/nfp/nfdk/dp.c | pkt_len | loop bound | no | FP |
| 5632 | Low | 50 | F | nvme_free_sgls | drivers/nvme/host/pci.c | len | loop bound | no | FP |
| 5633 | Low | 50 | F | nvme_parse_ana_log | drivers/nvme/host/multipath.c | (inline) | loop bound | no | FP |
| 5634 | Low | 50 | F | nvme_scan_ns_list | drivers/nvme/host/core.c | nsid | loop bound | no | FP |
| 5635 | Low | 50 | F | nvme_scan_ns_sequential | drivers/nvme/host/core.c | nn | loop bound | no | FP |
| 5636 | Low | 50 | F | nvmet_bdev_execute_discard | drivers/nvme/target/io-cmd-bdev.c | (inline) | loop bound | no | FP |
| 5637 | Low | 50 | E | nvmet_execute_pr_report | drivers/nvme/target/pr.c | ctrl_eds | ctrl_eds->cntlid | yes? | FP |
| 5638 | Low | 50 | E | nvmet_execute_pr_report | drivers/nvme/target/pr.c | ctrl_eds | ctrl_eds->rcsts | yes? | FP |
| 5639 | Low | 50 | E | nvmet_execute_pr_report | drivers/nvme/target/pr.c | ctrl_eds | ctrl_eds->rcsts | yes? | FP |
| 5640 | Low | 50 | E | nvmet_execute_pr_report | drivers/nvme/target/pr.c | ctrl_eds | ctrl_eds->hostid | yes? | FP |
| 5641 | Low | 50 | E | nvmet_execute_pr_report | drivers/nvme/target/pr.c | ctrl_eds | ctrl_eds->rkey | yes? | FP |
| 5642 | Low | 50 | E | nvmet_execute_pr_report | drivers/nvme/target/pr.c | data | data->regctl | yes? | FP |
| 5643 | Low | 50 | F | ohci_enable | drivers/firewire/ohci.c | be32_to_cpu(ohci->next_config_rom[2]) | loop bound | no | FP |
| 5644 | Low | 50 | F | onie_tlv_parse_table | drivers/nvmem/layouts/onie-tlv.c | data_len | loop bound | no | FP |
| 5645 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | pda | pda->? | yes? | FP |
| 5646 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | data_len | data_len->? | yes? | FP |
| 5647 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | pda | pda->? | yes? | FP |
| 5648 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | data_len | data_len->? | yes? | FP |
| 5649 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | pda | pda->? | yes? | FP |
| 5650 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | data_len | data_len->? | yes? | FP |
| 5651 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | pda | pda->? | yes? | FP |
| 5652 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | data_len | data_len->? | yes? | FP |
| 5653 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | pda | pda->? | yes? | FP |
| 5654 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | data_len | data_len->? | yes? | FP |
| 5655 | Low | 50 | F | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | loop bound | no | FP |
| 5656 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->code | yes? | FP |
| 5657 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5658 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5659 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5660 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | curve_data | curve_data->cal_method_rev | yes? | FP |
| 5661 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | curve_data | curve_data->cal_method_rev | yes? | FP |
| 5662 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5663 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5664 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5665 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5666 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5667 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5668 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->code | yes? | FP |
| 5669 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5670 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5671 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5672 | Low | 50 | E | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | entry->data | yes? | FP |
| 5673 | Low | 50 | F | p54_parse_firmware | drivers/net/wireless/intersil/p54/fwio.c | (inline) | loop bound | no | FP |
| 5674 | Low | 50 | F | p54p_refill_rx_ring | drivers/net/wireless/intersil/p54/p54pci.c | limit | loop bound | no | FP |
| 5675 | Low | 50 | F | pagefault_data_segments | drivers/infiniband/hw/mlx5/odp.c | be32_to_cpu(key) | loop bound | no | FP |
| 5676 | Low | 50 | E | pagefault_data_segments | drivers/infiniband/hw/mlx5/odp.c | be32_to_cpu(key) | be32_to_cpu(key)->? | yes? | FP |
| 5677 | Low | 50 | E | pagefault_data_segments | drivers/infiniband/hw/mlx5/odp.c | be32_to_cpu(key) | be32_to_cpu(key)->? | yes? | FP |
| 5678 | Low | 50 | E | pagefault_data_segments | drivers/infiniband/hw/mlx5/odp.c | be32_to_cpu(key) | be32_to_cpu(key)->? | yes? | FP |
| 5679 | Low | 50 | E | pagefault_data_segments | drivers/infiniband/hw/mlx5/odp.c | be32_to_cpu(key) | be32_to_cpu(key)->? | yes? | FP |
| 5680 | Low | 50 | F | palm_os_3_probe | drivers/usb/serial/visor.c | num_ports | loop bound | no | FP |
| 5681 | Low | 50 | E | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | parent_ep->? | yes? | FP |
| 5682 | Low | 50 | E | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | parent_ep->? | yes? | FP |
| 5683 | Low | 50 | E | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | parent_ep->? | yes? | FP |
| 5684 | Low | 50 | A | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | memcpy() in cxgb_get_4tuple() | yes? | FP |
| 5685 | Low | 50 | E | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | parent_ep->? | yes? | FP |
| 5686 | Low | 50 | A | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | memcpy() in cxgb_get_4tuple() | yes? | FP |
| 5687 | Low | 50 | E | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | parent_ep->? | yes? | FP |
| 5688 | Low | 50 | E | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | parent_ep->? | yes? | FP |
| 5689 | Low | 50 | E | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | parent_ep->? | yes? | FP |
| 5690 | Low | 50 | A | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | memcpy() in cxgb_get_4tuple() | yes? | FP |
| 5691 | Low | 50 | E | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | parent_ep->? | yes? | FP |
| 5692 | Low | 50 | A | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | memcpy() in cxgb_get_4tuple() | yes? | FP |
| 5693 | Low | 50 | E | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | parent_ep->? | yes? | FP |
| 5694 | Low | 50 | E | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | parent_ep->? | yes? | FP |
| 5695 | Low | 50 | E | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | parent_ep | parent_ep->? | yes? | FP |
| 5696 | Low | 50 | F | pcan_usb_pro_decode_buf | drivers/net/can/usb/peak_usb/pcan_usb_pro.c | rec_cnt | loop bound | no | FP |
| 5697 | Low | 50 | F | pcnet32_rx | drivers/net/ethernet/amd/pcnet32.c | (inline) | loop bound | no | FP |
| 5698 | Low | 50 | F | pdsc_process_notifyq | drivers/net/ethernet/amd/pds_core/adminq.c | eid | loop bound | no | FP |
| 5699 | Low | 50 | F | pdsfc_free_endpoints | drivers/fwctl/pds/main.c | num_endpoints | loop bound | no | FP |
| 5700 | Low | 50 | F | port100_tx_frame_finish | drivers/nfc/port100.c | le16_to_cpu(frame->datalen) | loop bound | no | FP |
| 5701 | Low | 50 | E | ppp_rx | drivers/net/wan/hdlc_ppp.c | len | len->? | yes? | FP |
| 5702 | Low | 50 | E | ppp_rx | drivers/net/wan/hdlc_ppp.c | len | len->? | yes? | FP |
| 5703 | Low | 50 | E | ppp_rx | drivers/net/wan/hdlc_ppp.c | len | len->? | yes? | FP |
| 5704 | Low | 50 | E | ppp_rx | drivers/net/wan/hdlc_ppp.c | len | len->? | yes? | FP |
| 5705 | Low | 50 | E | ppp_rx | drivers/net/wan/hdlc_ppp.c | len | len->? | yes? | FP |
| 5706 | Low | 50 | E | ppp_rx | drivers/net/wan/hdlc_ppp.c | len | len->? | yes? | FP |
| 5707 | Low | 50 | E | ppp_rx | drivers/net/wan/hdlc_ppp.c | len | len->? | yes? | FP |
| 5708 | Low | 50 | E | ppt_get_vce_state_table_entry_v1_0 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | vce_state_record | vce_state_record->ucMCLKIndex | yes? | FP |
| 5709 | Low | 50 | E | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | phys_lun | phys_lun->lunid | yes? | FP |
| 5710 | Low | 50 | F | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | i | loop bound | no | FP |
| 5711 | Low | 50 | F | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | i | loop bound | no | FP |
| 5712 | Low | 50 | E | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | phys_lun | phys_lun->lunid | yes? | FP |
| 5713 | Low | 50 | E | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | phys_lun | phys_lun->device_type | yes? | FP |
| 5714 | Low | 50 | E | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | phys_lun | phys_lun->wwid | yes? | FP |
| 5715 | Low | 50 | E | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | phys_lun | phys_lun->wwid | yes? | FP |
| 5716 | Low | 50 | A | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | phys_lun | memcpy() | yes? | FP |
| 5717 | Low | 50 | E | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | phys_lun | phys_lun->wwid | yes? | FP |
| 5718 | Low | 50 | E | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | phys_lun | phys_lun->device_flags | yes? | FP |
| 5719 | Low | 50 | E | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | phys_lun | phys_lun->aio_handle | yes? | FP |
| 5720 | Low | 50 | E | pqi_update_scsi_devices | drivers/scsi/smartpqi/smartpqi_init.c | phys_lun | phys_lun->aio_handle | yes? | FP |
| 5721 | Low | 50 | G1 | printer_read | drivers/usb/gadget/function/f_printer.c | not_copied | copy_to_user() retval unchecked | no | FP |
| 5722 | Low | 50 | G1 | proc_bus_pci_read | drivers/pci/proc.c | | __put_user() retval discarded | no | FP |
| 5723 | Low | 50 | G1 | proc_bus_pci_read | drivers/pci/proc.c | | __put_user() retval discarded | no | FP |
| 5724 | Low | 50 | G1 | proc_bus_pci_read | drivers/pci/proc.c | | __put_user() retval discarded | no | FP |
| 5725 | Low | 50 | G1 | proc_bus_pci_read | drivers/pci/proc.c | | __put_user() retval discarded | no | FP |
| 5726 | Low | 50 | G1 | proc_bus_pci_read | drivers/pci/proc.c | | __put_user() retval discarded | no | FP |
| 5727 | Low | 50 | G1 | proc_bus_pci_write | drivers/pci/proc.c | | __get_user() retval discarded | no | FP |
| 5728 | Low | 50 | G1 | proc_bus_pci_write | drivers/pci/proc.c | | __get_user() retval discarded | no | FP |
| 5729 | Low | 50 | G1 | proc_bus_pci_write | drivers/pci/proc.c | | __get_user() retval discarded | no | FP |
| 5730 | Low | 50 | G1 | proc_bus_pci_write | drivers/pci/proc.c | | __get_user() retval discarded | no | FP |
| 5731 | Low | 50 | G1 | proc_bus_pci_write | drivers/pci/proc.c | | __get_user() retval discarded | no | FP |
| 5732 | Low | 50 | F | process_bulk_in | drivers/char/xillybus/xillyusb.c | bytes | loop bound | no | FP |
| 5733 | Low | 50 | E | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | skb | skb->? | yes? | FP |
| 5734 | Low | 50 | E | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | skb | skb->? | yes? | FP |
| 5735 | Low | 50 | E | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | skb | skb->? | yes? | FP |
| 5736 | Low | 50 | E | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | skb | skb->? | yes? | FP |
| 5737 | Low | 50 | E | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | skb | skb->? | yes? | FP |
| 5738 | Low | 50 | E | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | fl | fl->? | yes? | FP |
| 5739 | Low | 50 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->upacket_count | yes? | FP |
| 5740 | Low | 50 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->packet_count | yes? | FP |
| 5741 | Low | 50 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->demux | yes? | FP |
| 5742 | Low | 50 | E | pt1_filter | drivers/media/pci/pt1/pt1.c | adap | adap->packet_count | yes? | FP |
| 5743 | Low | 50 | F | qcom_glink_native_rx | drivers/rpmsg/qcom_glink_native.c | param2 | loop bound | no | FP |
| 5744 | Low | 50 | F | qcom_show_pmic_model_array | drivers/soc/qcom/socinfo.c | num_pmics | loop bound | no | FP |
| 5745 | Low | 50 | F | qcom_smem_get_item_count | drivers/soc/qcom/smem.c | info | loop bound | no | FP |
| 5746 | Low | 50 | F | qcom_smem_partition_header | drivers/soc/qcom/smem.c | header | loop bound | no | FP |
| 5747 | Low | 50 | F | qcom_smem_set_global_partition | drivers/soc/qcom/smem.c | (inline) | loop bound | no | FP |
| 5748 | Low | 50 | F | qed_init_cmd_array | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | repeats | loop bound | no | FP |
| 5749 | Low | 50 | F | qed_init_cmd_wr | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | b_must_dmae | loop bound | no | FP |
| 5750 | Low | 50 | F | qla24xx_load_risc_blob | drivers/scsi/qla2xxx/qla_init.c | templates | loop bound | no | FP |
| 5751 | Low | 50 | F | qla24xx_load_risc_flash | drivers/scsi/qla2xxx/qla_init.c | dlen | loop bound | no | FP |
| 5752 | Low | 50 | F | qla24xx_load_risc_flash | drivers/scsi/qla2xxx/qla_init.c | risc_size | loop bound | no | FP |
| 5753 | Low | 50 | F | qla24xx_load_risc_flash | drivers/scsi/qla2xxx/qla_init.c | dlen | loop bound | no | FP |
| 5754 | Low | 50 | F | qla24xx_load_risc_flash | drivers/scsi/qla2xxx/qla_init.c | templates | loop bound | no | FP |
| 5755 | Low | 50 | F | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | loop bound | no | FP |
| 5756 | Low | 50 | F | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | loop bound | no | FP |
| 5757 | Low | 50 | F | qla28xx_load_fw_template | drivers/scsi/qla2xxx/qla_init.c | risc_size | loop bound | no | FP |
| 5758 | Low | 50 | F | qla28xx_load_fw_template | drivers/scsi/qla2xxx/qla_init.c | templates | loop bound | no | FP |
| 5759 | Low | 50 | F | qla2x00_load_risc | drivers/scsi/qla2xxx/qla_init.c | risc_size | loop bound | no | FP |
| 5760 | Low | 50 | F | qla4_84xx_minidump_process_pollwr | drivers/scsi/qla4xxx/ql4_nx.c | poll | loop bound | no | FP |
| 5761 | Low | 50 | F | qla4_84xx_minidump_process_rddfe | drivers/scsi/qla4xxx/ql4_nx.c | poll | loop bound | no | FP |
| 5762 | Low | 50 | F | qlcnic_82xx_process_rcv_ring_diag | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | desc_cnt | loop bound | no | FP |
| 5763 | Low | 50 | F | qlcnic_82xx_process_rcv_ring_diag | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | desc_cnt | loop bound | no | FP |
| 5764 | Low | 50 | F | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | desc_cnt | loop bound | no | FP |
| 5765 | Low | 50 | F | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | desc_cnt | loop bound | no | FP |
| 5766 | Low | 50 | F | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | loop bound | no | FP |
| 5767 | Low | 50 | F | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | sh | loop bound | no | FP |
| 5768 | Low | 50 | F | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | (inline) | loop bound | no | FP |
| 5769 | Low | 50 | F | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | count | loop bound | no | FP |
| 5770 | Low | 50 | F | rbd_header_from_disk | drivers/block/rbd.c | snap_count | loop bound | no | FP |
| 5771 | Low | 50 | F | receive_Data | drivers/block/drbd/drbd_receiver.c | peer_req | loop bound | no | FP |
| 5772 | Low | 50 | E | resp_close_zone | drivers/scsi/scsi_debug.c | z_id | z_id->? | yes? | FP |
| 5773 | Low | 50 | E | resp_close_zone | drivers/scsi/scsi_debug.c | z_id | z_id->? | yes? | FP |
| 5774 | Low | 50 | F | resp_comp_write | drivers/scsi/scsi_debug.c | lba | loop bound | no | FP |
| 5775 | Low | 50 | E | resp_finish_zone | drivers/scsi/scsi_debug.c | z_id | z_id->? | yes? | FP |
| 5776 | Low | 50 | E | resp_finish_zone | drivers/scsi/scsi_debug.c | z_id | z_id->? | yes? | FP |
| 5777 | Low | 50 | F | resp_locate | drivers/scsi/scsi_debug.c | pos | loop bound | no | FP |
| 5778 | Low | 50 | E | resp_open_zone | drivers/scsi/scsi_debug.c | z_id | z_id->? | yes? | FP |
| 5779 | Low | 50 | E | resp_open_zone | drivers/scsi/scsi_debug.c | z_id | z_id->? | yes? | FP |
| 5780 | Low | 50 | E | resp_open_zone | drivers/scsi/scsi_debug.c | zsp | zsp->z_cond | yes? | FP |
| 5781 | Low | 50 | E | resp_read_dt0 | drivers/scsi/scsi_debug.c | lba | lba->? | yes? | FP |
| 5782 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_cond | yes? | FP |
| 5783 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_cond | yes? | FP |
| 5784 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_cond | yes? | FP |
| 5785 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_cond | yes? | FP |
| 5786 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_cond | yes? | FP |
| 5787 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_non_seq_resource | yes? | FP |
| 5788 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_type | yes? | FP |
| 5789 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_cond | yes? | FP |
| 5790 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_non_seq_resource | yes? | FP |
| 5791 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_size | yes? | FP |
| 5792 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_start | yes? | FP |
| 5793 | Low | 50 | E | resp_report_zones | drivers/scsi/scsi_debug.c | zsp | zsp->z_wp | yes? | FP |
| 5794 | Low | 50 | F | resp_rsup_opcodes | drivers/scsi/scsi_debug.c | a_len | loop bound | no | FP |
| 5795 | Low | 50 | E | resp_rwp_zone | drivers/scsi/scsi_debug.c | z_id | z_id->? | yes? | FP |
| 5796 | Low | 50 | E | resp_rwp_zone | drivers/scsi/scsi_debug.c | z_id | z_id->? | yes? | FP |
| 5797 | Low | 50 | F | resp_unmap | drivers/scsi/scsi_debug.c | lba | loop bound | no | FP |
| 5798 | Low | 50 | F | resp_unmap | drivers/scsi/scsi_debug.c | num | loop bound | no | FP |
| 5799 | Low | 50 | F | resp_write_dt0 | drivers/scsi/scsi_debug.c | num | loop bound | no | FP |
| 5800 | Low | 50 | F | resp_write_dt0 | drivers/scsi/scsi_debug.c | lba | loop bound | no | FP |
| 5801 | Low | 50 | F | resp_write_dt0 | drivers/scsi/scsi_debug.c | num | loop bound | no | FP |
| 5802 | Low | 50 | F | resp_write_scat | drivers/scsi/scsi_debug.c | lba | loop bound | no | FP |
| 5803 | Low | 50 | E | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | save_info | save_info->? | yes? | FP |
| 5804 | Low | 50 | E | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | new_zone | new_zone->? | yes? | FP |
| 5805 | Low | 50 | E | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | save_info | save_info->? | yes? | FP |
| 5806 | Low | 50 | E | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | new_zone | new_zone->? | yes? | FP |
| 5807 | Low | 50 | E | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | save_info | save_info->? | yes? | FP |
| 5808 | Low | 50 | E | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | new_zone | new_zone->? | yes? | FP |
| 5809 | Low | 50 | E | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | save_info | save_info->? | yes? | FP |
| 5810 | Low | 50 | F | rpaphp_check_drc_props | drivers/pci/hotplug/rpaphp_core.c | be32_to_cpu(*my_index) | loop bound | no | FP |
| 5811 | Low | 50 | F | rtlbt_parse_firmware | drivers/bluetooth/btrtl.c | num_patches | loop bound | no | FP |
| 5812 | Low | 50 | A | rtlbt_parse_firmware | drivers/bluetooth/btrtl.c | patch_offset | memcpy() | yes? | FP |
| 5813 | Low | 50 | F | rtlbt_parse_firmware_v2 | drivers/bluetooth/btrtl.c | opcode | loop bound | no | FP |
| 5814 | Low | 50 | F | rtlbt_parse_firmware_v2 | drivers/bluetooth/btrtl.c | ptr | loop bound | no | FP |
| 5815 | Low | 50 | F | rtlbt_parse_firmware_v2 | drivers/bluetooth/btrtl.c | section_len | loop bound | no | FP |
| 5816 | Low | 50 | F | rtlbt_parse_firmware_v2 | drivers/bluetooth/btrtl.c | num_sections | loop bound | no | FP |
| 5817 | Low | 50 | F | rtw89_fw_log_create_fmts_dict | drivers/net/wireless/realtek/rtw89/fw.c | fmt_count | loop bound | no | FP |
| 5818 | Low | 50 | F | scsi_report_lun_scan | drivers/scsi/scsi_scan.c | num_luns | loop bound | no | FP |
| 5819 | Low | 50 | F | sd_zbc_report_zones | drivers/scsi/sd_zbc.c | nr | loop bound | no | FP |
| 5820 | Low | 50 | F | sh_eth_rx | drivers/net/ethernet/renesas/sh_eth.c | dma_addr | loop bound | no | FP |
| 5821 | Low | 50 | E | si_parse_power_table | drivers/gpu/drm/radeon/si_dpm.c | clock_info_array | clock_info_array->clockInfo | yes? | FP |
| 5822 | Low | 50 | F | sii8620_burst_receive | drivers/gpu/drm/bridge/sil-sii8620.c | count | loop bound | no | FP |
| 5823 | Low | 50 | F | sm_ll_find_free_block | drivers/md/persistent-data/dm-space-map-common.c | max_t(unsigned int, begin, le32_to_cpu(ie_disk.none_free_bef | loop bound | no | FP |
| 5824 | Low | 50 | F | smu_sat_get_sdb_partition | drivers/macintosh/windfarm_smu_sat.c | len | loop bound | no | FP |
| 5825 | Low | 50 | F | solos_bh | drivers/atm/solos-pci.c | skb | loop bound | no | FP |
| 5826 | Low | 50 | F | st_lsm6dsx_read_tagged_fifo | drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | fifo_len | loop bound | no | FP |
| 5827 | Low | 50 | F | super_1_sync | drivers/md/md.c | max_dev | loop bound | no | FP |
| 5828 | Low | 50 | F | sur40_poll | drivers/input/touchscreen/sur40.c | packet_blobs | loop bound | no | FP |
| 5829 | Low | 50 | F | tpm2_map_response_body | drivers/char/tpm/tpm2-space.c | (inline) | loop bound | no | FP |
| 5830 | Low | 50 | A | tpm_buf_check_hmac_response | drivers/char/tpm/tpm2-sessions.c | offset_s | memcpy() | yes? | FP |
| 5831 | Low | 50 | E | tulip_poll | drivers/net/ethernet/dec/tulip/interrupt.c | skb | skb->head | yes? | FP |
| 5832 | Low | 50 | E | tulip_rx | drivers/net/ethernet/dec/tulip/interrupt.c | skb | skb->head | yes? | FP |
| 5833 | Low | 50 | F | tweak_set_interface_cmd | drivers/usb/usbip/stub_rx.c | interface | loop bound | no | FP |
| 5834 | Low | 50 | F | tweak_set_interface_cmd | drivers/usb/usbip/stub_rx.c | interface | loop bound | no | FP |
| 5835 | Low | 50 | F | tweak_set_interface_cmd | drivers/usb/usbip/stub_rx.c | alternate | loop bound | no | FP |
| 5836 | Low | 50 | F | txdesc_show | drivers/net/wireless/ath/wil6210/debugfs.c | skb | loop bound | no | FP |
| 5837 | Low | 50 | F | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | (inline) | loop bound | no | FP |
| 5838 | Low | 50 | F | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | (inline) | loop bound | no | FP |
| 5839 | Low | 50 | F | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | (inline) | loop bound | no | FP |
| 5840 | Low | 50 | F | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | (inline) | loop bound | no | FP |
| 5841 | Low | 50 | F | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | (inline) | loop bound | no | FP |
| 5842 | Low | 50 | F | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | (inline) | loop bound | no | FP |
| 5843 | Low | 50 | F | update_edgeport_E2PROM | drivers/usb/serial/io_edgeport.c | be16_to_cpu(rec->len) | loop bound | no | FP |
| 5844 | Low | 50 | F | usb_enumerate_device_otg | drivers/usb/core/hub.c | le16_to_cpu(udev->config[0].desc.wTotalLength) | loop bound | no | FP |
| 5845 | Low | 50 | F | usb_get_configuration | drivers/usb/core/config.c | bigbuffer | loop bound | no | FP |
| 5846 | Low | 50 | F | usb_get_configuration | drivers/usb/core/config.c | bigbuffer | loop bound | no | FP |
| 5847 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5848 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5849 | Low | 50 | A | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | memcpy() in uvc_alloc_new_entity() | yes? | FP |
| 5850 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5851 | Low | 50 | A | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | memcpy() in uvc_alloc_new_entity() | yes? | FP |
| 5852 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5853 | Low | 50 | A | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | memcpy() in uvc_alloc_new_entity() | yes? | FP |
| 5854 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5855 | Low | 50 | A | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | memcpy() in uvc_alloc_new_entity() | yes? | FP |
| 5856 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5857 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5858 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5859 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5860 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5861 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5862 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5863 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | type->? | yes? | FP |
| 5864 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->camera | yes? | FP |
| 5865 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->camera | yes? | FP |
| 5866 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->camera | yes? | FP |
| 5867 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->camera | yes? | FP |
| 5868 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->camera | yes? | FP |
| 5869 | Low | 50 | A | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | memcpy() | yes? | FP |
| 5870 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->camera | yes? | FP |
| 5871 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->media | yes? | FP |
| 5872 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->media | yes? | FP |
| 5873 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->media | yes? | FP |
| 5874 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->media | yes? | FP |
| 5875 | Low | 50 | A | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | memcpy() | yes? | FP |
| 5876 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->media | yes? | FP |
| 5877 | Low | 50 | A | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | memcpy() | yes? | FP |
| 5878 | Low | 50 | E | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | term | term->media | yes? | FP |
| 5879 | Low | 50 | E | vsc_identify_ace_image | drivers/misc/mei/vsc-fw-loader.c | sign | sign->magic | yes? | FP |
| 5880 | Low | 50 | E | vsc_identify_csi_image | drivers/misc/mei/vsc-fw-loader.c | sign | sign->magic | yes? | FP |
| 5881 | Low | 50 | E | vsc_identify_csi_image | drivers/misc/mei/vsc-fw-loader.c | sign | sign->image | yes? | FP |
| 5882 | Low | 50 | E | vsc_identify_csi_image | drivers/misc/mei/vsc-fw-loader.c | sign | sign->image_size | yes? | FP |
| 5883 | Low | 50 | F | wdt87xx_write_firmware | drivers/input/touchscreen/wdt87xx_i2c.c | page_size | loop bound | no | FP |
| 5884 | Low | 50 | E | wfx_send_pds | drivers/net/wireless/silabs/wfx/main.c | chunk_len | chunk_len->? | yes? | FP |
| 5885 | Low | 50 | E | wfx_send_pds | drivers/net/wireless/silabs/wfx/main.c | chunk_len | chunk_len->? | yes? | FP |
| 5886 | Low | 50 | E | wil_brd_process | drivers/net/wireless/ath/wil6210/fw_inc.c | hdr | hdr->size | yes? | FP |
| 5887 | Low | 50 | E | wil_brd_process | drivers/net/wireless/ath/wil6210/fw_inc.c | hdr | hdr->type | yes? | FP |
| 5888 | Low | 50 | E | wil_brd_process | drivers/net/wireless/ath/wil6210/fw_inc.c | hdr | hdr->type | yes? | FP |
| 5889 | Low | 50 | F | wilc_wfi_cfg_parse_ch_attr | drivers/net/wireless/microchip/wilc1000/cfg80211.c | elem_size | loop bound | no | FP |
| 5890 | Low | 50 | F | wmfw_err_bad_header_length | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | real_len | loop bound | no | FP |
| 5891 | Low | 50 | F | wmfw_err_bad_header_length | drivers/firmware/cirrus/test/cs_dsp_test_wmfw_error.c | real_len | loop bound | no | FP |
| 5892 | Low | 50 | F | wmi_marshal_string | drivers/platform/wmi/marshalling.c | chars | loop bound | no | FP |
| 5893 | Low | 50 | F | xgene_enet_tx_completion | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | skb | loop bound | no | FP |
| 5894 | Low | 50 | F | xhci_handle_cmd_reset_ep | drivers/usb/host/xhci-ring.c | ep_index | loop bound | no | FP |
| 5895 | Low | 50 | F | xhci_handle_cmd_set_deq | drivers/usb/host/xhci-ring.c | ep_index | loop bound | no | FP |
| 5896 | Low | 50 | F | xhci_handle_cmd_stop_ep | drivers/usb/host/xhci-ring.c | ep_index | loop bound | no | FP |
| 5897 | Low | 50 | F | xillyusb_discovery | drivers/char/xillybus/xillyusb.c | num_channels | loop bound | no | FP |
| 5898 | Low | 50 | F | xillyusb_discovery | drivers/char/xillybus/xillyusb.c | num_channels | loop bound | no | FP |
| 5899 | Low | 40 | C | <unknown> | drivers/scsi/qla1280.c | handle | subscript | yes? | FP |
| 5900 | Low | 40 | C | <unknown> | drivers/scsi/qla1280.c | handle | subscript | yes? | FP |
| 5901 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | first_logical_block | subscript | yes? | FP |
| 5902 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | logical_block | subscript | yes? | FP |
| 5903 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | block | subscript | yes? | FP |
| 5904 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | block | subscript | yes? | FP |
| 5905 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | block | subscript | yes? | FP |
| 5906 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | block | subscript | yes? | FP |
| 5907 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | block | subscript | yes? | FP |
| 5908 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | block | subscript | yes? | FP |
| 5909 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | logical_block | subscript | yes? | FP |
| 5910 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | block | subscript | yes? | FP |
| 5911 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | block | subscript | yes? | FP |
| 5912 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | block | subscript | yes? | FP |
| 5913 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | block | subscript | yes? | FP |
| 5914 | Low | 40 | C | INFTL_mount | drivers/mtd/inftlmount.c | block | subscript | yes? | FP |
| 5915 | Low | 40 | C | NFTL_mount | drivers/mtd/nftlmount.c | first_block1 | subscript (callee) | yes? | FP |
| 5916 | Low | 40 | C | NFTL_mount | drivers/mtd/nftlmount.c | chain_to_format | subscript (callee) | yes? | FP |
| 5917 | Low | 40 | C | NFTL_mount | drivers/mtd/nftlmount.c | chain_to_format | subscript (callee) | yes? | FP |
| 5918 | Low | 40 | C | NFTL_mount | drivers/mtd/nftlmount.c | rep_block | subscript | yes? | FP |
| 5919 | Low | 40 | C | NFTL_mount | drivers/mtd/nftlmount.c | rep_block | subscript | yes? | FP |
| 5920 | Low | 40 | C | NFTL_mount | drivers/mtd/nftlmount.c | block | subscript | yes? | FP |
| 5921 | Low | 40 | C | NFTL_mount | drivers/mtd/nftlmount.c | block | subscript | yes? | FP |
| 5922 | Low | 40 | H | OnDeAuth | drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | updated | truncation | no | FP |
| 5923 | Low | 40 | H | OnDisassoc | drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | updated | truncation | no | FP |
| 5924 | Low | 40 | H | ProcessEventNotification | drivers/message/fusion/mptbase.c | event | truncation | no | FP |
| 5925 | Low | 40 | H | ProcessEventNotification | drivers/message/fusion/mptbase.c | evState | truncation | no | FP |
| 5926 | Low | 40 | H | __block_dec | drivers/md/persistent-data/dm-array.c | r | truncation | no | FP |
| 5927 | Low | 40 | H | __block_dec | drivers/md/persistent-data/dm-array.c | r | truncation | no | FP |
| 5928 | Low | 40 | H | __bnge_rx_agg_netmems | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | frag_len | truncation | no | FP |
| 5929 | Low | 40 | H | __bnxt_rx_agg_netmems | drivers/net/ethernet/broadcom/bnxt/bnxt.c | frag_len | truncation | no | FP |
| 5930 | Low | 40 | H | __create_snap | drivers/md/dm-thin-metadata.c | r | truncation | no | FP |
| 5931 | Low | 40 | H | __efct_read_topology_cb | drivers/scsi/elx/efct/efct_hw.c | speed | truncation | no | FP |
| 5932 | Low | 40 | H | __get_mssc_key_idx | drivers/net/wireless/realtek/rtw89/fw.c | sel_bit_idx | truncation | no | FP |
| 5933 | Low | 40 | C | __get_mssc_key_idx | drivers/net/wireless/realtek/rtw89/fw.c | sel_byte_idx | subscript | yes? | FP |
| 5934 | Low | 40 | C | __get_mssc_key_idx | drivers/net/wireless/realtek/rtw89/fw.c | sel_byte_idx | subscript | yes? | FP |
| 5935 | Low | 40 | H | __get_sta_eht_pkt_padding | drivers/net/wireless/realtek/rtw89/fw.c | ru_bitmap | truncation | no | FP |
| 5936 | Low | 40 | H | __get_sta_eht_pkt_padding | drivers/net/wireless/realtek/rtw89/fw.c | n | truncation | no | FP |
| 5937 | Low | 40 | H | __get_sta_eht_pkt_padding | drivers/net/wireless/realtek/rtw89/fw.c | idx | truncation | no | FP |
| 5938 | Low | 40 | H | __get_sta_eht_pkt_padding | drivers/net/wireless/realtek/rtw89/fw.c | sh | truncation | no | FP |
| 5939 | Low | 40 | H | __get_sta_eht_pkt_padding | drivers/net/wireless/realtek/rtw89/fw.c | ppe16 | truncation | no | FP |
| 5940 | Low | 40 | H | __get_sta_eht_pkt_padding | drivers/net/wireless/realtek/rtw89/fw.c | ppe8 | truncation | no | FP |
| 5941 | Low | 40 | H | __get_sta_he_pkt_padding | drivers/net/wireless/realtek/rtw89/fw.c | ppe16 | truncation | no | FP |
| 5942 | Low | 40 | H | __get_sta_he_pkt_padding | drivers/net/wireless/realtek/rtw89/fw.c | ppe8 | truncation | no | FP |
| 5943 | Low | 40 | H | __mlx4_register_vlan | drivers/net/ethernet/mellanox/mlx4/port.c | dup_vlan | truncation | no | FP |
| 5944 | Low | 40 | H | __netdev_rx | drivers/net/ethernet/adaptec/starfire.c | pkt_len | truncation | no | FP |
| 5945 | Low | 40 | C | __parse_formatted_mssc | drivers/net/wireless/realtek/rtw89/fw.c | rmp_tbl_size | subscript (callee) | yes? | FP |
| 5946 | Low | 40 | C | __parse_formatted_mssc | drivers/net/wireless/realtek/rtw89/fw.c | rmp_tbl_size | subscript (callee) | yes? | FP |
| 5947 | Low | 40 | B | __qla_copy_purex_to_buffer | drivers/scsi/qla2xxx/qla_isr.c | no_bytes | memcpy() | yes? | FP |
| 5948 | Low | 40 | B | __qla_copy_purex_to_buffer | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | memcpy() | yes? | FP |
| 5949 | Low | 40 | B | __rebalance2 | drivers/md/persistent-data/dm-btree-remove.c | nr_right | memcpy() in node_copy() | yes? | FP |
| 5950 | Low | 40 | B | __rebalance2 | drivers/md/persistent-data/dm-btree-remove.c | nr_right | memcpy() in node_copy() | yes? | FP |
| 5951 | Low | 40 | B | __rebalance2 | drivers/md/persistent-data/dm-btree-remove.c | nr_right | memcpy() in node_copy() | yes? | FP |
| 5952 | Low | 40 | B | __rebalance2 | drivers/md/persistent-data/dm-btree-remove.c | nr_right | memcpy() in node_copy() | yes? | FP |
| 5953 | Low | 40 | H | __remove_range | drivers/md/dm-thin-metadata.c | mapping_root | truncation | no | FP |
| 5954 | Low | 40 | H | __remove_range | drivers/md/dm-thin-metadata.c | r | truncation | no | FP |
| 5955 | Low | 40 | H | __remove_range | drivers/md/dm-thin-metadata.c | r | truncation | no | FP |
| 5956 | Low | 40 | H | __subn_set_opa_portinfo | drivers/infiniband/hw/hfi1/mad.c | crc_enabled | truncation | no | FP |
| 5957 | Low | 40 | H | _base_make_ioc_operational | drivers/scsi/mpt3sas/mpt3sas_base.c | hide_flag | truncation | no | FP |
| 5958 | Low | 40 | H | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | cb_idx | truncation | no | FP |
| 5959 | Low | 40 | C | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | cb_idx | subscript | yes? | FP |
| 5960 | Low | 40 | C | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | cb_idx | subscript | yes? | FP |
| 5961 | Low | 40 | H | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | cb_idx | truncation | no | FP |
| 5962 | Low | 40 | C | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | cb_idx | subscript | yes? | FP |
| 5963 | Low | 40 | C | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | cb_idx | subscript | yes? | FP |
| 5964 | Low | 40 | C | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | smid | subscript (callee) | yes? | FP |
| 5965 | Low | 40 | H | _chk_btc_report | drivers/net/wireless/realtek/rtw89/coex.c | val1 | truncation | no | FP |
| 5966 | Low | 40 | H | _chk_btc_report | drivers/net/wireless/realtek/rtw89/coex.c | val1 | truncation | no | FP |
| 5967 | Low | 40 | H | _chk_btc_report | drivers/net/wireless/realtek/rtw89/coex.c | val1 | truncation | no | FP |
| 5968 | Low | 40 | H | _chk_btc_report | drivers/net/wireless/realtek/rtw89/coex.c | val2 | truncation | no | FP |
| 5969 | Low | 40 | H | _chk_btc_report | drivers/net/wireless/realtek/rtw89/coex.c | val1 | truncation | no | FP |
| 5970 | Low | 40 | H | _chk_btc_report | drivers/net/wireless/realtek/rtw89/coex.c | val2 | truncation | no | FP |
| 5971 | Low | 40 | H | _rtl8821ae_rate_to_bitmap_2ssvht | drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | tmp_rate | truncation | no | FP |
| 5972 | Low | 40 | H | _scsih_sas_ir_config_change_event | drivers/scsi/mpt3sas/mpt3sas_scsih.c | foreign_config | truncation | no | FP |
| 5973 | Low | 40 | H | _scsih_sas_ir_config_change_event_debug | drivers/scsi/mpt3sas/mpt3sas_scsih.c | element_type | truncation | no | FP |
| 5974 | Low | 40 | H | _scsih_sas_topology_change_event | drivers/scsi/mpt3sas/mpt3sas_scsih.c | max_phys | truncation | no | FP |
| 5975 | Low | 40 | H | _show_fbtc_step_v2 | drivers/net/wireless/realtek/rtw89/coex.c | type | truncation | no | FP |
| 5976 | Low | 40 | H | _show_fbtc_step_v2 | drivers/net/wireless/realtek/rtw89/coex.c | val | truncation | no | FP |
| 5977 | Low | 40 | H | _show_fbtc_step_v3 | drivers/net/wireless/realtek/rtw89/coex.c | type | truncation | no | FP |
| 5978 | Low | 40 | H | _show_fbtc_step_v3 | drivers/net/wireless/realtek/rtw89/coex.c | val | truncation | no | FP |
