Priority Summary — 20260819_143225_fs_smb_client

Date: 2026-08-19 14:34:37 Source: fs/smb/client Total: 257 findings Critical: 4 Medium: 100 Low: 153 By category: Cat A: 24   Cat B: 58   Cat C: 19   Cat E: 124   Cat F: 21   Cat H: 11 LLM: 4 real  |  253 FP  |  0 unanalyzed Kernel: v7.2-2632-g33ef135f7377 Branch: work/integration
40 local commit(s) since origin/master
  1. 33ef135f7377 Merge branch 'work/smb2-bounds-fixes' into work/integration
  2. 5bfb653fd866 Merge branch 'work/smb1-wsl-eas-fix' into work/integration
  3. aef284e4f46f Merge branch 'work/smb1-t2-fixes' into work/integration
  4. d0a18cd9afb3 Merge branch 'work/reparse-nfs-bounds' into work/integration
  5. afbff4564024 Merge branch 'work/other-fixes' into work/integration
  6. 855d029f33a6 Merge branch 'work/fscache-fixes' into work/integration
  7. b99c85788399 Merge branch 'work/deferred' into work/integration
  8. c7df6b3ad142 Merge branch 'work/cifs_debug-reset' into work/integration
  9. c37af2da3d9e smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
  10. 4fbe30b50447 smb: client: fix OOB read in parse_reparse_wsl_symlink() from unvalidated ReparseDataLength
  11. ac2b2cd0a7f7 smb: client: fix OOB read in parse_reparse_nfs() from unvalidated ReparseDataLength
  12. 2cbd2ba647e3 smb: client: fix missing lower-bound on Next field in parse_server_interfaces()
  13. a26a663211f5 smb: client: fix NameOffset and Next field validation in smb2_parse_contexts()
  14. 88c1c17157f5 smb: client: fix OOB read in parse_posix_ctxt() from undersized DataLength
  15. d129d8c2959a smb: client: fix incomplete bounds check on reparse buffer in cifs_query_reparse_point()
  16. 104da662a1be smb: client: fix potential OOB read in smb3_enum_snapshots()
  17. ae544f66e3e2 smb: client: fix missing lower-bound check on DFS referral string offsets
  18. a3efd925788b smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
  19. 68924f1ed158 smb: client: fix underflow in is_valid_oplock_break() notify offset check
  20. 6c7af443b86f smb: client: fix missing iov bounds check in parse_posix_sids()
  21. 90407311fd83 smb: client: fix missing lower-bound check on NextCommand in receive_encrypted_standard()
  22. 729a9e17dd0d smb: client: fix OOB array access in __smb2_calc_size() on unknown Command
  23. c0650fdd6c10 smb: client: fix OOB read in CIFSSMBRead() from unvalidated DataOffset
  24. 97f17f8bc3af smb: client: fix OOB pointer arithmetic in cifs_to_posix_acl()
  25. 3c3406588fb2 smb: client: tighten validate_t2() offset bounds against actual buffer size
  26. 7ec5ee3c8d82 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
  27. ada8a5918d85 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
  28. 0f272f583738 smb: client: fix ALIGN() overflow in symlink_data() error context loop
  29. 92fc7855f81c smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
  30. b7091a43f053 cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
  31. a10394d26c2c cifs: don't update i_size in cifs_do_truncate() without a cached handle
  32. 501b64f335b7 cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
  33. 38eaad263c99 cifs: fix i_size inconsistency in smb2_duplicate_extents() on FSCTL failure
  34. f3d777d0841a cifs: call pagecache_isize_extended() in cifs_setsize() when extending
