Priority Summary — 20260819_082622_fs_smb

All Findings — Ranked by Priority

#	Tier	Score	Cat	Function	File	Variable	Sink	Guard	LLM
1	Critical	370	A	`coalesce_t2`	fs/smb/client/smb1transport.c	`data_area_of_tgt`	memcpy()	no	BUG:oob_write
2	Critical	350	E	`CIFSFindFirst`	fs/smb/client/cifssmb.c	`parms`	parms->EndofSearch	no	BUG:oob_read
3	Critical	350	E	`CIFSFindFirst`	fs/smb/client/cifssmb.c	`parms`	parms->SearchCount	no	BUG:oob_read
4	Critical	350	E	`CIFSFindFirst`	fs/smb/client/cifssmb.c	`parms`	parms->LastNameOffset	no	BUG:oob_read
5	Critical	350	E	`CIFSFindFirst`	fs/smb/client/cifssmb.c	`parms`	parms->SearchHandle	no	BUG:oob_read
6	Critical	350	E	`CIFSFindNext`	fs/smb/client/cifssmb.c	`parms`	parms->EndofSearch	no	BUG:oob_read
7	Critical	350	E	`CIFSFindNext`	fs/smb/client/cifssmb.c	`parms`	parms->SearchCount	no	BUG:oob_read
8	Critical	350	E	`CIFSFindNext`	fs/smb/client/cifssmb.c	`parms`	parms->LastNameOffset	no	BUG:oob_read
9	Critical	350	E	`CIFSGetExtAttr`	fs/smb/client/cifssmb.c	`pfinfo`	pfinfo->mode	no	BUG:oob_read
10	Critical	350	E	`CIFSGetExtAttr`	fs/smb/client/cifssmb.c	`pfinfo`	pfinfo->mask	no	BUG:oob_read
11	Critical	350	E	`CIFSGetSrvInodeNumber`	fs/smb/client/cifssmb.c	`pfinfo`	pfinfo->UniqueId	no	BUG:oob_read
12	Critical	350	E	`CIFSPOSIXCreate`	fs/smb/client/cifssmb.c	`psx_rsp`	psx_rsp->OplockFlags	no	BUG:oob_read
13	Critical	350	E	`CIFSPOSIXCreate`	fs/smb/client/cifssmb.c	`psx_rsp`	psx_rsp->Fid	no	BUG:oob_read
14	Critical	350	E	`CIFSPOSIXCreate`	fs/smb/client/cifssmb.c	`psx_rsp`	psx_rsp->CreateAction	no	BUG:oob_read
15	Critical	350	E	`CIFSPOSIXCreate`	fs/smb/client/cifssmb.c	`psx_rsp`	psx_rsp->ReturnedLevel	no	BUG:oob_read
16	Critical	350	E	`CIFSSMBPosixLock`	fs/smb/client/cifssmb.c	`parm_data`	parm_data->lock_type	no	BUG:oob_read
17	Critical	350	E	`CIFSSMBQAllEAs`	fs/smb/client/cifssmb.c	`ea_response_data`	ea_response_data->list_len	no	BUG:oob_read
18	Critical	350	A	`CIFSSMBQFSAttributeInfo`	fs/smb/client/cifssmb.c	`response_data`	memcpy()	no	BUG:oob_read
19	Critical	350	A	`CIFSSMBQFSDeviceInfo`	fs/smb/client/cifssmb.c	`response_data`	memcpy()	no	BUG:oob_read
20	Critical	350	E	`CIFSSMBQFSInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->BytesPerSector	no	BUG:oob_read
21	Critical	350	E	`CIFSSMBQFSInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->SectorsPerAllocationUnit	no	BUG:oob_read
22	Critical	350	E	`CIFSSMBQFSInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->TotalAllocationUnits	no	BUG:oob_read
23	Critical	350	E	`CIFSSMBQFSInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->AvailableAllocationUnits	no	BUG:oob_read
24	Critical	350	E	`CIFSSMBQFSPosixInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->BlockSize	no	BUG:oob_read
25	Critical	350	E	`CIFSSMBQFSPosixInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->TotalBlocks	no	BUG:oob_read
26	Critical	350	E	`CIFSSMBQFSPosixInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->BlocksAvail	no	BUG:oob_read