| 5979 | Low | 40 | H | _show_mreg_v1 | drivers/net/wireless/realtek/rtw89/coex.c | type | truncation | no | FP |
| 5980 | Low | 40 | H | _show_mreg_v2 | drivers/net/wireless/realtek/rtw89/coex.c | type | truncation | no | FP |
| 5981 | Low | 40 | H | _show_mreg_v7 | drivers/net/wireless/realtek/rtw89/coex.c | type | truncation | no | FP |
| 5982 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5983 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5984 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5985 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5986 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5987 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5988 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5989 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5990 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5991 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5992 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5993 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5994 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5995 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5996 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5997 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5998 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 5999 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6000 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6001 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6002 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6003 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6004 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6005 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6006 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6007 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6008 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6009 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6010 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6011 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6012 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6013 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6014 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6015 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6016 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6017 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6018 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6019 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6020 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6021 | Low | 40 | C | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | subscript | yes? | FP |
| 6022 | Low | 40 | H | aac_read_block | drivers/scsi/aacraid/aachba.c | fibsize | truncation | no | FP |
| 6023 | Low | 40 | H | aac_read_block64 | drivers/scsi/aacraid/aachba.c | fibsize | truncation | no | FP |
| 6024 | Low | 40 | H | aac_read_raw_io | drivers/scsi/aacraid/aachba.c | fibsize | truncation | no | FP |
| 6025 | Low | 40 | H | aac_read_raw_io | drivers/scsi/aacraid/aachba.c | fibsize | truncation | no | FP |
| 6026 | Low | 40 | H | aac_scsi_32 | drivers/scsi/aacraid/aachba.c | fibsize | truncation | no | FP |
| 6027 | Low | 40 | H | aac_scsi_64 | drivers/scsi/aacraid/aachba.c | fibsize | truncation | no | FP |
| 6028 | Low | 40 | H | aac_write_block | drivers/scsi/aacraid/aachba.c | fibsize | truncation | no | FP |
| 6029 | Low | 40 | H | aac_write_block64 | drivers/scsi/aacraid/aachba.c | fibsize | truncation | no | FP |
| 6030 | Low | 40 | H | aac_write_raw_io | drivers/scsi/aacraid/aachba.c | fibsize | truncation | no | FP |
| 6031 | Low | 40 | H | aac_write_raw_io | drivers/scsi/aacraid/aachba.c | fibsize | truncation | no | FP |
| 6032 | Low | 40 | H | ac_rq_in | drivers/usb/gadget/function/f_uac1.c | ep | truncation | no | FP |
| 6033 | Low | 40 | C | act_open_rpl | drivers/infiniband/hw/cxgb4/cm.c | ep | subscript (callee) | yes? | FP |
| 6034 | Low | 40 | C | act_open_rpl | drivers/infiniband/hw/cxgb4/cm.c | ep | subscript (callee) | yes? | FP |
| 6035 | Low | 40 | B | act_open_rpl | drivers/infiniband/hw/cxgb4/cm.c | ep | memcpy() in connect_reply_upcall() | yes? | FP |
| 6036 | Low | 40 | B | act_open_rpl | drivers/infiniband/hw/cxgb4/cm.c | ep | memcpy() in connect_reply_upcall() | yes? | FP |
| 6037 | Low | 40 | C | act_open_rpl | drivers/infiniband/hw/cxgb4/cm.c | ep | subscript (callee) | yes? | FP |
| 6038 | Low | 40 | C | act_open_rpl | drivers/infiniband/hw/cxgb4/cm.c | ep | subscript (callee) | yes? | FP |
| 6039 | Low | 40 | C | act_open_rpl | drivers/infiniband/hw/cxgb4/cm.c | ep | subscript (callee) | yes? | FP |
| 6040 | Low | 40 | C | adaptive_early_32k | drivers/staging/rtl8723bs/core/rtw_wlan_util.c | delay_ms | subscript | yes? | FP |
| 6041 | Low | 40 | C | add_promisc_qp | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | subscript | yes? | FP |
| 6042 | Low | 40 | H | adis16550_spi_validate | drivers/iio/imu/adis16550.c | crc_rcv | truncation | no | FP |
| 6043 | Low | 40 | H | adis16550_spi_validate | drivers/iio/imu/adis16550.c | crc | truncation | no | FP |
| 6044 | Low | 40 | H | adis16550_spi_validate | drivers/iio/imu/adis16550.c | sv | truncation | no | FP |
| 6045 | Low | 40 | H | adm8211_interrupt_rci | drivers/net/wireless/admtek/adm8211.c | rate | truncation | no | FP |
| 6046 | Low | 40 | H | adm8211_interrupt_rci | drivers/net/wireless/admtek/adm8211.c | rssi | truncation | no | FP |
| 6047 | Low | 40 | C | adv_get_next_carrier | drivers/scsi/advansys.c | next_vpa | subscript (callee) | yes? | FP |
| 6048 | Low | 40 | C | aeq_irq_handler | drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c | event | subscript | yes? | FP |
| 6049 | Low | 40 | B | ag6xx_setup | drivers/bluetooth/hci_ag6xx.c | plen | memcpy() in intel_mem_write() | yes? | FP |
| 6050 | Low | 40 | C | aiptek_irq | drivers/input/tablet/aiptek.c | macro | subscript | yes? | FP |
| 6051 | Low | 40 | C | aiptek_irq | drivers/input/tablet/aiptek.c | macro | subscript | yes? | FP |
| 6052 | Low | 40 | C | aiptek_irq | drivers/input/tablet/aiptek.c | macro | subscript | yes? | FP |
| 6053 | Low | 40 | H | airoha_get_dsa_tag | drivers/net/ethernet/airoha/airoha_eth.c | xmit_tpid | truncation | no | FP |
| 6054 | Low | 40 | C | airoha_qdma_rx_process | drivers/net/ethernet/airoha/airoha_eth.c | sptag | subscript | yes? | FP |
| 6055 | Low | 40 | C | airoha_qdma_rx_process | drivers/net/ethernet/airoha/airoha_eth.c | hash | subscript (callee) | yes? | FP |
| 6056 | Low | 40 | C | airoha_qdma_rx_process | drivers/net/ethernet/airoha/airoha_eth.c | hash | subscript (callee) | yes? | FP |
| 6057 | Low | 40 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | subscript (callee) | yes? | FP |
| 6058 | Low | 40 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | subscript (callee) | yes? | FP |
| 6059 | Low | 40 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | subscript (callee) | yes? | FP |
| 6060 | Low | 40 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | subscript (callee) | yes? | FP |
| 6061 | Low | 40 | B | altera_execute | drivers/misc/altera-stapl/altera.c | long_tmp | kzalloc() | yes? | FP |
| 6062 | Low | 40 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx | subscript | yes? | FP |
| 6063 | Low | 40 | C | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx | subscript | yes? | FP |
| 6064 | Low | 40 | H | altera_get_act_info | drivers/misc/altera-stapl/altera.c | act_proc_attribute | truncation | no | FP |
| 6065 | Low | 40 | H | alx_clean_rx_irq | drivers/net/ethernet/atheros/alx/main.c | length | truncation | no | FP |
| 6066 | Low | 40 | H | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | con_obj_id | truncation | no | FP |
| 6067 | Low | 40 | C | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | con_obj_id | subscript | yes? | FP |
| 6068 | Low | 40 | H | amdgpu_atombios_get_connector_info_from_object_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | grph_obj_type | truncation | no | FP |
| 6069 | Low | 40 | H | amdgpu_atombios_init_mc_reg_table | drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | t_mem_id | truncation | no | FP |
| 6070 | Low | 40 | H | amdgpu_atomfirmware_get_umc_info | drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | mem_type | truncation | no | FP |
| 6071 | Low | 40 | H | amdgpu_atomfirmware_mem_ecc_supported | drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | umc_config | truncation | no | FP |
| 6072 | Low | 40 | H | amdgpu_atomfirmware_mem_ecc_supported | drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | umc_config | truncation | no | FP |
| 6073 | Low | 40 | H | amdgpu_atomfirmware_mem_ecc_supported | drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | umc_config | truncation | no | FP |
| 6074 | Low | 40 | H | amdgpu_atomfirmware_mem_ecc_supported | drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | umc_config | truncation | no | FP |
| 6075 | Low | 40 | H | amdgpu_discovery_read_from_harvest_table | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | inst | truncation | no | FP |
| 6076 | Low | 40 | H | amdgpu_discovery_read_harvest_bit_per_ip | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | inst | truncation | no | FP |
| 6077 | Low | 40 | H | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | inst | truncation | no | FP |
| 6078 | Low | 40 | H | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | num_base_address | truncation | no | FP |
| 6079 | Low | 40 | C | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | subscript | yes? | FP |
| 6080 | Low | 40 | C | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | ip | subscript | yes? | FP |
| 6081 | Low | 40 | C | amdgpu_ib_preempt_mark_partial_job | drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | preempt_seq | subscript | yes? | FP |
| 6082 | Low | 40 | H | amdgpu_parse_extended_power_table | drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | rev | truncation | no | FP |
| 6083 | Low | 40 | H | amdgpu_vcn_sw_init | drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | fw_check | truncation | no | FP |
| 6084 | Low | 40 | H | aml_sfc_check_ecc_pages_valid | drivers/spi/spi-amlogic-spifc-a4.c | ret | truncation | no | FP |
| 6085 | Low | 40 | H | aml_sfc_check_hwecc_status | drivers/spi/spi-amlogic-spifc-a4.c | per_sector_bitflips | truncation | no | FP |
| 6086 | Low | 40 | H | aml_sfc_check_hwecc_status | drivers/spi/spi-amlogic-spifc-a4.c | max_bitflips | truncation | no | FP |
| 6087 | Low | 40 | B | aoecmd_cfg_rsp | drivers/block/aoe/aoecmd.c | d | memcmp() in gettgt() | yes? | FP |
| 6088 | Low | 40 | B | aoecmd_cfg_rsp | drivers/block/aoe/aoecmd.c | d | memset() in aoecmd_ata_id() | yes? | FP |
| 6089 | Low | 40 | H | applesmc_light_show | drivers/hwmon/applesmc.c | left | truncation | no | FP |
| 6090 | Low | 40 | B | applespi_got_data | drivers/input/keyboard/applespi.c | len | memcpy() | yes? | FP |
| 6091 | Low | 40 | H | arm_smmu_attach_prepare_vmaster | drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | cfg | truncation | no | FP |
| 6092 | Low | 40 | H | arm_smmu_get_ste_used | drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | cfg | truncation | no | FP |
| 6093 | Low | 40 | H | arm_smmu_make_nested_domain_ste | drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | cfg | truncation | no | FP |
| 6094 | Low | 40 | H | arm_smmu_validate_vste | drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | cfg | truncation | no | FP |
| 6095 | Low | 40 | H | arm_smmu_validate_vste | drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | eats | truncation | no | FP |
| 6096 | Low | 40 | C | aspeed_intc_populate_ranges | drivers/irqchip/irq-ast2700.c | be32_to_cpu(pvs[ASPEED_INTC_RANGE_OFF_PHANDLE]) | subscript (callee) | yes? | FP |
| 6097 | Low | 40 | C | ast_vhub_class_hub_request | drivers/usb/gadget/udc/aspeed-vhub/hub.c | wIndex | subscript (callee) | yes? | FP |
| 6098 | Low | 40 | C | ast_vhub_class_hub_request | drivers/usb/gadget/udc/aspeed-vhub/hub.c | wIndex | subscript (callee) | yes? | FP |
| 6099 | Low | 40 | C | ast_vhub_class_hub_request | drivers/usb/gadget/udc/aspeed-vhub/hub.c | wIndex | subscript (callee) | yes? | FP |
| 6100 | Low | 40 | C | ast_vhub_class_hub_request | drivers/usb/gadget/udc/aspeed-vhub/hub.c | wIndex | subscript (callee) | yes? | FP |
| 6101 | Low | 40 | C | ast_vhub_std_dev_request | drivers/usb/gadget/udc/aspeed-vhub/dev.c | wIndex | subscript (callee) | yes? | FP |
| 6102 | Low | 40 | C | ast_vhub_std_dev_request | drivers/usb/gadget/udc/aspeed-vhub/dev.c | wIndex | subscript (callee) | yes? | FP |
| 6103 | Low | 40 | C | ast_vhub_std_dev_request | drivers/usb/gadget/udc/aspeed-vhub/dev.c | wIndex | subscript (callee) | yes? | FP |
| 6104 | Low | 40 | B | ast_vhub_std_hub_request | drivers/usb/gadget/udc/aspeed-vhub/hub.c | wValue | memcpy() in ast_vhub_rep_string() | yes? | FP |
| 6105 | Low | 40 | B | ast_vhub_std_hub_request | drivers/usb/gadget/udc/aspeed-vhub/hub.c | wIndex | memcpy() in ast_vhub_rep_string() | yes? | FP |
| 6106 | Low | 40 | B | ath10k_core_fetch_firmware_api_n | drivers/net/wireless/ath/ath10k/core.c | ie_len | memcpy() | yes? | FP |
| 6107 | Low | 40 | C | ath10k_core_fetch_firmware_api_n | drivers/net/wireless/ath/ath10k/core.c | ie_len | subscript | yes? | FP |
| 6108 | Low | 40 | H | ath10k_htt_rx_h_frag_pn_check | drivers/net/wireless/ath/ath10k/htt_rx.c | frag_number | truncation | no | FP |
| 6109 | Low | 40 | H | ath10k_htt_rx_tx_fetch_ind | drivers/net/wireless/ath/ath10k/htt_rx.c | tid | truncation | no | FP |
| 6110 | Low | 40 | C | ath10k_htt_rx_tx_fetch_ind | drivers/net/wireless/ath/ath10k/htt_rx.c | peer_id | subscript (callee) | yes? | FP |
| 6111 | Low | 40 | C | ath10k_htt_rx_tx_fetch_ind | drivers/net/wireless/ath/ath10k/htt_rx.c | tid | subscript (callee) | yes? | FP |
| 6112 | Low | 40 | H | ath10k_htt_rx_tx_mode_switch_ind | drivers/net/wireless/ath/ath10k/htt_rx.c | tid | truncation | no | FP |
| 6113 | Low | 40 | C | ath11k_bss_assoc | drivers/net/wireless/ath/ath11k/mac.c | le16_to_cpu(ap_sta->deflink.he_6ghz_capa.capa) | subscript (callee) | yes? | FP |
| 6114 | Low | 40 | H | ath11k_peer_assoc_h_he | drivers/net/wireless/ath/ath11k/mac.c | mcs_160 | truncation | no | FP |
| 6115 | Low | 40 | H | ath11k_peer_assoc_h_he | drivers/net/wireless/ath/ath11k/mac.c | mcs_80 | truncation | no | FP |
| 6116 | Low | 40 | H | ath11k_peer_assoc_h_he | drivers/net/wireless/ath/ath11k/mac.c | he_mcs | truncation | no | FP |
| 6117 | Low | 40 | C | ath11k_station_assoc | drivers/net/wireless/ath/ath11k/mac.c | le16_to_cpu(sta->deflink.he_6ghz_capa.capa) | subscript (callee) | yes? | FP |
| 6118 | Low | 40 | C | ath12k_chan_info_event | drivers/net/wireless/ath/ath12k/wmi.c | idx | subscript | yes? | FP |
| 6119 | Low | 40 | C | ath12k_dbring_buffer_release_event | drivers/net/wireless/ath/ath12k/dbring.c | pdev_idx | subscript | yes? | FP |
| 6120 | Low | 40 | C | ath12k_dbring_buffer_release_event | drivers/net/wireless/ath/ath12k/dbring.c | pdev_idx | subscript | yes? | FP |
| 6121 | Low | 40 | H | ath12k_get_tpc_ctl_mode_idx | drivers/net/wireless/ath/ath12k/debugfs.c | band | truncation | no | FP |
| 6122 | Low | 40 | H | ath12k_htt_print_chan_switch_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | i | truncation | no | FP |
| 6123 | Low | 40 | C | ath12k_htt_tlv_ppdu_stats_parse | drivers/net/wireless/ath/ath12k/dp_htt.c | cur_user | subscript | yes? | FP |
| 6124 | Low | 40 | C | ath12k_htt_tlv_ppdu_stats_parse | drivers/net/wireless/ath/ath12k/dp_htt.c | cur_user | subscript | yes? | FP |
| 6125 | Low | 40 | C | ath12k_htt_tlv_ppdu_stats_parse | drivers/net/wireless/ath/ath12k/dp_htt.c | cur_user | subscript | yes? | FP |
| 6126 | Low | 40 | C | ath12k_pdev_bss_chan_info_event | drivers/net/wireless/ath/ath12k/wmi.c | idx | subscript | yes? | FP |
| 6127 | Low | 40 | H | ath12k_peer_assoc_h_he | drivers/net/wireless/ath/ath12k/mac.c | mcs_160 | truncation | no | FP |
| 6128 | Low | 40 | H | ath12k_peer_assoc_h_he | drivers/net/wireless/ath/ath12k/mac.c | mcs_80 | truncation | no | FP |
| 6129 | Low | 40 | H | ath12k_peer_assoc_h_he | drivers/net/wireless/ath/ath12k/mac.c | he_mcs | truncation | no | FP |
| 6130 | Low | 40 | H | ath12k_roam_event | drivers/net/wireless/ath/ath12k/wmi.c | roam_reason | truncation | no | FP |
| 6131 | Low | 40 | C | ath12k_tm_process_event | drivers/net/wireless/ath/ath12k/testmode.c | pdev_id | subscript | yes? | FP |
| 6132 | Low | 40 | H | ath12k_tpc_get_rate | drivers/net/wireless/ath/ath12k/debugfs.c | tpc_ctl | truncation | no | FP |
| 6133 | Low | 40 | H | ath12k_tpc_get_rate | drivers/net/wireless/ath/ath12k/debugfs.c | rates_ctl_min | truncation | no | FP |
| 6134 | Low | 40 | H | ath12k_tpc_get_rate | drivers/net/wireless/ath/ath12k/debugfs.c | tpc | truncation | no | FP |
| 6135 | Low | 40 | H | ath12k_tpc_get_rate | drivers/net/wireless/ath/ath12k/debugfs.c | tpc | truncation | no | FP |
| 6136 | Low | 40 | H | ath12k_wifi7_dp_rx_h_defrag_reo_reinject | drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | dst_ind | truncation | no | FP |
| 6137 | Low | 40 | H | ath12k_wmi_ext_soc_hal_reg_caps_parse | drivers/net/wireless/ath/ath12k/wmi.c | hw_mode_id | truncation | no | FP |
| 6138 | Low | 40 | C | ath12k_wmi_hw_mode_caps | drivers/net/wireless/ath/ath12k/wmi.c | mode | subscript | yes? | FP |
| 6139 | Low | 40 | H | ath5k_prepare_multicast | drivers/net/wireless/ath/ath5k/mac80211-ops.c | pos | truncation | no | FP |
| 6140 | Low | 40 | B | ath6kl_read_fwlogs | drivers/net/wireless/ath/ath6kl/main.c | length | memcpy() in ath6kl_debug_fwlog_event() | yes? | FP |
| 6141 | Low | 40 | B | ath6kl_read_fwlogs | drivers/net/wireless/ath/ath6kl/main.c | length | memset() in ath6kl_debug_fwlog_event() | yes? | FP |
| 6142 | Low | 40 | C | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | skbuff | subscript (callee) | yes? | FP |
| 6143 | Low | 40 | H | ath6kl_rx | drivers/net/wireless/ath/ath6kl/txrx.c | pad_before_data_start | truncation | no | FP |
| 6144 | Low | 40 | H | ath6kl_wmi_cac_event_rx | drivers/net/wireless/ath/ath6kl/wmi.c | tsid | truncation | no | FP |
| 6145 | Low | 40 | H | ath6kl_wmi_cac_event_rx | drivers/net/wireless/ath/ath6kl/wmi.c | ts_id | truncation | no | FP |
| 6146 | Low | 40 | H | ath6kl_wmi_control_rx_xtnd | drivers/net/wireless/ath/ath6kl/wmi.c | id | truncation | no | FP |
| 6147 | Low | 40 | H | ath6kl_wmi_implicit_create_pstream | drivers/net/wireless/ath/ath6kl/wmi.c | traffic_class | truncation | no | FP |
| 6148 | Low | 40 | H | ath6kl_wmi_proc_events | drivers/net/wireless/ath/ath6kl/wmi.c | if_idx | truncation | no | FP |
| 6149 | Low | 40 | H | ath9k_htc_choose_bslot | drivers/net/wireless/ath/ath9k/htc_drv_beacon.c | tsftu | truncation | no | FP |
| 6150 | Low | 40 | H | ath9k_htc_choose_bslot | drivers/net/wireless/ath/ath9k/htc_drv_beacon.c | slot | truncation | no | FP |
| 6151 | Low | 40 | H | ath9k_htc_choose_bslot | drivers/net/wireless/ath/ath9k/htc_drv_beacon.c | slot | truncation | no | FP |
| 6152 | Low | 40 | H | atmel_aes_ctr_transfer | drivers/crypto/atmel-aes.c | start | truncation | no | FP |
| 6153 | Low | 40 | H | atmel_aes_ctr_transfer | drivers/crypto/atmel-aes.c | end | truncation | no | FP |
| 6154 | Low | 40 | H | atomctrl_initialize_mc_reg_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | reg_block | truncation | no | FP |
| 6155 | Low | 40 | H | atomctrl_initialize_mc_reg_table | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | reg_block | truncation | no | FP |
| 6156 | Low | 40 | H | atomctrl_initialize_mc_reg_table_v2_2 | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | reg_block | truncation | no | FP |
| 6157 | Low | 40 | H | atomctrl_retrieve_ac_timing | drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | tmem_id | truncation | no | FP |
| 6158 | Low | 40 | H | audio_get_endpoint_req | drivers/usb/gadget/function/f_uac1_legacy.c | ep | truncation | no | FP |
| 6159 | Low | 40 | H | audio_get_endpoint_req | drivers/usb/gadget/function/f_uac1.c | ep | truncation | no | FP |
| 6160 | Low | 40 | H | audio_get_endpoint_req | drivers/usb/gadget/function/f_uac1.c | cs | truncation | no | FP |
| 6161 | Low | 40 | H | audio_get_intf_req | drivers/usb/gadget/function/f_uac1_legacy.c | id | truncation | no | FP |
| 6162 | Low | 40 | H | audio_get_intf_req | drivers/usb/gadget/function/f_uac1_legacy.c | con_sel | truncation | no | FP |
| 6163 | Low | 40 | H | audio_set_endpoint_req | drivers/usb/gadget/function/f_uac1.c | cs | truncation | no | FP |
| 6164 | Low | 40 | H | audio_set_intf_req | drivers/usb/gadget/function/f_uac1_legacy.c | id | truncation | no | FP |
| 6165 | Low | 40 | H | audio_set_intf_req | drivers/usb/gadget/function/f_uac1_legacy.c | con_sel | truncation | no | FP |
| 6166 | Low | 40 | H | ax88179_rx_fixup | drivers/net/usb/ax88179_178a.c | hdr_off | truncation | no | FP |
| 6167 | Low | 40 | H | ax88179_rx_fixup | drivers/net/usb/ax88179_178a.c | pkt_len | truncation | no | FP |
| 6168 | Low | 40 | H | ax88179_rx_fixup | drivers/net/usb/ax88179_178a.c | pkt_len_plus_padd | truncation | no | FP |
| 6169 | Low | 40 | B | ax88179_rx_fixup | drivers/net/usb/ax88179_178a.c | pkt_len | memcpy() | yes? | FP |
| 6170 | Low | 40 | C | b43_rx | drivers/net/wireless/broadcom/b43/xmit.c | keyidx | subscript | yes? | FP |
| 6171 | Low | 40 | C | b43legacy_rx | drivers/net/wireless/broadcom/b43legacy/xmit.c | keyidx | subscript | yes? | FP |
| 6172 | Low | 40 | H | bcm_sf2_cfp_ipv4_rule_set | drivers/net/dsa/bcm_sf2_cfp.c | ip_frag | truncation | no | FP |
| 6173 | Low | 40 | H | bcm_sf2_cfp_ipv6_rule_set | drivers/net/dsa/bcm_sf2_cfp.c | ip_frag | truncation | no | FP |
| 6174 | Low | 40 | H | bdc_sr_xsf | drivers/usb/gadget/udc/bdc/bdc_ep.c | ep_num | truncation | no | FP |
| 6175 | Low | 40 | C | bdc_sr_xsf | drivers/usb/gadget/udc/bdc/bdc_ep.c | ep_num | subscript | yes? | FP |
| 6176 | Low | 40 | H | be_async_port_misconfig_event_process | drivers/net/ethernet/emulex/benet/be_cmds.c | new_phy_state | truncation | no | FP |
| 6177 | Low | 40 | H | be_async_port_misconfig_event_process | drivers/net/ethernet/emulex/benet/be_cmds.c | phy_state_info | truncation | no | FP |
| 6178 | Low | 40 | H | be_async_port_misconfig_event_process | drivers/net/ethernet/emulex/benet/be_cmds.c | msg_severity | truncation | no | FP |
| 6179 | Low | 40 | H | be_async_port_misconfig_event_process | drivers/net/ethernet/emulex/benet/be_cmds.c | phy_oper_state | truncation | no | FP |
| 6180 | Low | 40 | B | be_flash_skyhawk | drivers/net/ethernet/emulex/benet/be_cmds.c | img_size | memcpy() in be_flash() | yes? | FP |
| 6181 | Low | 40 | H | bf_show | drivers/net/wireless/ath/wil6210/debugfs.c | bf_mcs | truncation | no | FP |
| 6182 | Low | 40 | H | bnge_discard_rx | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | agg_bufs | truncation | no | FP |
| 6183 | Low | 40 | H | bnge_rx_pkt | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | skb | truncation | no | FP |
| 6184 | Low | 40 | H | bnge_rx_pkt | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | skb | truncation | no | FP |
| 6185 | Low | 40 | H | bnge_rx_pkt | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | agg_bufs | truncation | no | FP |
| 6186 | Low | 40 | H | bnge_rx_vlan | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | vtag | truncation | no | FP |
| 6187 | Low | 40 | H | bnge_rx_vlan | drivers/net/ethernet/broadcom/bnge/bnge_txrx.c | vlan_proto | truncation | no | FP |
| 6188 | Low | 40 | B | bnx2x_rx_int | drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | len | memcpy() | yes? | FP |
| 6189 | Low | 40 | H | bnxt_async_event_process | drivers/net/ethernet/broadcom/bnxt/bnxt.c | port_id | truncation | no | FP |
| 6190 | Low | 40 | H | bnxt_async_event_process | drivers/net/ethernet/broadcom/bnxt/bnxt.c | grp_idx | truncation | no | FP |
| 6191 | Low | 40 | C | bnxt_async_event_process | drivers/net/ethernet/broadcom/bnxt/bnxt.c | grp_idx | subscript | yes? | FP |
| 6192 | Low | 40 | H | bnxt_async_event_process | drivers/net/ethernet/broadcom/bnxt/bnxt.c | seq_id | truncation | no | FP |
| 6193 | Low | 40 | H | bnxt_async_event_process | drivers/net/ethernet/broadcom/bnxt/bnxt.c | type | truncation | no | FP |
| 6194 | Low | 40 | C | bnxt_async_event_process | drivers/net/ethernet/broadcom/bnxt/bnxt.c | type | subscript | yes? | FP |
| 6195 | Low | 40 | H | bnxt_discard_rx | drivers/net/ethernet/broadcom/bnxt/bnxt.c | agg_bufs | truncation | no | FP |
| 6196 | Low | 40 | H | bnxt_hwrm_queue_pfc_qcfg | drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | pri_mask | truncation | no | FP |
| 6197 | Low | 40 | C | bnxt_qplib_cq_process_req | drivers/infiniband/hw/bnxt_re/qplib_fp.c | sq | subscript (callee) | yes? | FP |
| 6198 | Low | 40 | C | bnxt_qplib_cq_process_req | drivers/infiniband/hw/bnxt_re/qplib_fp.c | qp | subscript (callee) | yes? | FP |
| 6199 | Low | 40 | C | bnxt_qplib_cq_process_req | drivers/infiniband/hw/bnxt_re/qplib_fp.c | sq | subscript (callee) | yes? | FP |
| 6200 | Low | 40 | C | bnxt_qplib_cq_process_req | drivers/infiniband/hw/bnxt_re/qplib_fp.c | cqe_sq_cons | subscript (callee) | yes? | FP |
| 6201 | Low | 40 | H | bnxt_qplib_cq_process_req | drivers/infiniband/hw/bnxt_re/qplib_fp.c | cqe_cons | truncation | no | FP |
| 6202 | Low | 40 | C | bnxt_qplib_cq_process_req | drivers/infiniband/hw/bnxt_re/qplib_fp.c | sq | subscript | yes? | FP |
| 6203 | Low | 40 | C | bnxt_qplib_cq_process_res_raweth_qp1 | drivers/infiniband/hw/bnxt_re/qplib_fp.c | srq | subscript (callee) | yes? | FP |
| 6204 | Low | 40 | C | bnxt_qplib_cq_process_res_raweth_qp1 | drivers/infiniband/hw/bnxt_re/qplib_fp.c | srq | subscript (callee) | yes? | FP |
| 6205 | Low | 40 | C | bnxt_qplib_cq_process_res_raweth_qp1 | drivers/infiniband/hw/bnxt_re/qplib_fp.c | wr_id_idx | subscript | yes? | FP |
| 6206 | Low | 40 | C | bnxt_qplib_cq_process_res_raweth_qp1 | drivers/infiniband/hw/bnxt_re/qplib_fp.c | rq | subscript | yes? | FP |
| 6207 | Low | 40 | C | bnxt_qplib_cq_process_res_rc | drivers/infiniband/hw/bnxt_re/qplib_fp.c | srq | subscript (callee) | yes? | FP |
| 6208 | Low | 40 | C | bnxt_qplib_cq_process_res_rc | drivers/infiniband/hw/bnxt_re/qplib_fp.c | srq | subscript (callee) | yes? | FP |
| 6209 | Low | 40 | C | bnxt_qplib_cq_process_res_rc | drivers/infiniband/hw/bnxt_re/qplib_fp.c | wr_id_idx | subscript | yes? | FP |
| 6210 | Low | 40 | C | bnxt_qplib_cq_process_res_rc | drivers/infiniband/hw/bnxt_re/qplib_fp.c | rq | subscript | yes? | FP |
| 6211 | Low | 40 | C | bnxt_qplib_cq_process_res_ud | drivers/infiniband/hw/bnxt_re/qplib_fp.c | srq | subscript (callee) | yes? | FP |
| 6212 | Low | 40 | C | bnxt_qplib_cq_process_res_ud | drivers/infiniband/hw/bnxt_re/qplib_fp.c | srq | subscript (callee) | yes? | FP |
| 6213 | Low | 40 | C | bnxt_qplib_cq_process_res_ud | drivers/infiniband/hw/bnxt_re/qplib_fp.c | wr_id_idx | subscript | yes? | FP |
| 6214 | Low | 40 | C | bnxt_qplib_cq_process_res_ud | drivers/infiniband/hw/bnxt_re/qplib_fp.c | rq | subscript | yes? | FP |
| 6215 | Low | 40 | H | bnxt_qplib_cq_process_terminal | drivers/infiniband/hw/bnxt_re/qplib_fp.c | swq_last | truncation | no | FP |
| 6216 | Low | 40 | C | bnxt_qplib_cq_process_terminal | drivers/infiniband/hw/bnxt_re/qplib_fp.c | swq_last | subscript | yes? | FP |
| 6217 | Low | 40 | C | bnxt_qplib_cq_process_terminal | drivers/infiniband/hw/bnxt_re/qplib_fp.c | swq_last | subscript | yes? | FP |
| 6218 | Low | 40 | C | bnxt_qplib_cq_process_terminal | drivers/infiniband/hw/bnxt_re/qplib_fp.c | swq_last | subscript | yes? | FP |
| 6219 | Low | 40 | C | bnxt_qplib_cq_process_terminal | drivers/infiniband/hw/bnxt_re/qplib_fp.c | swq_last | subscript | yes? | FP |
| 6220 | Low | 40 | C | bnxt_qplib_cq_process_terminal | drivers/infiniband/hw/bnxt_re/qplib_fp.c | swq_last | subscript | yes? | FP |
| 6221 | Low | 40 | H | bnxt_rx_pkt | drivers/net/ethernet/broadcom/bnxt/bnxt.c | skb | truncation | no | FP |
| 6222 | Low | 40 | H | bnxt_rx_pkt | drivers/net/ethernet/broadcom/bnxt/bnxt.c | skb | truncation | no | FP |
| 6223 | Low | 40 | H | bnxt_rx_pkt | drivers/net/ethernet/broadcom/bnxt/bnxt.c | agg_bufs | truncation | no | FP |
| 6224 | Low | 40 | H | bnxt_rx_vlan | drivers/net/ethernet/broadcom/bnxt/bnxt.c | vtag | truncation | no | FP |
| 6225 | Low | 40 | H | bnxt_rx_vlan | drivers/net/ethernet/broadcom/bnxt/bnxt.c | vlan_proto | truncation | no | FP |
| 6226 | Low | 40 | H | boomerang_rx | drivers/net/ethernet/3com/3c59x.c | rx_error | truncation | no | FP |
| 6227 | Low | 40 | B | brcmf_cfg80211_escan_handler | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | bi_length | memcpy() | yes? | FP |
| 6228 | Low | 40 | C | brcmf_fweh_process_event | drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | fwevt_idx | subscript | yes? | FP |
| 6229 | Low | 40 | B | brcmf_fweh_process_event | drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | datalen | memcpy() | yes? | FP |
| 6230 | Low | 40 | H | brcmf_fws_txstatus_indicate | drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | flags | truncation | no | FP |
| 6231 | Low | 40 | C | brcmf_msgbuf_process_event | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | idx | subscript (callee) | yes? | FP |
| 6232 | Low | 40 | C | brcmf_msgbuf_process_event | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | idx | subscript (callee) | yes? | FP |
| 6233 | Low | 40 | B | brcmf_msgbuf_process_event | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | skb | memcmp() in brcmf_fweh_process_skb() | yes? | FP |
| 6234 | Low | 40 | C | brcmf_msgbuf_process_rx_complete | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | idx | subscript (callee) | yes? | FP |
| 6235 | Low | 40 | C | brcmf_msgbuf_process_rx_complete | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | idx | subscript (callee) | yes? | FP |
| 6236 | Low | 40 | C | brcmf_msgbuf_process_txstatus | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | idx | subscript (callee) | yes? | FP |
| 6237 | Low | 40 | C | brcmf_msgbuf_process_txstatus | drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | idx | subscript (callee) | yes? | FP |
| 6238 | Low | 40 | B | brcmf_notify_sched_scan_results | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | result_count | kzalloc() in brcmf_alloc_internal_escan_request() | yes? | FP |
| 6239 | Low | 40 | C | brcmf_notify_sched_scan_results | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | request | subscript (callee) | yes? | FP |
| 6240 | Low | 40 | C | brcmf_notify_sched_scan_results | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | request | subscript (callee) | yes? | FP |
| 6241 | Low | 40 | C | brcmf_pno_get_bucket_channels | drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c | n_chan | subscript | yes? | FP |
| 6242 | Low | 40 | H | brcmf_sdio_fromevntchan | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | ret | truncation | no | FP |
| 6243 | Low | 40 | H | brcmf_sdio_hdparse | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | rx_seq | truncation | no | FP |
| 6244 | Low | 40 | H | brcmf_sdio_hdparse | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | fc | truncation | no | FP |
| 6245 | Low | 40 | H | brcmf_sdio_hdparse | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | tx_seq_max | truncation | no | FP |
| 6246 | Low | 40 | H | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | dptr | truncation | no | FP |
| 6247 | Low | 40 | H | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | truncation | no | FP |
| 6248 | Low | 40 | H | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | truncation | no | FP |
| 6249 | Low | 40 | H | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pfirst | truncation | no | FP |
| 6250 | Low | 40 | H | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | doff | truncation | no | FP |
| 6251 | Low | 40 | C | brcms_c_ampdu_dotxstatus_complete | drivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c | index | subscript | yes? | FP |
| 6252 | Low | 40 | C | build_block_map | drivers/mtd/rfd_ftl.c | entry | subscript | yes? | FP |
| 6253 | Low | 40 | C | build_block_map | drivers/mtd/rfd_ftl.c | entry | subscript | yes? | FP |
| 6254 | Low | 40 | H | build_cpl_pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | eth_hdr_len | truncation | no | FP |
| 6255 | Low | 40 | H | build_cpl_pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | eth_hdr_len | truncation | no | FP |
| 6256 | Low | 40 | H | build_mlx_header | drivers/infiniband/hw/mlx4/qp.c | pcp | truncation | no | FP |
| 6257 | Low | 40 | H | caam_rsp_fq_dqrr_cb | drivers/crypto/caam/qi.c | err_id | truncation | no | FP |
| 6258 | Low | 40 | H | cas_tx | drivers/net/ethernet/sun/cassini.c | limit | truncation | no | FP |
| 6259 | Low | 40 | H | cas_tx_ringN | drivers/net/ethernet/sun/cassini.c | dlen | truncation | no | FP |
| 6260 | Low | 40 | H | cdns2_ep0_handle_feature_endpoint | drivers/usb/gadget/udc/cdns2/cdns2-ep0.c | wValue | truncation | no | FP |
| 6261 | Low | 40 | H | cdns3_req_ep0_get_status | drivers/usb/cdns3/cdns3-ep0.c | index | truncation | no | FP |
| 6262 | Low | 40 | H | cdnsp_process_bulk_intr_td | drivers/usb/cdns3/cdnsp-ring.c | ep_trb_len | truncation | no | FP |
| 6263 | Low | 40 | H | cdnsp_process_isoc_td | drivers/usb/cdns3/cdnsp-ring.c | td_length | truncation | no | FP |
| 6264 | Low | 40 | C | ceq_irq_handler | drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c | ceqe | subscript (callee) | yes? | FP |
| 6265 | Low | 40 | C | ceq_irq_handler | drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c | ceqe | subscript (callee) | yes? | FP |
| 6266 | Low | 40 | B | ch9_postconfig | drivers/usb/misc/usbtest.c | total | memset() in usb_get_descriptor() | yes? | FP |
| 6267 | Low | 40 | C | chcr_ktls_cpl_act_open_rpl | drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | tx_info | subscript (callee) | yes? | FP |
| 6268 | Low | 40 | C | chcr_ktls_cpl_act_open_rpl | drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | tx_info | subscript (callee) | yes? | FP |
| 6269 | Low | 40 | H | check_dsp_e1 | drivers/usb/atm/ueagle-atm.c | blockcount | truncation | no | FP |
| 6270 | Low | 40 | H | check_sb_changes | drivers/md/md.c | ret | truncation | no | FP |
| 6271 | Low | 40 | H | cik_irq_process | drivers/gpu/drm/radeon/cik.c | me_id | truncation | no | FP |
| 6272 | Low | 40 | H | cik_irq_process | drivers/gpu/drm/radeon/cik.c | pipe_id | truncation | no | FP |
| 6273 | Low | 40 | H | cik_irq_process | drivers/gpu/drm/radeon/cik.c | queue_id | truncation | no | FP |
| 6274 | Low | 40 | H | cik_irq_process | drivers/gpu/drm/radeon/cik.c | me_id | truncation | no | FP |
| 6275 | Low | 40 | H | cik_irq_process | drivers/gpu/drm/radeon/cik.c | me_id | truncation | no | FP |
| 6276 | Low | 40 | H | cik_irq_process | drivers/gpu/drm/radeon/cik.c | me_id | truncation | no | FP |
| 6277 | Low | 40 | H | cik_irq_process | drivers/gpu/drm/radeon/cik.c | queue_id | truncation | no | FP |
| 6278 | Low | 40 | H | cik_irq_process | drivers/gpu/drm/radeon/cik.c | me_id | truncation | no | FP |
| 6279 | Low | 40 | H | cik_irq_process | drivers/gpu/drm/radeon/cik.c | queue_id | truncation | no | FP |
| 6280 | Low | 40 | H | cmd_db_debugfs_dump | drivers/soc/qcom/cmd-db.c | major | truncation | no | FP |
| 6281 | Low | 40 | H | cmd_db_debugfs_dump | drivers/soc/qcom/cmd-db.c | minor | truncation | no | FP |
| 6282 | Low | 40 | H | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | status | truncation | no | FP |
| 6283 | Low | 40 | H | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | extStatus | truncation | no | FP |
| 6284 | Low | 40 | B | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_mfi | memcpy() in megasas_complete_cmd() | yes? | FP |
| 6285 | Low | 40 | C | complete_v3_hw | drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | iptt | subscript | yes? | FP |
| 6286 | Low | 40 | C | composite_setup | drivers/usb/gadget/composite.c | interface | subscript (callee) | yes? | FP |
| 6287 | Low | 40 | C | composite_setup | drivers/usb/gadget/composite.c | interface | subscript (callee) | yes? | FP |
| 6288 | Low | 40 | C | composite_setup | drivers/usb/gadget/composite.c | interface | subscript (callee) | yes? | FP |
| 6289 | Low | 40 | H | composite_setup | drivers/usb/gadget/composite.c | intf | truncation | no | FP |
| 6290 | Low | 40 | C | composite_setup | drivers/usb/gadget/composite.c | intf | subscript | yes? | FP |
| 6291 | Low | 40 | C | composite_setup | drivers/usb/gadget/composite.c | intf | subscript | yes? | FP |
| 6292 | Low | 40 | C | composite_setup | drivers/usb/gadget/composite.c | intf | subscript | yes? | FP |
| 6293 | Low | 40 | C | composite_setup | drivers/usb/gadget/composite.c | intf | subscript | yes? | FP |
| 6294 | Low | 40 | B | composite_setup | drivers/usb/gadget/composite.c | w_length | memset() | yes? | FP |
| 6295 | Low | 40 | C | composite_setup | drivers/usb/gadget/composite.c | interface | subscript | yes? | FP |
| 6296 | Low | 40 | C | composite_setup | drivers/usb/gadget/composite.c | intf | subscript | yes? | FP |
| 6297 | Low | 40 | H | cp2104_gpioconf_init | drivers/usb/serial/cp210x.c | gpio_latch | truncation | no | FP |