  35. ee55d472e47a cifs: remove dead size-update blocks in cifs_setattr_unix/nounix
  36. 8d9b6755ecae cifs: remove redundant size-update block in cifs_remap_file_range()
  37. 86ec06e178dd cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem
  38. e25d3f7e343a cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
  39. 5b58390e1582 smb: client: reject lease breaks with reserved NewLeaseState bits set
  40. 7936f61e9837 cifs: fix clearing stats for fastest execution of each smb2 command

All Findings — Ranked by Priority

#TierScoreCatFunctionFileVariableSinkGuardLLM
1Critical 360Bcifs_create_reparse_inodefs/smb/client/cifssmb.cle16_to_cpu(ea->ea_value_length)memcpy() in CIFSSMBSetEA()noBUG:oob_write
2Critical 350Ecifs_create_reparse_inodefs/smb/client/cifssmb.ceaea->next_entry_offsetnoBUG:oob_read
3Critical 340BCIFSSMBUnixQuerySymLinkfs/smb/client/cifssmb.cdata_startkmalloc() in cifs_strndup_from_utf16()noBUG:oob_read
4Critical 340BCIFSSMBUnixQuerySymLinkfs/smb/client/cifssmb.ccountkmalloc() in cifs_strndup_from_utf16()noBUG:oob_read
5Medium 70ECIFSFindFirstfs/smb/client/cifssmb.cparmsparms->EndofSearchnoFP
6Medium 70ECIFSFindFirstfs/smb/client/cifssmb.cparmsparms->SearchCountnoFP
7Medium 70ECIFSFindFirstfs/smb/client/cifssmb.cparmsparms->LastNameOffsetnoFP
8Medium 70ECIFSFindFirstfs/smb/client/cifssmb.cparmsparms->SearchHandlenoFP
9Medium 70ECIFSFindNextfs/smb/client/cifssmb.cparmsparms->EndofSearchnoFP
10Medium 70ECIFSFindNextfs/smb/client/cifssmb.cparmsparms->SearchCountnoFP
11Medium 70ECIFSFindNextfs/smb/client/cifssmb.cparmsparms->LastNameOffsetnoFP
12Medium 70ECIFSGetExtAttrfs/smb/client/cifssmb.cpfinfopfinfo->modenoFP
13Medium 70ECIFSGetExtAttrfs/smb/client/cifssmb.cpfinfopfinfo->masknoFP
14Medium 70ECIFSGetSrvInodeNumberfs/smb/client/cifssmb.cpfinfopfinfo->UniqueIdnoFP
15Medium 70ECIFSPOSIXCreatefs/smb/client/cifssmb.cpsx_rsppsx_rsp->OplockFlagsnoFP
16Medium 70ECIFSPOSIXCreatefs/smb/client/cifssmb.cpsx_rsppsx_rsp->FidnoFP
17Medium 70ECIFSPOSIXCreatefs/smb/client/cifssmb.cpsx_rsppsx_rsp->CreateActionnoFP
18Medium 70ECIFSPOSIXCreatefs/smb/client/cifssmb.cpsx_rsppsx_rsp->ReturnedLevelnoFP
19Medium 70ECIFSSMBPosixLockfs/smb/client/cifssmb.cparm_dataparm_data->lock_typenoFP
20Medium 70ECIFSSMBQAllEAsfs/smb/client/cifssmb.cea_response_dataea_response_data->list_lennoFP
21Medium 70ECIFSSMBQAllEAsfs/smb/client/cifssmb.ctemp_featemp_fea->name_lennoFP
22Medium 70ECIFSSMBQAllEAsfs/smb/client/cifssmb.ctemp_featemp_fea->value_lennoFP
23Medium 70ACIFSSMBQFSAttributeInfofs/smb/client/cifssmb.cresponse_datamemcpy()noFP
24Medium 70ACIFSSMBQFSDeviceInfofs/smb/client/cifssmb.cresponse_datamemcpy()noFP
25Medium 70ECIFSSMBQFSInfofs/smb/client/cifssmb.cresponse_dataresponse_data->BytesPerSectornoFP
26Medium 70ECIFSSMBQFSInfofs/smb/client/cifssmb.cresponse_dataresponse_data->SectorsPerAllocationUnitnoFP
27Medium 70ECIFSSMBQFSInfofs/smb/client/cifssmb.cresponse_dataresponse_data->TotalAllocationUnitsnoFP
28Medium 70ECIFSSMBQFSInfofs/smb/client/cifssmb.cresponse_dataresponse_data->AvailableAllocationUnitsnoFP
29Medium 70ECIFSSMBQFSPosixInfofs/smb/client/cifssmb.cresponse_dataresponse_data->BlockSizenoFP
30Medium 70ECIFSSMBQFSPosixInfofs/smb/client/cifssmb.cresponse_dataresponse_data->TotalBlocksnoFP
31Medium 70ECIFSSMBQFSPosixInfofs/smb/client/cifssmb.cresponse_dataresponse_data->BlocksAvailnoFP