27	Critical	350	E	`CIFSSMBQFSPosixInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->UserBlocksAvail	no	BUG:oob_read
28	Critical	350	E	`CIFSSMBQFSPosixInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->TotalFileNodes	no	BUG:oob_read
29	Critical	350	E	`CIFSSMBQFSPosixInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->FreeFileNodes	no	BUG:oob_read
30	Critical	350	A	`CIFSSMBQFSUnixInfo`	fs/smb/client/cifssmb.c	`response_data`	memcpy()	no	BUG:oob_read
31	Critical	350	A	`CIFSSMBRead`	fs/smb/client/cifssmb.c	`pReadData`	memcpy()	no	BUG:oob_read
32	Critical	350	E	`SMBOldQFSInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->BytesPerSector	no	BUG:oob_read
33	Critical	350	E	`SMBOldQFSInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->SectorsPerAllocationUnit	no	BUG:oob_read
34	Critical	350	E	`SMBOldQFSInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->TotalAllocationUnits	no	BUG:oob_read
35	Critical	350	E	`SMBOldQFSInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->FreeAllocationUnits	no	BUG:oob_read
36	Critical	350	A	`coalesce_t2`	fs/smb/client/smb1transport.c	`data_area_of_src`	memcpy()	no	BUG:oob_read
37	Critical	350	E	`is_valid_oplock_break`	fs/smb/client/smb1misc.c	`pnotify`	pnotify->FileName	no	BUG:oob_read
38	Critical	350	E	`reparse_buf_ptr`	fs/smb/client/smb2inode.c	`buf`	buf->ReparseDataLength	no	BUG:oob_read
39	Critical	340	B	`CIFSSMBQAllEAs`	fs/smb/client/cifssmb.c	`name_len`	memcpy()	yes?	BUG:oob_write
40	Critical	340	B	`CIFSSMBUnixQuerySymLink`	fs/smb/client/cifssmb.c	`data_start`	kmalloc() in cifs_strndup_from_utf16()	no	BUG:oob_read
41	Critical	340	B	`CIFSSMBUnixQuerySymLink`	fs/smb/client/cifssmb.c	`count`	kmalloc() in cifs_strndup_from_utf16()	no	BUG:oob_read
42	Critical	340	C	`__smb2_calc_size`	fs/smb/client/smb2misc.c	`le16_to_cpu(shdr->Command)`	subscript	no	BUG:oob_read
43	Critical	340	C	`cifs_do_get_acl`	fs/smb/client/cifssmb.c	`data_offset`	subscript (callee)	no	BUG:oob_read
44	Critical	340	B	`coalesce_t2`	fs/smb/client/smb1transport.c	`total_in_src`	memcpy()	no	BUG:oob_read
45	Critical	340	B	`posix_info_parse`	fs/smb/client/smb2pdu.c	`owner_len`	memcpy()	yes?	BUG:oob_write
46	Critical	340	B	`posix_info_parse`	fs/smb/client/smb2pdu.c	`group_len`	memcpy()	yes?	BUG:oob_write
47	Critical	340	B	`receive_encrypted_standard`	fs/smb/client/smb2ops.c	`next_cmd`	memcpy()	yes?	BUG:oob_write
48	Critical	330	A	`CIFSPOSIXCreate`	fs/smb/client/cifssmb.c	`psx_rsp`	memcpy()	yes?	BUG:oob_read
49	Critical	330	E	`CIFSSMBPosixLock`	fs/smb/client/cifssmb.c	`parm_data`	parm_data->lock_type	yes?	BUG:oob_read
50	Critical	330	E	`CIFSSMBPosixLock`	fs/smb/client/cifssmb.c	`parm_data`	parm_data->lock_type	yes?	BUG:oob_read
51	Critical	330	E	`CIFSSMBPosixLock`	fs/smb/client/cifssmb.c	`parm_data`	parm_data->start	yes?	BUG:oob_read
52	Critical	330	E	`CIFSSMBPosixLock`	fs/smb/client/cifssmb.c	`parm_data`	parm_data->length	yes?	BUG:oob_read
53	Critical	330	E	`CIFSSMBPosixLock`	fs/smb/client/cifssmb.c	`parm_data`	parm_data->length	yes?	BUG:oob_read