| 6298 | Low | 40 | H | cpl_fw6_pld_handler | drivers/crypto/chelsio/chcr_core.c | error_status | truncation | no | FP |
| 6299 | Low | 40 | H | cq_thread_v2_hw | drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | iptt | truncation | no | FP |
| 6300 | Low | 40 | C | cs_dsp_load_coeff | drivers/firmware/cirrus/cs_dsp.c | pos | subscript | yes? | FP |
| 6301 | Low | 40 | B | cs_dsp_load_coeff | drivers/firmware/cirrus/cs_dsp.c | buf_len | vmalloc() | yes? | FP |
| 6302 | Low | 40 | B | cs_dsp_load_coeff | drivers/firmware/cirrus/cs_dsp.c | region_len | memcpy() | yes? | FP |
| 6303 | Low | 40 | H | csio_fcoe_fwevt_handler | drivers/scsi/csiostor/csio_lnode.c | portid | truncation | no | FP |
| 6304 | Low | 40 | C | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | port_id | subscript (callee) | yes? | FP |
| 6305 | Low | 40 | H | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | port_id | truncation | no | FP |
| 6306 | Low | 40 | H | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | action | truncation | no | FP |
| 6307 | Low | 40 | H | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | mod_type | truncation | no | FP |
| 6308 | Low | 40 | H | csio_mb_fwevt_handler | drivers/scsi/csiostor/csio_mb.c | mod_type | truncation | no | FP |
| 6309 | Low | 40 | C | cxacru_cm_get_array | drivers/usb/atm/cxacru.c | offd | subscript | yes? | FP |
| 6310 | Low | 40 | C | cxgb4_dcb_handle_fw_update | drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | dcb | subscript | yes? | FP |
| 6311 | Low | 40 | C | cxgb4_dcb_handle_fw_update | drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | dcb | subscript | yes? | FP |
| 6312 | Low | 40 | B | cxgb4_dcb_handle_fw_update | drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | dcb | memcpy() | yes? | FP |
| 6313 | Low | 40 | B | cxgb4_dcb_handle_fw_update | drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | dcb | memcpy() | yes? | FP |
| 6314 | Low | 40 | B | cxgb4_dcb_handle_fw_update | drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | dcb | memcpy() | yes? | FP |
| 6315 | Low | 40 | H | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | flits | truncation | no | FP |
| 6316 | Low | 40 | H | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | flits | truncation | no | FP |
| 6317 | Low | 40 | H | cxgb4_ethofld_rx_handler | drivers/net/ethernet/chelsio/cxgb4/sge.c | wrlen16 | truncation | no | FP |
| 6318 | Low | 40 | H | cxgb4_fill_ipv4_frag | drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h | frag_val | truncation | no | FP |
| 6319 | Low | 40 | C | cxlctl_get_supported_features | drivers/cxl/core/features.c | i | subscript | yes? | FP |
| 6320 | Low | 40 | B | cyapa_empty_pip_output_data | drivers/input/mouse/cyapa_gen5.c | length | memcpy() | yes? | FP |
| 6321 | Low | 40 | B | cyapa_empty_pip_output_data | drivers/input/mouse/cyapa_gen5.c | length | memcpy() | yes? | FP |
| 6322 | Low | 40 | B | cyapa_pip_irq_cmd_handler | drivers/input/mouse/cyapa_gen5.c | length | memcpy() in cyapa_empty_pip_output_data() | yes? | FP |
| 6323 | Low | 40 | B | cyapa_pip_irq_cmd_handler | drivers/input/mouse/cyapa_gen5.c | length | memcpy() in cyapa_empty_pip_output_data() | yes? | FP |
| 6324 | Low | 40 | B | ddcb_cmd_fixups | drivers/misc/genwqe/card_dev.c | m | memset() in genwqe_mapping_init() | yes? | FP |
| 6325 | Low | 40 | B | ddcb_cmd_fixups | drivers/misc/genwqe/card_dev.c | m | kcalloc() in genwqe_user_vmap() | yes? | FP |
| 6326 | Low | 40 | H | ddcb_cmd_fixups | drivers/misc/genwqe/card_dev.c | page_offs | truncation | no | FP |
| 6327 | Low | 40 | H | ddcb_cmd_fixups | drivers/misc/genwqe/card_dev.c | rc | truncation | no | FP |
| 6328 | Low | 40 | C | decode_deactivate | drivers/accel/qaic/qaic_control.c | dbc_id | subscript (callee) | yes? | FP |
| 6329 | Low | 40 | C | decode_deactivate | drivers/accel/qaic/qaic_control.c | dbc_id | subscript (callee) | yes? | FP |
| 6330 | Low | 40 | C | decode_deactivate | drivers/accel/qaic/qaic_control.c | dbc_id | subscript (callee) | yes? | FP |
| 6331 | Low | 40 | C | decode_deactivate | drivers/accel/qaic/qaic_control.c | dbc_id | subscript (callee) | yes? | FP |
| 6332 | Low | 40 | B | decode_passthrough | drivers/accel/qaic/qaic_control.c | len | memcpy() | yes? | FP |
| 6333 | Low | 40 | B | delete_center_node | drivers/md/persistent-data/dm-btree-remove.c | shift | memmove() in node_shift() | yes? | FP |
| 6334 | Low | 40 | B | delete_center_node | drivers/md/persistent-data/dm-btree-remove.c | shift | memmove() in node_shift() | yes? | FP |
| 6335 | Low | 40 | B | delete_center_node | drivers/md/persistent-data/dm-btree-remove.c | shift | memmove() in node_shift() | yes? | FP |
| 6336 | Low | 40 | B | delete_center_node | drivers/md/persistent-data/dm-btree-remove.c | shift | memmove() in node_shift() | yes? | FP |
| 6337 | Low | 40 | B | delete_center_node | drivers/md/persistent-data/dm-btree-remove.c | shift | memcpy() in node_copy() | yes? | FP |
| 6338 | Low | 40 | B | delete_center_node | drivers/md/persistent-data/dm-btree-remove.c | shift | memcpy() in node_copy() | yes? | FP |
| 6339 | Low | 40 | B | delete_center_node | drivers/md/persistent-data/dm-btree-remove.c | shift | memcpy() in node_copy() | yes? | FP |
| 6340 | Low | 40 | B | delete_center_node | drivers/md/persistent-data/dm-btree-remove.c | shift | memcpy() in node_copy() | yes? | FP |
| 6341 | Low | 40 | B | descriptors_changed | drivers/usb/core/hub.c | old_length | memset() in usb_get_descriptor() | yes? | FP |
| 6342 | Low | 40 | C | descriptors_changed | drivers/usb/core/hub.c | buf | subscript (callee) | yes? | FP |
| 6343 | Low | 40 | B | descriptors_changed | drivers/usb/core/hub.c | len | memcmp() | yes? | FP |
| 6344 | Low | 40 | B | descriptors_changed | drivers/usb/core/hub.c | len | kmalloc() | yes? | FP |
| 6345 | Low | 40 | B | descriptors_changed | drivers/usb/core/hub.c | old_length | memcmp() | yes? | FP |
| 6346 | Low | 40 | B | descriptors_changed | drivers/usb/core/hub.c | length | memcmp() | yes? | FP |
| 6347 | Low | 40 | C | dln2_gpio_event | drivers/gpio/gpio-dln2.c | pin | subscript | yes? | FP |
| 6348 | Low | 40 | C | dln2_rx | drivers/mfd/dln2.c | handle | subscript (callee) | yes? | FP |
| 6349 | Low | 40 | C | dln2_rx | drivers/mfd/dln2.c | echo | subscript (callee) | yes? | FP |
| 6350 | Low | 40 | H | dm_btree_lookup_next | drivers/md/persistent-data/dm-btree.c | r | truncation | no | FP |
| 6351 | Low | 40 | C | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | subscript (callee) | yes? | FP |
| 6352 | Low | 40 | C | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | subscript (callee) | yes? | FP |
| 6353 | Low | 40 | C | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | subscript (callee) | yes? | FP |
| 6354 | Low | 40 | C | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | subscript (callee) | yes? | FP |
| 6355 | Low | 40 | C | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | subscript (callee) | yes? | FP |
| 6356 | Low | 40 | C | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | subscript (callee) | yes? | FP |
| 6357 | Low | 40 | C | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | subscript (callee) | yes? | FP |
| 6358 | Low | 40 | C | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | subscript (callee) | yes? | FP |
| 6359 | Low | 40 | C | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | subscript (callee) | yes? | FP |
| 6360 | Low | 40 | H | dmz_check_sb | drivers/md/dm-zoned-metadata.c | crc | truncation | no | FP |
| 6361 | Low | 40 | C | do_act_establish | drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | csk | subscript (callee) | yes? | FP |
| 6362 | Low | 40 | C | do_act_establish | drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | csk | subscript (callee) | yes? | FP |
| 6363 | Low | 40 | C | do_wa9060 | drivers/infiniband/hw/bnxt_re/qplib_fp.c | peek_sq_cons_idx | subscript | yes? | FP |
| 6364 | Low | 40 | B | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | snprintf() in mlx5dr_dbg_dump_data_print() | yes? | FP |
| 6365 | Low | 40 | B | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | snprintf() in mlx5dr_dbg_dump_data_print() | yes? | FP |
| 6366 | Low | 40 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | no | FP |
| 6367 | Low | 40 | B | e1000_clean_jumbo_rx_irq | drivers/net/ethernet/intel/e1000e/netdev.c | length | memcpy() | yes? | FP |
| 6368 | Low | 40 | B | e1000_clean_rx_irq_ps | drivers/net/ethernet/intel/e1000e/netdev.c | l1 | memcpy() | yes? | FP |
| 6369 | Low | 40 | H | e100_phy_check_without_mii | drivers/net/ethernet/intel/e100.c | phy_type | truncation | no | FP |
| 6370 | Low | 40 | C | eea_clean_tx | drivers/net/ethernet/alibaba/eea/eea_tx.c | id | subscript | yes? | FP |
| 6371 | Low | 40 | C | eea_rx_desc_to_ctx | drivers/net/ethernet/alibaba/eea/eea_rx.c | id | subscript | yes? | FP |
| 6372 | Low | 40 | H | ef100_has_fcs_error | drivers/net/ethernet/sfc/ef100_rx.c | l2status | truncation | no | FP |
| 6373 | Low | 40 | H | ensure_bitmap | drivers/md/persistent-data/dm-space-map-common.c | r | truncation | no | FP |
| 6374 | Low | 40 | H | ep0_get_status | drivers/usb/mtu3/mtu3_gadget_ep0.c | epnum | truncation | no | FP |
| 6375 | Low | 40 | H | ep0_handle_feature | drivers/usb/mtu3/mtu3_gadget_ep0.c | epnum | truncation | no | FP |
| 6376 | Low | 40 | C | ep0_setup | drivers/usb/gadget/udc/goku_udc.c | tmp | subscript | yes? | FP |
| 6377 | Low | 40 | C | ep0_setup | drivers/usb/gadget/udc/goku_udc.c | tmp | subscript | yes? | FP |
| 6378 | Low | 40 | C | ep0_setup | drivers/usb/gadget/udc/goku_udc.c | tmp | subscript | yes? | FP |
| 6379 | Low | 40 | C | ep0_setup | drivers/usb/gadget/udc/goku_udc.c | tmp | subscript | yes? | FP |
| 6380 | Low | 40 | H | erdma_poll_one_cqe | drivers/infiniband/hw/erdma/erdma_cq.c | qtype | truncation | no | FP |
| 6381 | Low | 40 | H | erdma_poll_one_cqe | drivers/infiniband/hw/erdma/erdma_cq.c | syndrome | truncation | no | FP |
| 6382 | Low | 40 | H | erdma_poll_one_cqe | drivers/infiniband/hw/erdma/erdma_cq.c | depth | truncation | no | FP |
| 6383 | Low | 40 | H | erdma_poll_one_cqe | drivers/infiniband/hw/erdma/erdma_cq.c | depth | truncation | no | FP |
| 6384 | Low | 40 | H | erdma_remove_cqes_of_qp | drivers/infiniband/hw/erdma/erdma_cq.c | owner | truncation | no | FP |
| 6385 | Low | 40 | H | es581_4_dispatch_rx_cmd | drivers/net/can/usb/etas_es58x/es581_4.c | msg_len | truncation | no | FP |
| 6386 | Low | 40 | H | es581_4_rx_can_msg | drivers/net/can/usb/etas_es58x/es581_4.c | ret | truncation | no | FP |
| 6387 | Low | 40 | H | es58x_fd_rx_can_msg | drivers/net/can/usb/etas_es58x/es58x_fd.c | ret | truncation | no | FP |
| 6388 | Low | 40 | B | esas2r_ae_complete | drivers/scsi/esas2r/esas2r_int.c | length | memcpy() in esas2r_lun_event() | yes? | FP |
| 6389 | Low | 40 | B | esas2r_disc_passthru_dev_addr_cb | drivers/scsi/esas2r/esas2r_disc.c | addrlen | memcpy() | yes? | FP |
| 6390 | Low | 40 | H | esas2r_send_task_mgmt | drivers/scsi/esas2r/esas2r_io.c | lun | truncation | no | FP |
| 6391 | Low | 40 | H | fbnic_clean_rcq | drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | head0 | truncation | no | FP |
| 6392 | Low | 40 | H | fbnic_clean_rcq | drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | head1 | truncation | no | FP |
| 6393 | Low | 40 | H | fbnic_clean_tcq | drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | head1 | truncation | no | FP |
| 6394 | Low | 40 | H | fbnic_clean_tcq | drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | head0 | truncation | no | FP |
| 6395 | Low | 40 | H | fbnic_unmap_page_twd | drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | len | truncation | no | FP |
| 6396 | Low | 40 | H | fbnic_unmap_single_twd | drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | len | truncation | no | FP |
| 6397 | Low | 40 | B | fc_fcp_recv_data | drivers/scsi/libfc/fc_fcp.c | offset | memcpy() in fc_copy_buffer_to_sglist() | yes? | FP |
| 6398 | Low | 40 | B | fc_rport_recv_prli_req | drivers/scsi/libfc/fc_rport.c | len | memset() | yes? | FP |
| 6399 | Low | 40 | C | ffs_func_setup | drivers/usb/gadget/function/f_fs.c | ret | subscript | yes? | FP |
| 6400 | Low | 40 | H | find_leaf | drivers/md/persistent-data/dm-btree.c | r | truncation | no | FP |
| 6401 | Low | 40 | H | find_mad_agent | drivers/infiniband/core/mad.c | hi_tid | truncation | no | FP |
| 6402 | Low | 40 | C | fm10k_type_trans | drivers/net/ethernet/intel/fm10k/fm10k_main.c | idx | subscript | yes? | FP |
| 6403 | Low | 40 | H | fotg210_set_feature | drivers/usb/fotg210/fotg210-udc.c | epnum | truncation | no | FP |
| 6404 | Low | 40 | C | fsi_occ_submit | drivers/fsi/fsi-occ.c | resp_data_length | subscript (callee) | yes? | FP |
| 6405 | Low | 40 | B | fsi_occ_submit | drivers/fsi/fsi-occ.c | resp_data_length | memcpy() in occ_getsram() | yes? | FP |
| 6406 | Low | 40 | H | fsi_slave_init | drivers/fsi/fsi-core.c | crc | truncation | no | FP |
| 6407 | Low | 40 | H | fsi_slave_scan | drivers/fsi/fsi-core.c | crc | truncation | no | FP |
| 6408 | Low | 40 | H | fsi_slave_scan | drivers/fsi/fsi-core.c | slots | truncation | no | FP |
| 6409 | Low | 40 | H | fsi_slave_scan | drivers/fsi/fsi-core.c | version | truncation | no | FP |
| 6410 | Low | 40 | H | fsi_slave_scan | drivers/fsi/fsi-core.c | type | truncation | no | FP |
| 6411 | Low | 40 | B | ftpm_tee_tpm_op_send | drivers/char/tpm/tpm_ftpm_tee.c | resp_len | memcpy() | yes? | FP |
| 6412 | Low | 40 | C | fun_update_link_state | drivers/net/ethernet/fungible/funeth/funeth_main.c | port_idx | subscript | yes? | FP |
| 6413 | Low | 40 | H | fw6_msg | drivers/infiniband/hw/cxgb4/cm.c | ret | truncation | no | FP |
| 6414 | Low | 40 | H | fw_compute_block_crc | drivers/firewire/core-card.c | crc | truncation | no | FP |
| 6415 | Low | 40 | B | fw_download_fetch_firmware | drivers/staging/greybus/fw-download.c | size | memcpy() | yes? | FP |
| 6416 | Low | 40 | H | fwevtq_handler | drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | opcode | truncation | no | FP |
| 6417 | Low | 40 | C | fwevtq_handler | drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | eq_idx | subscript | yes? | FP |
| 6418 | Low | 40 | H | fwnet_tx | drivers/firewire/net.c | generation | truncation | no | FP |
| 6419 | Low | 40 | H | fwnet_tx | drivers/firewire/net.c | dest_node | truncation | no | FP |
| 6420 | Low | 40 | H | fwnet_tx | drivers/firewire/net.c | max_payload | truncation | no | FP |
| 6421 | Low | 40 | H | fwnet_tx | drivers/firewire/net.c | datagram_label | truncation | no | FP |
| 6422 | Low | 40 | B | gadgetfs_setup | drivers/usb/gadget/legacy/inode.c | w_length | kmalloc() in setup_req() | yes? | FP |
| 6423 | Low | 40 | C | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | subscript (callee) | yes? | FP |
| 6424 | Low | 40 | C | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | subscript (callee) | yes? | FP |
| 6425 | Low | 40 | C | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | subscript (callee) | yes? | FP |
| 6426 | Low | 40 | C | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | subscript (callee) | yes? | FP |
| 6427 | Low | 40 | H | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | truncation | no | FP |
| 6428 | Low | 40 | C | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | subscript | yes? | FP |
| 6429 | Low | 40 | C | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | subscript | yes? | FP |
| 6430 | Low | 40 | H | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | error_count | truncation | no | FP |
| 6431 | Low | 40 | H | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | error_count | truncation | no | FP |
| 6432 | Low | 40 | H | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | error_count | truncation | no | FP |
| 6433 | Low | 40 | H | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | error_count | truncation | no | FP |
| 6434 | Low | 40 | H | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | error_count | truncation | no | FP |
| 6435 | Low | 40 | H | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | error_count | truncation | no | FP |
| 6436 | Low | 40 | H | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | error_count | truncation | no | FP |
| 6437 | Low | 40 | H | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | error_count | truncation | no | FP |
| 6438 | Low | 40 | H | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | error_count | truncation | no | FP |
| 6439 | Low | 40 | C | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | subscript | yes? | FP |
| 6440 | Low | 40 | C | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | subscript | yes? | FP |
| 6441 | Low | 40 | C | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | subscript | yes? | FP |
| 6442 | Low | 40 | C | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | subscript | yes? | FP |
| 6443 | Low | 40 | C | gaudi2_handle_eqe | drivers/accel/habanalabs/gaudi2/gaudi2.c | event_type | subscript | yes? | FP |
| 6444 | Low | 40 | H | gaudi_handle_ecc_event | drivers/accel/habanalabs/gaudi/gaudi.c | rc | truncation | no | FP |
| 6445 | Low | 40 | C | gaudi_handle_eqe | drivers/accel/habanalabs/gaudi/gaudi.c | event_type | subscript (callee) | yes? | FP |
| 6446 | Low | 40 | C | gaudi_handle_eqe | drivers/accel/habanalabs/gaudi/gaudi.c | event_type | subscript (callee) | yes? | FP |
| 6447 | Low | 40 | C | gaudi_handle_eqe | drivers/accel/habanalabs/gaudi/gaudi.c | event_type | subscript (callee) | yes? | FP |
| 6448 | Low | 40 | H | gaudi_handle_eqe | drivers/accel/habanalabs/gaudi/gaudi.c | event_type | truncation | no | FP |
| 6449 | Low | 40 | C | gaudi_handle_eqe | drivers/accel/habanalabs/gaudi/gaudi.c | event_type | subscript | yes? | FP |
| 6450 | Low | 40 | C | gaudi_handle_eqe | drivers/accel/habanalabs/gaudi/gaudi.c | event_type | subscript | yes? | FP |
| 6451 | Low | 40 | C | gaudi_handle_eqe | drivers/accel/habanalabs/gaudi/gaudi.c | event_type | subscript | yes? | FP |
| 6452 | Low | 40 | C | gaudi_handle_eqe | drivers/accel/habanalabs/gaudi/gaudi.c | event_type | subscript | yes? | FP |
| 6453 | Low | 40 | H | gaudi_handle_eqe | drivers/accel/habanalabs/gaudi/gaudi.c | cause | truncation | no | FP |
| 6454 | Low | 40 | H | gaudi_patch_cb | drivers/accel/habanalabs/gaudi/gaudi.c | pkt_size | truncation | no | FP |
| 6455 | Low | 40 | H | gaudi_validate_cb | drivers/accel/habanalabs/gaudi/gaudi.c | pkt_size | truncation | no | FP |
| 6456 | Low | 40 | H | gaudi_validate_dma_pkt_host | drivers/accel/habanalabs/gaudi/gaudi.c | rc | truncation | no | FP |
| 6457 | Low | 40 | B | gb_bootrom_get_firmware | drivers/staging/greybus/bootrom.c | size | memcpy() | yes? | FP |
| 6458 | Low | 40 | B | gb_connection_recv | drivers/greybus/operation.c | msg_size | memcpy() in gb_connection_recv_response() | yes? | FP |
| 6459 | Low | 40 | B | gb_hid_parse | drivers/staging/greybus/hid.c | rsize | kzalloc() | yes? | FP |
| 6460 | Low | 40 | C | gb_log_request_handler | drivers/staging/greybus/log.c | len | subscript | yes? | FP |
| 6461 | Low | 40 | H | gem_tx | drivers/net/ethernet/sun/sungem.c | dma_len | truncation | no | FP |
| 6462 | Low | 40 | C | genelink_rx_fixup | drivers/net/usb/gl620a.c | size | subscript | yes? | FP |
| 6463 | Low | 40 | H | get_port_ssp_rate | drivers/usb/core/hub.c | ssac | truncation | no | FP |
| 6464 | Low | 40 | H | get_port_ssp_rate | drivers/usb/core/hub.c | ssid | truncation | no | FP |
| 6465 | Low | 40 | H | get_port_ssp_rate | drivers/usb/core/hub.c | type | truncation | no | FP |
| 6466 | Low | 40 | H | get_vht_ra_mask | drivers/net/wireless/realtek/rtw88/main.c | vht_mcs_cap | truncation | no | FP |
| 6467 | Low | 40 | B | gfx_v10_0_rlc_backdoor_autoload_copy_gfx_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_size | memset() in gfx_v10_0_rlc_backdoor_autoload_copy_ucode() | yes? | FP |
| 6468 | Low | 40 | B | gfx_v10_0_rlc_backdoor_autoload_copy_sdma_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | fw_size | memset() in gfx_v10_0_rlc_backdoor_autoload_copy_ucode() | yes? | FP |
| 6469 | Low | 40 | B | gfx_v11_0_rlc_backdoor_autoload_copy_gfx_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | memset() in gfx_v11_0_rlc_backdoor_autoload_copy_ucode() | yes? | FP |
| 6470 | Low | 40 | B | gfx_v11_0_rlc_backdoor_autoload_copy_mes_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | memset() in gfx_v11_0_rlc_backdoor_autoload_copy_ucode() | yes? | FP |
| 6471 | Low | 40 | B | gfx_v11_0_rlc_backdoor_autoload_copy_sdma_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | fw_size | memset() in gfx_v11_0_rlc_backdoor_autoload_copy_ucode() | yes? | FP |
| 6472 | Low | 40 | B | gfx_v12_0_rlc_backdoor_autoload_copy_gfx_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_size | memset() in gfx_v12_0_rlc_backdoor_autoload_copy_ucode() | yes? | FP |
| 6473 | Low | 40 | B | gfx_v12_0_rlc_backdoor_autoload_copy_mes_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_size | memset() in gfx_v12_0_rlc_backdoor_autoload_copy_ucode() | yes? | FP |
| 6474 | Low | 40 | B | gfx_v12_0_rlc_backdoor_autoload_copy_sdma_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | fw_size | memset() in gfx_v12_0_rlc_backdoor_autoload_copy_ucode() | yes? | FP |
| 6475 | Low | 40 | B | gfx_v12_1_rlc_backdoor_autoload_copy_gfx_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_size | memset() in gfx_v12_1_rlc_backdoor_autoload_copy_ucode() | yes? | FP |
| 6476 | Low | 40 | B | gfx_v12_1_rlc_backdoor_autoload_copy_mes_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_size | memset() in gfx_v12_1_rlc_backdoor_autoload_copy_ucode() | yes? | FP |
| 6477 | Low | 40 | B | gfx_v12_1_rlc_backdoor_autoload_copy_sdma_ucode | drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | fw_size | memset() in gfx_v12_1_rlc_backdoor_autoload_copy_ucode() | yes? | FP |
| 6478 | Low | 40 | H | gicv5_its_alloc_l2_devtab | drivers/irqchip/irq-gic-v5-its.c | span | truncation | no | FP |
| 6479 | Low | 40 | B | glink_smem_tx_write | drivers/rpmsg/qcom_glink_smem.c | head | memcpy() in glink_smem_tx_write_one() | yes? | FP |
| 6480 | Low | 40 | B | goodix_hid_parse | drivers/hid/hid-goodix-spi.c | rsize | memcpy() in goodix_spi_read() | yes? | FP |
| 6481 | Low | 40 | B | goodix_hid_parse | drivers/hid/hid-goodix-spi.c | rsize | kzalloc() | yes? | FP |
| 6482 | Low | 40 | H | got_NegAck | drivers/block/drbd/drbd_receiver.c | err | truncation | no | FP |
| 6483 | Low | 40 | C | got_RqSReply | drivers/block/drbd/drbd_receiver.c | retcode | subscript (callee) | yes? | FP |
| 6484 | Low | 40 | C | got_conn_RqSReply | drivers/block/drbd/drbd_receiver.c | retcode | subscript (callee) | yes? | FP |
| 6485 | Low | 40 | H | goya_handle_eqe | drivers/accel/habanalabs/goya/goya.c | event_type | truncation | no | FP |
| 6486 | Low | 40 | C | goya_handle_eqe | drivers/accel/habanalabs/goya/goya.c | event_type | subscript | yes? | FP |
| 6487 | Low | 40 | C | goya_handle_eqe | drivers/accel/habanalabs/goya/goya.c | event_type | subscript | yes? | FP |
| 6488 | Low | 40 | H | goya_patch_cb | drivers/accel/habanalabs/goya/goya.c | pkt_size | truncation | no | FP |
| 6489 | Low | 40 | H | goya_validate_cb | drivers/accel/habanalabs/goya/goya.c | pkt_size | truncation | no | FP |
| 6490 | Low | 40 | H | goya_validate_dma_pkt_host | drivers/accel/habanalabs/goya/goya.c | rc | truncation | no | FP |
| 6491 | Low | 40 | H | goya_validate_wreg32 | drivers/accel/habanalabs/goya/goya.c | reg_offset | truncation | no | FP |
| 6492 | Low | 40 | C | gr_ep0_setup | drivers/usb/gadget/udc/gr_udc.c | index | subscript (callee) | yes? | FP |
| 6493 | Low | 40 | H | gsi_event_trans | drivers/net/ipa/gsi.c | tre_offset | truncation | no | FP |
| 6494 | Low | 40 | H | gsi_event_trans | drivers/net/ipa/gsi.c | tre_index | truncation | no | FP |
| 6495 | Low | 40 | H | gud_plane_add_properties | drivers/gpu/drm/gud/gud_drv.c | ret | truncation | no | FP |
| 6496 | Low | 40 | H | gud_xrgb8888_to_color | drivers/gpu/drm/gud/gud_pipe.c | r | truncation | no | FP |
| 6497 | Low | 40 | H | gud_xrgb8888_to_color | drivers/gpu/drm/gud/gud_pipe.c | g | truncation | no | FP |
| 6498 | Low | 40 | H | gud_xrgb8888_to_color | drivers/gpu/drm/gud/gud_pipe.c | b | truncation | no | FP |
| 6499 | Low | 40 | H | gud_xrgb8888_to_color | drivers/gpu/drm/gud/gud_pipe.c | pix | truncation | no | FP |
| 6500 | Low | 40 | C | gve_clean_tx_done_dqo | drivers/net/ethernet/google/gve/gve_tx_dqo.c | compl_tag | subscript (callee) | yes? | FP |
| 6501 | Low | 40 | C | gve_clean_tx_done_dqo | drivers/net/ethernet/google/gve/gve_tx_dqo.c | compl_tag | subscript (callee) | yes? | FP |
| 6502 | Low | 40 | C | gve_get_ethtool_stats | drivers/net/ethernet/google/gve/gve_ethtool.c | queue_id | subscript | yes? | FP |
| 6503 | Low | 40 | C | gve_get_ethtool_stats | drivers/net/ethernet/google/gve/gve_ethtool.c | queue_id | subscript | yes? | FP |
| 6504 | Low | 40 | C | gve_rx_dqo | drivers/net/ethernet/google/gve/gve_rx_dqo.c | buffer_id | subscript | yes? | FP |
| 6505 | Low | 40 | C | handle_cmd_completion | drivers/usb/host/xhci-ring.c | slot_id | subscript (callee) | yes? | FP |
| 6506 | Low | 40 | C | handle_cmd_completion | drivers/usb/host/xhci-ring.c | slot_id | subscript (callee) | yes? | FP |
| 6507 | Low | 40 | C | handle_cmd_completion | drivers/usb/host/xhci-ring.c | cmd_comp_code | subscript (callee) | yes? | FP |
| 6508 | Low | 40 | C | handle_cmd_completion | drivers/usb/host/xhci-ring.c | slot_id | subscript (callee) | yes? | FP |
| 6509 | Low | 40 | C | handle_cmd_completion | drivers/usb/host/xhci-ring.c | slot_id | subscript (callee) | yes? | FP |
| 6510 | Low | 40 | C | handle_cmd_completion | drivers/usb/host/xhci-ring.c | slot_id | subscript (callee) | yes? | FP |
| 6511 | Low | 40 | C | handle_cmd_completion | drivers/usb/host/xhci-ring.c | slot_id | subscript (callee) | yes? | FP |
| 6512 | Low | 40 | C | handle_cmd_completion | drivers/usb/host/xhci-ring.c | slot_id | subscript (callee) | yes? | FP |
| 6513 | Low | 40 | C | handle_port_status | drivers/usb/host/xhci-ring.c | port | subscript (callee) | yes? | FP |
| 6514 | Low | 40 | B | handle_port_status | drivers/usb/host/xhci-ring.c | hcd | memcpy() in usb_hcd_poll_rh_status() | yes? | FP |
| 6515 | Low | 40 | C | handle_port_status | drivers/usb/host/xhci-ring.c | port_id | subscript | yes? | FP |
| 6516 | Low | 40 | C | handle_port_status | drivers/usb/host/xhci-ring.c | port | subscript | yes? | FP |
| 6517 | Low | 40 | H | handle_responder | drivers/infiniband/hw/mlx5/cq.c | g | truncation | no | FP |
| 6518 | Low | 40 | H | handle_responder | drivers/infiniband/hw/mlx5/cq.c | pkey | truncation | no | FP |
| 6519 | Low | 40 | H | handle_responder | drivers/infiniband/hw/mlx5/cq.c | roce_packet_type | truncation | no | FP |
| 6520 | Low | 40 | C | handle_tx_event | drivers/usb/host/xhci-ring.c | slot_id | subscript (callee) | yes? | FP |
| 6521 | Low | 40 | C | handle_tx_event | drivers/usb/host/xhci-ring.c | slot_id | subscript (callee) | yes? | FP |
| 6522 | Low | 40 | C | handle_tx_event | drivers/usb/host/xhci-ring.c | ep_index | subscript (callee) | yes? | FP |
| 6523 | Low | 40 | H | hclge_add_mac_vlan_tbl | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | resp_code | truncation | no | FP |
| 6524 | Low | 40 | H | hclge_add_mac_vlan_tbl | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | resp_code | truncation | no | FP |
| 6525 | Low | 40 | H | hclge_add_mgr_tbl | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | resp_code | truncation | no | FP |
| 6526 | Low | 40 | H | hclge_dbg_dump_loopback | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | loopback_en | truncation | no | FP |
| 6527 | Low | 40 | H | hclge_fd_parse_user_def_field | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_fd.c | data | truncation | no | FP |
| 6528 | Low | 40 | H | hclge_fd_parse_user_def_field | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_fd.c | data_mask | truncation | no | FP |
| 6529 | Low | 40 | H | hclge_fd_parse_user_def_field | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_fd.c | offset | truncation | no | FP |
| 6530 | Low | 40 | H | hclge_fd_parse_user_def_field | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_fd.c | offset_mask | truncation | no | FP |
| 6531 | Low | 40 | C | hclge_get_queue_id_in_pf | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | queue_id | subscript (callee) | yes? | FP |
| 6532 | Low | 40 | H | hclge_get_vf_ring_vector_map | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | int_gl_index | truncation | no | FP |
| 6533 | Low | 40 | H | hclge_lookup_mac_vlan_tbl | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | resp_code | truncation | no | FP |
| 6534 | Low | 40 | H | hclge_remove_mac_vlan_tbl | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | resp_code | truncation | no | FP |
| 6535 | Low | 40 | H | hclgevf_mbx_async_handler | drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c | duplex | truncation | no | FP |
| 6536 | Low | 40 | H | hfi1_handle_kdeth_eflags | drivers/infiniband/hw/hfi1/tid_rdma.c | opcode | truncation | no | FP |
| 6537 | Low | 40 | C | hfi1_handle_kdeth_eflags | drivers/infiniband/hw/hfi1/tid_rdma.c | qpriv | subscript | yes? | FP |
| 6538 | Low | 40 | C | hfi1_handle_kdeth_eflags | drivers/infiniband/hw/hfi1/tid_rdma.c | req | subscript | yes? | FP |
| 6539 | Low | 40 | C | hfi1_kdeth_eager_rcv | drivers/infiniband/hw/hfi1/verbs.c | opcode | subscript (callee) | yes? | FP |
| 6540 | Low | 40 | H | hfi1_kdeth_eager_rcv | drivers/infiniband/hw/hfi1/verbs.c | opcode | truncation | no | FP |
| 6541 | Low | 40 | C | hfi1_kdeth_expected_rcv | drivers/infiniband/hw/hfi1/verbs.c | opcode | subscript (callee) | yes? | FP |
| 6542 | Low | 40 | H | hfi1_kdeth_expected_rcv | drivers/infiniband/hw/hfi1/verbs.c | opcode | truncation | no | FP |
| 6543 | Low | 40 | C | hfi1_rc_rcv | drivers/infiniband/hw/hfi1/rc.c | rkey | subscript (callee) | yes? | FP |
| 6544 | Low | 40 | C | hfi1_rc_rcv | drivers/infiniband/hw/hfi1/rc.c | rkey | subscript (callee) | yes? | FP |
| 6545 | Low | 40 | C | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | yes? | FP |
| 6546 | Low | 40 | H | hfi1_rc_rcv_tid_rdma_write_data | drivers/infiniband/hw/hfi1/tid_rdma.c | opcode | truncation | no | FP |
| 6547 | Low | 40 | C | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | yes? | FP |
| 6548 | Low | 40 | H | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | ok | truncation | no | FP |
| 6549 | Low | 40 | C | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | rkey | subscript (callee) | yes? | FP |
| 6550 | Low | 40 | C | hfi1_user_sdma_process_request | drivers/infiniband/hw/hfi1/user_sdma.c | dlid | subscript (callee) | yes? | FP |
| 6551 | Low | 40 | H | hfi1_user_sdma_process_request | drivers/infiniband/hw/hfi1/user_sdma.c | opcode | truncation | no | FP |
| 6552 | Low | 40 | H | hfi1_user_sdma_process_request | drivers/infiniband/hw/hfi1/user_sdma.c | vl | truncation | no | FP |
| 6553 | Low | 40 | H | hfi1_user_sdma_process_request | drivers/infiniband/hw/hfi1/user_sdma.c | sc | truncation | no | FP |
| 6554 | Low | 40 | H | hfi1_user_sdma_process_request | drivers/infiniband/hw/hfi1/user_sdma.c | pkey | truncation | no | FP |
| 6555 | Low | 40 | C | hfi1_user_sdma_process_request | drivers/infiniband/hw/hfi1/user_sdma.c | vl | subscript (callee) | yes? | FP |
| 6556 | Low | 40 | C | hfi1_user_sdma_process_request | drivers/infiniband/hw/hfi1/user_sdma.c | vl | subscript (callee) | yes? | FP |
| 6557 | Low | 40 | C | hfi1_user_sdma_process_request | drivers/infiniband/hw/hfi1/user_sdma.c | vl | subscript (callee) | yes? | FP |
| 6558 | Low | 40 | H | hidpp_ff_init | drivers/hid/hid-logitech-hidpp.c | version | truncation | no | FP |
| 6559 | Low | 40 | H | hinic3_rx_poll | drivers/net/ethernet/huawei/hinic3/hinic3_rx.c | num_lro | truncation | no | FP |
| 6560 | Low | 40 | H | hinic_rq_prepare_ctxt | drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c | wq_page_pfn_hi | truncation | no | FP |
| 6561 | Low | 40 | H | hinic_rq_prepare_ctxt | drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c | wq_page_pfn_lo | truncation | no | FP |
| 6562 | Low | 40 | H | hinic_sq_prepare_ctxt | drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c | wq_page_pfn_hi | truncation | no | FP |
| 6563 | Low | 40 | H | hinic_sq_prepare_ctxt | drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c | wq_page_pfn_lo | truncation | no | FP |
| 6564 | Low | 40 | H | hinic_sq_prepare_ctxt | drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c | wq_block_pfn_hi | truncation | no | FP |
| 6565 | Low | 40 | H | hinic_sq_prepare_ctxt | drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c | wq_block_pfn_lo | truncation | no | FP |
| 6566 | Low | 40 | C | hl_build_hwmon_channel_info | drivers/accel/habanalabs/common/hwmon.c | type | subscript | yes? | FP |
| 6567 | Low | 40 | H | hl_fw_dynamic_copy_image | drivers/accel/habanalabs/common/firmware_if.c | rc | truncation | no | FP |
| 6568 | Low | 40 | H | hl_fw_dynamic_copy_msg | drivers/accel/habanalabs/common/firmware_if.c | rc | truncation | no | FP |
| 6569 | Low | 40 | C | hl_fw_dynamic_read_and_validate_descriptor | drivers/accel/habanalabs/common/firmware_if.c | temp_fw_desc | subscript (callee) | yes? | FP |
| 6570 | Low | 40 | H | hl_fw_dynamic_read_and_validate_descriptor | drivers/accel/habanalabs/common/firmware_if.c | temp_fw_desc | truncation | no | FP |
| 6571 | Low | 40 | C | hl_fw_dynamic_validate_descriptor | drivers/accel/habanalabs/common/firmware_if.c | region_id | subscript | yes? | FP |
| 6572 | Low | 40 | H | hl_fw_dynamic_validate_descriptor | drivers/accel/habanalabs/common/firmware_if.c | rc | truncation | no | FP |
| 6573 | Low | 40 | H | hl_irq_handler_cq | drivers/accel/habanalabs/common/irq.c | shadow_index | truncation | no | FP |
| 6574 | Low | 40 | H | hl_irq_handler_eq | drivers/accel/habanalabs/common/irq.c | cur_eqe_index | truncation | no | FP |
| 6575 | Low | 40 | H | hl_irq_handler_eq | drivers/accel/habanalabs/common/irq.c | event_type | truncation | no | FP |
| 6576 | Low | 40 | B | hns3_handle_rx_bd | drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | length | memcpy() in hns3_alloc_skb() | yes? | FP |
| 6577 | Low | 40 | B | hns_nic_poll_rx_skb | drivers/net/ethernet/hisilicon/hns/hns_enet.c | length | memcpy() | yes? | FP |
| 6578 | Low | 40 | C | hpsa_scsi_ioaccel_raid_map | drivers/scsi/hpsa.c | map_index | subscript | yes? | FP |
| 6579 | Low | 40 | C | hpsa_scsi_ioaccel_raid_map | drivers/scsi/hpsa.c | map_index | subscript | yes? | FP |
| 6580 | Low | 40 | C | hpsa_scsi_ioaccel_raid_map | drivers/scsi/hpsa.c | map_index | subscript | yes? | FP |
| 6581 | Low | 40 | H | htt_print_tx_pdev_mu_ppdu_dist_stats_tlv | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | hw_mode | truncation | no | FP |
| 6582 | Low | 40 | H | hw_event_phy_down | drivers/scsi/pm8001/pm8001_hwi.c | port_id | truncation | no | FP |
| 6583 | Low | 40 | H | hw_event_phy_down | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | truncation | no | FP |
| 6584 | Low | 40 | H | hw_event_phy_down | drivers/scsi/pm8001/pm8001_hwi.c | portstate | truncation | no | FP |
| 6585 | Low | 40 | H | hw_event_phy_down | drivers/scsi/pm8001/pm80xx_hwi.c | port_id | truncation | no | FP |
| 6586 | Low | 40 | H | hw_event_phy_down | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | truncation | no | FP |
| 6587 | Low | 40 | H | hw_event_phy_down | drivers/scsi/pm8001/pm80xx_hwi.c | portstate | truncation | no | FP |
| 6588 | Low | 40 | H | hw_event_port_recover | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | truncation | no | FP |
| 6589 | Low | 40 | H | hw_event_port_recover | drivers/scsi/pm8001/pm80xx_hwi.c | link_rate | truncation | no | FP |
| 6590 | Low | 40 | H | hw_event_port_recover | drivers/scsi/pm8001/pm80xx_hwi.c | port_id | truncation | no | FP |
| 6591 | Low | 40 | H | hw_event_sas_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | link_rate | truncation | no | FP |
| 6592 | Low | 40 | H | hw_event_sas_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | port_id | truncation | no | FP |
| 6593 | Low | 40 | H | hw_event_sas_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | truncation | no | FP |
| 6594 | Low | 40 | H | hw_event_sas_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | portstate | truncation | no | FP |
| 6595 | Low | 40 | H | hw_event_sas_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | link_rate | truncation | no | FP |
| 6596 | Low | 40 | H | hw_event_sas_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | port_id | truncation | no | FP |
| 6597 | Low | 40 | H | hw_event_sas_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | truncation | no | FP |
| 6598 | Low | 40 | H | hw_event_sas_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | portstate | truncation | no | FP |
| 6599 | Low | 40 | H | hw_event_sata_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | link_rate | truncation | no | FP |
| 6600 | Low | 40 | H | hw_event_sata_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | port_id | truncation | no | FP |