32Medium 70ECIFSSMBQFSPosixInfofs/smb/client/cifssmb.cresponse_dataresponse_data->UserBlocksAvailnoFP
33Medium 70ECIFSSMBQFSPosixInfofs/smb/client/cifssmb.cresponse_dataresponse_data->TotalFileNodesnoFP
34Medium 70ECIFSSMBQFSPosixInfofs/smb/client/cifssmb.cresponse_dataresponse_data->FreeFileNodesnoFP
35Medium 70ACIFSSMBQFSUnixInfofs/smb/client/cifssmb.cresponse_datamemcpy()noFP
36Medium 70ACIFSSMBReadfs/smb/client/cifssmb.cpReadDatamemcpy()noFP
37Medium 70ESMB2_QFS_attrfs/smb/client/smb2pdu.css_infoss_info->FlagsnoFP
38Medium 70ESMB2_QFS_attrfs/smb/client/smb2pdu.css_infoss_info->PhysicalBytesPerSectorForPerfnoFP
39Medium 70ESMB2_QFS_attrfs/smb/client/smb2pdu.cvol_infovol_info->VolumeSerialNumbernoFP
40Medium 70ESMB2_QFS_attrfs/smb/client/smb2pdu.cvol_infovol_info->VolumeCreationTimenoFP
41Medium 70ESMBOldQFSInfofs/smb/client/cifssmb.cresponse_dataresponse_data->BytesPerSectornoFP
42Medium 70ESMBOldQFSInfofs/smb/client/cifssmb.cresponse_dataresponse_data->SectorsPerAllocationUnitnoFP
43Medium 70ESMBOldQFSInfofs/smb/client/cifssmb.cresponse_dataresponse_data->TotalAllocationUnitsnoFP
44Medium 70ESMBOldQFSInfofs/smb/client/cifssmb.cresponse_dataresponse_data->FreeAllocationUnitsnoFP
45Medium 70Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?noFP
46Medium 70Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?noFP
47Medium 70Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?noFP
48Medium 70Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?noFP
49Medium 70Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->revisionnoFP
50Medium 70Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->revisionnoFP
51Medium 70Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->num_acesnoFP
52Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->ea_datanoFP
53Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->next_entry_offsetnoFP
54Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->flagsnoFP
55Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->ea_name_lengthnoFP
56Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->ea_value_lengthnoFP
57Medium 70Acifs_query_path_infofs/smb/client/smb1ops.ceamemcpy()noFP
58Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->ea_datanoFP
59Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->next_entry_offsetnoFP
60Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->ea_value_lengthnoFP
61Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->next_entry_offsetnoFP
62Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->ea_name_lengthnoFP
63Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->ea_value_lengthnoFP
64Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->ea_datanoFP
65Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->next_entry_offsetnoFP
66Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->flagsnoFP
67Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->ea_name_lengthnoFP
68Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->ea_value_lengthnoFP
69Medium 70Acifs_query_path_infofs/smb/client/smb1ops.ceamemcpy()noFP
70Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->ea_datanoFP
71Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->?noFP
72Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->?noFP