54	Critical	330	E	`CIFSSMBPosixLock`	fs/smb/client/cifssmb.c	`parm_data`	parm_data->pid	yes?	BUG:oob_read
55	Critical	330	E	`CIFSSMBQAllEAs`	fs/smb/client/cifssmb.c	`ea_response_data`	ea_response_data->list	yes?	BUG:oob_read
56	Critical	330	E	`CIFSSMBQFSPosixInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->UserBlocksAvail	yes?	BUG:oob_read
57	Critical	330	E	`CIFSSMBQFSPosixInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->TotalFileNodes	yes?	BUG:oob_read
58	Critical	330	E	`CIFSSMBQFSPosixInfo`	fs/smb/client/cifssmb.c	`response_data`	response_data->FreeFileNodes	yes?	BUG:oob_read
59	Critical	330	E	`cifs_query_reparse_point`	fs/smb/client/cifssmb.c	`buf`	buf->ReparseDataLength	yes?	BUG:oob_read
60	Critical	330	E	`cifs_query_reparse_point`	fs/smb/client/cifssmb.c	`buf`	buf->ReparseDataLength	yes?	BUG:oob_read
61	Critical	330	E	`cifs_query_reparse_point`	fs/smb/client/cifssmb.c	`buf`	buf->ReparseTag	yes?	BUG:oob_read
62	Critical	330	F	`parse_dacl`	fs/smb/client/cifsacl.c	`ppace`	loop bound	no	BUG:oob_read
63	Critical	310	F	`parse_dacl`	fs/smb/client/cifsacl.c	`num_aces`	loop bound	yes?	BUG:oob_read
64	Critical	300	H	`smb2_tcon_find_pending_open_lease`	fs/smb/client/smb2misc.c	`lease_state`	truncation	no	BUG:integer_overflow
65	Critical	300	H	`smb2_tcon_has_lease`	fs/smb/client/smb2misc.c	`lease_state`	truncation	no	BUG:integer_overflow
66	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->ea_data	no	?
67	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->next_entry_offset	no	?
68	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->flags	no	?
69	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->ea_name_length	no	?
70	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->ea_value_length	no	?
71	High	120	A	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	memcpy()	no	?
72	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->ea_data	no	?
73	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->next_entry_offset	no	?
74	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->ea_value_length	no	?
75	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->next_entry_offset	no	?
76	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->ea_name_length	no	?
77	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->ea_value_length	no	?
78	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->ea_data	no	?
79	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->next_entry_offset	no	?
80	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->flags	no	?
81	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->ea_name_length	no	?
82	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->ea_value_length	no	?
83	High	120	A	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	memcpy()	no	?
84	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->ea_data	no	?
85	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->?	no	?
86	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->?	no	?