| 6601 | Low | 40 | H | hw_event_sata_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | truncation | no | FP |
| 6602 | Low | 40 | H | hw_event_sata_phy_up | drivers/scsi/pm8001/pm8001_hwi.c | portstate | truncation | no | FP |
| 6603 | Low | 40 | H | hw_event_sata_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | link_rate | truncation | no | FP |
| 6604 | Low | 40 | H | hw_event_sata_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | port_id | truncation | no | FP |
| 6605 | Low | 40 | H | hw_event_sata_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | truncation | no | FP |
| 6606 | Low | 40 | H | hw_event_sata_phy_up | drivers/scsi/pm8001/pm80xx_hwi.c | portstate | truncation | no | FP |
| 6607 | Low | 40 | H | hws_send_engine_dump_error_cqe | drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c | wqe_opcode | truncation | no | FP |
| 6608 | Low | 40 | B | i2c_hid_parse | drivers/hid/i2c-hid/i2c-hid-core.c | rsize | kzalloc() | yes? | FP |
| 6609 | Low | 40 | H | i40e_cee_to_dcb_config | drivers/net/ethernet/intel/i40e/i40e_dcb.c | err | truncation | no | FP |
| 6610 | Low | 40 | H | i40e_cee_to_dcb_config | drivers/net/ethernet/intel/i40e/i40e_dcb.c | sync | truncation | no | FP |
| 6611 | Low | 40 | H | i40e_cee_to_dcb_config | drivers/net/ethernet/intel/i40e/i40e_dcb.c | oper | truncation | no | FP |
| 6612 | Low | 40 | H | i40e_cee_to_dcb_config | drivers/net/ethernet/intel/i40e/i40e_dcb.c | err | truncation | no | FP |
| 6613 | Low | 40 | H | i40e_cee_to_dcb_config | drivers/net/ethernet/intel/i40e/i40e_dcb.c | sync | truncation | no | FP |
| 6614 | Low | 40 | H | i40e_cee_to_dcb_config | drivers/net/ethernet/intel/i40e/i40e_dcb.c | oper | truncation | no | FP |
| 6615 | Low | 40 | H | i40e_cee_to_dcb_config | drivers/net/ethernet/intel/i40e/i40e_dcb.c | err | truncation | no | FP |
| 6616 | Low | 40 | H | i40e_cee_to_dcb_config | drivers/net/ethernet/intel/i40e/i40e_dcb.c | sync | truncation | no | FP |
| 6617 | Low | 40 | H | i40e_cee_to_dcb_config | drivers/net/ethernet/intel/i40e/i40e_dcb.c | oper | truncation | no | FP |
| 6618 | Low | 40 | H | i40e_cee_to_dcb_v1_config | drivers/net/ethernet/intel/i40e/i40e_dcb.c | err | truncation | no | FP |
| 6619 | Low | 40 | C | i40e_clean_adminq_subtask | drivers/net/ethernet/intel/i40e/i40e_main.c | le16_to_cpu(event.desc.retval) | subscript (callee) | yes? | FP |
| 6620 | Low | 40 | H | i40e_clean_rx_irq | drivers/net/ethernet/intel/i40e/i40e_txrx.c | size | truncation | no | FP |
| 6621 | Low | 40 | H | i40e_clean_rx_irq_zc | drivers/net/ethernet/intel/i40e/i40e_xsk.c | size | truncation | no | FP |
| 6622 | Low | 40 | C | i40e_handle_lan_overflow_event | drivers/net/ethernet/intel/i40e/i40e_main.c | vf | subscript (callee) | yes? | FP |
| 6623 | Low | 40 | H | i40e_parse_cee_tlv | drivers/net/ethernet/intel/i40e/i40e_dcb.c | subtype | truncation | no | FP |
| 6624 | Low | 40 | H | i40e_parse_cee_tlv | drivers/net/ethernet/intel/i40e/i40e_dcb.c | len | truncation | no | FP |
| 6625 | Low | 40 | H | i40e_parse_cee_tlv | drivers/net/ethernet/intel/i40e/i40e_dcb.c | subtype | truncation | no | FP |
| 6626 | Low | 40 | C | i40e_parse_discover_capabilities | drivers/net/ethernet/intel/i40e/i40e_common.c | phys_id | subscript | yes? | FP |
| 6627 | Low | 40 | C | i40e_parse_discover_capabilities | drivers/net/ethernet/intel/i40e/i40e_common.c | phys_id | subscript | yes? | FP |
| 6628 | Low | 40 | H | i40e_parse_ieee_tlv | drivers/net/ethernet/intel/i40e/i40e_dcb.c | subtype | truncation | no | FP |
| 6629 | Low | 40 | H | i40e_parse_rx_flow_user_data | drivers/net/ethernet/intel/i40e/i40e_ethtool.c | valid | truncation | no | FP |
| 6630 | Low | 40 | H | i40e_process_skb_fields | drivers/net/ethernet/intel/i40e/i40e_txrx.c | rx_status | truncation | no | FP |
| 6631 | Low | 40 | H | i40e_process_skb_fields | drivers/net/ethernet/intel/i40e/i40e_txrx.c | tsynvalid | truncation | no | FP |
| 6632 | Low | 40 | H | i40e_process_skb_fields | drivers/net/ethernet/intel/i40e/i40e_txrx.c | tsyn | truncation | no | FP |
| 6633 | Low | 40 | H | i40e_process_skb_fields | drivers/net/ethernet/intel/i40e/i40e_txrx.c | rx_ptype | truncation | no | FP |
| 6634 | Low | 40 | H | i40e_rx_checksum | drivers/net/ethernet/intel/i40e/i40e_txrx.c | ptype | truncation | no | FP |
| 6635 | Low | 40 | H | i40e_rx_checksum | drivers/net/ethernet/intel/i40e/i40e_txrx.c | rx_error | truncation | no | FP |
| 6636 | Low | 40 | H | i40e_rx_checksum | drivers/net/ethernet/intel/i40e/i40e_txrx.c | rx_status | truncation | no | FP |
| 6637 | Low | 40 | H | ibmveth_poll | drivers/net/ethernet/ibm/ibmveth.c | mss | truncation | no | FP |
| 6638 | Low | 40 | C | ibmvfc_abort_task_set | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp_iu.cmd.status) | subscript (callee) | yes? | FP |
| 6639 | Low | 40 | C | ibmvfc_abort_task_set | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp_iu.cmd.error) | subscript (callee) | yes? | FP |
| 6640 | Low | 40 | C | ibmvfc_discover_targets_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->status) | subscript (callee) | yes? | FP |
| 6641 | Low | 40 | C | ibmvfc_discover_targets_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->error) | subscript (callee) | yes? | FP |
| 6642 | Low | 40 | C | ibmvfc_get_err_result | drivers/scsi/ibmvscsi/ibmvfc.c | err | subscript | yes? | FP |
| 6643 | Low | 40 | C | ibmvfc_log_error | drivers/scsi/ibmvscsi/ibmvfc.c | index | subscript | yes? | FP |
| 6644 | Low | 40 | C | ibmvfc_log_error | drivers/scsi/ibmvscsi/ibmvfc.c | index | subscript | yes? | FP |
| 6645 | Low | 40 | C | ibmvfc_npiv_login_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->status) | subscript (callee) | yes? | FP |
| 6646 | Low | 40 | C | ibmvfc_npiv_login_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->error) | subscript (callee) | yes? | FP |
| 6647 | Low | 40 | C | ibmvfc_npiv_login_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->status) | subscript (callee) | yes? | FP |
| 6648 | Low | 40 | C | ibmvfc_npiv_login_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->error) | subscript (callee) | yes? | FP |
| 6649 | Low | 40 | H | ibmvfc_npiv_login_done | drivers/scsi/ibmvscsi/ibmvfc.c | npiv_max_sectors | truncation | no | FP |
| 6650 | Low | 40 | C | ibmvfc_reset_device | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp_iu.cmd.status) | subscript (callee) | yes? | FP |
| 6651 | Low | 40 | C | ibmvfc_reset_device | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp_iu.cmd.error) | subscript (callee) | yes? | FP |
| 6652 | Low | 40 | H | ibmvfc_send_event | drivers/scsi/ibmvscsi/ibmvfc.c | rc | truncation | no | FP |
| 6653 | Low | 40 | H | ibmvfc_send_event | drivers/scsi/ibmvscsi/ibmvfc.c | rc | truncation | no | FP |
| 6654 | Low | 40 | C | ibmvfc_tgt_adisc_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(mad->iu.status) | subscript (callee) | yes? | FP |
| 6655 | Low | 40 | C | ibmvfc_tgt_adisc_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(mad->iu.error) | subscript (callee) | yes? | FP |
| 6656 | Low | 40 | H | ibmvfc_tgt_adisc_done | drivers/scsi/ibmvscsi/ibmvfc.c | fc_reason | truncation | no | FP |
| 6657 | Low | 40 | H | ibmvfc_tgt_adisc_done | drivers/scsi/ibmvscsi/ibmvfc.c | fc_explain | truncation | no | FP |
| 6658 | Low | 40 | C | ibmvfc_tgt_plogi_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->status) | subscript (callee) | yes? | FP |
| 6659 | Low | 40 | C | ibmvfc_tgt_plogi_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->error) | subscript (callee) | yes? | FP |
| 6660 | Low | 40 | C | ibmvfc_tgt_plogi_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->status) | subscript (callee) | yes? | FP |
| 6661 | Low | 40 | C | ibmvfc_tgt_plogi_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->error) | subscript (callee) | yes? | FP |
| 6662 | Low | 40 | C | ibmvfc_tgt_prli_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->status) | subscript (callee) | yes? | FP |
| 6663 | Low | 40 | C | ibmvfc_tgt_prli_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->error) | subscript (callee) | yes? | FP |
| 6664 | Low | 40 | C | ibmvfc_tgt_prli_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->status) | subscript (callee) | yes? | FP |
| 6665 | Low | 40 | C | ibmvfc_tgt_prli_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->error) | subscript (callee) | yes? | FP |
| 6666 | Low | 40 | C | ibmvfc_tgt_query_target_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->status) | subscript (callee) | yes? | FP |
| 6667 | Low | 40 | C | ibmvfc_tgt_query_target_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->error) | subscript (callee) | yes? | FP |
| 6668 | Low | 40 | C | ibmvfc_tgt_query_target_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->status) | subscript (callee) | yes? | FP |
| 6669 | Low | 40 | C | ibmvfc_tgt_query_target_done | drivers/scsi/ibmvscsi/ibmvfc.c | be16_to_cpu(rsp->error) | subscript (callee) | yes? | FP |
| 6670 | Low | 40 | C | ibmvmc_add_buffer | drivers/misc/ibmvmc.c | buffer_id | subscript | yes? | FP |
| 6671 | Low | 40 | C | ibmvmc_process_open_resp | drivers/misc/ibmvmc.c | buffer_id | subscript | yes? | FP |
| 6672 | Low | 40 | H | ibmvnic_poll | drivers/net/ethernet/ibm/ibmvnic.c | length | truncation | no | FP |
| 6673 | Low | 40 | H | ibmvscsi_send_srp_event | drivers/scsi/ibmvscsi/ibmvscsi.c | rc | truncation | no | FP |
| 6674 | Low | 40 | H | ibmvscsis_parse_task | drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | rc | truncation | no | FP |
| 6675 | Low | 40 | H | ice_cee_to_dcb_cfg | drivers/net/ethernet/intel/ice/ice_dcb.c | err | truncation | no | FP |
| 6676 | Low | 40 | H | ice_cee_to_dcb_cfg | drivers/net/ethernet/intel/ice/ice_dcb.c | sync | truncation | no | FP |
| 6677 | Low | 40 | H | ice_cee_to_dcb_cfg | drivers/net/ethernet/intel/ice/ice_dcb.c | oper | truncation | no | FP |
| 6678 | Low | 40 | B | ice_cfg_tx_topo | drivers/net/ethernet/intel/ice/ice_ddp.c | size | memcpy() | yes? | FP |
| 6679 | Low | 40 | H | ice_get_initial_sw_cfg | drivers/net/ethernet/intel/ice/ice_switch.c | res_type | truncation | no | FP |
| 6680 | Low | 40 | H | ice_parse_cee_tlv | drivers/net/ethernet/intel/ice/ice_dcb.c | subtype | truncation | no | FP |
| 6681 | Low | 40 | H | ice_parse_cee_tlv | drivers/net/ethernet/intel/ice/ice_dcb.c | len | truncation | no | FP |
| 6682 | Low | 40 | H | ice_parse_cee_tlv | drivers/net/ethernet/intel/ice/ice_dcb.c | subtype | truncation | no | FP |
| 6683 | Low | 40 | H | ice_parse_ieee_tlv | drivers/net/ethernet/intel/ice/ice_dcb.c | subtype | truncation | no | FP |
| 6684 | Low | 40 | C | ice_pkg_buf_alloc_section | drivers/net/ethernet/intel/ice/ice_ddp.c | sect_count | subscript | yes? | FP |
| 6685 | Low | 40 | C | ice_pkg_buf_alloc_section | drivers/net/ethernet/intel/ice/ice_ddp.c | sect_count | subscript | yes? | FP |
| 6686 | Low | 40 | C | ice_pkg_buf_alloc_section | drivers/net/ethernet/intel/ice/ice_ddp.c | sect_count | subscript | yes? | FP |
| 6687 | Low | 40 | C | ice_sched_init_port | drivers/net/ethernet/intel/ice/ice_sched.c | num_elems | subscript | yes? | FP |
| 6688 | Low | 40 | C | ice_sched_init_port | drivers/net/ethernet/intel/ice/ice_sched.c | num_elems | subscript | yes? | FP |
| 6689 | Low | 40 | C | ice_sched_init_port | drivers/net/ethernet/intel/ice/ice_sched.c | num_elems | subscript | yes? | FP |
| 6690 | Low | 40 | B | ice_sq_send_cmd | drivers/net/ethernet/intel/ice/ice_controlq.c | copy_size | memcpy() | yes? | FP |
| 6691 | Low | 40 | B | idpf_ptp_get_vport_tstamps_caps | drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c | size | kzalloc() | yes? | FP |
| 6692 | Low | 40 | H | idpf_rx_singleq_base_csum | drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c | rx_status | truncation | no | FP |
| 6693 | Low | 40 | H | idpf_rx_singleq_base_csum | drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c | rx_error | truncation | no | FP |
| 6694 | Low | 40 | C | idpf_send_get_rx_ptype_msg | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | pt_10 | subscript | yes? | FP |
| 6695 | Low | 40 | B | idpf_send_get_set_rss_key_msg | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | key_size | kzalloc() | yes? | FP |
| 6696 | Low | 40 | B | idpf_send_get_set_rss_lut_msg | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | lut_buf_size | kzalloc() | yes? | FP |
| 6697 | Low | 40 | H | idtcm_get_dco_delay | drivers/ptp/ptp_clockmatrix.c | fodFreq | truncation | no | FP |
| 6698 | Low | 40 | H | idtfc3_get_time_ref_freq | drivers/ptp/ptp_fc3.c | time_ref_div | truncation | no | FP |
| 6699 | Low | 40 | H | if_usb_receive | drivers/net/wireless/marvell/libertas_tf/if_usb.c | tmp | truncation | no | FP |
| 6700 | Low | 40 | H | if_usb_receive | drivers/net/wireless/marvell/libertas_tf/if_usb.c | retrycnt | truncation | no | FP |
| 6701 | Low | 40 | H | if_usb_receive | drivers/net/wireless/marvell/libertas_tf/if_usb.c | failure | truncation | no | FP |
| 6702 | Low | 40 | H | igb_rxnfc_write_vlan_prio_filter | drivers/net/ethernet/intel/igb/igb_ethtool.c | vlan_priority | truncation | no | FP |
| 6703 | Low | 40 | H | igc_fpe_transmitted_smd_v | drivers/net/ethernet/intel/igc/igc_tsn.h | smd | truncation | no | FP |
| 6704 | Low | 40 | H | il3945_get_measurement | drivers/net/wireless/intel/iwlegacy/3945-mac.c | add_time | truncation | no | FP |
| 6705 | Low | 40 | H | il3945_get_measurement | drivers/net/wireless/intel/iwlegacy/3945-mac.c | add_time | truncation | no | FP |
| 6706 | Low | 40 | C | il3945_hdl_tx | drivers/net/wireless/intel/iwlegacy/3945.c | txq | subscript | yes? | FP |
| 6707 | Low | 40 | C | il3945_hw_txq_attach_buf_to_tfd | drivers/net/wireless/intel/iwlegacy/3945.c | count | subscript | yes? | FP |
| 6708 | Low | 40 | C | il3945_hw_txq_attach_buf_to_tfd | drivers/net/wireless/intel/iwlegacy/3945.c | count | subscript | yes? | FP |
| 6709 | Low | 40 | C | il3945_send_tx_power | drivers/net/wireless/intel/iwlegacy/3945.c | chan | subscript (callee) | yes? | FP |
| 6710 | Low | 40 | H | il3945_store_measurement | drivers/net/wireless/intel/iwlegacy/3945-mac.c | params | truncation | no | FP |
| 6711 | Low | 40 | H | il3945_store_measurement | drivers/net/wireless/intel/iwlegacy/3945-mac.c | params | truncation | no | FP |
| 6712 | Low | 40 | H | il4965_chain_noise_calibration | drivers/net/wireless/intel/iwlegacy/4965-calib.c | stat_chnum | truncation | no | FP |
| 6713 | Low | 40 | C | il4965_dump_nic_error_log | drivers/net/wireless/intel/iwlegacy/4965-mac.c | desc | subscript (callee) | yes? | FP |
| 6714 | Low | 40 | C | il4965_hdl_compressed_ba | drivers/net/wireless/intel/iwlegacy/4965-mac.c | scd_flow | subscript (callee) | yes? | FP |
| 6715 | Low | 40 | C | il4965_hdl_compressed_ba | drivers/net/wireless/intel/iwlegacy/4965-mac.c | scd_flow | subscript (callee) | yes? | FP |
| 6716 | Low | 40 | C | il4965_hdl_compressed_ba | drivers/net/wireless/intel/iwlegacy/4965-mac.c | scd_flow | subscript (callee) | yes? | FP |
| 6717 | Low | 40 | C | il4965_hdl_compressed_ba | drivers/net/wireless/intel/iwlegacy/4965-mac.c | scd_flow | subscript (callee) | yes? | FP |
| 6718 | Low | 40 | C | il4965_hdl_compressed_ba | drivers/net/wireless/intel/iwlegacy/4965-mac.c | scd_flow | subscript | yes? | FP |
| 6719 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | sta_id | subscript (callee) | yes? | FP |
| 6720 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | sta_id | subscript (callee) | yes? | FP |
| 6721 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | sta_id | subscript (callee) | yes? | FP |
| 6722 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | tid | subscript (callee) | yes? | FP |
| 6723 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | sta_id | subscript (callee) | yes? | FP |
| 6724 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | tid | subscript (callee) | yes? | FP |
| 6725 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | sta_id | subscript (callee) | yes? | FP |
| 6726 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | sta_id | subscript (callee) | yes? | FP |
| 6727 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | sta_id | subscript (callee) | yes? | FP |
| 6728 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | idx | subscript (callee) | yes? | FP |
| 6729 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | idx | subscript (callee) | yes? | FP |
| 6730 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | txq | subscript | yes? | FP |
| 6731 | Low | 40 | C | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | sta_id | subscript | yes? | FP |
| 6732 | Low | 40 | H | il4965_remove_dynamic_key | drivers/net/wireless/intel/iwlegacy/4965-mac.c | keyidx | truncation | no | FP |
| 6733 | Low | 40 | C | il4965_rs_sta_dbgfs_scale_table_read | drivers/net/wireless/intel/iwlegacy/4965-rs.c | le32_to_cpu
(lq_sta->lq.rs_table[i].
| subscript (callee) | yes? | FP |
| 6734 | Low | 40 | C | il4965_send_tx_power | drivers/net/wireless/intel/iwlegacy/4965.c | le16_to_cpu(il->active.channel) | subscript (callee) | yes? | FP |
| 6735 | Low | 40 | C | il4965_send_tx_power | drivers/net/wireless/intel/iwlegacy/4965.c | le16_to_cpu(il->active.channel) | subscript (callee) | yes? | FP |
| 6736 | Low | 40 | C | il4965_send_tx_power | drivers/net/wireless/intel/iwlegacy/4965.c | le16_to_cpu(il->active.channel) | subscript (callee) | yes? | FP |
| 6737 | Low | 40 | H | il4965_tx_status_reply_compressed_ba | drivers/net/wireless/intel/iwlegacy/4965-mac.c | ack | truncation | no | FP |
| 6738 | Low | 40 | C | il_connection_init_rx_config | drivers/net/wireless/intel/iwlegacy/common.c | le16_to_cpu(il->active.channel) | subscript (callee) | yes? | FP |
| 6739 | Low | 40 | C | il_tx_cmd_complete | drivers/net/wireless/intel/iwlegacy/common.c | txq_id | subscript (callee) | yes? | FP |
| 6740 | Low | 40 | B | ili251x_firmware_to_buffer | drivers/input/touchscreen/ili210x.c | fw_len | memcpy() | yes? | FP |
| 6741 | Low | 40 | H | imon_incoming_packet | drivers/media/rc/imon.c | kc | truncation | no | FP |
| 6742 | Low | 40 | B | ims_pcu_flash_firmware | drivers/input/misc/ims-pcu.c | len | memcmp() in ims_pcu_verify_block() | yes? | FP |
| 6743 | Low | 40 | B | ims_pcu_flash_firmware | drivers/input/misc/ims-pcu.c | len | memcpy() | yes? | FP |
| 6744 | Low | 40 | H | in_rq_cur | drivers/usb/gadget/function/f_uac1.c | entity_id | truncation | no | FP |
| 6745 | Low | 40 | H | in_rq_cur | drivers/usb/gadget/function/f_uac1.c | control_selector | truncation | no | FP |
| 6746 | Low | 40 | H | in_rq_cur | drivers/usb/gadget/function/f_uac2.c | entity_id | truncation | no | FP |
| 6747 | Low | 40 | H | in_rq_cur | drivers/usb/gadget/function/f_uac2.c | control_selector | truncation | no | FP |
| 6748 | Low | 40 | H | in_rq_max | drivers/usb/gadget/function/f_uac1.c | entity_id | truncation | no | FP |
| 6749 | Low | 40 | H | in_rq_max | drivers/usb/gadget/function/f_uac1.c | control_selector | truncation | no | FP |
| 6750 | Low | 40 | H | in_rq_min | drivers/usb/gadget/function/f_uac1.c | entity_id | truncation | no | FP |
| 6751 | Low | 40 | H | in_rq_min | drivers/usb/gadget/function/f_uac1.c | control_selector | truncation | no | FP |
| 6752 | Low | 40 | H | in_rq_range | drivers/usb/gadget/function/f_uac2.c | entity_id | truncation | no | FP |
| 6753 | Low | 40 | H | in_rq_range | drivers/usb/gadget/function/f_uac2.c | control_selector | truncation | no | FP |
| 6754 | Low | 40 | H | in_rq_res | drivers/usb/gadget/function/f_uac1.c | entity_id | truncation | no | FP |
| 6755 | Low | 40 | H | in_rq_res | drivers/usb/gadget/function/f_uac1.c | control_selector | truncation | no | FP |
| 6756 | Low | 40 | C | init_non_clock_fields | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | rrr_index | subscript | yes? | FP |
| 6757 | Low | 40 | H | initialize_cx231xx | drivers/media/usb/cx231xx/cx231xx-pcb-cfg.c | usb_speed | truncation | no | FP |
| 6758 | Low | 40 | B | insert_at | drivers/md/persistent-data/dm-btree.c | nr_entries | memmove() in array_insert() | yes? | FP |
| 6759 | Low | 40 | H | intr_handler | drivers/net/ethernet/adaptec/starfire.c | entry | truncation | no | FP |
| 6760 | Low | 40 | B | ioctl_send_fib | drivers/scsi/aacraid/commctrl.c | size | memset() | yes? | FP |
| 6761 | Low | 40 | B | ioctl_send_fib | drivers/scsi/aacraid/commctrl.c | size | copy_from_user() | yes? | FP |
| 6762 | Low | 40 | B | ioctl_send_fib | drivers/scsi/aacraid/commctrl.c | size | copy_to_user() | yes? | FP |
| 6763 | Low | 40 | H | ionic_comp_msn | drivers/infiniband/hw/ionic/ionic_datapath.c | cqe_seq | truncation | no | FP |
| 6764 | Low | 40 | H | ionic_comp_msn | drivers/infiniband/hw/ionic/ionic_datapath.c | cqe_idx | truncation | no | FP |
| 6765 | Low | 40 | H | ionic_poll_recv | drivers/infiniband/hw/ionic/ionic_datapath.c | op | truncation | no | FP |
| 6766 | Low | 40 | C | ipc_mux_session_close | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript (callee) | yes? | FP |
| 6767 | Low | 40 | C | ipc_mux_session_close | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6768 | Low | 40 | C | ipc_mux_session_close | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6769 | Low | 40 | C | ipc_mux_session_close | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6770 | Low | 40 | C | ipc_mux_session_open | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript (callee) | yes? | FP |
| 6771 | Low | 40 | C | ipc_mux_session_open | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6772 | Low | 40 | C | ipc_mux_session_open | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6773 | Low | 40 | C | ipc_mux_session_open | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6774 | Low | 40 | C | ipc_mux_session_open | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6775 | Low | 40 | C | ipc_mux_session_open | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6776 | Low | 40 | C | ipc_mux_session_open | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6777 | Low | 40 | C | ipc_mux_session_open | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6778 | Low | 40 | C | ipc_mux_session_open | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6779 | Low | 40 | C | ipc_mux_session_open | drivers/net/wwan/iosm/iosm_ipc_mux.c | if_id | subscript | yes? | FP |
| 6780 | Low | 40 | C | ipr_dump_ioasa | drivers/scsi/ipr.c | error_index | subscript | yes? | FP |
| 6781 | Low | 40 | H | ipr_process_hrrq | drivers/scsi/ipr.c | cmd_index | truncation | no | FP |
| 6782 | Low | 40 | C | ipr_process_hrrq | drivers/scsi/ipr.c | cmd_index | subscript | yes? | FP |
| 6783 | Low | 40 | H | iqs5xx_fw_file_parse | drivers/input/touchscreen/iqs5xx.c | rec_type | truncation | no | FP |
| 6784 | Low | 40 | C | irdma_inetaddr_event | drivers/infiniband/hw/irdma/utils.c | local_ipaddr | subscript (callee) | yes? | FP |
| 6785 | Low | 40 | C | irdma_inetaddr_event | drivers/infiniband/hw/irdma/utils.c | local_ipaddr | subscript (callee) | yes? | FP |
| 6786 | Low | 40 | B | irdma_parse_mpa | drivers/infiniband/hw/irdma/cm.c | priv_data_len | memcpy() | yes? | FP |
| 6787 | Low | 40 | H | irdma_terminate_received | drivers/infiniband/hw/irdma/ctrl.c | ddp_ctl | truncation | no | FP |
| 6788 | Low | 40 | H | irdma_terminate_received | drivers/infiniband/hw/irdma/ctrl.c | rdma_ctl | truncation | no | FP |
| 6789 | Low | 40 | B | iscsi_scsi_cmd_rsp | drivers/scsi/libiscsi.c | senselen | memcpy() | yes? | FP |
| 6790 | Low | 40 | C | iscsit_get_dataout | drivers/target/iscsi/iscsi_target.c | be32_to_cpu(hdr->offset) | subscript (callee) | yes? | FP |
| 6791 | Low | 40 | B | iscsit_setup_scsi_cmd | drivers/target/iscsi/iscsi_target.c | cdb | kzalloc() in target_cmd_init_cdb() | yes? | FP |
| 6792 | Low | 40 | B | iscsit_setup_scsi_cmd | drivers/target/iscsi/iscsi_target.c | cdb | memcpy() in target_cmd_init_cdb() | yes? | FP |
| 6793 | Low | 40 | B | iscsit_setup_scsi_cmd | drivers/target/iscsi/iscsi_target.c | cdb | memcpy() in target_cmd_init_cdb() | yes? | FP |
| 6794 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | sectnum | truncation | no | FP |
| 6795 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | cylinder | truncation | no | FP |
| 6796 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | head | truncation | no | FP |
| 6797 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | sectnum | truncation | no | FP |
| 6798 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | cylinder | truncation | no | FP |
| 6799 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | head | truncation | no | FP |
| 6800 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | sectnum | truncation | no | FP |
| 6801 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | cylinder | truncation | no | FP |
| 6802 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | head | truncation | no | FP |
| 6803 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | sectnum | truncation | no | FP |
| 6804 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | cylinder | truncation | no | FP |
| 6805 | Low | 40 | H | isd200_scsi_to_ata | drivers/usb/storage/isd200.c | head | truncation | no | FP |
| 6806 | Low | 40 | H | isr_setup_packet_handler | drivers/usb/chipidea/udc.c | tmode | truncation | no | FP |
| 6807 | Low | 40 | C | iter_axes_extended_name_process_response | drivers/firmware/arm_scmi/sensors.c | axis_id | subscript | yes? | FP |
| 6808 | Low | 40 | H | iwl_chain_noise_calibration | drivers/net/wireless/intel/iwlwifi/dvm/calib.c | stat_chnum | truncation | no | FP |
| 6809 | Low | 40 | C | iwl_dbg_tlv_alloc | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tlv_idx | subscript | yes? | FP |
| 6810 | Low | 40 | C | iwl_dbg_tlv_alloc_buf_alloc | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | alloc_id | subscript | yes? | FP |
| 6811 | Low | 40 | B | iwl_dbg_tlv_alloc_hcmd | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tp | memcpy() in iwl_dbg_tlv_add() | yes? | FP |
| 6812 | Low | 40 | B | iwl_dbg_tlv_alloc_hcmd | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tp | memcpy() in iwl_dbg_tlv_add() | yes? | FP |
| 6813 | Low | 40 | C | iwl_dbg_tlv_alloc_hcmd | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tp | subscript | yes? | FP |
| 6814 | Low | 40 | C | iwl_dbg_tlv_alloc_region | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | id | subscript | yes? | FP |
| 6815 | Low | 40 | B | iwl_dbg_tlv_alloc_trigger | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tp | memcpy() in iwl_dbg_tlv_add() | yes? | FP |
| 6816 | Low | 40 | B | iwl_dbg_tlv_alloc_trigger | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tp | memcpy() in iwl_dbg_tlv_add() | yes? | FP |
| 6817 | Low | 40 | C | iwl_dbg_tlv_alloc_trigger | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tp | subscript | yes? | FP |
| 6818 | Low | 40 | B | iwl_dbg_tlv_config_set | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tp | memcpy() in iwl_dbg_tlv_add() | yes? | FP |
| 6819 | Low | 40 | B | iwl_dbg_tlv_config_set | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tp | memcpy() in iwl_dbg_tlv_add() | yes? | FP |
| 6820 | Low | 40 | C | iwl_dbg_tlv_config_set | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | tp | subscript | yes? | FP |
| 6821 | Low | 40 | B | iwl_dbgfs_mem_read | drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | len | copy_to_user() | yes? | FP |
| 6822 | Low | 40 | C | iwl_fw_ini_trigger_on | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | tp_id | subscript (callee) | yes? | FP |
| 6823 | Low | 40 | C | iwl_fw_ini_trigger_on | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | tp_id | subscript (callee) | yes? | FP |
| 6824 | Low | 40 | C | iwl_fw_ini_trigger_on | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | tp_id | subscript (callee) | yes? | FP |
| 6825 | Low | 40 | C | iwl_ini_get_rxf_data | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | fifo_idx | subscript | yes? | FP |
| 6826 | Low | 40 | B | iwl_mei_handle_conn_status | drivers/net/wireless/intel/iwlwifi/mei/main.c | conn_info | memcpy() | yes? | FP |
| 6827 | Low | 40 | B | iwl_mei_handle_sap_data | drivers/net/wireless/intel/iwlwifi/mei/main.c | ethhdr | memcpy() in iwl_mei_read_from_q() | yes? | FP |
| 6828 | Low | 40 | B | iwl_mei_handle_sap_data | drivers/net/wireless/intel/iwlwifi/mei/main.c | ethhdr | memcpy() in iwl_mei_read_from_q() | yes? | FP |
| 6829 | Low | 40 | B | iwl_mei_write_cyclic_buf | drivers/net/wireless/intel/iwlwifi/mei/main.c | tx_sz | memcpy() | yes? | FP |
| 6830 | Low | 40 | B | iwl_mei_write_cyclic_buf | drivers/net/wireless/intel/iwlwifi/mei/main.c | wr | memcpy() | yes? | FP |
| 6831 | Low | 40 | B | iwl_mei_write_cyclic_buf | drivers/net/wireless/intel/iwlwifi/mei/main.c | tx_sz | memcpy() | yes? | FP |
| 6832 | Low | 40 | C | iwl_mld_handle_beacon_filter_notif | drivers/net/wireless/intel/iwlwifi/mld/link.c | link_id | subscript (callee) | yes? | FP |
| 6833 | Low | 40 | C | iwl_mld_handle_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mld/scan.c | chan_idx | subscript | yes? | FP |
| 6834 | Low | 40 | C | iwl_mld_handle_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mld/scan.c | chan_idx | subscript | yes? | FP |
| 6835 | Low | 40 | C | iwl_mld_handle_channel_switch_error_notif | drivers/net/wireless/intel/iwlwifi/mld/notif.c | link_id | subscript (callee) | yes? | FP |
| 6836 | Low | 40 | C | iwl_mld_handle_channel_switch_start_notif | drivers/net/wireless/intel/iwlwifi/mld/notif.c | link_id | subscript (callee) | yes? | FP |
| 6837 | Low | 40 | C | iwl_mld_handle_emlsr_trans_fail_notif | drivers/net/wireless/intel/iwlwifi/mld/mlo.c | fw_link_id | subscript (callee) | yes? | FP |
| 6838 | Low | 40 | C | iwl_mld_handle_missed_beacon_notif | drivers/net/wireless/intel/iwlwifi/mld/link.c | fw_link_id | subscript (callee) | yes? | FP |
| 6839 | Low | 40 | C | iwl_mld_handle_missed_beacon_notif | drivers/net/wireless/intel/iwlwifi/mld/link.c | other_link_fw_id | subscript (callee) | yes? | FP |
| 6840 | Low | 40 | H | iwl_mld_handle_missed_beacon_notif | drivers/net/wireless/intel/iwlwifi/mld/link.c | link_id | truncation | no | FP |
| 6841 | Low | 40 | C | iwl_mld_handle_scan_start_notif | drivers/net/wireless/intel/iwlwifi/mld/scan.c | uid | subscript | yes? | FP |
| 6842 | Low | 40 | C | iwl_mld_handle_scan_start_notif | drivers/net/wireless/intel/iwlwifi/mld/scan.c | uid | subscript | yes? | FP |
| 6843 | Low | 40 | C | iwl_mld_handle_scan_start_notif | drivers/net/wireless/intel/iwlwifi/mld/scan.c | uid | subscript | yes? | FP |
| 6844 | Low | 40 | C | iwl_mld_handle_scan_start_notif | drivers/net/wireless/intel/iwlwifi/mld/scan.c | uid | subscript | yes? | FP |
| 6845 | Low | 40 | C | iwl_mld_handle_session_prot_notif | drivers/net/wireless/intel/iwlwifi/mld/session-protect.c | fw_link_id | subscript (callee) | yes? | FP |
| 6846 | Low | 40 | H | iwl_mld_handle_tlc_notif | drivers/net/wireless/intel/iwlwifi/mld/tlc.c | size | truncation | no | FP |
| 6847 | Low | 40 | H | iwl_mld_process_per_sta_stats | drivers/net/wireless/intel/iwlwifi/mld/stats.c | avg_energy | truncation | no | FP |
| 6848 | Low | 40 | C | iwl_mld_reorder | drivers/net/wireless/intel/iwlwifi/mld/agg.c | baid_data | subscript (callee) | yes? | FP |
| 6849 | Low | 40 | C | iwl_mld_reorder | drivers/net/wireless/intel/iwlwifi/mld/agg.c | buffer | subscript (callee) | yes? | FP |
| 6850 | Low | 40 | C | iwl_mld_reorder | drivers/net/wireless/intel/iwlwifi/mld/agg.c | baid_data | subscript (callee) | yes? | FP |
| 6851 | Low | 40 | C | iwl_mld_reorder | drivers/net/wireless/intel/iwlwifi/mld/agg.c | buffer | subscript (callee) | yes? | FP |
| 6852 | Low | 40 | H | iwl_mld_reorder | drivers/net/wireless/intel/iwlwifi/mld/agg.c | baid | truncation | no | FP |
| 6853 | Low | 40 | C | iwl_mld_reorder | drivers/net/wireless/intel/iwlwifi/mld/agg.c | baid | subscript | yes? | FP |
| 6854 | Low | 40 | C | iwl_mld_reorder | drivers/net/wireless/intel/iwlwifi/mld/agg.c | baid_data | subscript | yes? | FP |
| 6855 | Low | 40 | H | iwl_mld_reorder | drivers/net/wireless/intel/iwlwifi/mld/agg.c | sn | truncation | no | FP |
| 6856 | Low | 40 | H | iwl_mld_reorder | drivers/net/wireless/intel/iwlwifi/mld/agg.c | nssn | truncation | no | FP |
| 6857 | Low | 40 | H | iwl_mld_rx_crypto | drivers/net/wireless/intel/iwlwifi/mld/rx.c | status | truncation | no | FP |
| 6858 | Low | 40 | H | iwl_mld_rx_crypto | drivers/net/wireless/intel/iwlwifi/mld/rx.c | le16_to_cpu(desc->mpdu_len) | truncation | no | FP |
| 6859 | Low | 40 | C | iwl_mld_rx_crypto | drivers/net/wireless/intel/iwlwifi/mld/rx.c | status | subscript (callee) | yes? | FP |
| 6860 | Low | 40 | C | iwl_mld_rx_crypto | drivers/net/wireless/intel/iwlwifi/mld/rx.c | le16_to_cpu(desc->mpdu_len) | subscript (callee) | yes? | FP |
| 6861 | Low | 40 | C | iwl_mld_rx_mgmt_prot | drivers/net/wireless/intel/iwlwifi/mld/rx.c | keyidx | subscript | yes? | FP |
| 6862 | Low | 40 | C | iwl_mld_session_start_fn | drivers/net/wireless/intel/iwlwifi/mld/session-protect.c | fw_link_id | subscript (callee) | yes? | FP |
| 6863 | Low | 40 | C | iwl_mvm_channel_switch_error_notif | drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | id | subscript (callee) | yes? | FP |
| 6864 | Low | 40 | C | iwl_mvm_channel_switch_error_notif | drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | id | subscript (callee) | yes? | FP |
| 6865 | Low | 40 | C | iwl_mvm_channel_switch_start_notif | drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | mac_id | subscript (callee) | yes? | FP |
| 6866 | Low | 40 | C | iwl_mvm_channel_switch_start_notif | drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | link_id | subscript (callee) | yes? | FP |
| 6867 | Low | 40 | C | iwl_mvm_channel_switch_start_notif | drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | mac_id | subscript (callee) | yes? | FP |
| 6868 | Low | 40 | C | iwl_mvm_channel_switch_start_notif | drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | link_id | subscript (callee) | yes? | FP |
| 6869 | Low | 40 | C | iwl_mvm_handle_missed_beacons_notif | drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | id | subscript (callee) | yes? | FP |
| 6870 | Low | 40 | C | iwl_mvm_handle_missed_beacons_notif | drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | id | subscript (callee) | yes? | FP |
| 6871 | Low | 40 | H | iwl_mvm_power_uapsd_misbehaving_ap_notif | drivers/net/wireless/intel/iwlwifi/mvm/power.c | ap_sta_id | truncation | no | FP |
| 6872 | Low | 40 | C | iwl_mvm_probe_resp_data_notif | drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | id | subscript (callee) | yes? | FP |
| 6873 | Low | 40 | C | iwl_mvm_probe_resp_data_notif | drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | id | subscript (callee) | yes? | FP |
| 6874 | Low | 40 | C | iwl_mvm_reorder | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | baid_data | subscript (callee) | yes? | FP |
| 6875 | Low | 40 | C | iwl_mvm_reorder | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | buffer | subscript (callee) | yes? | FP |
| 6876 | Low | 40 | C | iwl_mvm_reorder | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | baid_data | subscript (callee) | yes? | FP |
| 6877 | Low | 40 | C | iwl_mvm_reorder | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | buffer | subscript (callee) | yes? | FP |
| 6878 | Low | 40 | H | iwl_mvm_reorder | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | baid | truncation | no | FP |
| 6879 | Low | 40 | C | iwl_mvm_reorder | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | baid | subscript | yes? | FP |
| 6880 | Low | 40 | H | iwl_mvm_reorder | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | nssn | truncation | no | FP |
| 6881 | Low | 40 | H | iwl_mvm_reorder | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | sn | truncation | no | FP |
| 6882 | Low | 40 | C | iwl_mvm_reorder | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | baid_data | subscript | yes? | FP |
| 6883 | Low | 40 | C | iwl_mvm_rx_beacon_filter_notif | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | id | subscript (callee) | yes? | FP |
| 6884 | Low | 40 | C | iwl_mvm_rx_beacon_filter_notif | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | id | subscript (callee) | yes? | FP |
| 6885 | Low | 40 | H | iwl_mvm_rx_beacon_notif | drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | status | truncation | no | FP |
| 6886 | Low | 40 | C | iwl_mvm_rx_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mvm/scan.c | chan_idx | subscript | yes? | FP |
| 6887 | Low | 40 | C | iwl_mvm_rx_channel_survey_notif | drivers/net/wireless/intel/iwlwifi/mvm/scan.c | chan_idx | subscript | yes? | FP |
| 6888 | Low | 40 | C | iwl_mvm_rx_crypto | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | status | subscript (callee) | yes? | FP |
| 6889 | Low | 40 | H | iwl_mvm_rx_csum | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | l3_prot | truncation | no | FP |
| 6890 | Low | 40 | C | iwl_mvm_rx_eosp_notif | drivers/net/wireless/intel/iwlwifi/mvm/sta.c | sta_id | subscript | yes? | FP |
| 6891 | Low | 40 | H | iwl_mvm_rx_mgmt_prot | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | keyid | truncation | no | FP |