73Medium 70Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->?noFP
74Medium 70Eid_mode_to_cifs_aclfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->num_acesnoFP
75Medium 70Eid_mode_to_cifs_aclfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->sizenoFP
76Medium 70Eis_valid_oplock_breakfs/smb/client/smb1misc.cpnotifypnotify->FileNamenoFP
77Medium 70Aopen_cached_dirfs/smb/client/cached_dir.cle16_to_cpu(qi_rsp->OutputBufferOffset)memcpy() in smb2_validate_and_copy_iov()noFP
78Medium 70Aparse_posix_ctxtfs/smb/client/smb2pdu.csidmemcpy()noFP
79Medium 70Aparse_posix_ctxtfs/smb/client/smb2pdu.csidmemcpy()noFP
80Medium 70Bparse_reparse_wsl_symlinkfs/smb/client/reparse.csymname_utf8_lensymname_utf8_len * 2yes?FP
81Medium 70Aquery_infofs/smb/client/smb2pdu.cle16_to_cpu(rsp->OutputBufferOffset)memcpy() in smb2_validate_and_copy_iov()noFP
82Medium 70Ereparse_buf_ptrfs/smb/client/smb2inode.cbufbuf->ReparseDataLengthnoFP
83Medium 70Asmb2_compound_opfs/smb/client/smb2inode.cle16_to_cpu(qi_rsp->OutputBufferOffset)memcpy() in smb2_validate_and_copy_iov()noFP
84Medium 70Esmb2_parse_contextsfs/smb/client/smb2pdu.ccccc->DataOffsetnoFP
85Medium 70Esmb2_parse_contextsfs/smb/client/smb2pdu.ccccc->DataLengthnoFP
86Medium 70Esmb2_parse_contextsfs/smb/client/smb2pdu.ccccc->NameOffsetnoFP
87Medium 70Esmb2_parse_contextsfs/smb/client/smb2pdu.ccccc->NameLengthnoFP
88Medium 70Asmb2_parse_contextsfs/smb/client/smb2pdu.cnamememcmp()noFP
89Medium 70Esmb311_decode_neg_contextfs/smb/client/smb2pdu.cpctxpctx->DataLengthnoFP
90Medium 70Esmb311_decode_neg_contextfs/smb/client/smb2pdu.cpctxpctx->ContextTypenoFP
91Medium 60BSMB2_QFS_attrfs/smb/client/smb2pdu.crsp_lenmemcpy()noFP
92Medium 60C__smb2_calc_sizefs/smb/client/smb2misc.cle16_to_cpu(shdr->Command)subscriptnoFP
93Medium 60C__smb2_plain_req_initfs/smb/client/smb2pdu.ccom_codesubscriptnoFP
94Medium 60Ccifs_do_get_aclfs/smb/client/cifssmb.cdata_offsetsubscript (callee)noFP
95Medium 60Ccifs_do_get_aclfs/smb/client/cifssmb.ccountsubscript (callee)noFP
96Medium 60Ccifs_to_posix_aclfs/smb/client/cifssmb.ccountsubscriptnoFP
97Medium 60CcnvrtDosUnixTmfs/smb/client/netmisc.cmonthsubscriptnoFP
98Medium 60Cfill_small_buffs/smb/client/smb2pdu.cle16_to_cpu(smb2_command)subscriptnoFP
99Medium 60Bmknod_wslfs/smb/client/reparse.cdatamemset() in cifs_free_open_info()noFP
100Medium 60Bmknod_wslfs/smb/client/reparse.clenmemcpy()noFP
101Medium 60Bparse_dfs_referralsfs/smb/client/misc.ctempkmalloc() in cifs_strndup_from_utf16()noFP
102Medium 60Bparse_dfs_referralsfs/smb/client/misc.cmax_lenkmalloc() in cifs_strndup_from_utf16()noFP
103Medium 60Bparse_reparse_wsl_symlinkfs/smb/client/reparse.csymname_utf16kmalloc() in cifs_strndup_from_utf16()noFP
104Medium 60Csmb2_query_easfs/smb/client/smb2ops.cinfosubscript (callee)noFP
105Low 50ACIFSPOSIXCreatefs/smb/client/cifssmb.cpsx_rspmemcpy()yes?FP
106Low 50ECIFSSMBPosixLockfs/smb/client/cifssmb.cparm_dataparm_data->lock_typeyes?FP
107Low 50ECIFSSMBPosixLockfs/smb/client/cifssmb.cparm_dataparm_data->lock_typeyes?FP
108Low 50ECIFSSMBPosixLockfs/smb/client/cifssmb.cparm_dataparm_data->startyes?FP
109Low 50ECIFSSMBPosixLockfs/smb/client/cifssmb.cparm_dataparm_data->lengthyes?FP
110Low 50ECIFSSMBPosixLockfs/smb/client/cifssmb.cparm_dataparm_data->lengthyes?FP