87	High	120	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->?	no	?
88	High	100	E	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	ea->?	yes?	?
89	Medium	90	B	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	memcmp() in CIFSSMBQAllEAs()	yes?	?
90	Medium	90	B	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	memcpy() in CIFSSMBQAllEAs()	yes?	?
91	Medium	90	B	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	memcpy() in CIFSSMBQAllEAs()	yes?	?
92	Medium	80	F	`cifs_query_path_info`	fs/smb/client/smb1ops.c	`ea`	loop bound	yes?	?
93	Medium	70	E	`CIFSSMBQAllEAs`	fs/smb/client/cifssmb.c	`temp_fea`	temp_fea->name_len	no	FP
94	Medium	70	E	`CIFSSMBQAllEAs`	fs/smb/client/cifssmb.c	`temp_fea`	temp_fea->value_len	no	FP
95	Medium	70	E	`SMB2_QFS_attr`	fs/smb/client/smb2pdu.c	`ss_info`	ss_info->Flags	no	FP
96	Medium	70	E	`SMB2_QFS_attr`	fs/smb/client/smb2pdu.c	`ss_info`	ss_info->PhysicalBytesPerSectorForPerf	no	FP
97	Medium	70	E	`SMB2_QFS_attr`	fs/smb/client/smb2pdu.c	`vol_info`	vol_info->VolumeSerialNumber	no	FP
98	Medium	70	E	`SMB2_QFS_attr`	fs/smb/client/smb2pdu.c	`vol_info`	vol_info->VolumeCreationTime	no	FP
99	Medium	70	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	no	FP
100	Medium	70	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	no	FP
101	Medium	70	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	no	FP
102	Medium	70	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	no	FP
103	Medium	70	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->revision	no	FP
104	Medium	70	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->revision	no	FP
105	Medium	70	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->num_aces	no	FP
106	Medium	70	E	`cifs_create_reparse_inode`	fs/smb/client/cifssmb.c	`ea`	ea->next_entry_offset	no	FP
107	Medium	70	E	`id_mode_to_cifs_acl`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->num_aces	no	FP
108	Medium	70	E	`id_mode_to_cifs_acl`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->size	no	FP
109	Medium	70	E	`move_smb2_ea_to_cifs`	fs/smb/client/smb2ops.c	`src`	src->next_entry_offset	no	FP
110	Medium	70	A	`open_cached_dir`	fs/smb/client/cached_dir.c	`le16_to_cpu(qi_rsp->OutputBufferOffset)`	memcpy() in smb2_validate_and_copy_iov()	no	FP
111	Medium	70	A	`parse_posix_ctxt`	fs/smb/client/smb2pdu.c	`sid`	memcpy()	no	FP
112	Medium	70	A	`parse_posix_ctxt`	fs/smb/client/smb2pdu.c	`sid`	memcpy()	no	FP
113	Medium	70	A	`parse_posix_sids`	fs/smb/client/smb2inode.c	`sidsbuf`	memcpy()	no	FP
114	Medium	70	A	`parse_posix_sids`	fs/smb/client/smb2inode.c	`sidsbuf`	memcpy()	no	FP
115	Medium	70	B	`parse_reparse_wsl_symlink`	fs/smb/client/reparse.c	`symname_utf8_len`	symname_utf8_len * 2	yes?	FP
116	Medium	70	E	`parse_server_interfaces`	fs/smb/client/smb2ops.c	`p`	p->Next	no	FP
117	Medium	70	A	`query_info`	fs/smb/client/smb2pdu.c	`le16_to_cpu(rsp->OutputBufferOffset)`	memcpy() in smb2_validate_and_copy_iov()	no	FP
118	Medium	70	A	`smb2_compound_op`	fs/smb/client/smb2inode.c	`le16_to_cpu(qi_rsp->OutputBufferOffset)`	memcpy() in smb2_validate_and_copy_iov()	no	FP
119	Medium	70	E	`smb2_parse_contexts`	fs/smb/client/smb2pdu.c	`cc`	cc->DataOffset	no	FP
120	Medium	70	E	`smb2_parse_contexts`	fs/smb/client/smb2pdu.c	`cc`	cc->DataLength	no	FP
121	Medium	70	E	`smb2_parse_contexts`	fs/smb/client/smb2pdu.c	`cc`	cc->NameOffset	no	FP