| 6892 | Low | 40 | C | iwl_mvm_rx_mgmt_prot | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | keyid | subscript | yes? | FP |
| 6893 | Low | 40 | C | iwl_mvm_rx_mpdu_mq | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | baid | subscript (callee) | yes? | FP |
| 6894 | Low | 40 | H | iwl_mvm_rx_mpdu_mq | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | baid | truncation | no | FP |
| 6895 | Low | 40 | C | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | rate_n_flags | subscript (callee) | yes? | FP |
| 6896 | Low | 40 | C | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | id | subscript | yes? | FP |
| 6897 | Low | 40 | H | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | stbc | truncation | no | FP |
| 6898 | Low | 40 | H | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | stbc | truncation | no | FP |
| 6899 | Low | 40 | H | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | sta | truncation | no | FP |
| 6900 | Low | 40 | H | iwl_mvm_rx_rx_mpdu | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | rx_pkt_status | truncation | no | FP |
| 6901 | Low | 40 | C | iwl_mvm_rx_session_protect_notif | drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | id | subscript (callee) | yes? | FP |
| 6902 | Low | 40 | C | iwl_mvm_rx_session_protect_notif | drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | id | subscript (callee) | yes? | FP |
| 6903 | Low | 40 | C | iwl_mvm_rx_tdls_notif | drivers/net/wireless/intel/iwlwifi/mvm/tdls.c | sta_id | subscript | yes? | FP |
| 6904 | Low | 40 | H | iwl_mvm_stat_iterator | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | id | truncation | no | FP |
| 6905 | Low | 40 | H | iwl_mvm_tlc_update_notif | drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | size | truncation | no | FP |
| 6906 | Low | 40 | H | iwl_mvm_window_status_notif | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | tid | truncation | no | FP |
| 6907 | Low | 40 | H | iwl_mvm_window_status_notif | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | sta_id | truncation | no | FP |
| 6908 | Low | 40 | C | iwl_mvm_window_status_notif | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | sta_id | subscript | yes? | FP |
| 6909 | Low | 40 | C | iwl_parse_tlv_firmware | drivers/net/wireless/intel/iwlwifi/iwl-drv.c | trigger_id | subscript | yes? | FP |
| 6910 | Low | 40 | C | iwl_parse_tlv_firmware | drivers/net/wireless/intel/iwlwifi/iwl-drv.c | trigger_id | subscript | yes? | FP |
| 6911 | Low | 40 | C | iwl_parse_tlv_firmware | drivers/net/wireless/intel/iwlwifi/iwl-drv.c | trigger_id | subscript | yes? | FP |
| 6912 | Low | 40 | H | iwl_pcie_get_rxb | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c | vid | truncation | no | FP |
| 6913 | Low | 40 | C | iwl_pcie_get_rxb | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c | vid | subscript | yes? | FP |
| 6914 | Low | 40 | C | iwl_pcie_hcmd_complete | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx.c | cmd_id | subscript (callee) | yes? | FP |
| 6915 | Low | 40 | C | iwl_pcie_hcmd_complete | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx.c | cmd_id | subscript (callee) | yes? | FP |
| 6916 | Low | 40 | C | iwl_pcie_hcmd_complete | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx.c | txq_id | subscript (callee) | yes? | FP |
| 6917 | Low | 40 | H | iwl_pcie_hcmd_complete | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx.c | group_id | truncation | no | FP |
| 6918 | Low | 40 | C | iwl_pcie_txq_alloc_response | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx-gen2.c | qid | subscript | yes? | FP |
| 6919 | Low | 40 | C | iwl_pcie_txq_alloc_response | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx-gen2.c | qid | subscript | yes? | FP |
| 6920 | Low | 40 | C | iwl_read_external_nvm | drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | section_id | subscript | yes? | FP |
| 6921 | Low | 40 | C | iwl_read_external_nvm | drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | section_id | subscript | yes? | FP |
| 6922 | Low | 40 | C | iwl_read_external_nvm | drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | section_id | subscript | yes? | FP |
| 6923 | Low | 40 | H | iwl_rx_reply_tx_agg | drivers/net/wireless/intel/iwlwifi/dvm/tx.c | retry_cnt | truncation | no | FP |
| 6924 | Low | 40 | C | iwl_set_default_calib | drivers/net/wireless/intel/iwlwifi/iwl-drv.c | ucode_type | subscript | yes? | FP |
| 6925 | Low | 40 | C | iwl_set_default_calib | drivers/net/wireless/intel/iwlwifi/iwl-drv.c | ucode_type | subscript | yes? | FP |
| 6926 | Low | 40 | H | iwlagn_calc_rssi | drivers/net/wireless/intel/iwlwifi/dvm/rx.c | agc | truncation | no | FP |
| 6927 | Low | 40 | C | ixgbe_clean_rx_irq | drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | skb | subscript (callee) | yes? | FP |
| 6928 | Low | 40 | C | ixgbe_fcoe_ddp | drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c | xid | subscript | yes? | FP |
| 6929 | Low | 40 | H | ixgbe_get_media_type_e610 | drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | highest_bit | truncation | no | FP |
| 6930 | Low | 40 | H | ixgbe_get_media_type_e610 | drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | highest_bit | truncation | no | FP |
| 6931 | Low | 40 | H | ixgbe_parse_e610_caps | drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | index | truncation | no | FP |
| 6932 | Low | 40 | H | kvaser_usb_hydra_rx_msg_ext | drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | dlc | truncation | no | FP |
| 6933 | Low | 40 | C | libipw_rx | drivers/net/wireless/intel/ipw2x00/libipw_rx.c | crypt | subscript (callee) | yes? | FP |
| 6934 | Low | 40 | C | libipw_rx | drivers/net/wireless/intel/ipw2x00/libipw_rx.c | hdrlen | subscript | yes? | FP |
| 6935 | Low | 40 | C | libipw_rx | drivers/net/wireless/intel/ipw2x00/libipw_rx.c | hdrlen | subscript | yes? | FP |
| 6936 | Low | 40 | C | libipw_rx | drivers/net/wireless/intel/ipw2x00/libipw_rx.c | keyidx | subscript | yes? | FP |
| 6937 | Low | 40 | H | load_ablock | drivers/md/persistent-data/dm-array.c | r | truncation | no | FP |
| 6938 | Low | 40 | C | load_waveform | drivers/video/fbdev/metronomefb.c | cksum_idx | subscript (callee) | yes? | FP |
| 6939 | Low | 40 | C | load_waveform | drivers/video/fbdev/metronomefb.c | cksum_idx | subscript | yes? | FP |
| 6940 | Low | 40 | C | load_waveform | drivers/video/fbdev/metronomefb.c | cksum_idx | subscript | yes? | FP |
| 6941 | Low | 40 | C | load_waveform | drivers/video/fbdev/metronomefb.c | cksum_idx | subscript | yes? | FP |
| 6942 | Low | 40 | C | load_waveform | drivers/video/fbdev/metronomefb.c | cksum_idx | subscript | yes? | FP |
| 6943 | Low | 40 | C | load_waveform | drivers/video/fbdev/metronomefb.c | wfm_idx | subscript | yes? | FP |
| 6944 | Low | 40 | H | load_waveform | drivers/video/fbdev/metronomefb.c | cksum | truncation | no | FP |
| 6945 | Low | 40 | C | load_waveform | drivers/video/fbdev/metronomefb.c | cksum_idx | subscript | yes? | FP |
| 6946 | Low | 40 | C | load_waveform | drivers/video/fbdev/metronomefb.c | cksum_idx | subscript | yes? | FP |
| 6947 | Low | 40 | H | lpfc_debugfs_dif_err_read | drivers/scsi/lpfc/lpfc_debugfs.c | cnt | truncation | no | FP |
| 6948 | Low | 40 | C | lpfc_nvmet_rcv_unsol_abort | drivers/scsi/lpfc/lpfc_nvmet.c | ctxp | subscript (callee) | yes? | FP |
| 6949 | Low | 40 | C | mace_rxdma_intr | drivers/net/ethernet/apple/mace.c | nb | subscript | yes? | FP |
| 6950 | Low | 40 | C | megasas_complete_cmd_dpc | drivers/scsi/megaraid/megaraid_sas_base.c | context | subscript | yes? | FP |
| 6951 | Low | 40 | B | megasas_complete_cmd_dpc | drivers/scsi/megaraid/megaraid_sas_base.c | cmd | memcpy() in megasas_complete_cmd() | yes? | FP |
| 6952 | Low | 40 | H | metadata_drop_snap | drivers/md/dm-era-target.c | r | truncation | no | FP |
| 6953 | Low | 40 | H | metadata_drop_snap | drivers/md/dm-era-target.c | r | truncation | no | FP |
| 6954 | Low | 40 | H | mhi_ep_ring_start | drivers/bus/mhi/ep/ring.c | ret | truncation | no | FP |
| 6955 | Low | 40 | H | mlx4_WRITE_MTT_wrapper | drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | err | truncation | no | FP |
| 6956 | Low | 40 | H | mlx4_WRITE_MTT_wrapper | drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | err | truncation | no | FP |
| 6957 | Low | 40 | C | mlx4_cmd_poll | drivers/net/ethernet/mellanox/mlx4/cmd.c | stat | subscript (callee) | yes? | FP |
| 6958 | Low | 40 | C | mlx4_cmd_poll | drivers/net/ethernet/mellanox/mlx4/cmd.c | stat | subscript (callee) | yes? | FP |
| 6959 | Low | 40 | C | mlx4_qp_attach_common | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | subscript | yes? | FP |
| 6960 | Low | 40 | C | mlx4_qp_attach_common | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | subscript | yes? | FP |
| 6961 | Low | 40 | H | mlx4_qp_roce_entropy | drivers/net/ethernet/mellanox/mlx4/qp.c | folded_dst | truncation | no | FP |
| 6962 | Low | 40 | H | mlx5dr_action_create_push_vlan | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_action.c | ethertype | truncation | no | FP |
| 6963 | Low | 40 | H | mlx5e_ptp_handle_ts_cqe | drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | metadata_id | truncation | no | FP |
| 6964 | Low | 40 | H | mlx5e_txwqe_complete | drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | metadata_index | truncation | no | FP |
| 6965 | Low | 40 | H | mlx5i_complete_rx_cqe | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | g | truncation | no | FP |
| 6966 | Low | 40 | H | mlx5i_handle_rx_cqe | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | cqe_bcnt | truncation | no | FP |
| 6967 | Low | 40 | H | mlx5i_handle_rx_cqe | drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | skb | truncation | no | FP |
| 6968 | Low | 40 | H | mlx5r_umr_post_send_wait | drivers/infiniband/hw/mlx5/umr.c | err | truncation | no | FP |
| 6969 | Low | 40 | C | mmc_ioctl_cdrom_volume | drivers/cdrom/cdrom.c | offset | subscript | yes? | FP |
| 6970 | Low | 40 | C | mmc_ioctl_cdrom_volume | drivers/cdrom/cdrom.c | offset | subscript | yes? | FP |
| 6971 | Low | 40 | C | mmc_ioctl_cdrom_volume | drivers/cdrom/cdrom.c | offset | subscript | yes? | FP |
| 6972 | Low | 40 | C | mmc_ioctl_cdrom_volume | drivers/cdrom/cdrom.c | offset | subscript | yes? | FP |
| 6973 | Low | 40 | C | mmc_ioctl_cdrom_volume | drivers/cdrom/cdrom.c | offset | subscript | yes? | FP |
| 6974 | Low | 40 | C | mmc_ioctl_cdrom_volume | drivers/cdrom/cdrom.c | offset | subscript | yes? | FP |
| 6975 | Low | 40 | C | mmc_ioctl_cdrom_volume | drivers/cdrom/cdrom.c | offset | subscript | yes? | FP |
| 6976 | Low | 40 | C | mmc_ioctl_cdrom_volume | drivers/cdrom/cdrom.c | offset | subscript | yes? | FP |
| 6977 | Low | 40 | C | mmc_ioctl_cdrom_volume | drivers/cdrom/cdrom.c | offset | subscript | yes? | FP |
| 6978 | Low | 40 | C | mmc_ioctl_cdrom_volume | drivers/cdrom/cdrom.c | offset | subscript | yes? | FP |
| 6979 | Low | 40 | H | mmc_sd_num_wr_blocks | drivers/mmc/core/block.c | result | truncation | no | FP |
| 6980 | Low | 40 | C | move_block_contents | drivers/mtd/rfd_ftl.c | entry | subscript (callee) | yes? | FP |
| 6981 | Low | 40 | C | move_block_contents | drivers/mtd/rfd_ftl.c | entry | subscript (callee) | yes? | FP |
| 6982 | Low | 40 | H | mpi3mr_encldev_add_chg_evt_bh | drivers/scsi/mpi3mr/mpi3mr_os.c | present | truncation | no | FP |
| 6983 | Low | 40 | B | mpi3mr_process_op_reply_desc | drivers/scsi/mpi3mr/mpi3mr_os.c | scmd | scnprintf() in scsi_print_command() | yes? | FP |
| 6984 | Low | 40 | B | mpi3mr_process_op_reply_desc | drivers/scsi/mpi3mr/mpi3mr_os.c | scmd | scnprintf() in scsi_print_command() | yes? | FP |
| 6985 | Low | 40 | B | mpi3mr_process_op_reply_desc | drivers/scsi/mpi3mr/mpi3mr_os.c | scmd | scnprintf() in scsi_print_command() | yes? | FP |
| 6986 | Low | 40 | B | mpi3mr_process_op_reply_desc | drivers/scsi/mpi3mr/mpi3mr_os.c | scmd | scnprintf() in scsi_print_command() | yes? | FP |
| 6987 | Low | 40 | H | mpi3mr_process_op_reply_desc | drivers/scsi/mpi3mr/mpi3mr_os.c | throttle_enabled_dev | truncation | no | FP |
| 6988 | Low | 40 | H | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | port_id | truncation | no | FP |
| 6989 | Low | 40 | H | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | phy_id | truncation | no | FP |
| 6990 | Low | 40 | H | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | portstate | truncation | no | FP |
| 6991 | Low | 40 | H | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | eventType | truncation | no | FP |
| 6992 | Low | 40 | H | mpi_hw_event | drivers/scsi/pm8001/pm80xx_hwi.c | status | truncation | no | FP |
| 6993 | Low | 40 | H | mpi_hw_event | drivers/scsi/pm8001/pm8001_hwi.c | port_id | truncation | no | FP |
| 6994 | Low | 40 | H | mpi_hw_event | drivers/scsi/pm8001/pm8001_hwi.c | phy_id | truncation | no | FP |
| 6995 | Low | 40 | H | mpi_hw_event | drivers/scsi/pm8001/pm8001_hwi.c | eventType | truncation | no | FP |
| 6996 | Low | 40 | H | mpi_hw_event | drivers/scsi/pm8001/pm8001_hwi.c | status | truncation | no | FP |
| 6997 | Low | 40 | H | mpi_set_phy_profile_resp | drivers/scsi/pm8001/pm80xx_hwi.c | page_code | truncation | no | FP |
| 6998 | Low | 40 | H | mpt3sas_init_warpdrive_properties | drivers/scsi/mpt3sas/mpt3sas_warpdrive.c | stripe_exp | truncation | no | FP |
| 6999 | Low | 40 | H | mpt3sas_init_warpdrive_properties | drivers/scsi/mpt3sas/mpt3sas_warpdrive.c | block_exp | truncation | no | FP |
| 7000 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | event | truncation | no | FP |
| 7001 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | ReasonCode | truncation | no | FP |
| 7002 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | id | truncation | no | FP |
| 7003 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | channel | truncation | no | FP |
| 7004 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | ReasonCode | truncation | no | FP |
| 7005 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | curr_depth | truncation | no | FP |
| 7006 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | channel | truncation | no | FP |
| 7007 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | id | truncation | no | FP |
| 7008 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | LinkRates | truncation | no | FP |
| 7009 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | PhyNumber | truncation | no | FP |
| 7010 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | LinkRates | truncation | no | FP |
| 7011 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | resync_complete | truncation | no | FP |
| 7012 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | id | truncation | no | FP |
| 7013 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | channel | truncation | no | FP |
| 7014 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | phys_num | truncation | no | FP |
| 7015 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | ReasonCode | truncation | no | FP |
| 7016 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | phy_num | truncation | no | FP |
| 7017 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | port_num | truncation | no | FP |
| 7018 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | port_width | truncation | no | FP |
| 7019 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | primitive | truncation | no | FP |
| 7020 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | reason | truncation | no | FP |
| 7021 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | max_init | truncation | no | FP |
| 7022 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | current_init | truncation | no | FP |
| 7023 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | status | truncation | no | FP |
| 7024 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | port_num | truncation | no | FP |
| 7025 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | result | truncation | no | FP |
| 7026 | Low | 40 | H | mpt_display_event_info | drivers/message/fusion/mptbase.c | reason | truncation | no | FP |
| 7027 | Low | 40 | H | mptbase_reply | drivers/message/fusion/mptbase.c | event | truncation | no | FP |
| 7028 | Low | 40 | H | mptctl_event_process | drivers/message/fusion/mptctl.c | event | truncation | no | FP |
| 7029 | Low | 40 | H | mptfc_event_process | drivers/message/fusion/mptfc.c | event | truncation | no | FP |
| 7030 | Low | 40 | H | mptsas_send_link_status_event | drivers/message/fusion/mptsas.c | id | truncation | no | FP |
| 7031 | Low | 40 | H | mptsas_send_link_status_event | drivers/message/fusion/mptsas.c | channel | truncation | no | FP |
| 7032 | Low | 40 | H | mptscsih_event_process | drivers/message/fusion/mptscsih.c | event | truncation | no | FP |
| 7033 | Low | 40 | C | mptscsih_io_done | drivers/message/fusion/mptscsih.c | req_idx | subscript (callee) | yes? | FP |
| 7034 | Low | 40 | C | mptscsih_io_done | drivers/message/fusion/mptscsih.c | req_idx | subscript (callee) | yes? | FP |
| 7035 | Low | 40 | C | mptscsih_qcmd | drivers/message/fusion/mptscsih.c | my_idx | subscript (callee) | yes? | FP |
| 7036 | Low | 40 | C | mptscsih_qcmd | drivers/message/fusion/mptscsih.c | my_idx | subscript (callee) | yes? | FP |
| 7037 | Low | 40 | C | mptscsih_qcmd | drivers/message/fusion/mptscsih.c | my_idx | subscript (callee) | yes? | FP |
| 7038 | Low | 40 | C | mptscsih_qcmd | drivers/message/fusion/mptscsih.c | my_idx | subscript (callee) | yes? | FP |
| 7039 | Low | 40 | C | mptscsih_qcmd | drivers/message/fusion/mptscsih.c | my_idx | subscript (callee) | yes? | FP |
| 7040 | Low | 40 | H | mptspi_event_process | drivers/message/fusion/mptspi.c | event | truncation | no | FP |
| 7041 | Low | 40 | H | mrf24j40_filter | drivers/net/ieee802154/mrf24j40.c | addrh | truncation | no | FP |
| 7042 | Low | 40 | H | mrf24j40_filter | drivers/net/ieee802154/mrf24j40.c | addrl | truncation | no | FP |
| 7043 | Low | 40 | H | mrf24j40_filter | drivers/net/ieee802154/mrf24j40.c | panidh | truncation | no | FP |
| 7044 | Low | 40 | H | mrf24j40_filter | drivers/net/ieee802154/mrf24j40.c | panidl | truncation | no | FP |
| 7045 | Low | 40 | H | msb_ftl_scan | drivers/memstick/core/ms_block.c | other_overwrite_flag | truncation | no | FP |
| 7046 | Low | 40 | C | msb_read_bad_block_table | drivers/memstick/core/ms_block.c | bad_block | subscript (callee) | yes? | FP |
| 7047 | Low | 40 | C | mt7603_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7603/mac.c | i | subscript | yes? | FP |
| 7048 | Low | 40 | H | mt7603_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7603/mac.c | key_id | truncation | no | FP |
| 7049 | Low | 40 | H | mt7603_mac_write_txwi | drivers/net/wireless/mediatek/mt76/mt7603/mac.c | frame_type | truncation | no | FP |
| 7050 | Low | 40 | H | mt7603_mac_write_txwi | drivers/net/wireless/mediatek/mt76/mt7603/mac.c | frame_subtype | truncation | no | FP |
| 7051 | Low | 40 | H | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | chfreq | truncation | no | FP |
| 7052 | Low | 40 | H | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | fc | truncation | no | FP |
| 7053 | Low | 40 | H | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | qos_ctl | truncation | no | FP |
| 7054 | Low | 40 | H | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | seq_ctrl | truncation | no | FP |
| 7055 | Low | 40 | H | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | stbc | truncation | no | FP |
| 7056 | Low | 40 | H | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | amsdu_info | truncation | no | FP |
| 7057 | Low | 40 | H | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | hdr_gap | truncation | no | FP |
| 7058 | Low | 40 | H | mt7615_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | key_id | truncation | no | FP |
| 7059 | Low | 40 | H | mt7615_mac_fill_tm_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | cbw | truncation | no | FP |
| 7060 | Low | 40 | H | mt7615_mac_fill_tm_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | mode | truncation | no | FP |
| 7061 | Low | 40 | H | mt7615_mac_fill_tm_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | foe | truncation | no | FP |
| 7062 | Low | 40 | H | mt7615_mac_fill_tm_rx | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | foe | truncation | no | FP |
| 7063 | Low | 40 | H | mt7615_mac_write_txwi | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | fc_type | truncation | no | FP |
| 7064 | Low | 40 | H | mt7615_mac_write_txwi | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | fc_stype | truncation | no | FP |
| 7065 | Low | 40 | H | mt7615_txwi_free | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | wcid | truncation | no | FP |
| 7066 | Low | 40 | H | mt76_connac2_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | nss | truncation | no | FP |
| 7067 | Low | 40 | H | mt76_connac2_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | stbc | truncation | no | FP |
| 7068 | Low | 40 | H | mt76_connac2_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | gi | truncation | no | FP |
| 7069 | Low | 40 | H | mt76_connac2_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | dcm | truncation | no | FP |
| 7070 | Low | 40 | H | mt76_connac2_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | dcm | truncation | no | FP |
| 7071 | Low | 40 | H | mt76_connac2_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | bw | truncation | no | FP |
| 7072 | Low | 40 | H | mt76_connac2_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | stbc | truncation | no | FP |
| 7073 | Low | 40 | H | mt76_connac2_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | gi | truncation | no | FP |
| 7074 | Low | 40 | H | mt76_connac2_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | dcm | truncation | no | FP |
| 7075 | Low | 40 | H | mt76_connac2_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | bw | truncation | no | FP |
| 7076 | Low | 40 | H | mt76_connac2_mac_write_txwi_80211 | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | tid | truncation | no | FP |
| 7077 | Low | 40 | H | mt76_connac2_mac_write_txwi_80211 | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | tid | truncation | no | FP |
| 7078 | Low | 40 | H | mt76_connac2_mac_write_txwi_80211 | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | fc_type | truncation | no | FP |
| 7079 | Low | 40 | H | mt76_connac2_mac_write_txwi_80211 | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | fc_stype | truncation | no | FP |
| 7080 | Low | 40 | H | mt76_connac2_tx_check_aggr | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | fc | truncation | no | FP |
| 7081 | Low | 40 | H | mt76_connac3_mac_decode_eht_radiotap | drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.c | bw | truncation | no | FP |
| 7082 | Low | 40 | H | mt76_dma_get_rxdmad_c_buf | drivers/net/wireless/mediatek/mt76/dma.c | rx_token_id | truncation | no | FP |
| 7083 | Low | 40 | H | mt76_dma_get_rxdmad_c_buf | drivers/net/wireless/mediatek/mt76/dma.c | ind_reason | truncation | no | FP |
| 7084 | Low | 40 | H | mt76_rx_aggr_check_ctl | drivers/net/wireless/mediatek/mt76/agg-rx.c | tidno | truncation | no | FP |
| 7085 | Low | 40 | H | mt76x02_mac_process_rx | drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | wcid | truncation | no | FP |
| 7086 | Low | 40 | H | mt76x02_mac_process_rx | drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | pn_len | truncation | no | FP |
| 7087 | Low | 40 | H | mt7915_mac_add_twt_setup | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | exp | truncation | no | FP |
| 7088 | Low | 40 | H | mt7915_mac_check_twt_req | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | exp | truncation | no | FP |
| 7089 | Low | 40 | H | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | remove_pad | truncation | no | FP |
| 7090 | Low | 40 | H | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | fc | truncation | no | FP |
| 7091 | Low | 40 | H | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | qos_ctl | truncation | no | FP |
| 7092 | Low | 40 | H | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | seq_ctrl | truncation | no | FP |
| 7093 | Low | 40 | H | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | amsdu_info | truncation | no | FP |
| 7094 | Low | 40 | H | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | hdr_gap | truncation | no | FP |
| 7095 | Low | 40 | H | mt7915_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | key_id | truncation | no | FP |
| 7096 | Low | 40 | H | mt7915_mac_fill_rx_vector | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | snr | truncation | no | FP |
| 7097 | Low | 40 | H | mt7915_mac_twt_param_equal | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | exp | truncation | no | FP |
| 7098 | Low | 40 | H | mt7915_mac_tx_free | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | idx | truncation | no | FP |
| 7099 | Low | 40 | H | mt7915_mac_tx_free_v0 | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | count | truncation | no | FP |
| 7100 | Low | 40 | H | mt7915_mcu_sta_bfer_he | drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | nss_mcs | truncation | no | FP |
| 7101 | Low | 40 | H | mt7915_mcu_sta_bfer_he | drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | nss_mcs | truncation | no | FP |
| 7102 | Low | 40 | H | mt7915_mcu_sta_bfer_he | drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | nss_mcs | truncation | no | FP |
| 7103 | Low | 40 | H | mt7915_mcu_sta_bfer_vht | drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | nss_mcs | truncation | no | FP |
| 7104 | Low | 40 | H | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | chfreq | truncation | no | FP |
| 7105 | Low | 40 | H | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | remove_pad | truncation | no | FP |
| 7106 | Low | 40 | H | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | fc | truncation | no | FP |
| 7107 | Low | 40 | H | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | seq_ctrl | truncation | no | FP |
| 7108 | Low | 40 | H | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | qos_ctl | truncation | no | FP |
| 7109 | Low | 40 | H | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | amsdu_info | truncation | no | FP |
| 7110 | Low | 40 | H | mt7921_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | key_id | truncation | no | FP |
| 7111 | Low | 40 | H | mt7921_mac_tx_free | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | idx | truncation | no | FP |
| 7112 | Low | 40 | H | mt7921_mac_tx_free | drivers/net/wireless/mediatek/mt76/mt7921/mac.c | stat | truncation | no | FP |
| 7113 | Low | 40 | H | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | chfreq | truncation | no | FP |
| 7114 | Low | 40 | H | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | remove_pad | truncation | no | FP |
| 7115 | Low | 40 | H | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | fc | truncation | no | FP |
| 7116 | Low | 40 | H | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | seq_ctrl | truncation | no | FP |
| 7117 | Low | 40 | H | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | qos_ctl | truncation | no | FP |
| 7118 | Low | 40 | H | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | amsdu_info | truncation | no | FP |
| 7119 | Low | 40 | H | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | hdr_gap | truncation | no | FP |
| 7120 | Low | 40 | H | mt7925_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | key_id | truncation | no | FP |
| 7121 | Low | 40 | H | mt7925_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | nss | truncation | no | FP |
| 7122 | Low | 40 | H | mt7925_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | stbc | truncation | no | FP |
| 7123 | Low | 40 | H | mt7925_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | gi | truncation | no | FP |
| 7124 | Low | 40 | H | mt7925_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | dcm | truncation | no | FP |
| 7125 | Low | 40 | H | mt7925_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | bw | truncation | no | FP |
| 7126 | Low | 40 | H | mt7925_mac_tx_free | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | idx | truncation | no | FP |
| 7127 | Low | 40 | H | mt7925_mac_write_txwi_80211 | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | fc_type | truncation | no | FP |
| 7128 | Low | 40 | H | mt7925_mac_write_txwi_80211 | drivers/net/wireless/mediatek/mt76/mt7925/mac.c | fc_stype | truncation | no | FP |
| 7129 | Low | 40 | H | mt7996_mac_add_twt_setup | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | exp | truncation | no | FP |
| 7130 | Low | 40 | H | mt7996_mac_add_txs_skb | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | tid | truncation | no | FP |
| 7131 | Low | 40 | H | mt7996_mac_check_twt_req | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | exp | truncation | no | FP |
| 7132 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | sband | truncation | no | FP |
| 7133 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | sband | truncation | no | FP |
| 7134 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | sband | truncation | no | FP |
| 7135 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | sband | truncation | no | FP |
| 7136 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | sband | truncation | no | FP |
| 7137 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | band_idx | truncation | no | FP |
| 7138 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | remove_pad | truncation | no | FP |
| 7139 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | fc | truncation | no | FP |
| 7140 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | qos_ctl | truncation | no | FP |
| 7141 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | seq_ctrl | truncation | no | FP |
| 7142 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | amsdu_info | truncation | no | FP |
| 7143 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | hdr_gap | truncation | no | FP |
| 7144 | Low | 40 | H | mt7996_mac_fill_rx | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | key_id | truncation | no | FP |
| 7145 | Low | 40 | H | mt7996_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | nss | truncation | no | FP |
| 7146 | Low | 40 | H | mt7996_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | stbc | truncation | no | FP |
| 7147 | Low | 40 | H | mt7996_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | gi | truncation | no | FP |
| 7148 | Low | 40 | H | mt7996_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | dcm | truncation | no | FP |
| 7149 | Low | 40 | H | mt7996_mac_fill_rx_rate | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | bw | truncation | no | FP |
| 7150 | Low | 40 | H | mt7996_mac_twt_param_equal | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | exp | truncation | no | FP |
| 7151 | Low | 40 | H | mt7996_mac_tx_free | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | idx | truncation | no | FP |
| 7152 | Low | 40 | H | mt7996_mac_write_txwi_80211 | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | fc_type | truncation | no | FP |
| 7153 | Low | 40 | H | mt7996_mac_write_txwi_80211 | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | fc_stype | truncation | no | FP |
| 7154 | Low | 40 | H | mt7996_mcu_sta_bfer_he | drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | nss_mcs | truncation | no | FP |
| 7155 | Low | 40 | H | mt7996_mcu_sta_bfer_he | drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | nss_mcs | truncation | no | FP |
| 7156 | Low | 40 | H | mt7996_mcu_sta_bfer_he | drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | nss_mcs | truncation | no | FP |
| 7157 | Low | 40 | H | mt7996_mcu_sta_bfer_vht | drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | nss_mcs | truncation | no | FP |
| 7158 | Low | 40 | C | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | len | subscript (callee) | yes? | FP |
| 7159 | Low | 40 | H | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | ind_reason | truncation | no | FP |
| 7160 | Low | 40 | H | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | start_seq | truncation | no | FP |
| 7161 | Low | 40 | H | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | signature | truncation | no | FP |
| 7162 | Low | 40 | H | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | rx_token_id | truncation | no | FP |
| 7163 | Low | 40 | C | mthca_cmd_poll | drivers/infiniband/hw/mthca/mthca_cmd.c | status | subscript (callee) | yes? | FP |
| 7164 | Low | 40 | C | mthca_cmd_poll | drivers/infiniband/hw/mthca/mthca_cmd.c | status | subscript (callee) | yes? | FP |
| 7165 | Low | 40 | H | mthca_cmd_poll | drivers/infiniband/hw/mthca/mthca_cmd.c | status | truncation | no | FP |
| 7166 | Low | 40 | H | mthca_poll_one | drivers/infiniband/hw/mthca/mthca_cq.c | checksum | truncation | no | FP |
| 7167 | Low | 40 | C | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | if_id | subscript (callee) | yes? | FP |
| 7168 | Low | 40 | C | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | if_id | subscript | yes? | FP |
| 7169 | Low | 40 | C | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | if_id | subscript | yes? | FP |
| 7170 | Low | 40 | H | mv_process_crpb_entries | drivers/ata/sata_mv.c | tag | truncation | no | FP |
| 7171 | Low | 40 | H | mv_process_crpb_entries | drivers/ata/sata_mv.c | tag | truncation | no | FP |
| 7172 | Low | 40 | H | mv_process_crpb_response | drivers/ata/sata_mv.c | err_cause | truncation | no | FP |
| 7173 | Low | 40 | H | mv_process_crpb_response | drivers/ata/sata_mv.c | ata_status | truncation | no | FP |
| 7174 | Low | 40 | H | mwifiex_cfg80211_authenticate | drivers/net/wireless/marvell/mwifiex/cfg80211.c | trans | truncation | no | FP |
| 7175 | Low | 40 | H | mwifiex_cfg80211_authenticate | drivers/net/wireless/marvell/mwifiex/cfg80211.c | status_code | truncation | no | FP |
| 7176 | Low | 40 | H | mwifiex_cmd_11n_addba_rsp_gen | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | tid | truncation | no | FP |
| 7177 | Low | 40 | B | mwifiex_deaggr_sdio_pkt | drivers/net/wireless/marvell/mwifiex/sdio.c | pkt_len | memcpy() | yes? | FP |
| 7178 | Low | 40 | C | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | subscript (callee) | yes? | FP |
| 7179 | Low | 40 | B | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | memcpy() in mwifiex_process_tdls_action_frame() | yes? | FP |
| 7180 | Low | 40 | B | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | memcpy() in mwifiex_process_tdls_action_frame() | yes? | FP |
| 7181 | Low | 40 | B | mwifiex_ret_802_11_key_material_v1 | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | len | memcpy() | yes? | FP |
| 7182 | Low | 40 | B | mwifiex_ret_802_11_key_material_v2 | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | len | memcpy() | yes? | FP |
| 7183 | Low | 40 | H | mwifiex_ret_802_11_scan | drivers/net/wireless/marvell/mwifiex/scan.c | is_bgscan_resp | truncation | no | FP |
| 7184 | Low | 40 | H | mwifiex_ret_802_11_scan | drivers/net/wireless/marvell/mwifiex/scan.c | ret | truncation | no | FP |
| 7185 | Low | 40 | B | mwifiex_sdio_card_to_host_mp_aggr | drivers/net/wireless/marvell/mwifiex/sdio.c | pkt_len | memcpy() | yes? | FP |
| 7186 | Low | 40 | H | mwifiex_tdls_add_vht_oper | drivers/net/wireless/marvell/mwifiex/tdls.c | peer_supp_chwd_set | truncation | no | FP |
| 7187 | Low | 40 | H | mwifiex_tdls_add_vht_oper | drivers/net/wireless/marvell/mwifiex/tdls.c | supp_chwd_set | truncation | no | FP |
| 7188 | Low | 40 | H | mwifiex_tdls_add_vht_oper | drivers/net/wireless/marvell/mwifiex/tdls.c | ap_supp_chwd_set | truncation | no | FP |
| 7189 | Low | 40 | H | mwifiex_tdls_add_vht_oper | drivers/net/wireless/marvell/mwifiex/tdls.c | supp_chwd_set | truncation | no | FP |
| 7190 | Low | 40 | C | mwifiex_update_autoindex_ies | drivers/net/wireless/marvell/mwifiex/ie.c | index | subscript | yes? | FP |
| 7191 | Low | 40 | C | mwifiex_update_autoindex_ies | drivers/net/wireless/marvell/mwifiex/ie.c | index | subscript | yes? | FP |
| 7192 | Low | 40 | C | mwifiex_update_autoindex_ies | drivers/net/wireless/marvell/mwifiex/ie.c | index | subscript | yes? | FP |
| 7193 | Low | 40 | C | mwifiex_update_autoindex_ies | drivers/net/wireless/marvell/mwifiex/ie.c | index | subscript | yes? | FP |
| 7194 | Low | 40 | C | mwifiex_update_autoindex_ies | drivers/net/wireless/marvell/mwifiex/ie.c | index | subscript | yes? | FP |
| 7195 | Low | 40 | B | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | stream | memset() in mwl8k_remove_stream() | yes? | FP |
| 7196 | Low | 40 | H | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tid | truncation | no | FP |
| 7197 | Low | 40 | H | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | tid | truncation | no | FP |
| 7198 | Low | 40 | C | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | txq | subscript | yes? | FP |
| 7199 | Low | 40 | C | mwl8k_txq_xmit | drivers/net/wireless/marvell/mwl8k.c | txq | subscript | yes? | FP |
| 7200 | Low | 40 | C | mxuport_process_read_urb_demux_data | drivers/usb/serial/mxuport.c | rcv_port | subscript | yes? | FP |