111Low 50ECIFSSMBPosixLockfs/smb/client/cifssmb.cparm_dataparm_data->pidyes?FP
112Low 50ECIFSSMBQAllEAsfs/smb/client/cifssmb.cea_response_dataea_response_data->listyes?FP
113Low 50ACIFSSMBQAllEAsfs/smb/client/cifssmb.ctemp_ptrmemcmp()yes?FP
114Low 50ACIFSSMBQAllEAsfs/smb/client/cifssmb.ctemp_ptrmemcpy()yes?FP
115Low 50ACIFSSMBQAllEAsfs/smb/client/cifssmb.ctemp_ptrmemcpy()yes?FP
116Low 50ECIFSSMBQFSPosixInfofs/smb/client/cifssmb.cresponse_dataresponse_data->UserBlocksAvailyes?FP
117Low 50ECIFSSMBQFSPosixInfofs/smb/client/cifssmb.cresponse_dataresponse_data->TotalFileNodesyes?FP
118Low 50ECIFSSMBQFSPosixInfofs/smb/client/cifssmb.cresponse_dataresponse_data->FreeFileNodesyes?FP
119Low 50Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
120Low 50Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
121Low 50Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
122Low 50Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
123Low 50Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
124Low 50Fbuild_sec_descfs/smb/client/cifsacl.cdacl_ptrloop boundnoFP
125Low 50Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
126Low 50Fbuild_sec_descfs/smb/client/cifsacl.cdacl_ptrloop boundnoFP
127Low 50Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
128Low 50Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
129Low 50Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
130Low 50Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
131Low 50Ebuild_sec_descfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
132Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->ea_name_lengthyes?FP
133Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->ea_value_lengthyes?FP
134Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->ea_datayes?FP
135Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->ea_datayes?FP
136Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->ea_datayes?FP
137Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->ea_datayes?FP
138Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->ea_datayes?FP
139Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->ea_datayes?FP
140Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->ea_datayes?FP
141Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->ea_datayes?FP
142Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->ea_datayes?FP
143Low 50Echeck_wsl_easfs/smb/client/smb2inode.ceaea->next_entry_offsetyes?FP
144Low 50Ecifs_query_path_infofs/smb/client/smb1ops.ceaea->?yes?FP
145Low 50Ecifs_query_reparse_pointfs/smb/client/cifssmb.cbufbuf->ReparseDataLengthyes?FP
146Low 50Ecifs_query_reparse_pointfs/smb/client/cifssmb.cbufbuf->ReparseDataLengthyes?FP
147Low 50Ecifs_query_reparse_pointfs/smb/client/cifssmb.cbufbuf->ReparseTagyes?FP
148Low 50Acoalesce_t2fs/smb/client/smb1transport.cdata_area_of_tgtmemcpy()yes?FP
149Low 50Acoalesce_t2fs/smb/client/smb1transport.cdata_area_of_srcmemcpy()yes?FP
150Low 50Eid_mode_to_cifs_aclfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
151Low 50Eid_mode_to_cifs_aclfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
152Low 50Eid_mode_to_cifs_aclfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
153Low 50Eid_mode_to_cifs_aclfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
154Low 50Eid_mode_to_cifs_aclfs/smb/client/cifsacl.cdacl_ptrdacl_ptr->?yes?FP