122	Medium	70	E	`smb2_parse_contexts`	fs/smb/client/smb2pdu.c	`cc`	cc->NameLength	no	FP
123	Medium	70	A	`smb2_parse_contexts`	fs/smb/client/smb2pdu.c	`name`	memcmp()	no	FP
124	Medium	70	E	`smb2_parse_contexts`	fs/smb/client/smb2pdu.c	`cc`	cc->Next	no	FP
125	Medium	70	E	`smb2_query_eas`	fs/smb/client/smb2ops.c	`info`	info->?	no	FP
126	Medium	70	E	`smb2_query_eas`	fs/smb/client/smb2ops.c	`le32_to_cpu(rsp->OutputBufferLength)`	le32_to_cpu(rsp->OutputBufferLength)->?	no	FP
127	Medium	70	E	`smb311_decode_neg_context`	fs/smb/client/smb2pdu.c	`pctx`	pctx->DataLength	no	FP
128	Medium	70	E	`smb311_decode_neg_context`	fs/smb/client/smb2pdu.c	`pctx`	pctx->ContextType	no	FP
129	Medium	60	B	`SMB2_QFS_attr`	fs/smb/client/smb2pdu.c	`rsp_len`	memcpy()	no	FP
130	Medium	60	C	`__smb2_plain_req_init`	fs/smb/client/smb2pdu.c	`com_code`	subscript	no	FP
131	Medium	60	B	`cifs_create_reparse_inode`	fs/smb/client/cifssmb.c	`le16_to_cpu(ea->ea_value_length)`	memcpy() in CIFSSMBSetEA()	no	FP
132	Medium	60	C	`cifs_do_get_acl`	fs/smb/client/cifssmb.c	`count`	subscript (callee)	no	FP
133	Medium	60	C	`cifs_to_posix_acl`	fs/smb/client/cifssmb.c	`count`	subscript	no	FP
134	Medium	60	C	`cnvrtDosUnixTm`	fs/smb/client/netmisc.c	`month`	subscript	no	FP
135	Medium	60	C	`fill_small_buf`	fs/smb/client/smb2pdu.c	`le16_to_cpu(smb2_command)`	subscript	no	FP
136	Medium	60	B	`mknod_wsl`	fs/smb/client/reparse.c	`data`	memset() in cifs_free_open_info()	no	FP
137	Medium	60	B	`mknod_wsl`	fs/smb/client/reparse.c	`len`	memcpy()	no	FP
138	Medium	60	B	`parse_dfs_referrals`	fs/smb/client/misc.c	`temp`	kmalloc() in cifs_strndup_from_utf16()	no	FP
139	Medium	60	B	`parse_dfs_referrals`	fs/smb/client/misc.c	`max_len`	kmalloc() in cifs_strndup_from_utf16()	no	FP
140	Medium	60	B	`parse_reparse_wsl_symlink`	fs/smb/client/reparse.c	`symname_utf16`	kmalloc() in cifs_strndup_from_utf16()	no	FP
141	Medium	60	C	`smb2_query_eas`	fs/smb/client/smb2ops.c	`info`	subscript (callee)	no	FP
142	Medium	60	G2	`smb3_enum_snapshots`	fs/smb/client/smb2ops.c	`ret_data_len`	copy_to_user() unvalidated size	no	FP
143	Low	50	A	`CIFSSMBQAllEAs`	fs/smb/client/cifssmb.c	`temp_ptr`	memcmp()	yes?	FP
144	Low	50	A	`CIFSSMBQAllEAs`	fs/smb/client/cifssmb.c	`temp_ptr`	memcpy()	yes?	FP
145	Low	50	A	`CIFSSMBQAllEAs`	fs/smb/client/cifssmb.c	`temp_ptr`	memcpy()	yes?	FP
146	Low	50	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
147	Low	50	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
148	Low	50	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
149	Low	50	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
150	Low	50	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
151	Low	50	F	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	loop bound	no	FP
152	Low	50	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
153	Low	50	F	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	loop bound	no	FP
154	Low	50	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
155	Low	50	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
156	Low	50	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
157	Low	50	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
158	Low	50	E	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
159	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->ea_name_length	yes?	FP
160	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->ea_value_length	yes?	FP