| 7201 | Low | 40 | C | mxuport_process_read_urb_demux_event | drivers/usb/serial/mxuport.c | rcv_port | subscript | yes? | FP |
| 7202 | Low | 40 | H | nbd_handle_reply | drivers/block/nbd.c | tag | truncation | no | FP |
| 7203 | Low | 40 | H | nbd_handle_reply | drivers/block/nbd.c | hwq | truncation | no | FP |
| 7204 | Low | 40 | C | nbd_handle_reply | drivers/block/nbd.c | hwq | subscript | yes? | FP |
| 7205 | Low | 40 | H | nd_pfn_clear_memmap_errors | drivers/nvdimm/pfn_devs.c | rc | truncation | no | FP |
| 7206 | Low | 40 | H | nd_pfn_clear_memmap_errors | drivers/nvdimm/pfn_devs.c | bb_present | truncation | no | FP |
| 7207 | Low | 40 | C | ndfc_probe | drivers/mtd/nand/raw/ndfc.c | cs | subscript | yes? | FP |
| 7208 | Low | 40 | C | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | subscript (callee) | yes? | FP |
| 7209 | Low | 40 | C | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | sts_data0 | subscript (callee) | yes? | FP |
| 7210 | Low | 40 | C | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | subscript (callee) | yes? | FP |
| 7211 | Low | 40 | C | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | sts_data0 | subscript (callee) | yes? | FP |
| 7212 | Low | 40 | H | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | desc_cnt | truncation | no | FP |
| 7213 | Low | 40 | H | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | opcode | truncation | no | FP |
| 7214 | Low | 40 | H | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | truncation | no | FP |
| 7215 | Low | 40 | H | netxen_process_rcv_ring | drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | ring | truncation | no | FP |
| 7216 | Low | 40 | C | new_steering_entry | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | subscript | yes? | FP |
| 7217 | Low | 40 | C | nexio_read_data | drivers/input/touchscreen/usbtouchscreen.c | y | subscript | yes? | FP |
| 7218 | Low | 40 | H | nfp_abm_u32_knode_replace | drivers/net/ethernet/netronome/nfp/abm/cls.c | val | truncation | no | FP |
| 7219 | Low | 40 | H | nfp_abm_u32_knode_replace | drivers/net/ethernet/netronome/nfp/abm/cls.c | mask | truncation | no | FP |
| 7220 | Low | 40 | C | nfp_bpf_ctrl_rc_to_errno | drivers/net/ethernet/netronome/nfp/bpf/cmsg.c | rc | subscript | yes? | FP |
| 7221 | Low | 40 | H | nfp_bpf_event_output | drivers/net/ethernet/netronome/nfp/bpf/offload.c | map_id | truncation | no | FP |
| 7222 | Low | 40 | H | nfp_eth_port_translate | drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp_eth.c | rate | truncation | no | FP |
| 7223 | Low | 40 | H | nfp_eth_port_translate | drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp_eth.c | fec | truncation | no | FP |
| 7224 | Low | 40 | H | nfp_eth_port_translate | drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp_eth.c | fec | truncation | no | FP |
| 7225 | Low | 40 | C | nfp_nsp_versions_get | drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c | buf_off | subscript | yes? | FP |
| 7226 | Low | 40 | C | nfp_nsp_versions_get | drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c | buf_off | subscript | yes? | FP |
| 7227 | Low | 40 | H | nv_rx_process_optimized | drivers/net/ethernet/nvidia/forcedeth.c | vid | truncation | no | FP |
| 7228 | Low | 40 | B | nvme_auth_process_dhchap_challenge | drivers/nvme/host/auth.c | dhvlen | kmalloc() | yes? | FP |
| 7229 | Low | 40 | B | nvme_auth_process_dhchap_challenge | drivers/nvme/host/auth.c | dhvlen | memcpy() | yes? | FP |
| 7230 | Low | 40 | H | nvme_configure_pi_elbas | drivers/nvme/host/core.c | guard_type | truncation | no | FP |
| 7231 | Low | 40 | H | nvme_configure_pi_elbas | drivers/nvme/host/core.c | guard_type | truncation | no | FP |
| 7232 | Low | 40 | H | nvme_dbbuf_update_and_check_event | drivers/nvme/host/pci.c | old_value | truncation | no | FP |
| 7233 | Low | 40 | H | nvme_dbbuf_update_and_check_event | drivers/nvme/host/pci.c | event_idx | truncation | no | FP |
| 7234 | Low | 40 | C | nvme_tcp_handle_c2h_term | drivers/nvme/host/tcp.c | fes | subscript | yes? | FP |
| 7235 | Low | 40 | H | nvmet_bdev_zone_zmgmt_recv_work | drivers/nvme/target/zns.c | status | truncation | no | FP |
| 7236 | Low | 40 | C | nvmet_execute_admin_connect | drivers/nvme/target/fabrics-cmd.c | ctrl | subscript (callee) | yes? | FP |
| 7237 | Low | 40 | C | nvmet_execute_create_sq | drivers/nvme/target/admin-cmd.c | sqid | subscript (callee) | yes? | FP |
| 7238 | Low | 40 | C | nvmet_execute_create_sq | drivers/nvme/target/admin-cmd.c | sqid | subscript (callee) | yes? | FP |
| 7239 | Low | 40 | C | nvmet_execute_delete_sq | drivers/nvme/target/admin-cmd.c | sqid | subscript (callee) | yes? | FP |
| 7240 | Low | 40 | C | nvmet_execute_delete_sq | drivers/nvme/target/admin-cmd.c | sqid | subscript (callee) | yes? | FP |
| 7241 | Low | 40 | C | nvmet_execute_io_connect | drivers/nvme/target/fabrics-cmd.c | ctrl | subscript (callee) | yes? | FP |
| 7242 | Low | 40 | C | nvmet_execute_io_connect | drivers/nvme/target/fabrics-cmd.c | ctrl | subscript (callee) | yes? | FP |
| 7243 | Low | 40 | H | nvmet_execute_pr_acquire | drivers/nvme/target/pr.c | rtype | truncation | no | FP |
| 7244 | Low | 40 | H | nvmet_execute_pr_acquire | drivers/nvme/target/pr.c | acquire_act | truncation | no | FP |
| 7245 | Low | 40 | H | nvmet_execute_pr_acquire | drivers/nvme/target/pr.c | status | truncation | no | FP |
| 7246 | Low | 40 | H | nvmet_execute_pr_register | drivers/nvme/target/pr.c | ignore_key | truncation | no | FP |
| 7247 | Low | 40 | H | nvmet_execute_pr_register | drivers/nvme/target/pr.c | reg_act | truncation | no | FP |
| 7248 | Low | 40 | H | nvmet_execute_pr_register | drivers/nvme/target/pr.c | status | truncation | no | FP |
| 7249 | Low | 40 | H | nvmet_execute_pr_register | drivers/nvme/target/pr.c | status | truncation | no | FP |
| 7250 | Low | 40 | H | nvmet_execute_pr_release | drivers/nvme/target/pr.c | rtype | truncation | no | FP |
| 7251 | Low | 40 | H | nvmet_execute_pr_release | drivers/nvme/target/pr.c | release_act | truncation | no | FP |
| 7252 | Low | 40 | H | nvmet_execute_pr_release | drivers/nvme/target/pr.c | status | truncation | no | FP |
| 7253 | Low | 40 | H | nvmet_execute_pr_report | drivers/nvme/target/pr.c | eds | truncation | no | FP |
| 7254 | Low | 40 | B | nvmet_execute_pr_report | drivers/nvme/target/pr.c | num_bytes | kzalloc() | yes? | FP |
| 7255 | Low | 40 | H | nvmet_execute_set_features | drivers/nvme/target/admin-cmd.c | ncqr | truncation | no | FP |
| 7256 | Low | 40 | H | nvmet_execute_set_features | drivers/nvme/target/admin-cmd.c | nsqr | truncation | no | FP |
| 7257 | Low | 40 | H | nvmet_execute_set_features | drivers/nvme/target/admin-cmd.c | status | truncation | no | FP |
| 7258 | Low | 40 | C | nvmet_fc_ls_create_connection | drivers/nvme/target/fc.c | be16_to_cpu(rqst->connect_cmd.qid) | subscript (callee) | yes? | FP |
| 7259 | Low | 40 | C | nvmet_fc_ls_create_connection | drivers/nvme/target/fc.c | be16_to_cpu(rqst->connect_cmd.qid) | subscript (callee) | yes? | FP |
| 7260 | Low | 40 | C | nvmet_fc_rcv_fcp_req | drivers/nvme/target/fc.c | be64_to_cpu(cmdiu->connection_id) | subscript (callee) | yes? | FP |
| 7261 | Low | 40 | H | nvmet_get_feat_irq_config | drivers/nvme/target/admin-cmd.c | status | truncation | no | FP |
| 7262 | Low | 40 | H | nvmet_pci_epf_get_sgl_segment | drivers/nvme/target/pci-epf.c | ret | truncation | no | FP |
| 7263 | Low | 40 | H | nvmet_pci_epf_iod_parse_prp_list | drivers/nvme/target/pci-epf.c | nr_segs | truncation | no | FP |
| 7264 | Low | 40 | H | nvmet_pci_epf_iod_parse_prp_list | drivers/nvme/target/pci-epf.c | ret | truncation | no | FP |
| 7265 | Low | 40 | H | nvmet_pci_epf_iod_parse_prp_list | drivers/nvme/target/pci-epf.c | nr_prps | truncation | no | FP |
| 7266 | Low | 40 | H | nvmet_pr_replace | drivers/nvme/target/pr.c | status | truncation | no | FP |
| 7267 | Low | 40 | H | nvmet_rdma_map_sgl_keyed | drivers/nvme/target/rdma.c | ret | truncation | no | FP |
| 7268 | Low | 40 | B | nx842_crypto_decompress | drivers/crypto/nx/nx-842.c | ignore | memset() in decompress() | yes? | FP |
| 7269 | Low | 40 | B | nx842_crypto_decompress | drivers/crypto/nx/nx-842.c | ignore | memcpy() in decompress() | yes? | FP |
| 7270 | Low | 40 | B | nx842_crypto_decompress | drivers/crypto/nx/nx-842.c | ignore | memcpy() in decompress() | yes? | FP |
| 7271 | Low | 40 | C | ocrdma_poll_err_scqe | drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | status | subscript | yes? | FP |
| 7272 | Low | 40 | H | ocrdma_poll_hwcq | drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | qpn | truncation | no | FP |
| 7273 | Low | 40 | C | ocrdma_poll_rcqe | drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | status | subscript (callee) | yes? | FP |
| 7274 | Low | 40 | H | ocrdma_update_ud_rcqe | drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | hdr_type | truncation | no | FP |
| 7275 | Low | 40 | C | of_irq_parse_raw | drivers/of/irq.c | addrsize | subscript | yes? | FP |
| 7276 | Low | 40 | B | onie_tlv_parse_table | drivers/nvmem/layouts/onie-tlv.c | table_len | devm_kmalloc() | yes? | FP |
| 7277 | Low | 40 | H | opfn_conn_response | drivers/infiniband/hw/hfi1/opfn.c | capcode | truncation | no | FP |
| 7278 | Low | 40 | C | opfn_conn_response | drivers/infiniband/hw/hfi1/opfn.c | capcode | subscript | yes? | FP |
| 7279 | Low | 40 | H | orc_load_firmware | drivers/scsi/a100u2w.c | bios_addr | truncation | no | FP |
| 7280 | Low | 40 | H | out_rq_cur | drivers/usb/gadget/function/f_uac1.c | entity_id | truncation | no | FP |
| 7281 | Low | 40 | H | out_rq_cur | drivers/usb/gadget/function/f_uac1.c | control_selector | truncation | no | FP |
| 7282 | Low | 40 | H | out_rq_cur | drivers/usb/gadget/function/f_uac2.c | entity_id | truncation | no | FP |
| 7283 | Low | 40 | H | out_rq_cur | drivers/usb/gadget/function/f_uac2.c | control_selector | truncation | no | FP |
| 7284 | Low | 40 | H | out_rq_cur | drivers/usb/gadget/function/f_uac2.c | clock_id | truncation | no | FP |
| 7285 | Low | 40 | H | out_rq_cur_complete | drivers/usb/gadget/function/f_uac1.c | entity_id | truncation | no | FP |
| 7286 | Low | 40 | H | out_rq_cur_complete | drivers/usb/gadget/function/f_uac1.c | control_selector | truncation | no | FP |
| 7287 | Low | 40 | H | out_rq_cur_complete | drivers/usb/gadget/function/f_uac2.c | entity_id | truncation | no | FP |
| 7288 | Low | 40 | H | out_rq_cur_complete | drivers/usb/gadget/function/f_uac2.c | control_selector | truncation | no | FP |
| 7289 | Low | 40 | B | p54_convert_db | drivers/net/wireless/intersil/p54/eeprom.c | payload_len | memcpy() | yes? | FP |
| 7290 | Low | 40 | C | p54_generate_channel_lists | drivers/net/wireless/intersil/p54/eeprom.c | freq | subscript (callee) | yes? | FP |
| 7291 | Low | 40 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | data_len | kzalloc() in p54_parse_rssical() | yes? | FP |
| 7292 | Low | 40 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | kmalloc() in p54_convert_output_limits() | yes? | FP |
| 7293 | Low | 40 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | entry | memcpy() in p54_convert_output_limits() | yes? | FP |
| 7294 | Low | 40 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | pda | kmalloc() in p54_convert_db() | yes? | FP |
| 7295 | Low | 40 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | data_len | kmalloc() in p54_convert_db() | yes? | FP |
| 7296 | Low | 40 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | pda | memcpy() in p54_convert_db() | yes? | FP |
| 7297 | Low | 40 | B | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | data_len | memcpy() in p54_convert_db() | yes? | FP |
| 7298 | Low | 40 | B | pagefault_data_segments | drivers/infiniband/hw/mlx5/odp.c | be32_to_cpu(key) | kzalloc() in pagefault_single_data_segment() | yes? | FP |
| 7299 | Low | 40 | C | par_io_of_config | drivers/soc/fsl/qe/qe_io.c | port | subscript (callee) | yes? | FP |
| 7300 | Low | 40 | H | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | tos | truncation | no | FP |
| 7301 | Low | 40 | C | pci_epf_test_bar_subrange_clear | drivers/pci/endpoint/functions/pci-epf-test.c | bar | subscript (callee) | yes? | FP |
| 7302 | Low | 40 | C | pci_epf_test_bar_subrange_clear | drivers/pci/endpoint/functions/pci-epf-test.c | bar | subscript (callee) | yes? | FP |
| 7303 | Low | 40 | C | pci_epf_test_bar_subrange_clear | drivers/pci/endpoint/functions/pci-epf-test.c | barno | subscript | yes? | FP |
| 7304 | Low | 40 | C | pci_epf_test_bar_subrange_setup | drivers/pci/endpoint/functions/pci-epf-test.c | bar | subscript (callee) | yes? | FP |
| 7305 | Low | 40 | C | pci_epf_test_bar_subrange_setup | drivers/pci/endpoint/functions/pci-epf-test.c | bar | subscript (callee) | yes? | FP |
| 7306 | Low | 40 | C | pci_epf_test_bar_subrange_setup | drivers/pci/endpoint/functions/pci-epf-test.c | barno | subscript | yes? | FP |
| 7307 | Low | 40 | H | pci_epf_test_copy | drivers/pci/endpoint/functions/pci-epf-test.c | ret | truncation | no | FP |
| 7308 | Low | 40 | H | pci_epf_test_copy | drivers/pci/endpoint/functions/pci-epf-test.c | ret | truncation | no | FP |
| 7309 | Low | 40 | H | pci_epf_test_read | drivers/pci/endpoint/functions/pci-epf-test.c | ret | truncation | no | FP |
| 7310 | Low | 40 | H | pci_epf_test_write | drivers/pci/endpoint/functions/pci-epf-test.c | ret | truncation | no | FP |
| 7311 | Low | 40 | H | pcnet32_rx_entry | drivers/net/ethernet/amd/pcnet32.c | pkt_len | truncation | no | FP |
| 7312 | Low | 40 | H | peer_abort | drivers/infiniband/hw/cxgb4/cm.c | status | truncation | no | FP |
| 7313 | Low | 40 | C | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | skb | subscript (callee) | yes? | FP |
| 7314 | Low | 40 | C | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | len | subscript | yes? | FP |
| 7315 | Low | 40 | C | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | len | subscript | yes? | FP |
| 7316 | Low | 40 | C | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | len | subscript | yes? | FP |
| 7317 | Low | 40 | C | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | len | subscript | yes? | FP |
| 7318 | Low | 40 | C | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | len | subscript | yes? | FP |
| 7319 | Low | 40 | C | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | len | subscript | yes? | FP |
| 7320 | Low | 40 | C | pio_rx_frame | drivers/net/wireless/broadcom/b43/pio.c | len | subscript | yes? | FP |
| 7321 | Low | 40 | H | pm8001_mpi_set_dev_state_resp | drivers/scsi/pm8001/pm8001_hwi.c | pds | truncation | no | FP |
| 7322 | Low | 40 | H | pm8001_mpi_set_dev_state_resp | drivers/scsi/pm8001/pm8001_hwi.c | nds | truncation | no | FP |
| 7323 | Low | 40 | H | pma_get_opa_datacounters | drivers/infiniband/hw/hfi1/mad.c | num_vls | truncation | no | FP |
| 7324 | Low | 40 | H | pma_get_opa_datacounters | drivers/infiniband/hw/hfi1/mad.c | res_lli | truncation | no | FP |
| 7325 | Low | 40 | H | pma_get_opa_datacounters | drivers/infiniband/hw/hfi1/mad.c | res_lli | truncation | no | FP |
| 7326 | Low | 40 | H | pma_get_opa_datacounters | drivers/infiniband/hw/hfi1/mad.c | res_ler | truncation | no | FP |
| 7327 | Low | 40 | H | pma_get_opa_datacounters | drivers/infiniband/hw/hfi1/mad.c | res_ler | truncation | no | FP |
| 7328 | Low | 40 | H | pma_get_opa_datacounters | drivers/infiniband/hw/hfi1/mad.c | port_num | truncation | no | FP |
| 7329 | Low | 40 | H | pma_get_opa_errorinfo | drivers/infiniband/hw/hfi1/mad.c | num_pslm | truncation | no | FP |
| 7330 | Low | 40 | H | pma_get_opa_errorinfo | drivers/infiniband/hw/hfi1/mad.c | port_num | truncation | no | FP |
| 7331 | Low | 40 | H | pma_get_opa_porterrors | drivers/infiniband/hw/hfi1/mad.c | num_pslm | truncation | no | FP |
| 7332 | Low | 40 | H | pma_get_opa_porterrors | drivers/infiniband/hw/hfi1/mad.c | num_vls | truncation | no | FP |
| 7333 | Low | 40 | H | pma_get_opa_porterrors | drivers/infiniband/hw/hfi1/mad.c | port_num | truncation | no | FP |
| 7334 | Low | 40 | H | pma_get_opa_portstatus | drivers/infiniband/hw/hfi1/mad.c | num_vls | truncation | no | FP |
| 7335 | Low | 40 | H | pma_set_opa_errorinfo | drivers/infiniband/hw/hfi1/mad.c | num_pslm | truncation | no | FP |
| 7336 | Low | 40 | H | pma_set_opa_errorinfo | drivers/infiniband/hw/hfi1/mad.c | port_num | truncation | no | FP |
| 7337 | Low | 40 | C | pmcraid_init_ioadls | drivers/scsi/pmcraid.c | ioadl_count | subscript | yes? | FP |
| 7338 | Low | 40 | C | pmcraid_init_ioadls | drivers/scsi/pmcraid.c | ioadl_count | subscript | yes? | FP |
| 7339 | Low | 40 | H | pmcraid_sdev_init | drivers/scsi/pmcraid.c | target | truncation | no | FP |
| 7340 | Low | 40 | C | pmcraid_tasklet_function | drivers/scsi/pmcraid.c | cmd_index | subscript | yes? | FP |
| 7341 | Low | 40 | H | pmcraid_worker_function | drivers/scsi/pmcraid.c | target | truncation | no | FP |
| 7342 | Low | 40 | H | pmic_glink_altmode_callback | drivers/soc/qcom/pmic_glink_altmode.c | opcode | truncation | no | FP |
| 7343 | Low | 40 | H | pmic_glink_altmode_callback | drivers/soc/qcom/pmic_glink_altmode.c | svid | truncation | no | FP |
| 7344 | Low | 40 | H | pmic_glink_altmode_sc8180xp_notify | drivers/soc/qcom/pmic_glink_altmode.c | port | truncation | no | FP |
| 7345 | Low | 40 | H | pmic_glink_altmode_sc8180xp_notify | drivers/soc/qcom/pmic_glink_altmode.c | orientation | truncation | no | FP |
| 7346 | Low | 40 | H | pmic_glink_altmode_sc8180xp_notify | drivers/soc/qcom/pmic_glink_altmode.c | mux | truncation | no | FP |
| 7347 | Low | 40 | H | pmic_glink_altmode_sc8180xp_notify | drivers/soc/qcom/pmic_glink_altmode.c | mode | truncation | no | FP |
| 7348 | Low | 40 | H | pmic_glink_altmode_sc8180xp_notify | drivers/soc/qcom/pmic_glink_altmode.c | hpd_state | truncation | no | FP |
| 7349 | Low | 40 | H | pmic_glink_altmode_sc8180xp_notify | drivers/soc/qcom/pmic_glink_altmode.c | hpd_irq | truncation | no | FP |
| 7350 | Low | 40 | H | pmic_glink_altmode_sc8180xp_notify | drivers/soc/qcom/pmic_glink_altmode.c | svid | truncation | no | FP |
| 7351 | Low | 40 | C | pmic_glink_altmode_sc8180xp_notify | drivers/soc/qcom/pmic_glink_altmode.c | port | subscript | yes? | FP |
| 7352 | Low | 40 | H | pn533_std_rx_frame_is_valid | drivers/nfc/pn533/pn533.c | checksum | truncation | no | FP |
| 7353 | Low | 40 | H | pn533_std_rx_frame_is_valid | drivers/nfc/pn533/pn533.c | checksum | truncation | no | FP |
| 7354 | Low | 40 | H | port100_rx_frame_is_valid | drivers/nfc/port100.c | checksum | truncation | no | FP |
| 7355 | Low | 40 | H | port100_rx_frame_is_valid | drivers/nfc/port100.c | checksum | truncation | no | FP |
| 7356 | Low | 40 | C | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pnon_clock_arrays | subscript (callee) | yes? | FP |
| 7357 | Low | 40 | C | pp_tables_get_entry | drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | pnon_clock_info | subscript (callee) | yes? | FP |
| 7358 | Low | 40 | C | ppp_rx | drivers/net/wan/hdlc_ppp.c | pid | subscript (callee) | yes? | FP |
| 7359 | Low | 40 | C | ppp_rx | drivers/net/wan/hdlc_ppp.c | pid | subscript (callee) | yes? | FP |
| 7360 | Low | 40 | C | ppp_rx | drivers/net/wan/hdlc_ppp.c | pid | subscript (callee) | yes? | FP |
| 7361 | Low | 40 | C | ppp_start_xmit | drivers/net/ppp/ppp_generic.c | npi | subscript | yes? | FP |
| 7362 | Low | 40 | C | ppp_start_xmit | drivers/net/ppp/ppp_generic.c | npi | subscript | yes? | FP |
| 7363 | Low | 40 | C | pqi_process_io_intr | drivers/scsi/smartpqi/smartpqi_init.c | request_id | subscript | yes? | FP |
| 7364 | Low | 40 | C | process_bulk_in | drivers/char/xillybus/xillyusb.c | chan_num | subscript (callee) | yes? | FP |
| 7365 | Low | 40 | C | process_bulk_in | drivers/char/xillybus/xillyusb.c | chan_idx | subscript | yes? | FP |
| 7366 | Low | 40 | C | process_bulk_in | drivers/char/xillybus/xillyusb.c | chan_idx | subscript | yes? | FP |
| 7367 | Low | 40 | C | process_intrq | drivers/net/ethernet/chelsio/cxgb4vf/sge.c | iq_idx | subscript | yes? | FP |
| 7368 | Low | 40 | H | process_one_iomb | drivers/scsi/pm8001/pm8001_hwi.c | opc | truncation | no | FP |
| 7369 | Low | 40 | H | process_recvd_msg | drivers/md/md-cluster.c | ret | truncation | no | FP |
| 7370 | Low | 40 | B | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | len | memcpy() in get_packet() | yes? | FP |
| 7371 | Low | 40 | B | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | len | memcpy() in get_packet_pg() | yes? | FP |
| 7372 | Low | 40 | C | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | skb | subscript (callee) | yes? | FP |
| 7373 | Low | 40 | C | process_responses | drivers/net/ethernet/chelsio/cxgb3/sge.c | skb | subscript (callee) | yes? | FP |
| 7374 | Low | 40 | C | prueth_tx_ts_sr1 | drivers/net/ethernet/ti/icssg/icssg_prueth_sr1.c | cookie | subscript | yes? | FP |
| 7375 | Low | 40 | C | prueth_tx_ts_sr1 | drivers/net/ethernet/ti/icssg/icssg_prueth_sr1.c | cookie | subscript | yes? | FP |
| 7376 | Low | 40 | C | pt1_filter | drivers/media/pci/pt1/pt1.c | index | subscript | yes? | FP |
| 7377 | Low | 40 | H | qca8k_mib_autocast_handler | drivers/net/dsa/qca/qca8k-8xxx.c | port | truncation | no | FP |
| 7378 | Low | 40 | H | qca8k_rw_reg_ack_handler | drivers/net/dsa/qca/qca8k-8xxx.c | cmd | truncation | no | FP |
| 7379 | Low | 40 | H | qca8k_rw_reg_ack_handler | drivers/net/dsa/qca/qca8k-8xxx.c | len | truncation | no | FP |
| 7380 | Low | 40 | H | qca_tlv_check_data | drivers/bluetooth/btqca.c | type | truncation | no | FP |
| 7381 | Low | 40 | H | qca_tlv_check_data | drivers/bluetooth/btqca.c | type | truncation | no | FP |
| 7382 | Low | 40 | H | qcom_add_minidump_segments | drivers/remoteproc/qcom_common.c | ret | truncation | no | FP |
| 7383 | Low | 40 | B | qcom_glink_native_rx | drivers/rpmsg/qcom_glink_native.c | param2 | kmalloc() in qcom_glink_handle_intent() | yes? | FP |
| 7384 | Low | 40 | H | qcom_llcc_verify_fw_config | drivers/soc/qcom/llcc-qcom.c | version | truncation | no | FP |
| 7385 | Low | 40 | C | qcom_show_pmic_model | drivers/soc/qcom/socinfo.c | model | subscript | yes? | FP |
| 7386 | Low | 40 | C | qcom_show_pmic_model | drivers/soc/qcom/socinfo.c | model | subscript | yes? | FP |
| 7387 | Low | 40 | C | qcom_show_pmic_model_array | drivers/soc/qcom/socinfo.c | model | subscript | yes? | FP |
| 7388 | Low | 40 | B | qcom_smem_enumerate_partitions | drivers/soc/qcom/smem.c | host0 | memcmp() in qcom_smem_partition_header() | yes? | FP |
| 7389 | Low | 40 | B | qcom_smem_enumerate_partitions | drivers/soc/qcom/smem.c | host1 | memcmp() in qcom_smem_partition_header() | yes? | FP |
| 7390 | Low | 40 | H | qdma_queue_isr | drivers/dma/amd/qdma/qdma.c | color | truncation | no | FP |
| 7391 | Low | 40 | H | qdma_queue_isr | drivers/dma/amd/qdma/qdma.c | qid | truncation | no | FP |
| 7392 | Low | 40 | H | qdma_queue_isr | drivers/dma/amd/qdma/qdma.c | cidx | truncation | no | FP |
| 7393 | Low | 40 | H | qdma_queue_isr | drivers/dma/amd/qdma/qdma.c | comp_desc | truncation | no | FP |
| 7394 | Low | 40 | H | qed_get_rxq_coalesce | drivers/net/ethernet/qlogic/qed/qed_l2.c | timer_res | truncation | no | FP |
| 7395 | Low | 40 | H | qed_get_txq_coalesce | drivers/net/ethernet/qlogic/qed/qed_l2.c | timer_res | truncation | no | FP |
| 7396 | Low | 40 | H | qed_int_attentions | drivers/net/ethernet/qlogic/qed/qed_int.c | asserted_bits | truncation | no | FP |
| 7397 | Low | 40 | H | qed_int_attentions | drivers/net/ethernet/qlogic/qed/qed_int.c | deasserted_bits | truncation | no | FP |
| 7398 | Low | 40 | C | qed_iwarp_ll2_slowpath | drivers/net/ethernet/qlogic/qed/qed_iwarp.c | cid | subscript (callee) | yes? | FP |
| 7399 | Low | 40 | B | qed_iwarp_process_mpa_pkt | drivers/net/ethernet/qlogic/qed/qed_iwarp.c | fpdu | memcpy() in qed_iwarp_cp_pkt() | yes? | FP |
| 7400 | Low | 40 | B | qed_iwarp_process_mpa_pkt | drivers/net/ethernet/qlogic/qed/qed_iwarp.c | fpdu | memcpy() in qed_iwarp_cp_pkt() | yes? | FP |
| 7401 | Low | 40 | H | qed_roce_async_event | drivers/net/ethernet/qlogic/qed/qed_roce.c | icid | truncation | no | FP |
| 7402 | Low | 40 | H | qed_roce_async_event | drivers/net/ethernet/qlogic/qed/qed_roce.c | srq_id | truncation | no | FP |
| 7403 | Low | 40 | H | qede_rx_process_cqe | drivers/net/ethernet/qlogic/qede/qede_fp.c | csum_flag | truncation | no | FP |
| 7404 | Low | 40 | C | qedf_process_unsol_compl | drivers/scsi/qedf/qedf_io.c | bdq_idx | subscript | yes? | FP |
| 7405 | Low | 40 | B | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | kzalloc() in qla24xx_alloc_purex_item() | yes? | FP |
| 7406 | Low | 40 | B | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | no_bytes | memcpy() | yes? | FP |
| 7407 | Low | 40 | B | qla27xx_copy_fpin_pkt | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | memcpy() | yes? | FP |
| 7408 | Low | 40 | B | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | no_bytes | memcpy() | yes? | FP |
| 7409 | Low | 40 | B | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | memcpy() | yes? | FP |
| 7410 | Low | 40 | B | qla27xx_copy_multiple_pkt | drivers/scsi/qla2xxx/qla_isr.c | total_bytes | kzalloc() in qla24xx_alloc_purex_item() | yes? | FP |
| 7411 | Low | 40 | H | qla2x00_els_dcmd2_sp_done | drivers/scsi/qla2xxx/qla_iocb.c | lid | truncation | no | FP |
| 7412 | Low | 40 | H | qla4_84xx_minidump_process_rdmdio | drivers/scsi/qla4xxx/ql4_nx.c | stride2 | truncation | no | FP |
| 7413 | Low | 40 | B | qla4xxx_copy_sense | drivers/scsi/qla4xxx/ql4_isr.c | sense_len | memcpy() | yes? | FP |
| 7414 | Low | 40 | C | qla4xxx_mbox_status_entry | drivers/scsi/qla4xxx/ql4_isr.c | le32_to_cpu(mbox_sts_entry->handle) | subscript (callee) | yes? | FP |
| 7415 | Low | 40 | C | qla4xxx_mbox_status_entry | drivers/scsi/qla4xxx/ql4_isr.c | le32_to_cpu(mbox_sts_entry->handle) | subscript (callee) | yes? | FP |
| 7416 | Low | 40 | C | qla4xxx_passthru_status_entry | drivers/scsi/qla4xxx/ql4_isr.c | fw_ddb_index | subscript (callee) | yes? | FP |
| 7417 | Low | 40 | B | qla4xxx_status_entry | drivers/scsi/qla4xxx/ql4_isr.c | srb | memcpy() in qla4xxx_copy_sense() | yes? | FP |
| 7418 | Low | 40 | C | qlafx00_multistatus_entry | drivers/scsi/qla2xxx/qla_mr.c | handle | subscript (callee) | yes? | FP |
| 7419 | Low | 40 | C | qlafx00_multistatus_entry | drivers/scsi/qla2xxx/qla_mr.c | handle | subscript (callee) | yes? | FP |
| 7420 | Low | 40 | C | qlafx00_multistatus_entry | drivers/scsi/qla2xxx/qla_mr.c | handle | subscript | yes? | FP |
| 7421 | Low | 40 | C | qlcnic_82xx_process_rcv_ring_diag | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | subscript (callee) | yes? | FP |
| 7422 | Low | 40 | H | qlcnic_82xx_process_rcv_ring_diag | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | desc_cnt | truncation | no | FP |
| 7423 | Low | 40 | H | qlcnic_82xx_process_rcv_ring_diag | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | opcode | truncation | no | FP |
| 7424 | Low | 40 | H | qlcnic_82xx_process_rcv_ring_diag | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | truncation | no | FP |
| 7425 | Low | 40 | C | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | subscript (callee) | yes? | FP |
| 7426 | Low | 40 | C | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | sts_data0 | subscript (callee) | yes? | FP |
| 7427 | Low | 40 | C | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | subscript (callee) | yes? | FP |
| 7428 | Low | 40 | C | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | sts_data0 | subscript (callee) | yes? | FP |
| 7429 | Low | 40 | H | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | desc_cnt | truncation | no | FP |
| 7430 | Low | 40 | H | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | opcode | truncation | no | FP |
| 7431 | Low | 40 | H | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | truncation | no | FP |
| 7432 | Low | 40 | H | qlcnic_process_rcv_ring | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ring | truncation | no | FP |
| 7433 | Low | 40 | H | qlcnic_send_filter | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | hval | truncation | no | FP |
| 7434 | Low | 40 | H | qlcnic_send_filter | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | hindex | truncation | no | FP |
| 7435 | Low | 40 | H | qlcnic_tx_pkt | drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | opcode | truncation | no | FP |
| 7436 | Low | 40 | C | qm_get_complete_eqe_num | drivers/crypto/hisilicon/qm.c | cqn | subscript | yes? | FP |
| 7437 | Low | 40 | B | qtnf_event_parse | drivers/net/wireless/quantenna/qtnfmac/event.c | event_len | memcpy() in qtnf_event_handle_external_auth() | yes? | FP |
| 7438 | Low | 40 | B | quickspi_handle_input_data | drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c | input_len | memcpy() | yes? | FP |
| 7439 | Low | 40 | C | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | sh | subscript (callee) | yes? | FP |
| 7440 | Low | 40 | C | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | sh | subscript (callee) | yes? | FP |
| 7441 | Low | 40 | C | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | sh | subscript (callee) | yes? | FP |
| 7442 | Low | 40 | H | r600_parse_extended_power_table | drivers/gpu/drm/radeon/r600_dpm.c | rev | truncation | no | FP |
| 7443 | Low | 40 | H | radeon_atom_init_mc_reg_table | drivers/gpu/drm/radeon/radeon_atombios.c | t_mem_id | truncation | no | FP |
| 7444 | Low | 40 | H | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | con_obj_id | truncation | no | FP |
| 7445 | Low | 40 | H | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | con_obj_num | truncation | no | FP |
| 7446 | Low | 40 | H | radeon_get_atom_connector_info_from_object_table | drivers/gpu/drm/radeon/radeon_atombios.c | grph_obj_type | truncation | no | FP |
| 7447 | Low | 40 | B | rbd_header_from_disk | drivers/block/rbd.c | snap_names_len | kmalloc() | yes? | FP |
| 7448 | Low | 40 | B | rbd_header_from_disk | drivers/block/rbd.c | snap_names_len | memcpy() | yes? | FP |
| 7449 | Low | 40 | C | rc_rcv_error | drivers/infiniband/hw/hfi1/rc.c | rkey | subscript (callee) | yes? | FP |
| 7450 | Low | 40 | C | rc_rcv_resp | drivers/infiniband/hw/hfi1/rc.c | aeth | subscript (callee) | yes? | FP |
| 7451 | Low | 40 | H | rd_nvram_byte | drivers/scsi/qla4xxx/ql4_nvram.c | rval | truncation | no | FP |
| 7452 | Low | 40 | H | rd_nvram_byte | drivers/scsi/qla4xxx/ql4_nvram.c | rval | truncation | no | FP |
| 7453 | Low | 40 | H | read_bulk_callback | drivers/net/usb/pegasus.c | pkt_len | truncation | no | FP |
| 7454 | Low | 40 | H | receive_Data | drivers/block/drbd/drbd_receiver.c | err | truncation | no | FP |
| 7455 | Low | 40 | H | receive_Data | drivers/block/drbd/drbd_receiver.c | err | truncation | no | FP |
| 7456 | Low | 40 | H | receive_DataReply | drivers/block/drbd/drbd_receiver.c | err | truncation | no | FP |
| 7457 | Low | 40 | H | receive_RSDataReply | drivers/block/drbd/drbd_receiver.c | err | truncation | no | FP |
| 7458 | Low | 40 | H | receive_packet | drivers/net/ethernet/dlink/dl2k.c | pkt_len | truncation | no | FP |
| 7459 | Low | 40 | H | receive_rs_deallocated | drivers/block/drbd/drbd_receiver.c | err | truncation | no | FP |
| 7460 | Low | 40 | B | redistribute2 | drivers/md/persistent-data/dm-btree.c | nr_left | memcpy() in copy_entries() | yes? | FP |
| 7461 | Low | 40 | B | redistribute2 | drivers/md/persistent-data/dm-btree.c | target_left | memcpy() in copy_entries() | yes? | FP |
| 7462 | Low | 40 | B | redistribute3 | drivers/md/persistent-data/dm-btree.c | nr_left | memcpy() in copy_entries() | yes? | FP |
| 7463 | Low | 40 | B | redistribute3 | drivers/md/persistent-data/dm-btree.c | nr_left | memcpy() in copy_entries() | yes? | FP |
| 7464 | Low | 40 | B | redistribute3 | drivers/md/persistent-data/dm-btree.c | target_left | memcpy() in copy_entries() | yes? | FP |
| 7465 | Low | 40 | H | replenish_rx_pool | drivers/net/ethernet/ibm/ibmvnic.c | bufidx | truncation | no | FP |
| 7466 | Low | 40 | H | resp_atomic_write | drivers/scsi/scsi_debug.c | ret | truncation | no | FP |
| 7467 | Low | 40 | C | resp_close_zone | drivers/scsi/scsi_debug.c | z_id | subscript (callee) | yes? | FP |
| 7468 | Low | 40 | C | resp_close_zone | drivers/scsi/scsi_debug.c | z_id | subscript (callee) | yes? | FP |
| 7469 | Low | 40 | H | resp_comp_write | drivers/scsi/scsi_debug.c | ret | truncation | no | FP |
| 7470 | Low | 40 | C | resp_finish_zone | drivers/scsi/scsi_debug.c | z_id | subscript (callee) | yes? | FP |
| 7471 | Low | 40 | C | resp_finish_zone | drivers/scsi/scsi_debug.c | z_id | subscript (callee) | yes? | FP |
| 7472 | Low | 40 | H | resp_get_lba_status | drivers/scsi/scsi_debug.c | ret | truncation | no | FP |
| 7473 | Low | 40 | H | resp_get_lba_status | drivers/scsi/scsi_debug.c | mapped | truncation | no | FP |
| 7474 | Low | 40 | C | resp_open_zone | drivers/scsi/scsi_debug.c | z_id | subscript (callee) | yes? | FP |
| 7475 | Low | 40 | C | resp_open_zone | drivers/scsi/scsi_debug.c | z_id | subscript (callee) | yes? | FP |
| 7476 | Low | 40 | H | resp_read_dt0 | drivers/scsi/scsi_debug.c | ret | truncation | no | FP |
| 7477 | Low | 40 | C | resp_report_zones | drivers/scsi/scsi_debug.c | lba | subscript (callee) | yes? | FP |
| 7478 | Low | 40 | C | resp_report_zones | drivers/scsi/scsi_debug.c | lba | subscript (callee) | yes? | FP |
| 7479 | Low | 40 | C | resp_rwp_zone | drivers/scsi/scsi_debug.c | z_id | subscript (callee) | yes? | FP |
| 7480 | Low | 40 | C | resp_rwp_zone | drivers/scsi/scsi_debug.c | z_id | subscript (callee) | yes? | FP |
| 7481 | Low | 40 | B | resp_rwp_zone | drivers/scsi/scsi_debug.c | zsp | memset() in zbc_rwp_zone() | yes? | FP |
| 7482 | Low | 40 | H | resp_unmap | drivers/scsi/scsi_debug.c | ret | truncation | no | FP |
| 7483 | Low | 40 | B | resp_verify | drivers/scsi/scsi_debug.c | vnum | memcmp() in comp_write_worker() | yes? | FP |
| 7484 | Low | 40 | B | resp_verify | drivers/scsi/scsi_debug.c | vnum | memcmp() in comp_write_worker() | yes? | FP |
| 7485 | Low | 40 | B | resp_verify | drivers/scsi/scsi_debug.c | vnum | memcpy() in comp_write_worker() | yes? | FP |
| 7486 | Low | 40 | B | resp_verify | drivers/scsi/scsi_debug.c | vnum | memcpy() in comp_write_worker() | yes? | FP |
| 7487 | Low | 40 | B | resp_verify | drivers/scsi/scsi_debug.c | vnum | kcalloc() | yes? | FP |
| 7488 | Low | 40 | H | resp_write_dt0 | drivers/scsi/scsi_debug.c | ret | truncation | no | FP |
| 7489 | Low | 40 | H | resp_write_dt0 | drivers/scsi/scsi_debug.c | ret | truncation | no | FP |
| 7490 | Low | 40 | B | resp_write_scat | drivers/scsi/scsi_debug.c | lbdof_blen | kzalloc() | yes? | FP |
| 7491 | Low | 40 | H | resp_write_scat | drivers/scsi/scsi_debug.c | ret | truncation | no | FP |
| 7492 | Low | 40 | H | resp_write_scat | drivers/scsi/scsi_debug.c | prot_ret | truncation | no | FP |
| 7493 | Low | 40 | B | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | save_info | memcpy() in uds_read_from_buffered_reader() | yes? | FP |
| 7494 | Low | 40 | C | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | new_zone | subscript (callee) | yes? | FP |
| 7495 | Low | 40 | C | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | save_info | subscript (callee) | yes? | FP |
| 7496 | Low | 40 | B | rh_call_control | drivers/usb/core/hcd.c | wLength | memcpy() in rh_string() | yes? | FP |
| 7497 | Low | 40 | C | rio_rx_data_handler | drivers/rapidio/rio_cm.c | ch | subscript | yes? | FP |
| 7498 | Low | 40 | H | rpmi_clk_get_attrs | drivers/clk/clk-rpmi.c | format | truncation | no | FP |
| 7499 | Low | 40 | C | rs_sta_dbgfs_scale_table_read | drivers/net/wireless/intel/iwlwifi/dvm/rs.c | le32_to_cpu(lq_sta->lq.rs_table[i].rate_n_flags) | subscript (callee) | yes? | FP |
| 7500 | Low | 40 | C | rs_sta_dbgfs_scale_table_read | drivers/net/wireless/intel/iwlwifi/dvm/rs.c | index | subscript | yes? | FP |
| 7501 | Low | 40 | C | rs_sta_dbgfs_scale_table_read | drivers/net/wireless/intel/iwlwifi/dvm/rs.c | index | subscript | yes? | FP |
| 7502 | Low | 40 | H | rtl8180_handle_rx | drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | agc | truncation | no | FP |
| 7503 | Low | 40 | H | rtl8180_handle_rx | drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | signal | truncation | no | FP |
| 7504 | Low | 40 | H | rtl8180_handle_rx | drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | signal | truncation | no | FP |
| 7505 | Low | 40 | H | rtl8180_handle_rx | drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | sq | truncation | no | FP |
| 7506 | Low | 40 | H | rtl8180_handle_rx | drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | signal | truncation | no | FP |
| 7507 | Low | 40 | H | rtl8180_handle_rx | drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | signal | truncation | no | FP |
| 7508 | Low | 40 | H | rtl8180_handle_rx | drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | signal | truncation | no | FP |
| 7509 | Low | 40 | H | rtl8180_handle_rx | drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | signal | truncation | no | FP |
| 7510 | Low | 40 | H | rtl8187b_status_cb | drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | cmd_type | truncation | no | FP |