161	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->ea_data	yes?	FP
162	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->ea_data	yes?	FP
163	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->ea_data	yes?	FP
164	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->ea_data	yes?	FP
165	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->ea_data	yes?	FP
166	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->ea_data	yes?	FP
167	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->ea_data	yes?	FP
168	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->ea_data	yes?	FP
169	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->ea_data	yes?	FP
170	Low	50	E	`check_wsl_eas`	fs/smb/client/smb2inode.c	`ea`	ea->next_entry_offset	yes?	FP
171	Low	50	E	`id_mode_to_cifs_acl`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
172	Low	50	E	`id_mode_to_cifs_acl`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
173	Low	50	E	`id_mode_to_cifs_acl`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
174	Low	50	E	`id_mode_to_cifs_acl`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
175	Low	50	E	`id_mode_to_cifs_acl`	fs/smb/client/cifsacl.c	`dacl_ptr`	dacl_ptr->?	yes?	FP
176	Low	50	A	`parse_reparse_native_symlink`	fs/smb/client/reparse.c	`offs`	memcpy() in smb2_parse_native_symlink()	yes?	FP
177	Low	50	A	`parse_reparse_native_symlink`	fs/smb/client/reparse.c	`len`	memcpy() in smb2_parse_native_symlink()	yes?	FP
178	Low	50	F	`replace_sids_and_copy_aces`	fs/smb/client/cifsacl.c	`src_num_aces`	loop bound	no	FP
179	Low	50	F	`set_chmod_dacl`	fs/smb/client/cifsacl.c	`src_num_aces`	loop bound	no	FP
180	Low	50	F	`smb2_parse_contexts`	fs/smb/client/smb2pdu.c	`rem`	loop bound	no	FP
181	Low	50	A	`smb2_parse_symlink_response`	fs/smb/client/smb2file.c	`sub_offs`	memcpy() in smb2_parse_native_symlink()	yes?	FP
182	Low	50	A	`smb2_parse_symlink_response`	fs/smb/client/smb2file.c	`sub_len`	memcpy() in smb2_parse_native_symlink()	yes?	FP
183	Low	50	F	`smb2_query_eas`	fs/smb/client/smb2ops.c	`le32_to_cpu(rsp->OutputBufferLength)`	loop bound	no	FP
184	Low	50	F	`smb2_seq_num_into_buf`	fs/smb/client/smb2transport.c	`num`	loop bound	no	FP
185	Low	50	F	`smb311_decode_neg_context`	fs/smb/client/smb2pdu.c	`ctxt_cnt`	loop bound	no	FP
186	Low	50	E	`smb311_decode_neg_context`	fs/smb/client/smb2pdu.c	`pctx`	pctx->ContextType	yes?	FP
187	Low	50	E	`smb311_decode_neg_context`	fs/smb/client/smb2pdu.c	`pctx`	pctx->ContextType	yes?	FP
188	Low	50	E	`smb311_decode_neg_context`	fs/smb/client/smb2pdu.c	`pctx`	pctx->ContextType	yes?	FP
189	Low	50	E	`smb311_decode_neg_context`	fs/smb/client/smb2pdu.c	`pctx`	pctx->ContextType	yes?	FP
190	Low	50	E	`smb311_decode_neg_context`	fs/smb/client/smb2pdu.c	`pctx`	pctx->ContextType	yes?	FP
191	Low	40	B	`CIFSSMBQAllEAs`	fs/smb/client/cifssmb.c	`name_len`	memcmp()	yes?	FP
192	Low	40	B	`CIFSSMBQAllEAs`	fs/smb/client/cifssmb.c	`value_len`	memcpy()	yes?	FP
193	Low	40	B	`CIFSSMBRead`	fs/smb/client/cifssmb.c	`data_length`	memcpy()	yes?	FP
194	Low	40	C	`__release_mid`	fs/smb/client/transport.c	`smb_cmd`	subscript	yes?	FP
195	Low	40	C	`__release_mid`	fs/smb/client/transport.c	`smb_cmd`	subscript	yes?	FP
196	Low	40	C	`__release_mid`	fs/smb/client/transport.c	`smb_cmd`	subscript	yes?	FP
197	Low	40	C	`__release_mid`	fs/smb/client/transport.c	`smb_cmd`	subscript	yes?	FP