| 7511 | Low | 40 | H | rtl8187b_status_cb | drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | pkt_rc | truncation | no | FP |
| 7512 | Low | 40 | H | rtl8187b_status_cb | drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | seq_no | truncation | no | FP |
| 7513 | Low | 40 | C | rtl_action_proc | drivers/net/wireless/realtek/rtlwifi/base.c | tid | subscript | yes? | FP |
| 7514 | Low | 40 | B | rtlbt_parse_firmware | drivers/bluetooth/btrtl.c | patch_length | kvmalloc() | yes? | FP |
| 7515 | Low | 40 | B | rtlbt_parse_firmware | drivers/bluetooth/btrtl.c | patch_length | memcpy() | yes? | FP |
| 7516 | Low | 40 | C | rtrs_clt_rkey_rsp_done | drivers/infiniband/ulp/rtrs/rtrs-clt.c | buf_id | subscript | yes? | FP |
| 7517 | Low | 40 | C | rtrs_rdma_connect | drivers/infiniband/ulp/rtrs/rtrs-srv.c | cid | subscript (callee) | yes? | FP |
| 7518 | Low | 40 | C | rtrs_rdma_connect | drivers/infiniband/ulp/rtrs/rtrs-srv.c | cid | subscript (callee) | yes? | FP |
| 7519 | Low | 40 | C | rtrs_rdma_connect | drivers/infiniband/ulp/rtrs/rtrs-srv.c | cid | subscript | yes? | FP |
| 7520 | Low | 40 | C | rtw89_fw_log_dump | drivers/net/wireless/realtek/rtw89/fw.c | fmt_idx | subscript (callee) | yes? | FP |
| 7521 | Low | 40 | C | rtw89_fw_log_dump | drivers/net/wireless/realtek/rtw89/fw.c | fmt_idx | subscript | yes? | FP |
| 7522 | Low | 40 | C | rtw89_fw_recognize_elements | drivers/net/wireless/realtek/rtw89/fw.c | elem_id | subscript | yes? | FP |
| 7523 | Low | 40 | C | rtw89_mac_diag_iter_all | drivers/net/wireless/realtek/rtw89/debug.c | rule_size | subscript | yes? | FP |
| 7524 | Low | 40 | C | rtw89_mac_diag_iter_all | drivers/net/wireless/realtek/rtw89/debug.c | rule_size | subscript | yes? | FP |
| 7525 | Low | 40 | C | rtw89_phy_c2h_rfk_log | drivers/net/wireless/realtek/rtw89/phy.c | content_len | subscript (callee) | yes? | FP |
| 7526 | Low | 40 | C | rtw89_phy_c2h_rfk_log | drivers/net/wireless/realtek/rtw89/phy.c | content_len | subscript (callee) | yes? | FP |
| 7527 | Low | 40 | C | rtw89_phy_c2h_rfk_run_log | drivers/net/wireless/realtek/rtw89/phy.c | fmt_idx | subscript | yes? | FP |
| 7528 | Low | 40 | H | rx_pkt | drivers/infiniband/hw/cxgb4/cm.c | eth_hdr_len | truncation | no | FP |
| 7529 | Low | 40 | H | rx_pkt | drivers/infiniband/hw/cxgb4/cm.c | eth_hdr_len | truncation | no | FP |
| 7530 | Low | 40 | H | rx_pkt | drivers/infiniband/hw/cxgb4/cm.c | eth_hdr_len | truncation | no | FP |
| 7531 | Low | 40 | H | rxq_recv | drivers/net/ethernet/huawei/hinic/hinic_rx.c | vid | truncation | no | FP |
| 7532 | Low | 40 | H | rxq_recv | drivers/net/ethernet/huawei/hinic/hinic_rx.c | num_lro | truncation | no | FP |
| 7533 | Low | 40 | C | sahara_read_data | drivers/accel/qaic/sahara.c | image_id | subscript (callee) | yes? | FP |
| 7534 | Low | 40 | C | sahara_read_data | drivers/accel/qaic/sahara.c | image_id | subscript (callee) | yes? | FP |
| 7535 | Low | 40 | C | sahara_read_data | drivers/accel/qaic/sahara.c | image_id | subscript (callee) | yes? | FP |
| 7536 | Low | 40 | C | save_frame | drivers/media/usb/s2255/s2255drv.c | cc | subscript | yes? | FP |
| 7537 | Low | 40 | C | save_frame | drivers/media/usb/s2255/s2255drv.c | cc | subscript | yes? | FP |
| 7538 | Low | 40 | H | sc_release_update | drivers/infiniband/hw/hfi1/pio.c | code | truncation | no | FP |
| 7539 | Low | 40 | H | scan_pool | drivers/mtd/ubi/fastmap.c | err | truncation | no | FP |
| 7540 | Low | 40 | H | scan_pool | drivers/mtd/ubi/fastmap.c | ret | truncation | no | FP |
| 7541 | Low | 40 | H | scan_pool | drivers/mtd/ubi/fastmap.c | ret | truncation | no | FP |
| 7542 | Low | 40 | C | sci_remote_device_frame_handler | drivers/scsi/isci/remote_device.c | be16_to_cpu(hdr.tag) | subscript (callee) | yes? | FP |
| 7543 | Low | 40 | C | sci_remote_device_frame_handler | drivers/scsi/isci/remote_device.c | be16_to_cpu(hdr.tag) | subscript (callee) | yes? | FP |
| 7544 | Low | 40 | H | sdma_gethead | drivers/infiniband/hw/hfi1/sdma.c | hwhead | truncation | no | FP |
| 7545 | Low | 40 | H | sdma_gethead | drivers/infiniband/hw/hfi1/sdma.c | sane | truncation | no | FP |
| 7546 | Low | 40 | H | sdma_gethead | drivers/infiniband/hw/hfi1/sdma.c | sane | truncation | no | FP |
| 7547 | Low | 40 | H | sdma_gethead | drivers/infiniband/hw/hfi1/sdma.c | sane | truncation | no | FP |
| 7548 | Low | 40 | B | self_check_volume | drivers/mtd/ubi/vmt.c | name_len | strncmp() | yes? | FP |
| 7549 | Low | 40 | H | seqfile_dump_rcd | drivers/infiniband/hw/hfi1/driver.c | lnh | truncation | no | FP |
| 7550 | Low | 40 | H | seqfile_dump_rcd | drivers/infiniband/hw/hfi1/driver.c | opcode | truncation | no | FP |
| 7551 | Low | 40 | C | set_txreq_header_ahg | drivers/infiniband/hw/hfi1/user_sdma.c | idx | subscript (callee) | yes? | FP |
| 7552 | Low | 40 | C | setup_received_handle | drivers/usb/gadget/udc/fsl_qe_udc.c | wIndex | subscript (callee) | yes? | FP |
| 7553 | Low | 40 | C | setup_received_handle | drivers/usb/gadget/udc/fsl_qe_udc.c | wIndex | subscript (callee) | yes? | FP |
| 7554 | Low | 40 | C | setup_received_handle | drivers/usb/gadget/udc/fsl_qe_udc.c | pipe | subscript | yes? | FP |
| 7555 | Low | 40 | C | setup_received_irq | drivers/usb/gadget/udc/fsl_udc_core.c | wIndex | subscript (callee) | yes? | FP |
| 7556 | Low | 40 | C | setup_received_irq | drivers/usb/gadget/udc/fsl_udc_core.c | wIndex | subscript (callee) | yes? | FP |
| 7557 | Low | 40 | H | setup_rq_inf | drivers/usb/gadget/function/f_uac2.c | intf | truncation | no | FP |
| 7558 | Low | 40 | H | sh_eth_rx | drivers/net/ethernet/renesas/sh_eth.c | pkt_len | truncation | no | FP |
| 7559 | Low | 40 | H | shadow_ablock | drivers/md/persistent-data/dm-array.c | r | truncation | no | FP |
| 7560 | Low | 40 | H | shadow_bitmap | drivers/md/persistent-data/dm-space-map-common.c | r | truncation | no | FP |
| 7561 | Low | 40 | C | sis_read_packet | drivers/input/touchscreen/sis_i2c.c | len | subscript | yes? | FP |
| 7562 | Low | 40 | B | slhc_compress | drivers/net/slip/slhc.c | deltaS | memcpy() | yes? | FP |
| 7563 | Low | 40 | H | sli_fc_rqe_fcfi | drivers/scsi/elx/libefc_sli/sli4.h | fcfi | truncation | no | FP |
| 7564 | Low | 40 | H | sm_ll_find_free_block | drivers/md/persistent-data/dm-space-map-common.c | r | truncation | no | FP |
| 7565 | Low | 40 | H | sm_ll_insert | drivers/md/persistent-data/dm-space-map-common.c | r | truncation | no | FP |
| 7566 | Low | 40 | H | sm_ll_lookup_bitmap | drivers/md/persistent-data/dm-space-map-common.c | r | truncation | no | FP |
| 7567 | Low | 40 | H | smsc95xx_rx_fixup | drivers/net/usb/smsc95xx.c | size | truncation | no | FP |
| 7568 | Low | 40 | B | smsc95xx_rx_fixup | drivers/net/usb/smsc95xx.c | size | memcpy() | yes? | FP |
| 7569 | Low | 40 | C | sock_put_port | drivers/scsi/cxgbi/libcxgbi.c | idx | subscript | yes? | FP |
| 7570 | Low | 40 | B | spc_fill_pd_text_id_info | drivers/target/target_core_spc.c | buf_len | kzalloc() | yes? | FP |
| 7571 | Low | 40 | B | spc_fill_pd_text_id_info | drivers/target/target_core_spc.c | buf_len | scnprintf() | yes? | FP |
| 7572 | Low | 40 | B | spc_fill_pd_text_id_info | drivers/target/target_core_spc.c | buf_len | memcpy() | yes? | FP |
| 7573 | Low | 40 | H | speedtch_find_firmware | drivers/usb/atm/speedtch.c | major_revision | truncation | no | FP |
| 7574 | Low | 40 | H | speedtch_find_firmware | drivers/usb/atm/speedtch.c | minor_revision | truncation | no | FP |
| 7575 | Low | 40 | H | split_one_into_two | drivers/md/persistent-data/dm-btree.c | r | truncation | no | FP |
| 7576 | Low | 40 | H | split_two_into_three | drivers/md/persistent-data/dm-btree.c | r | truncation | no | FP |
| 7577 | Low | 40 | H | sppctl_dt_node_to_map | drivers/pinctrl/sunplus/sppctl.c | pin_num | truncation | no | FP |
| 7578 | Low | 40 | H | sppctl_dt_node_to_map | drivers/pinctrl/sunplus/sppctl.c | pin_num | truncation | no | FP |
| 7579 | Low | 40 | H | sppctl_dt_node_to_map | drivers/pinctrl/sunplus/sppctl.c | pin_type | truncation | no | FP |
| 7580 | Low | 40 | H | sppctl_dt_node_to_map | drivers/pinctrl/sunplus/sppctl.c | pin_func | truncation | no | FP |
| 7581 | Low | 40 | H | spu2_dump_msg_hdr | drivers/crypto/bcm/spu2.c | hash_key_len | truncation | no | FP |
| 7582 | Low | 40 | H | spu2_dump_msg_hdr | drivers/crypto/bcm/spu2.c | ciph_key_len | truncation | no | FP |
| 7583 | Low | 40 | H | spu2_dump_msg_hdr | drivers/crypto/bcm/spu2.c | ciph_iv_len | truncation | no | FP |
| 7584 | Low | 40 | H | spu2_dump_msg_hdr | drivers/crypto/bcm/spu2.c | omd_len | truncation | no | FP |
| 7585 | Low | 40 | H | spu2_payload_length | drivers/crypto/bcm/spu2.c | pl_len | truncation | no | FP |
| 7586 | Low | 40 | H | sr_rx_fixup | drivers/net/usb/sr9800.c | size | truncation | no | FP |
| 7587 | Low | 40 | B | sr_rx_fixup | drivers/net/usb/sr9800.c | size | memcpy() | yes? | FP |
| 7588 | Low | 40 | B | srp_process_rsp | drivers/infiniband/ulp/srp/ib_srp.c | sense_len | memcpy() | yes? | FP |
| 7589 | Low | 40 | H | srpt_add_one | drivers/infiniband/ulp/srpt/ib_srpt.c | ret | truncation | no | FP |
| 7590 | Low | 40 | H | srpt_alloc_rw_ctxs | drivers/infiniband/ulp/srpt/ib_srpt.c | ret | truncation | no | FP |
| 7591 | Low | 40 | H | srpt_mgmt_method_get | drivers/infiniband/ulp/srpt/ib_srpt.c | hi | truncation | no | FP |
| 7592 | Low | 40 | H | srpt_mgmt_method_get | drivers/infiniband/ulp/srpt/ib_srpt.c | lo | truncation | no | FP |
| 7593 | Low | 40 | B | ssam_hid_get_descriptor | drivers/hid/surface-hid/surface_hid.c | length | memcpy() | yes? | FP |
| 7594 | Low | 40 | C | ssp_irq_msg | drivers/iio/common/ssp_sensors/ssp_spi.c | buffer | subscript (callee) | yes? | FP |
| 7595 | Low | 40 | C | ssp_irq_msg | drivers/iio/common/ssp_sensors/ssp_spi.c | buffer | subscript (callee) | yes? | FP |
| 7596 | Low | 40 | C | ssp_irq_msg | drivers/iio/common/ssp_sensors/ssp_spi.c | buffer | subscript (callee) | yes? | FP |
| 7597 | Low | 40 | C | ssp_irq_msg | drivers/iio/common/ssp_sensors/ssp_spi.c | buffer | subscript (callee) | yes? | FP |
| 7598 | Low | 40 | H | ssp_irq_msg | drivers/iio/common/ssp_sensors/ssp_spi.c | msg_type | truncation | no | FP |
| 7599 | Low | 40 | B | st_nci_i2c_read | drivers/nfc/st-nci/i2c.c | len | memcpy() | yes? | FP |
| 7600 | Low | 40 | B | st_nci_spi_read | drivers/nfc/st-nci/spi.c | len | memcpy() | yes? | FP |
| 7601 | Low | 40 | B | stex_mu_intr | drivers/scsi/stex.c | ccb | memcpy() in stex_copy_data() | yes? | FP |
| 7602 | Low | 40 | C | stex_mu_intr | drivers/scsi/stex.c | tag | subscript | yes? | FP |
| 7603 | Low | 40 | B | stex_ss_mu_intr | drivers/scsi/stex.c | ccb | memcpy() in stex_copy_data() | yes? | FP |
| 7604 | Low | 40 | C | stex_ss_mu_intr | drivers/scsi/stex.c | tag | subscript | yes? | FP |
| 7605 | Low | 40 | H | super_1_load | drivers/md/md.c | count | truncation | no | FP |
| 7606 | Low | 40 | C | t4_handle_get_port_info | drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | linkdnrc | subscript (callee) | yes? | FP |
| 7607 | Low | 40 | H | t4_tcb_get_field32 | drivers/infiniband/hw/cxgb4/cm.c | v | truncation | no | FP |
| 7608 | Low | 40 | H | t4vf_handle_fw_rpl | drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c | opcode | truncation | no | FP |
| 7609 | Low | 40 | C | t4vf_handle_get_port_info | drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c | linkdnrc | subscript (callee) | yes? | FP |
| 7610 | Low | 40 | H | t4vf_wr_mbox_core | drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c | v | truncation | no | FP |
| 7611 | Low | 40 | H | t7xx_port_next_rx_seq_num | drivers/net/wwan/t7xx/t7xx_port_proxy.c | seq_num | truncation | no | FP |
| 7612 | Low | 40 | H | t7xx_port_next_rx_seq_num | drivers/net/wwan/t7xx/t7xx_port_proxy.c | next_seq_num | truncation | no | FP |
| 7613 | Low | 40 | H | t7xx_port_proxy_recv_skb | drivers/net/wwan/t7xx/t7xx_port_proxy.c | port | truncation | no | FP |
| 7614 | Low | 40 | H | t7xx_port_proxy_recv_skb | drivers/net/wwan/t7xx/t7xx_port_proxy.c | port | truncation | no | FP |
| 7615 | Low | 40 | H | t7xx_port_proxy_recv_skb | drivers/net/wwan/t7xx/t7xx_port_proxy.c | channel | truncation | no | FP |
| 7616 | Low | 40 | H | t7xx_port_proxy_recv_skb | drivers/net/wwan/t7xx/t7xx_port_proxy.c | seq_num | truncation | no | FP |
| 7617 | Low | 40 | C | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | bd_count | subscript | yes? | FP |
| 7618 | Low | 40 | H | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | curid | truncation | no | FP |
| 7619 | Low | 40 | H | tce_iommu_unuse_page_v2 | drivers/vfio/vfio_iommu_spapr_tce.c | ret | truncation | no | FP |
| 7620 | Low | 40 | B | tcpci_pd_transmit | drivers/usb/typec/tcpm/tcpci.c | cnt | memcpy() | yes? | FP |
| 7621 | Low | 40 | C | tid_rdma_rcv_error | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | subscript (callee) | yes? | FP |
| 7622 | Low | 40 | C | to_rdma_ah_attr | drivers/infiniband/hw/mthca/mthca_qp.c | port_num | subscript (callee) | yes? | FP |
| 7623 | Low | 40 | C | to_rdma_ah_attr | drivers/infiniband/hw/mthca/mthca_qp.c | port_num | subscript (callee) | yes? | FP |
| 7624 | Low | 40 | H | to_rdma_ah_attr | drivers/infiniband/hw/mthca/mthca_qp.c | port_num | truncation | no | FP |
| 7625 | Low | 40 | B | tpm1_get_random | drivers/char/tpm/tpm1-cmd.c | recd | memcpy() | yes? | FP |
| 7626 | Low | 40 | B | tpm2_get_random | drivers/char/tpm/tpm2-cmd.c | recd | memcpy() | yes? | FP |
| 7627 | Low | 40 | B | tpm2_pcr_read | drivers/char/tpm/tpm2-cmd.c | digest_size | memcpy() | yes? | FP |
| 7628 | Low | 40 | C | tpm_buf_check_hmac_response | drivers/char/tpm/tpm2-sessions.c | i | subscript | yes? | FP |
| 7629 | Low | 40 | B | tpm_buf_check_hmac_response | drivers/char/tpm/tpm2-sessions.c | len | memcpy() | yes? | FP |
| 7630 | Low | 40 | C | tpm_buf_check_hmac_response | drivers/char/tpm/tpm2-sessions.c | offset_s | subscript | yes? | FP |
| 7631 | Low | 40 | C | tpm_buf_check_hmac_response | drivers/char/tpm/tpm2-sessions.c | offset_s | subscript | yes? | FP |
| 7632 | Low | 40 | C | tpm_buf_fill_hmac_session | drivers/char/tpm/tpm2-sessions.c | i | subscript | yes? | FP |
| 7633 | Low | 40 | C | tpm_buf_fill_hmac_session | drivers/char/tpm/tpm2-sessions.c | i | subscript | yes? | FP |
| 7634 | Low | 40 | C | tpm_buf_fill_hmac_session | drivers/char/tpm/tpm2-sessions.c | i | subscript | yes? | FP |
| 7635 | Low | 40 | C | tpm_buf_fill_hmac_session | drivers/char/tpm/tpm2-sessions.c | i | subscript | yes? | FP |
| 7636 | Low | 40 | C | tpm_buf_fill_hmac_session | drivers/char/tpm/tpm2-sessions.c | i | subscript | yes? | FP |
| 7637 | Low | 40 | C | tpm_buf_fill_hmac_session | drivers/char/tpm/tpm2-sessions.c | i | subscript | yes? | FP |
| 7638 | Low | 40 | C | tpm_find_and_validate_cc | drivers/char/tpm/tpm2-space.c | i | subscript | yes? | FP |
| 7639 | Low | 40 | H | tulip_poll | drivers/net/ethernet/dec/tulip/interrupt.c | pkt_len | truncation | no | FP |
| 7640 | Low | 40 | H | tulip_rx | drivers/net/ethernet/dec/tulip/interrupt.c | pkt_len | truncation | no | FP |
| 7641 | Low | 40 | H | typhoon_init_one | drivers/net/ethernet/3com/typhoon.c | monthday | truncation | no | FP |
| 7642 | Low | 40 | C | ubi_add_to_av | drivers/mtd/ubi/attach.c | aeb | subscript (callee) | yes? | FP |
| 7643 | Low | 40 | H | ubi_compare_lebs | drivers/mtd/ubi/attach.c | second_is_newer | truncation | no | FP |
| 7644 | Low | 40 | C | udc_handle_ep0_setup | drivers/usb/gadget/udc/lpc32xx_udc.c | tmp | subscript | yes? | FP |
| 7645 | Low | 40 | H | uea_load_page_e1 | drivers/usb/atm/ueagle-atm.c | blockcount | truncation | no | FP |
| 7646 | Low | 40 | H | ufs_sysfs_read_desc_param | drivers/ufs/core/ufs-sysfs.c | ret | truncation | no | FP |
| 7647 | Low | 40 | B | usb_get_bos_descriptor | drivers/usb/core/config.c | total_len | memset() in usb_get_descriptor() | yes? | FP |
| 7648 | Low | 40 | B | usb_get_bos_descriptor | drivers/usb/core/config.c | total_len | kzalloc() | yes? | FP |
| 7649 | Low | 40 | B | usb_get_configuration | drivers/usb/core/config.c | length | memset() in usb_get_descriptor() | yes? | FP |
| 7650 | Low | 40 | C | usb_get_configuration | drivers/usb/core/config.c | bigbuffer | subscript (callee) | yes? | FP |
| 7651 | Low | 40 | C | usb_get_configuration | drivers/usb/core/config.c | length | subscript (callee) | yes? | FP |
| 7652 | Low | 40 | C | usb_get_configuration | drivers/usb/core/config.c | bigbuffer | subscript (callee) | yes? | FP |
| 7653 | Low | 40 | C | usb_get_configuration | drivers/usb/core/config.c | length | subscript (callee) | yes? | FP |
| 7654 | Low | 40 | B | usb_get_configuration | drivers/usb/core/config.c | length | memcpy() | yes? | FP |
| 7655 | Low | 40 | B | usbhid_parse | drivers/hid/usbhid/hid-core.c | rsize | memset() in hid_get_class_descriptor() | yes? | FP |
| 7656 | Low | 40 | B | usbhid_parse | drivers/hid/usbhid/hid-core.c | rsize | kmalloc() | yes? | FP |
| 7657 | Low | 40 | B | usbio_bulk_msg | drivers/usb/misc/usbio.c | bpkt_len | memcpy() | yes? | FP |
| 7658 | Low | 40 | B | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | kzalloc() in uvc_alloc_new_entity() | yes? | FP |
| 7659 | Low | 40 | H | vfio_basic_config_write | drivers/vfio/pci/vfio_pci_config.c | new_cmd | truncation | no | FP |
| 7660 | Low | 40 | B | virtio_can_read_rx_queue | drivers/net/can/virtio_can.c | len | memcpy() | yes? | FP |
| 7661 | Low | 40 | C | vtbl_check | drivers/mtd/ubi/vtbl.c | n | subscript | yes? | FP |
| 7662 | Low | 40 | B | vtbl_check | drivers/mtd/ubi/vtbl.c | len1 | strncmp() | yes? | FP |
| 7663 | Low | 40 | C | vtbl_check | drivers/mtd/ubi/vtbl.c | n | subscript | yes? | FP |
| 7664 | Low | 40 | C | vtbl_check | drivers/mtd/ubi/vtbl.c | n | subscript | yes? | FP |
| 7665 | Low | 40 | H | w1_ds2405_select | drivers/w1/slaves/w1_ds2405.c | bit2send | truncation | no | FP |
| 7666 | Low | 40 | H | w1_ds2405_select | drivers/w1/slaves/w1_ds2405.c | ret | truncation | no | FP |
| 7667 | Low | 40 | H | walk_ablock | drivers/md/persistent-data/dm-array.c | r | truncation | no | FP |
| 7668 | Low | 40 | H | walk_node | drivers/md/persistent-data/dm-btree.c | r | truncation | no | FP |
| 7669 | Low | 40 | H | wdt87xx_validate_firmware | drivers/input/touchscreen/wdt87xx_i2c.c | fw_chip_id | truncation | no | FP |
| 7670 | Low | 40 | H | wdt87xx_write_firmware | drivers/input/touchscreen/wdt87xx_i2c.c | firmware_checksum | truncation | no | FP |
| 7671 | Low | 40 | B | wfx_send_pds | drivers/net/wireless/silabs/wfx/main.c | chunk_len | memcpy() in wfx_hif_configuration() | yes? | FP |
| 7672 | Low | 40 | C | wfx_send_pds | drivers/net/wireless/silabs/wfx/main.c | chunk_len | subscript | yes? | FP |
| 7673 | Low | 40 | H | wil_cid_fill_sinfo | drivers/net/wireless/ath/wil6210/cfg80211.c | tx_mcs | truncation | no | FP |
| 7674 | Low | 40 | B | wil_print_mbox_ring | drivers/net/wireless/ath/wil6210/debugfs.c | len | memcpy() in wil_memcpy_fromio_32() | yes? | FP |
| 7675 | Low | 40 | B | wilc_wlan_parse_response_frame | drivers/net/wireless/microchip/wilc1000/wlan_cfg.c | len | memcpy() | yes? | FP |
| 7676 | Low | 40 | B | wmi_get_ssid | drivers/net/wireless/ath/wil6210/wmi.c | len | memcpy() | yes? | FP |
| 7677 | Low | 40 | H | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | mid | truncation | no | FP |
| 7678 | Low | 40 | B | wmi_recv_cmd | drivers/net/wireless/ath/wil6210/wmi.c | len | memcpy() | yes? | FP |
| 7679 | Low | 40 | C | wmi_string_to_utf8s | drivers/platform/wmi/string.c | ret | subscript | yes? | FP |
| 7680 | Low | 40 | B | wx_build_skb | drivers/net/ethernet/wangxun/libwx/wx_lib.c | size | memcpy() | yes? | FP |
| 7681 | Low | 40 | H | wx_rx_vlan | drivers/net/ethernet/wangxun/libwx/wx_lib.c | idx | truncation | no | FP |
| 7682 | Low | 40 | H | xemaclite_recv_data | drivers/net/ethernet/xilinx/xilinx_emaclite.c | proto_type | truncation | no | FP |
| 7683 | Low | 40 | H | xemaclite_recv_data | drivers/net/ethernet/xilinx/xilinx_emaclite.c | length | truncation | no | FP |
| 7684 | Low | 40 | H | xemaclite_recv_data | drivers/net/ethernet/xilinx/xilinx_emaclite.c | length | truncation | no | FP |
| 7685 | Low | 40 | H | xge_rx_poll | drivers/net/ethernet/apm/xgene-v2/main.c | len | truncation | no | FP |
| 7686 | Low | 40 | H | xge_rx_poll | drivers/net/ethernet/apm/xgene-v2/main.c | rx_error | truncation | no | FP |
| 7687 | Low | 40 | H | xgene_enet_free_pagepool | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | frag_size | truncation | no | FP |
| 7688 | Low | 40 | H | xgene_enet_rx_frame | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | skb_index | truncation | no | FP |
| 7689 | Low | 40 | H | xgene_enet_rx_frame | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | datalen | truncation | no | FP |
| 7690 | Low | 40 | H | xgene_enet_rx_frame | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | status | truncation | no | FP |
| 7691 | Low | 40 | H | xgene_enet_rx_frame | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | frag_size | truncation | no | FP |
| 7692 | Low | 40 | H | xgene_enet_tx_completion | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | skb_index | truncation | no | FP |
| 7693 | Low | 40 | H | xgene_enet_tx_completion | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | mss_index | truncation | no | FP |
| 7694 | Low | 40 | H | xgene_enet_tx_completion | drivers/net/ethernet/apm/xgene/xgene_enet_main.c | status | truncation | no | FP |
| 7695 | Low | 40 | C | xhci_handle_cmd_reset_ep | drivers/usb/host/xhci-ring.c | ep_index | subscript (callee) | yes? | FP |
| 7696 | Low | 40 | C | xhci_handle_cmd_set_deq | drivers/usb/host/xhci-ring.c | ep_index | subscript (callee) | yes? | FP |
| 7697 | Low | 40 | C | xhci_handle_cmd_set_deq | drivers/usb/host/xhci-ring.c | stream_id | subscript (callee) | yes? | FP |
| 7698 | Low | 40 | C | xhci_handle_cmd_stop_ep | drivers/usb/host/xhci-ring.c | ep_index | subscript (callee) | yes? | FP |
| 7699 | Low | 40 | C | xhci_handle_command_timeout | drivers/usb/host/xhci-ring.c | cmd_field3 | subscript (callee) | yes? | FP |
| 7700 | Low | 40 | C | xhci_handle_command_timeout | drivers/usb/host/xhci-ring.c | cmd_field3 | subscript (callee) | yes? | FP |
| 7701 | Low | 40 | H | xudc_ep0_in | drivers/usb/gadget/udc/udc-xilinx.c | test_mode | truncation | no | FP |
| 7702 | Low | 40 | C | xudc_getstatus | drivers/usb/gadget/udc/udc-xilinx.c | epnum | subscript | yes? | FP |
| 7703 | Low | 40 | H | xudc_set_clear_feature | drivers/usb/gadget/udc/udc-xilinx.c | endpoint | truncation | no | FP |
| 7704 | Low | 40 | C | xudc_set_clear_feature | drivers/usb/gadget/udc/udc-xilinx.c | endpoint | subscript | yes? | FP |
| 7705 | Low | 40 | H | xudc_set_clear_feature | drivers/usb/gadget/udc/udc-xilinx.c | outinbit | truncation | no | FP |
| 7706 | Low | 40 | H | xudc_set_clear_feature | drivers/usb/gadget/udc/udc-xilinx.c | outinbit | truncation | no | FP |
| 7707 | Low | 40 | B | ziirave_firm_verify | drivers/watchdog/ziirave_wdt.c | len | memcmp() | yes? | FP |
| 7708 | Low | 30 | F | INFTL_mount | drivers/mtd/inftlmount.c | logical_block | loop bound | yes? | FP |
| 7709 | Low | 30 | F | INFTL_mount | drivers/mtd/inftlmount.c | block | loop bound | yes? | FP |
| 7710 | Low | 30 | F | MR_PopulateDrvRaidMap | drivers/scsi/megaraid/megaraid_sas_fp.c | ld_count | loop bound | yes? | FP |
| 7711 | Low | 30 | F | __get_mssc_key_idx | drivers/net/wireless/realtek/rtw89/fw.c | sel_byte_idx | loop bound | yes? | FP |
| 7712 | Low | 30 | F | __parse_formatted_mssc | drivers/net/wireless/realtek/rtw89/fw.c | rmp_tbl_size | loop bound | yes? | FP |
| 7713 | Low | 30 | F | __sbefifo_dump_ffdc | drivers/fsi/fsi-sbefifo.c | w0 | loop bound | yes? | FP |
| 7714 | Low | 30 | F | __subn_set_opa_cc_table | drivers/infiniband/hw/hfi1/mad.c | eentry | loop bound | yes? | FP |
| 7715 | Low | 30 | F | _scsih_expander_add | drivers/scsi/mpt3sas/mpt3sas_scsih.c | sas_expander | loop bound | yes? | FP |
| 7716 | Low | 30 | F | _scsih_expander_add | drivers/scsi/mpt3sas/mpt3sas_scsih.c | parent_handle | loop bound | yes? | FP |
| 7717 | Low | 30 | F | _show_fbtc_cysta_v3 | drivers/net/wireless/realtek/rtw89/coex.c | cycle | loop bound | yes? | FP |
| 7718 | Low | 30 | F | _show_fbtc_cysta_v4 | drivers/net/wireless/realtek/rtw89/coex.c | cycle | loop bound | yes? | FP |
| 7719 | Low | 30 | F | _show_fbtc_cysta_v5 | drivers/net/wireless/realtek/rtw89/coex.c | cycle | loop bound | yes? | FP |
| 7720 | Low | 30 | F | _show_fbtc_cysta_v7 | drivers/net/wireless/realtek/rtw89/coex.c | c_end | loop bound | yes? | FP |
| 7721 | Low | 30 | F | _show_fbtc_step_v3 | drivers/net/wireless/realtek/rtw89/coex.c | n_end | loop bound | yes? | FP |
| 7722 | Low | 30 | F | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | loop bound | yes? | FP |
| 7723 | Low | 30 | F | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | loop bound | yes? | FP |
| 7724 | Low | 30 | F | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | loop bound | yes? | FP |
| 7725 | Low | 30 | F | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | loop bound | yes? | FP |
| 7726 | Low | 30 | F | aac_handle_aif | drivers/scsi/aacraid/commsup.c | container | loop bound | yes? | FP |
| 7727 | Low | 30 | F | ag6xx_setup | drivers/bluetooth/hci_ag6xx.c | plen | loop bound | yes? | FP |
| 7728 | Low | 30 | F | altera_execute | drivers/misc/altera-stapl/altera.c | data_sect | loop bound | yes? | FP |
| 7729 | Low | 30 | F | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | loop bound | yes? | FP |
| 7730 | Low | 30 | F | altera_execute | drivers/misc/altera-stapl/altera.c | long_count | loop bound | yes? | FP |
| 7731 | Low | 30 | F | altera_execute | drivers/misc/altera-stapl/altera.c | long_tmp | loop bound | yes? | FP |
| 7732 | Low | 30 | F | altera_execute | drivers/misc/altera-stapl/altera.c | count | loop bound | yes? | FP |
| 7733 | Low | 30 | F | altera_execute | drivers/misc/altera-stapl/altera.c | long_idx | loop bound | yes? | FP |
| 7734 | Low | 30 | F | amdgpu_atombios_encoder_get_lcd_info | drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | edid | loop bound | yes? | FP |
| 7735 | Low | 30 | F | aoecmd_cfg_rsp | drivers/block/aoe/aoecmd.c | d | loop bound | yes? | FP |
| 7736 | Low | 30 | F | aoecmd_cfg_rsp | drivers/block/aoe/aoecmd.c | d | loop bound | yes? | FP |
| 7737 | Low | 30 | F | async_lcp_peek | drivers/net/ppp/ppp_async.c | dlen | loop bound | yes? | FP |
| 7738 | Low | 30 | F | async_lcp_peek | drivers/net/ppp/ppp_async.c | dlen | loop bound | yes? | FP |
| 7739 | Low | 30 | F | ath10k_core_parse_bd_ie_board | drivers/net/wireless/ath/ath10k/core.c | board_ie_len | loop bound | yes? | FP |
| 7740 | Low | 30 | F | ath10k_core_search_bd | drivers/net/wireless/ath/ath10k/core.c | ie_len | loop bound | yes? | FP |
| 7741 | Low | 30 | F | ath11k_core_fetch_board_data_api_n | drivers/net/wireless/ath/ath11k/core.c | ie_len | loop bound | yes? | FP |
| 7742 | Low | 30 | F | ath11k_core_parse_bd_ie_board | drivers/net/wireless/ath/ath11k/core.c | board_ie_len | loop bound | yes? | FP |
| 7743 | Low | 30 | F | ath12k_core_fetch_board_data_api_n | drivers/net/wireless/ath/ath12k/core.c | ie_len | loop bound | yes? | FP |
| 7744 | Low | 30 | F | ath12k_core_parse_bd_ie_board | drivers/net/wireless/ath/ath12k/core.c | board_ie_len | loop bound | yes? | FP |
| 7745 | Low | 30 | F | ath12k_htt_pull_ppdu_stats | drivers/net/wireless/ath/ath12k/dp_htt.c | ppdu_info | loop bound | yes? | FP |
| 7746 | Low | 30 | F | ax88179_rx_fixup | drivers/net/usb/ax88179_178a.c | pkt_cnt | loop bound | yes? | FP |
| 7747 | Low | 30 | F | bnge_hwrm_get_rings | drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c | cp | loop bound | yes? | FP |
| 7748 | Low | 30 | F | bnxt_hwrm_get_rings | drivers/net/ethernet/broadcom/bnxt/bnxt.c | cp | loop bound | yes? | FP |
| 7749 | Low | 30 | F | brcmf_cfg80211_del_pmksa | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | npmk | loop bound | yes? | FP |
| 7750 | Low | 30 | F | brcmf_enable_bw40_2g | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | num_chan | loop bound | yes? | FP |
| 7751 | Low | 30 | F | brcmf_notify_sched_scan_results | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | request | loop bound | yes? | FP |
| 7752 | Low | 30 | F | brcmf_notify_sched_scan_results | drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | result_count | loop bound | yes? | FP |
| 7753 | Low | 30 | F | brcmf_pcie_init_ringbuffers | drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | max_flowrings | loop bound | yes? | FP |
| 7754 | Low | 30 | F | cdat_sslbis_handler | drivers/cxl/core/cdat.c | entries | loop bound | yes? | FP |
| 7755 | Low | 30 | F | cdns_mhdp_mailbox_recv_header | drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | mbox_size | loop bound | yes? | FP |
| 7756 | Low | 30 | F | cdns_mhdp_secure_mailbox_recv_header | drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c | mbox_size | loop bound | yes? | FP |
| 7757 | Low | 30 | F | composite_setup | drivers/usb/gadget/composite.c | interface | loop bound | yes? | FP |
| 7758 | Low | 30 | F | composite_setup | drivers/usb/gadget/composite.c | interface | loop bound | yes? | FP |
| 7759 | Low | 30 | F | composite_setup | drivers/usb/gadget/composite.c | interface | loop bound | yes? | FP |
| 7760 | Low | 30 | F | core_scsi3_decode_spec_i_port | drivers/target/target_core_pr.c | tpdl | loop bound | yes? | FP |
| 7761 | Low | 30 | F | cyttsp5_read | drivers/input/touchscreen/cyttsp5.c | size | loop bound | yes? | FP |
| 7762 | Low | 30 | F | dell_wmi_notify | drivers/platform/x86/dell/dell-wmi-base.c | len | loop bound | yes? | FP |
| 7763 | Low | 30 | F | derlc | drivers/media/test-drivers/vicodec/codec-fwht.c | length | loop bound | yes? | FP |
| 7764 | Low | 30 | F | descriptors_changed | drivers/usb/core/hub.c | len | loop bound | yes? | FP |
| 7765 | Low | 30 | F | descriptors_changed | drivers/usb/core/hub.c | old_length | loop bound | yes? | FP |
| 7766 | Low | 30 | F | descriptors_changed | drivers/usb/core/hub.c | length | loop bound | yes? | FP |
| 7767 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | loop bound | yes? | FP |
| 7768 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | loop bound | yes? | FP |
| 7769 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | loop bound | yes? | FP |
| 7770 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | ic->provided_data_sectors - le64_to_cpu(ic->sb->recalc_secto | loop bound | yes? | FP |
| 7771 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | loop bound | yes? | FP |
| 7772 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | loop bound | yes? | FP |
| 7773 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | ic->provided_data_sectors - le64_to_cpu(ic->sb->recalc_secto | loop bound | yes? | FP |
| 7774 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | loop bound | yes? | FP |
| 7775 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | loop bound | yes? | FP |
| 7776 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | ic->provided_data_sectors - le64_to_cpu(ic->sb->recalc_secto | loop bound | yes? | FP |
| 7777 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | loop bound | yes? | FP |
| 7778 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | loop bound | yes? | FP |
| 7779 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | ic->provided_data_sectors - le64_to_cpu(ic->sb->recalc_secto | loop bound | yes? | FP |
| 7780 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | loop bound | yes? | FP |
| 7781 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | loop bound | yes? | FP |
| 7782 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | ic->provided_data_sectors - le64_to_cpu(ic->sb->recalc_secto | loop bound | yes? | FP |
| 7783 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | loop bound | yes? | FP |
| 7784 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | loop bound | yes? | FP |
| 7785 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | ic->provided_data_sectors - le64_to_cpu(ic->sb->recalc_secto | loop bound | yes? | FP |
| 7786 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | old_provided_data_sectors | loop bound | yes? | FP |
| 7787 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | le64_to_cpu(ic->sb->recalc_sector) | loop bound | yes? | FP |
| 7788 | Low | 30 | F | dm_integrity_resume | drivers/md/dm-integrity.c | ic->provided_data_sectors - le64_to_cpu(ic->sb->recalc_secto | loop bound | yes? | FP |
| 7789 | Low | 30 | F | dma_rx | drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c | resid | loop bound | yes? | FP |
| 7790 | Low | 30 | F | es581_4_dispatch_rx_cmd | drivers/net/can/usb/etas_es58x/es581_4.c | msg_len | loop bound | yes? | FP |
| 7791 | Low | 30 | F | es581_4_echo_msg | drivers/net/can/usb/etas_es58x/es581_4.c | num_element | loop bound | yes? | FP |
| 7792 | Low | 30 | F | es581_4_echo_msg | drivers/net/can/usb/etas_es58x/es581_4.c | num_element | loop bound | yes? | FP |
| 7793 | Low | 30 | F | es58x_fd_echo_msg | drivers/net/can/usb/etas_es58x/es58x_fd.c | num_element | loop bound | yes? | FP |
| 7794 | Low | 30 | F | fc_disc_recv_rscn_req | drivers/scsi/libfc/fc_disc.c | len | loop bound | yes? | FP |
| 7795 | Low | 30 | F | fc_rport_recv_prli_req | drivers/scsi/libfc/fc_rport.c | len | loop bound | yes? | FP |
| 7796 | Low | 30 | F | fcoe_ctlr_parse_adv | drivers/scsi/fcoe/fcoe_ctlr.c | rlen | loop bound | yes? | FP |
| 7797 | Low | 30 | F | fcoe_ctlr_recv_els | drivers/scsi/fcoe/fcoe_ctlr.c | rlen | loop bound | yes? | FP |
| 7798 | Low | 30 | F | fcoe_ctlr_vlan_parse | drivers/scsi/fcoe/fcoe_ctlr.c | rlen | loop bound | yes? | FP |
| 7799 | Low | 30 | F | fcoe_ctlr_vn_parse | drivers/scsi/fcoe/fcoe_ctlr.c | rlen | loop bound | yes? | FP |
| 7800 | Low | 30 | F | fsi_occ_submit | drivers/fsi/fsi-occ.c | resp_data_length | loop bound | yes? | FP |
| 7801 | Low | 30 | F | fw_handle_fill | drivers/net/wireless/ath/wil6210/fw_inc.c | s | loop bound | yes? | FP |
| 7802 | Low | 30 | F | gaudi_handle_eqe | drivers/accel/habanalabs/gaudi/gaudi.c | event_type | loop bound | yes? | FP |
| 7803 | Low | 30 | F | genelink_rx_fixup | drivers/net/usb/gl620a.c | count | loop bound | yes? | FP |
| 7804 | Low | 30 | F | get_supported_features | drivers/cxl/core/features.c | num_entries | loop bound | yes? | FP |
| 7805 | Low | 30 | F | glink_rpm_parse_toc | drivers/rpmsg/qcom_glink_rpm.c | num_entries | loop bound | yes? | FP |
| 7806 | Low | 30 | F | goodix_berlin_get_ic_info | drivers/input/touchscreen/goodix_berlin_core.c | length | loop bound | yes? | FP |
| 7807 | Low | 30 | F | goodix_berlin_get_ic_info | drivers/input/touchscreen/goodix_berlin_core.c | length | loop bound | yes? | FP |
| 7808 | Low | 30 | F | goodix_berlin_get_ic_info | drivers/input/touchscreen/goodix_berlin_core.c | length | loop bound | yes? | FP |
| 7809 | Low | 30 | F | goodix_berlin_get_ic_info | drivers/input/touchscreen/goodix_berlin_core.c | length | loop bound | yes? | FP |
| 7810 | Low | 30 | F | handle_port_status | drivers/usb/host/xhci-ring.c | port | loop bound | yes? | FP |
| 7811 | Low | 30 | F | hfi1_rc_rcv | drivers/infiniband/hw/hfi1/rc.c | rkey | loop bound | yes? | FP |
| 7812 | Low | 30 | F | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | loop bound | yes? | FP |
| 7813 | Low | 30 | F | hfi1_rc_rcv_tid_rdma_read_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | loop bound | yes? | FP |
| 7814 | Low | 30 | F | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | vaddr | loop bound | yes? | FP |
| 7815 | Low | 30 | F | hfi1_rc_rcv_tid_rdma_write_req | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | loop bound | yes? | FP |
| 7816 | Low | 30 | F | hfi1_rc_rcv_tid_rdma_write_resp | drivers/infiniband/hw/hfi1/tid_rdma.c | psn | loop bound | yes? | FP |
| 7817 | Low | 30 | F | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | vaddr | loop bound | yes? | FP |
| 7818 | Low | 30 | F | hfi1_uc_rcv | drivers/infiniband/hw/hfi1/uc.c | rkey | loop bound | yes? | FP |
| 7819 | Low | 30 | F | hwinfo_db_validate | drivers/net/ethernet/netronome/nfp/nfpcore/nfp_hwinfo.c | size | loop bound | yes? | FP |
| 7820 | Low | 30 | F | i2c_nuvoton_recv | drivers/char/tpm/tpm_i2c_nuvoton.c | expected | loop bound | yes? | FP |
| 7821 | Low | 30 | F | ice_gnss_read | drivers/net/ethernet/intel/ice/ice_gnss.c | data_len | loop bound | yes? | FP |
| 7822 | Low | 30 | F | ice_process_health_status_event | drivers/net/ethernet/intel/ice/devlink/health.c | count | loop bound | yes? | FP |
| 7823 | Low | 30 | F | ice_verify_pkg | drivers/net/ethernet/intel/ice/ice_ddp.c | seg_count | loop bound | yes? | FP |
| 7824 | Low | 30 | F | idpf_mac_filter_async_handler | drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | num_entries | loop bound | yes? | FP |
| 7825 | Low | 30 | F | il3945_hw_txq_free_tfd | drivers/net/wireless/intel/iwlegacy/3945.c | counter | loop bound | yes? | FP |
| 7826 | Low | 30 | F | il4965_hdl_tx | drivers/net/wireless/intel/iwlegacy/4965-mac.c | agg | loop bound | yes? | FP |
| 7827 | Low | 30 | F | il4965_rs_sta_dbgfs_scale_table_read | drivers/net/wireless/intel/iwlegacy/4965-rs.c | le32_to_cpu
(lq_sta->lq.rs_table[i].