198	Low	40	C	`__release_mid`	fs/smb/client/transport.c	`smb_cmd`	subscript	yes?	FP
199	Low	40	C	`__release_mid`	fs/smb/client/transport.c	`smb_cmd`	subscript	yes?	FP
200	Low	40	C	`__release_mid`	fs/smb/client/transport.c	`smb_cmd`	subscript	yes?	FP
201	Low	40	C	`__release_mid`	fs/smb/client/transport.c	`smb_cmd`	subscript	yes?	FP
202	Low	40	C	`__release_mid`	fs/smb/client/transport.c	`smb_cmd`	subscript	yes?	FP
203	Low	40	C	`__release_mid`	fs/smb/client/transport.c	`smb_cmd`	subscript	yes?	FP
204	Low	40	H	`build_sec_desc`	fs/smb/client/cifsacl.c	`size`	truncation	no	FP
205	Low	40	B	`check_wsl_eas`	fs/smb/client/smb2inode.c	`nlen`	strncmp()	yes?	FP
206	Low	40	B	`check_wsl_eas`	fs/smb/client/smb2inode.c	`nlen`	strncmp()	yes?	FP
207	Low	40	B	`check_wsl_eas`	fs/smb/client/smb2inode.c	`nlen`	strncmp()	yes?	FP
208	Low	40	B	`check_wsl_eas`	fs/smb/client/smb2inode.c	`nlen`	strncmp()	yes?	FP
209	Low	40	B	`check_wsl_eas`	fs/smb/client/smb2inode.c	`nlen`	strncmp()	yes?	FP
210	Low	40	B	`check_wsl_eas`	fs/smb/client/smb2inode.c	`nlen`	strncmp()	yes?	FP
211	Low	40	B	`check_wsl_eas`	fs/smb/client/smb2inode.c	`nlen`	strncmp()	yes?	FP
212	Low	40	B	`check_wsl_eas`	fs/smb/client/smb2inode.c	`nlen`	strncmp()	yes?	FP
213	Low	40	H	`crypt_message`	fs/smb/client/smb2ops.c	`rc`	truncation	no	FP
214	Low	40	H	`map_smb_to_linux_error`	fs/smb/client/smb1maperror.c	`smberrclass`	truncation	no	FP
215	Low	40	H	`map_smb_to_linux_error`	fs/smb/client/smb1maperror.c	`smberrcode`	truncation	no	FP
216	Low	40	B	`move_smb2_ea_to_cifs`	fs/smb/client/smb2ops.c	`value_len`	memcpy()	yes?	FP
217	Low	40	B	`parse_posix_ctxt`	fs/smb/client/smb2pdu.c	`sid_len`	memcpy()	yes?	FP
218	Low	40	B	`parse_posix_ctxt`	fs/smb/client/smb2pdu.c	`sid_len`	memcpy()	yes?	FP
219	Low	40	B	`parse_posix_sids`	fs/smb/client/smb2inode.c	`owner_len`	memcpy()	yes?	FP
220	Low	40	B	`parse_posix_sids`	fs/smb/client/smb2inode.c	`group_len`	memcpy()	yes?	FP
221	Low	40	B	`parse_reparse_native_symlink`	fs/smb/client/reparse.c	`offs`	kmalloc() in smb2_parse_native_symlink()	yes?	FP
222	Low	40	B	`parse_reparse_native_symlink`	fs/smb/client/reparse.c	`len`	kmalloc() in smb2_parse_native_symlink()	yes?	FP
223	Low	40	B	`parse_reparse_native_symlink`	fs/smb/client/reparse.c	`offs`	memcpy() in smb2_parse_native_symlink()	yes?	FP
224	Low	40	B	`parse_reparse_native_symlink`	fs/smb/client/reparse.c	`len`	memcpy() in smb2_parse_native_symlink()	yes?	FP
225	Low	40	B	`parse_reparse_native_symlink`	fs/smb/client/reparse.c	`offs`	kmalloc() in smb2_parse_native_symlink()	yes?	FP
226	Low	40	B	`parse_reparse_native_symlink`	fs/smb/client/reparse.c	`len`	kmalloc() in smb2_parse_native_symlink()	yes?	FP
227	Low	40	B	`parse_reparse_native_symlink`	fs/smb/client/reparse.c	`offs`	memcpy() in smb2_parse_native_symlink()	yes?	FP
228	Low	40	B	`parse_reparse_native_symlink`	fs/smb/client/reparse.c	`len`	memcpy() in smb2_parse_native_symlink()	yes?	FP
229	Low	40	B	`parse_reparse_nfs`	fs/smb/client/reparse.c	`len`	kmalloc() in cifs_strndup_from_utf16()	yes?	FP
230	Low	40	B	`parse_reparse_wsl_symlink`	fs/smb/client/reparse.c	`symname_utf16_len`	kmalloc() in cifs_strndup_from_utf16()	yes?	FP
231	Low	40	H	`smb2_calc_signature`	fs/smb/client/smb2transport.c	`rc`	truncation	no	FP
232	Low	40	C	`smb2_check_message`	fs/smb/client/smb2misc.c	`command`	subscript	yes?	FP