| loop bound | yes? | FP |
| 7828 | Low | 30 | F | ionic_map_disc_cmb | drivers/net/ethernet/pensando/ionic/ionic_dev.c | num_regions | loop bound | yes? | FP |
| 7829 | Low | 30 | F | ionic_map_disc_cmb | drivers/net/ethernet/pensando/ionic/ionic_dev.c | num_regions | loop bound | yes? | FP |
| 7830 | Low | 30 | F | ipc_coredump_get_list | drivers/net/wwan/iosm/iosm_ipc_coredump.c | num_entries | loop bound | yes? | FP |
| 7831 | Low | 30 | F | ipr_get_ioa_dump | drivers/scsi/ipr.c | bytes_to_copy | loop bound | yes? | FP |
| 7832 | Low | 30 | F | iscsi_parse_pr_out_transport_id | drivers/target/target_core_fabric_lib.c | p | loop bound | yes? | FP |
| 7833 | Low | 30 | F | iscsit_handle_snack | drivers/target/iscsi/iscsi_target.c | be32_to_cpu(hdr->begrun) | loop bound | yes? | FP |
| 7834 | Low | 30 | F | iwl_mld_flush_link_sta_txqs | drivers/net/wireless/intel/iwlwifi/mld/tx.c | num_flushed_queues | loop bound | yes? | FP |
| 7835 | Low | 30 | F | iwl_mld_handle_compressed_ba_notif | drivers/net/wireless/intel/iwlwifi/mld/tx.c | tfd_cnt | loop bound | yes? | FP |
| 7836 | Low | 30 | F | iwl_mvm_flush_sta_tids | drivers/net/wireless/intel/iwlwifi/mvm/tx.c | num_flushed_queues | loop bound | yes? | FP |
| 7837 | Low | 30 | F | iwl_mvm_rx_ba_notif | drivers/net/wireless/intel/iwlwifi/mvm/tx.c | tfd_cnt | loop bound | yes? | FP |
| 7838 | Low | 30 | F | iwl_mvm_v3_rate_from_fw | drivers/net/wireless/intel/iwlwifi/mvm/utils.c | rate_v1 | loop bound | yes? | FP |
| 7839 | Low | 30 | F | iwl_parse_shared_mem_22000 | drivers/net/wireless/intel/iwlwifi/fw/smem.c | lmac_num | loop bound | yes? | FP |
| 7840 | Low | 30 | F | iwl_pcie_hcmd_complete | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx.c | index | loop bound | yes? | FP |
| 7841 | Low | 30 | F | iwl_pcie_hcmd_complete | drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx.c | index | loop bound | yes? | FP |
| 7842 | Low | 30 | F | load_firmware | drivers/media/tuners/xc2028.c | size | loop bound | yes? | FP |
| 7843 | Low | 30 | F | load_waveform | drivers/video/fbdev/metronomefb.c | cksum_idx | loop bound | yes? | FP |
| 7844 | Low | 30 | F | megasas_get_ld_list | drivers/scsi/megaraid/megaraid_sas_base.c | ld_count | loop bound | yes? | FP |
| 7845 | Low | 30 | F | megasas_host_device_list_query | drivers/scsi/megaraid/megaraid_sas_base.c | count | loop bound | yes? | FP |
| 7846 | Low | 30 | F | mlx4_qp_attach_common | drivers/net/ethernet/mellanox/mlx4/mcg.c | members_count | loop bound | yes? | FP |
| 7847 | Low | 30 | F | mpi3mr_expander_add | drivers/scsi/mpi3mr/mpi3mr_transport.c | parent_handle | loop bound | yes? | FP |
| 7848 | Low | 30 | F | mpi3mr_process_op_reply_desc | drivers/scsi/mpi3mr/mpi3mr_os.c | scmd | loop bound | yes? | FP |
| 7849 | Low | 30 | F | mpi3mr_refresh_expanders | drivers/scsi/mpi3mr/mpi3mr_transport.c | sas_expander | loop bound | yes? | FP |
| 7850 | Low | 30 | F | mptsas_send_link_status_event | drivers/message/fusion/mptsas.c | port_info | loop bound | yes? | FP |
| 7851 | Low | 30 | F | mptsas_send_link_status_event | drivers/message/fusion/mptsas.c | port_info | loop bound | yes? | FP |
| 7852 | Low | 30 | F | mptsas_send_link_status_event | drivers/message/fusion/mptsas.c | port_info | loop bound | yes? | FP |
| 7853 | Low | 30 | F | mpu3050_trigger_handler | drivers/iio/gyro/mpu3050-core.c | fifocnt | loop bound | yes? | FP |
| 7854 | Low | 30 | F | ms_lib_process_bootblock | drivers/usb/storage/ene_ub6250.c | EntrySize | loop bound | yes? | FP |
| 7855 | Low | 30 | F | mt7915_mac_tx_free_v0 | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | count | loop bound | yes? | FP |
| 7856 | Low | 30 | F | mt7996_rro_rx_process | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | len | loop bound | yes? | FP |
| 7857 | Low | 30 | F | mux_dl_adb_decode | drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | nr_of_dg | loop bound | yes? | FP |
| 7858 | Low | 30 | F | mwifiex_11n_rxba_sync_event | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | tlv_bitmap_len | loop bound | yes? | FP |
| 7859 | Low | 30 | F | mwifiex_get_power_level | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | length | loop bound | yes? | FP |
| 7860 | Low | 30 | F | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | fw_tsf | loop bound | yes? | FP |
| 7861 | Low | 30 | F | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | radio_type | loop bound | yes? | FP |
| 7862 | Low | 30 | F | mwifiex_handle_event_ext_scan_report | drivers/net/wireless/marvell/mwifiex/scan.c | rssi | loop bound | yes? | FP |
| 7863 | Low | 30 | F | mwifiex_parse_single_response_buf | drivers/net/wireless/marvell/mwifiex/scan.c | curr_bcn_bytes | loop bound | yes? | FP |
| 7864 | Low | 30 | F | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | loop bound | yes? | FP |
| 7865 | Low | 30 | F | mwifiex_process_rx_packet | drivers/net/wireless/marvell/mwifiex/sta_rx.c | offset | loop bound | yes? | FP |
| 7866 | Low | 30 | F | mwifiex_ret_802_11_scan | drivers/net/wireless/marvell/mwifiex/scan.c | le64_to_cpu(fw_tsf) | loop bound | yes? | FP |
| 7867 | Low | 30 | F | mwifiex_ret_chan_region_cfg | drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | tlv_buf_len | loop bound | yes? | FP |
| 7868 | Low | 30 | F | mxuport_process_read_urb_demux_data | drivers/usb/serial/mxuport.c | rcv_len | loop bound | yes? | FP |
| 7869 | Low | 30 | F | nfp_tunnel_keep_alive | drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c | count | loop bound | yes? | FP |
| 7870 | Low | 30 | F | nfp_tunnel_keep_alive_v6 | drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c | count | loop bound | yes? | FP |
| 7871 | Low | 30 | F | nvme_pr_read_reservation | drivers/nvme/host/pr.c | num_regs | loop bound | yes? | FP |
| 7872 | Low | 30 | F | of_irq_parse_raw | drivers/of/irq.c | addrsize | loop bound | yes? | FP |
| 7873 | Low | 30 | F | of_irq_parse_raw | drivers/of/irq.c | addrsize | loop bound | yes? | FP |
| 7874 | Low | 30 | F | of_irq_parse_raw | drivers/of/irq.c | addrsize | loop bound | yes? | FP |
| 7875 | Low | 30 | F | ovpn_decrypt_post | drivers/net/ovpn/io.c | ntohl(*pid) | loop bound | yes? | FP |
| 7876 | Low | 30 | F | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | data_len | loop bound | yes? | FP |
| 7877 | Low | 30 | F | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | le16_to_cpu(entry->code) | loop bound | yes? | FP |
| 7878 | Low | 30 | F | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | data_len | loop bound | yes? | FP |
| 7879 | Low | 30 | F | p54_parse_eeprom | drivers/net/wireless/intersil/p54/eeprom.c | le16_to_cpu(entry->code) | loop bound | yes? | FP |
| 7880 | Low | 30 | F | parse_qcomsmem_part | drivers/mtd/parsers/qcomsmempart.c | tmpparts | loop bound | yes? | FP |
| 7881 | Low | 30 | F | parse_qcomsmem_part | drivers/mtd/parsers/qcomsmempart.c | tmpparts | loop bound | yes? | FP |
| 7882 | Low | 30 | F | ppp_rx | drivers/net/wan/hdlc_ppp.c | len | loop bound | yes? | FP |
| 7883 | Low | 30 | F | ppp_rx | drivers/net/wan/hdlc_ppp.c | len | loop bound | yes? | FP |
| 7884 | Low | 30 | F | process_bulk_in | drivers/char/xillybus/xillyusb.c | bytes | loop bound | yes? | FP |
| 7885 | Low | 30 | F | process_info_rsp | drivers/infiniband/ulp/rtrs/rtrs-clt.c | sg_cnt | loop bound | yes? | FP |
| 7886 | Low | 30 | F | qca_tlv_check_data | drivers/bluetooth/btqca.c | length | loop bound | yes? | FP |
| 7887 | Low | 30 | F | qed_init_cmd_array | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | output_len | loop bound | yes? | FP |
| 7888 | Low | 30 | F | qed_init_cmd_array | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | size | loop bound | yes? | FP |
| 7889 | Low | 30 | F | qed_init_cmd_wr | drivers/net/ethernet/qlogic/qed/qed_init_ops.c | data | loop bound | yes? | FP |
| 7890 | Low | 30 | F | qed_read_storm_fw_info | drivers/net/ethernet/qlogic/qed/qed_debug.c | size | loop bound | yes? | FP |
| 7891 | Low | 30 | F | qede_rx_process_cqe | drivers/net/ethernet/qlogic/qede/qede_fp.c | unmapped_frags | loop bound | yes? | FP |
| 7892 | Low | 30 | F | qla4_84xx_minidump_process_pollwr | drivers/scsi/qla4xxx/ql4_nx.c | poll | loop bound | yes? | FP |
| 7893 | Low | 30 | F | qla4_84xx_minidump_process_rddfe | drivers/scsi/qla4xxx/ql4_nx.c | poll | loop bound | yes? | FP |
| 7894 | Low | 30 | F | qla4_84xx_minidump_process_rddfe | drivers/scsi/qla4xxx/ql4_nx.c | poll | loop bound | yes? | FP |
| 7895 | Low | 30 | F | qla4xxx_copy_sense | drivers/scsi/qla4xxx/ql4_isr.c | sense_len | loop bound | yes? | FP |
| 7896 | Low | 30 | F | r5c_recovery_analyze_meta_block | drivers/md/raid5-cache.c | sh | loop bound | yes? | FP |
| 7897 | Low | 30 | F | radeon_atombios_get_lvds_info | drivers/gpu/drm/radeon/radeon_atombios.c | edid | loop bound | yes? | FP |
| 7898 | Low | 30 | F | rc_rcv_error | drivers/infiniband/hw/hfi1/rc.c | rkey | loop bound | yes? | FP |
| 7899 | Low | 30 | F | resp_atomic_write | drivers/scsi/scsi_debug.c | len | loop bound | yes? | FP |
| 7900 | Low | 30 | F | resp_read_dt0 | drivers/scsi/scsi_debug.c | num | loop bound | yes? | FP |
| 7901 | Low | 30 | F | resp_read_dt0 | drivers/scsi/scsi_debug.c | num | loop bound | yes? | FP |
| 7902 | Low | 30 | F | resp_unmap | drivers/scsi/scsi_debug.c | descriptors | loop bound | yes? | FP |
| 7903 | Low | 30 | F | resp_verify | drivers/scsi/scsi_debug.c | vnum | loop bound | yes? | FP |
| 7904 | Low | 30 | F | resp_write_same_10 | drivers/scsi/scsi_debug.c | num | loop bound | yes? | FP |
| 7905 | Low | 30 | F | resp_write_same_16 | drivers/scsi/scsi_debug.c | num | loop bound | yes? | FP |
| 7906 | Low | 30 | F | resp_write_scat | drivers/scsi/scsi_debug.c | num | loop bound | yes? | FP |
| 7907 | Low | 30 | F | resp_write_scat | drivers/scsi/scsi_debug.c | num | loop bound | yes? | FP |
| 7908 | Low | 30 | F | resp_write_scat | drivers/scsi/scsi_debug.c | num_lrd | loop bound | yes? | FP |
| 7909 | Low | 30 | F | restore_delta_list_data | drivers/md/dm-vdo/indexer/delta-index.c | save_info | loop bound | yes? | FP |
| 7910 | Low | 30 | F | rs_sta_dbgfs_scale_table_read | drivers/net/wireless/intel/iwlwifi/dvm/rs.c | le32_to_cpu(lq_sta->lq.rs_table[i].rate_n_flags) | loop bound | yes? | FP |
| 7911 | Low | 30 | F | rtw_parse_wpa2_ie | drivers/staging/rtl8723bs/core/rtw_ieee80211.c | count | loop bound | yes? | FP |
| 7912 | Low | 30 | F | rtw_parse_wpa_ie | drivers/staging/rtl8723bs/core/rtw_ieee80211.c | count | loop bound | yes? | FP |
| 7913 | Low | 30 | F | sbc_execute_unmap | drivers/target/target_core_sbc.c | size | loop bound | yes? | FP |
| 7914 | Low | 30 | F | scmi_base_implementation_list_get | drivers/firmware/arm_scmi/base.c | loop_num_ret | loop bound | yes? | FP |
| 7915 | Low | 30 | F | sd_read_cpr | drivers/scsi/sd.c | nr_cpr | loop bound | yes? | FP |
| 7916 | Low | 30 | F | srpt_get_desc_tbl | drivers/infiniband/ulp/srpt/ib_srpt.c | nbufs | loop bound | yes? | FP |
| 7917 | Low | 30 | F | ssp_irq_msg | drivers/iio/common/ssp_sensors/ssp_spi.c | length | loop bound | yes? | FP |
| 7918 | Low | 30 | F | st33zp24_recv | drivers/char/tpm/st33zp24/st33zp24.c | expected | loop bound | yes? | FP |
| 7919 | Low | 30 | F | subn_get_opa_aggregate | drivers/infiniband/hw/hfi1/mad.c | num_attr | loop bound | yes? | FP |
| 7920 | Low | 30 | F | subn_set_opa_aggregate | drivers/infiniband/hw/hfi1/mad.c | num_attr | loop bound | yes? | FP |
| 7921 | Low | 30 | F | super_1_load | drivers/md/md.c | sectors | loop bound | yes? | FP |
| 7922 | Low | 30 | F | t7xx_parse_host_rt_data | drivers/net/wwan/t7xx/t7xx_modem_ops.c | feat_data_len | loop bound | yes? | FP |
| 7923 | Low | 30 | F | t7xx_port_enum_msg_handler | drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | port_count | loop bound | yes? | FP |
| 7924 | Low | 30 | F | target_parse_xcopy_cmd | drivers/target/target_core_xcopy.c | tdll | loop bound | yes? | FP |
| 7925 | Low | 30 | F | target_parse_xcopy_cmd | drivers/target/target_core_xcopy.c | sdll | loop bound | yes? | FP |
| 7926 | Low | 30 | F | tc35815_rx | drivers/net/ethernet/toshiba/tc35815.c | bd_count | loop bound | yes? | FP |
| 7927 | Low | 30 | F | tid_rdma_rcv_error | drivers/infiniband/hw/hfi1/tid_rdma.c | rkey | loop bound | yes? | FP |
| 7928 | Low | 30 | F | tpm_atml_recv | drivers/char/tpm/tpm_atmel.c | size | loop bound | yes? | FP |
| 7929 | Low | 30 | F | tpm_atml_recv | drivers/char/tpm/tpm_atmel.c | size | loop bound | yes? | FP |
| 7930 | Low | 30 | F | tpm_buf_fill_hmac_session | drivers/char/tpm/tpm2-sessions.c | i | loop bound | yes? | FP |
| 7931 | Low | 30 | F | tpm_buf_fill_hmac_session | drivers/char/tpm/tpm2-sessions.c | i | loop bound | yes? | FP |
| 7932 | Low | 30 | F | tpm_tis_i2c_recv | drivers/char/tpm/tpm_i2c_infineon.c | expected | loop bound | yes? | FP |
| 7933 | Low | 30 | F | tpm_tis_try_recv | drivers/char/tpm/tpm_tis_core.c | expected | loop bound | yes? | FP |
| 7934 | Low | 30 | F | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | pool_size | loop bound | yes? | FP |
| 7935 | Low | 30 | F | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | wl_pool_size | loop bound | yes? | FP |
| 7936 | Low | 30 | F | ubi_scan_fastmap | drivers/mtd/ubi/fastmap.c | used_blocks | loop bound | yes? | FP |
| 7937 | Low | 30 | F | ubi_scan_fastmap | drivers/mtd/ubi/fastmap.c | used_blocks | loop bound | yes? | FP |
| 7938 | Low | 30 | F | uds_initialize_delta_index_page | drivers/md/dm-vdo/indexer/delta-index.c | list_count | loop bound | yes? | FP |
| 7939 | Low | 30 | F | usb_get_configuration | drivers/usb/core/config.c | bigbuffer | loop bound | yes? | FP |
| 7940 | Low | 30 | F | usb_get_configuration | drivers/usb/core/config.c | length | loop bound | yes? | FP |
| 7941 | Low | 30 | F | usb_get_configuration | drivers/usb/core/config.c | bigbuffer | loop bound | yes? | FP |
| 7942 | Low | 30 | F | usb_get_configuration | drivers/usb/core/config.c | length | loop bound | yes? | FP |
| 7943 | Low | 30 | F | usb_get_configuration | drivers/usb/core/config.c | length | loop bound | yes? | FP |
| 7944 | Low | 30 | F | usb_get_configuration | drivers/usb/core/config.c | length | loop bound | yes? | FP |
| 7945 | Low | 30 | F | usbhid_parse | drivers/hid/usbhid/hid-core.c | rsize | loop bound | yes? | FP |
| 7946 | Low | 30 | F | uvc_parse_standard_control | drivers/media/usb/uvc/uvc_driver.c | type | loop bound | yes? | FP |
| 7947 | Low | 30 | F | vtbl_check | drivers/mtd/ubi/vtbl.c | n | loop bound | yes? | FP |
| 7948 | Low | 30 | F | wil_print_mbox_ring | drivers/net/wireless/ath/wil6210/debugfs.c | len | loop bound | yes? | FP |
| 7949 | Low | 30 | F | wmi_evt_link_stats | drivers/net/wireless/ath/wil6210/wmi.c | payload_size | loop bound | yes? | FP |
| 7950 | Low | 30 | F | ziirave_firm_verify | drivers/watchdog/ziirave_wdt.c | len | loop bound | yes? | FP |
| 7951 | Low | 30 | F | ziirave_firm_verify | drivers/watchdog/ziirave_wdt.c | len | loop bound | yes? | FP |
| 7952 | Low | 20 | H | INFTL_mount | drivers/mtd/inftlmount.c | ANAC | truncation | yes? | FP |
| 7953 | Low | 20 | H | __parse_formatted_mssc | drivers/net/wireless/realtek/rtw89/fw.c | rmp_tbl_size | truncation | yes? | FP |
| 7954 | Low | 20 | H | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | rc | truncation | yes? | FP |
| 7955 | Low | 20 | H | _base_process_reply_queue | drivers/scsi/mpt3sas/mpt3sas_base.c | rc | truncation | yes? | FP |
| 7956 | Low | 20 | H | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | subrev | truncation | yes? | FP |
| 7957 | Low | 20 | H | amdgpu_discovery_reg_base_init | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | variant | truncation | yes? | FP |
| 7958 | Low | 20 | H | ath12k_debugfs_htt_ext_stats_handler | drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | pdev_id | truncation | yes? | FP |
| 7959 | Low | 20 | H | ath6kl_wmi_implicit_create_pstream | drivers/net/wireless/ath/ath6kl/wmi.c | usr_pri | truncation | yes? | FP |
| 7960 | Low | 20 | H | bme680_read_gas | drivers/iio/chemical/bme680_core.c | gas_range | truncation | yes? | FP |
| 7961 | Low | 20 | H | bme680_trigger_handler | drivers/iio/chemical/bme680_core.c | gas_range | truncation | yes? | FP |
| 7962 | Low | 20 | H | bnxt_qplib_cq_process_req | drivers/infiniband/hw/bnxt_re/qplib_fp.c | cqe_sq_cons | truncation | yes? | FP |
| 7963 | Low | 20 | H | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pnext | truncation | yes? | FP |
| 7964 | Low | 20 | H | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pnext | truncation | yes? | FP |
| 7965 | Low | 20 | H | brcmf_sdio_rxglom | drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | pnext | truncation | yes? | FP |
| 7966 | Low | 20 | H | cas_tx | drivers/net/ethernet/sun/cassini.c | limit | truncation | yes? | FP |
| 7967 | Low | 20 | H | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | td | truncation | yes? | FP |
| 7968 | Low | 20 | H | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | ep_trb | truncation | yes? | FP |
| 7969 | Low | 20 | H | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | truncation | yes? | FP |
| 7970 | Low | 20 | H | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | td | truncation | yes? | FP |
| 7971 | Low | 20 | H | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | ep_trb | truncation | yes? | FP |
| 7972 | Low | 20 | H | cdnsp_handle_tx_event | drivers/usb/cdns3/cdnsp-ring.c | pep | truncation | yes? | FP |
| 7973 | Low | 20 | H | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | truncation | yes? | FP |
| 7974 | Low | 20 | H | complete_cmd_fusion | drivers/scsi/megaraid/megaraid_sas_fusion.c | cmd_fusion | truncation | yes? | FP |
| 7975 | Low | 20 | H | composite_setup | drivers/usb/gadget/composite.c | endp | truncation | yes? | FP |
| 7976 | Low | 20 | H | crb_map_io | drivers/char/tpm/tpm_crb.c | rsp_size | truncation | yes? | FP |
| 7977 | Low | 20 | H | ddcb_cmd_fixups | drivers/misc/genwqe/card_dev.c | rc | truncation | yes? | FP |
| 7978 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7979 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7980 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7981 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7982 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7983 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7984 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7985 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7986 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7987 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7988 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7989 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7990 | Low | 20 | H | dr_dump_rule_action_mem | drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | ret | truncation | yes? | FP |
| 7991 | Low | 20 | H | gaudi_handle_eqe | drivers/accel/habanalabs/gaudi/gaudi.c | event_type | truncation | yes? | FP |
| 7992 | Low | 20 | H | gem_rx | drivers/net/ethernet/sun/sungem.c | len | truncation | yes? | FP |
| 7993 | Low | 20 | H | get_port_ssp_rate | drivers/usb/core/hub.c | lse | truncation | yes? | FP |
| 7994 | Low | 20 | H | get_port_ssp_rate | drivers/usb/core/hub.c | mantissa | truncation | yes? | FP |
| 7995 | Low | 20 | H | handle_outgoing_dr_smp | drivers/infiniband/core/mad.c | drslid | truncation | yes? | FP |
| 7996 | Low | 20 | H | idtfc3_get_tdc_offset_sign | drivers/ptp/ptp_fc3.c | sig1 | truncation | yes? | FP |
| 7997 | Low | 20 | H | idtfc3_get_tdc_offset_sign | drivers/ptp/ptp_fc3.c | sig2 | truncation | yes? | FP |
| 7998 | Low | 20 | H | intr_handler | drivers/net/ethernet/adaptec/starfire.c | entry | truncation | yes? | FP |
| 7999 | Low | 20 | H | investigate_read_descriptor | drivers/net/ethernet/dec/tulip/xircom_cb.c | pkt_len | truncation | yes? | FP |
| 8000 | Low | 20 | H | iwl_ini_get_rxf_data | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | fifo_idx | truncation | yes? | FP |
| 8001 | Low | 20 | H | iwl_ini_get_rxf_data | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | fifo_idx | truncation | yes? | FP |
| 8002 | Low | 20 | H | iwl_mvm_rx_crypto | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | status | truncation | yes? | FP |
| 8003 | Low | 20 | H | load_waveform | drivers/video/fbdev/metronomefb.c | cksum | truncation | yes? | FP |
| 8004 | Low | 20 | H | load_waveform | drivers/video/fbdev/metronomefb.c | cksum | truncation | yes? | FP |
| 8005 | Low | 20 | H | load_waveform | drivers/video/fbdev/metronomefb.c | v | truncation | yes? | FP |
| 8006 | Low | 20 | H | load_waveform | drivers/video/fbdev/metronomefb.c | v | truncation | yes? | FP |
| 8007 | Low | 20 | H | load_waveform | drivers/video/fbdev/metronomefb.c | rl | truncation | yes? | FP |
| 8008 | Low | 20 | H | megasas_complete_r1_command | drivers/scsi/megaraid/megaraid_sas_fusion.c | status | truncation | yes? | FP |
| 8009 | Low | 20 | H | megasas_complete_r1_command | drivers/scsi/megaraid/megaraid_sas_fusion.c | ex_status | truncation | yes? | FP |
| 8010 | Low | 20 | H | mt76_connac2_mac_fill_txs | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | tid | truncation | yes? | FP |
| 8011 | Low | 20 | H | nvmet_execute_pr_report | drivers/nvme/target/pr.c | status | truncation | yes? | FP |
| 8012 | Low | 20 | H | nvmet_file_execute_discard | drivers/nvme/target/io-cmd-file.c | ret | truncation | yes? | FP |
| 8013 | Low | 20 | H | nvmet_file_execute_discard | drivers/nvme/target/io-cmd-file.c | status | truncation | yes? | FP |
| 8014 | Low | 20 | H | nvmet_file_write_zeroes_work | drivers/nvme/target/io-cmd-file.c | ret | truncation | yes? | FP |
| 8015 | Low | 20 | H | pass_accept_req | drivers/infiniband/hw/cxgb4/cm.c | tos | truncation | yes? | FP |
| 8016 | Low | 20 | H | ptp_ocp_devlink_fw_image | drivers/ptp/ptp_ocp.c | crc | truncation | yes? | FP |
| 8017 | Low | 20 | H | qla2x00_status_entry | drivers/scsi/qla2xxx/qla_isr.c | lscsi_status | truncation | yes? | FP |
| 8018 | Low | 20 | H | qm_get_complete_eqe_num | drivers/crypto/hisilicon/qm.c | cqn | truncation | yes? | FP |
| 8019 | Low | 20 | H | qtnf_parse_variable_mac_info | drivers/net/wireless/quantenna/qtnfmac/commands.c | ext_capa_len | truncation | yes? | FP |
| 8020 | Low | 20 | H | qtnf_parse_variable_mac_info | drivers/net/wireless/quantenna/qtnfmac/commands.c | ext_capa_mask_len | truncation | yes? | FP |
| 8021 | Low | 20 | H | resp_get_lba_status | drivers/scsi/scsi_debug.c | num | truncation | yes? | FP |
| 8022 | Low | 20 | H | resp_read_dt0 | drivers/scsi/scsi_debug.c | ret | truncation | yes? | FP |
| 8023 | Low | 20 | H | resp_read_dt0 | drivers/scsi/scsi_debug.c | ret | truncation | yes? | FP |
| 8024 | Low | 20 | H | rtl_p2p_noa_ie | drivers/net/wireless/realtek/rtlwifi/ps.c | noa_num | truncation | yes? | FP |
| 8025 | Low | 20 | H | scan_peb | drivers/mtd/ubi/attach.c | err | truncation | yes? | FP |
| 8026 | Low | 20 | H | scan_peb | drivers/mtd/ubi/attach.c | err | truncation | yes? | FP |
| 8027 | Low | 20 | H | scan_peb | drivers/mtd/ubi/attach.c | err | truncation | yes? | FP |
| 8028 | Low | 20 | H | scan_peb | drivers/mtd/ubi/attach.c | err | truncation | yes? | FP |
| 8029 | Low | 20 | H | scan_peb | drivers/mtd/ubi/attach.c | err | truncation | yes? | FP |
| 8030 | Low | 20 | H | scan_peb | drivers/mtd/ubi/attach.c | err | truncation | yes? | FP |
| 8031 | Low | 20 | H | scan_peb | drivers/mtd/ubi/attach.c | err | truncation | yes? | FP |
| 8032 | Low | 20 | H | srpt_get_desc_tbl | drivers/infiniband/ulp/srpt/ib_srpt.c | nbufs | truncation | yes? | FP |
| 8033 | Low | 20 | H | ubi_add_to_av | drivers/mtd/ubi/attach.c | aeb | truncation | yes? | FP |
| 8034 | Low | 20 | H | ubi_add_to_av | drivers/mtd/ubi/attach.c | aeb | truncation | yes? | FP |
| 8035 | Low | 20 | H | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | pool_size | truncation | yes? | FP |
| 8036 | Low | 20 | H | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | wl_pool_size | truncation | yes? | FP |
| 8037 | Low | 20 | H | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | pool_size | truncation | yes? | FP |
| 8038 | Low | 20 | H | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | wl_pool_size | truncation | yes? | FP |
| 8039 | Low | 20 | H | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | pool_size | truncation | yes? | FP |
| 8040 | Low | 20 | H | ubi_attach_fastmap | drivers/mtd/ubi/fastmap.c | wl_pool_size | truncation | yes? | FP |
| 8041 | Low | 20 | H | ubi_compare_lebs | drivers/mtd/ubi/attach.c | second_is_newer | truncation | yes? | FP |
| 8042 | Low | 20 | H | usb_get_bos_descriptor | drivers/usb/core/config.c | cap_type | truncation | yes? | FP |
| 8043 | Low | 20 | H | xemaclite_recv_data | drivers/net/ethernet/xilinx/xilinx_emaclite.c | length | truncation | yes? | FP |
| 8044 | Low | 20 | H | zfcp_fc_eval_gpn_ft | drivers/s390/scsi/zfcp_fc.c | ret | truncation | yes? | FP |