233	Low	40	B	`smb2_parse_contexts`	fs/smb/client/smb2pdu.c	`cc`	memcpy() in parse_posix_ctxt()	yes?	FP
234	Low	40	B	`smb2_parse_contexts`	fs/smb/client/smb2pdu.c	`cc`	memcpy() in parse_posix_ctxt()	yes?	FP
235	Low	40	B	`smb2_parse_symlink_response`	fs/smb/client/smb2file.c	`sub_offs`	kmalloc() in smb2_parse_native_symlink()	yes?	FP
236	Low	40	B	`smb2_parse_symlink_response`	fs/smb/client/smb2file.c	`sub_len`	kmalloc() in smb2_parse_native_symlink()	yes?	FP
237	Low	40	B	`smb2_parse_symlink_response`	fs/smb/client/smb2file.c	`sub_offs`	memcpy() in smb2_parse_native_symlink()	yes?	FP
238	Low	40	B	`smb2_parse_symlink_response`	fs/smb/client/smb2file.c	`sub_len`	memcpy() in smb2_parse_native_symlink()	yes?	FP
239	Low	40	B	`smb2_parse_symlink_response`	fs/smb/client/smb2file.c	`sub_offs`	kmalloc() in smb2_parse_native_symlink()	yes?	FP
240	Low	40	B	`smb2_parse_symlink_response`	fs/smb/client/smb2file.c	`sub_len`	kmalloc() in smb2_parse_native_symlink()	yes?	FP
241	Low	40	B	`smb2_parse_symlink_response`	fs/smb/client/smb2file.c	`sub_offs`	memcpy() in smb2_parse_native_symlink()	yes?	FP
242	Low	40	B	`smb2_parse_symlink_response`	fs/smb/client/smb2file.c	`sub_len`	memcpy() in smb2_parse_native_symlink()	yes?	FP
243	Low	40	B	`smb2_query_eas`	fs/smb/client/smb2ops.c	`info`	memcmp() in move_smb2_ea_to_cifs()	yes?	FP
244	Low	40	B	`smb2_query_eas`	fs/smb/client/smb2ops.c	`info`	memcpy() in move_smb2_ea_to_cifs()	yes?	FP
245	Low	40	B	`smb2_query_eas`	fs/smb/client/smb2ops.c	`le32_to_cpu(rsp->OutputBufferLength)`	memcpy() in move_smb2_ea_to_cifs()	yes?	FP
246	Low	40	B	`smb2_query_eas`	fs/smb/client/smb2ops.c	`info`	memcpy() in move_smb2_ea_to_cifs()	yes?	FP
247	Low	40	H	`smb3_calc_signature`	fs/smb/client/smb2transport.c	`rc`	truncation	no	FP
248	Low	40	H	`smb3_fiemap`	fs/smb/client/smb2ops.c	`rc`	truncation	no	FP
249	Low	40	H	`smb3_simple_fallocate_range`	fs/smb/client/smb2ops.c	`rc`	truncation	no	FP
250	Low	30	F	`CIFSSMBQAllEAs`	fs/smb/client/cifssmb.c	`list_len`	loop bound	yes?	FP
251	Low	30	F	`build_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	loop bound	yes?	FP
252	Low	30	F	`decode_compress_ctx`	fs/smb/client/smb2pdu.c	`count`	loop bound	yes?	FP
253	Low	30	F	`id_mode_to_cifs_acl`	fs/smb/client/cifsacl.c	`dacl_ptr`	loop bound	yes?	FP
254	Low	30	F	`parse_dacl`	fs/smb/client/cifsacl.c	`ppace`	loop bound	yes?	FP
255	Low	30	F	`parse_dfs_referrals`	fs/smb/client/misc.c	`path_consumed`	loop bound	yes?	FP
256	Low	30	F	`parse_sec_desc`	fs/smb/client/cifsacl.c	`dacl_ptr`	loop bound	yes?	FP
257	Low	30	F	`smb311_decode_neg_context`	fs/smb/client/smb2pdu.c	`pctx`	loop bound	yes?	FP
258	Low	30	F	`validate_dacl`	fs/smb/client/cifsacl.c	`num_aces`	loop bound	yes?	FP
259	Low	20	H	`check_wsl_eas`	fs/smb/client/smb2inode.c	`nlen`	truncation	yes?	FP

Findings by File

File	Findings
fs/smb/client/cifssmb.c	65
fs/smb/client/cifsacl.c	37
fs/smb/client/smb2pdu.c	33
fs/smb/client/smb2inode.c	27
fs/smb/client/smb1ops.c	27
fs/smb/client/smb2ops.c	16
fs/smb/client/reparse.c	16
fs/smb/client/smb2file.c	10
fs/smb/client/transport.c	10
fs/smb/client/smb2misc.c	4
fs/smb/client/smb1transport.c	3
fs/smb/client/misc.c	3
fs/smb/client/smb2transport.c	3
fs/smb/client/smb1maperror.c	2
fs/smb/client/smb1misc.c	1
fs/smb/client/cached_dir.c	1
fs/smb/client/netmisc.c	1

Priority Summary — 20260819_082622_fs_smb_client

All Findings — Ranked by Priority

Findings by File