155Low 50Fparse_daclfs/smb/client/cifsacl.cppaceloop boundnoFP
156Low 50Aparse_posix_sidsfs/smb/client/smb2inode.csidsbufmemcpy()yes?FP
157Low 50Aparse_posix_sidsfs/smb/client/smb2inode.csidsbufmemcpy()yes?FP
158Low 50Aparse_reparse_native_symlinkfs/smb/client/reparse.coffsmemcpy() in smb2_parse_native_symlink()yes?FP
159Low 50Aparse_reparse_native_symlinkfs/smb/client/reparse.clenmemcpy() in smb2_parse_native_symlink()yes?FP
160Low 50Eparse_server_interfacesfs/smb/client/smb2ops.cpp->Nextyes?FP
161Low 50Freplace_sids_and_copy_acesfs/smb/client/cifsacl.csrc_num_acesloop boundnoFP
162Low 50Fset_chmod_daclfs/smb/client/cifsacl.csrc_num_acesloop boundnoFP
163Low 50Fsmb2_parse_contextsfs/smb/client/smb2pdu.cremloop boundnoFP
164Low 50Esmb2_parse_contextsfs/smb/client/smb2pdu.ccccc->Nextyes?FP
165Low 50Asmb2_parse_symlink_responsefs/smb/client/smb2file.csub_offsmemcpy() in smb2_parse_native_symlink()yes?FP
166Low 50Asmb2_parse_symlink_responsefs/smb/client/smb2file.csub_lenmemcpy() in smb2_parse_native_symlink()yes?FP
167Low 50Fsmb2_query_easfs/smb/client/smb2ops.cinfoloop boundnoFP
168Low 50Fsmb2_query_easfs/smb/client/smb2ops.cle32_to_cpu(rsp->OutputBufferLength)loop boundnoFP
169Low 50Fsmb2_seq_num_into_buffs/smb/client/smb2transport.cnumloop boundnoFP
170Low 50Fsmb311_decode_neg_contextfs/smb/client/smb2pdu.cctxt_cntloop boundnoFP
171Low 50Esmb311_decode_neg_contextfs/smb/client/smb2pdu.cpctxpctx->ContextTypeyes?FP
172Low 50Esmb311_decode_neg_contextfs/smb/client/smb2pdu.cpctxpctx->ContextTypeyes?FP
173Low 50Esmb311_decode_neg_contextfs/smb/client/smb2pdu.cpctxpctx->ContextTypeyes?FP
174Low 50Esmb311_decode_neg_contextfs/smb/client/smb2pdu.cpctxpctx->ContextTypeyes?FP
175Low 50Esmb311_decode_neg_contextfs/smb/client/smb2pdu.cpctxpctx->ContextTypeyes?FP
176Low 50Esymlink_datafs/smb/client/smb2file.cpp->ErrorContextDatayes?FP
177Low 40BCIFSSMBQAllEAsfs/smb/client/cifssmb.cname_lenmemcmp()yes?FP
178Low 40BCIFSSMBQAllEAsfs/smb/client/cifssmb.cvalue_lenmemcpy()yes?FP
179Low 40BCIFSSMBQAllEAsfs/smb/client/cifssmb.cname_lenmemcpy()yes?FP
180Low 40BCIFSSMBReadfs/smb/client/cifssmb.cdata_lengthmemcpy()yes?FP
181Low 40C__release_midfs/smb/client/transport.csmb_cmdsubscriptyes?FP
182Low 40C__release_midfs/smb/client/transport.csmb_cmdsubscriptyes?FP
183Low 40C__release_midfs/smb/client/transport.csmb_cmdsubscriptyes?FP
184Low 40C__release_midfs/smb/client/transport.csmb_cmdsubscriptyes?FP
185Low 40C__release_midfs/smb/client/transport.csmb_cmdsubscriptyes?FP
186Low 40C__release_midfs/smb/client/transport.csmb_cmdsubscriptyes?FP
187Low 40C__release_midfs/smb/client/transport.csmb_cmdsubscriptyes?FP
188Low 40C__release_midfs/smb/client/transport.csmb_cmdsubscriptyes?FP
189Low 40C__release_midfs/smb/client/transport.csmb_cmdsubscriptyes?FP
190Low 40C__release_midfs/smb/client/transport.csmb_cmdsubscriptyes?FP
191Low 40Hbuild_sec_descfs/smb/client/cifsacl.csizetruncationnoFP
192Low 40Bcheck_wsl_easfs/smb/client/smb2inode.cnlenstrncmp()yes?FP
193Low 40Bcheck_wsl_easfs/smb/client/smb2inode.cnlenstrncmp()yes?FP
194Low 40Bcheck_wsl_easfs/smb/client/smb2inode.cnlenstrncmp()yes?FP
195Low 40Bcheck_wsl_easfs/smb/client/smb2inode.cnlenstrncmp()yes?FP
196Low 40Bcheck_wsl_easfs/smb/client/smb2inode.cnlenstrncmp()yes?FP
197Low 40Bcheck_wsl_easfs/smb/client/smb2inode.cnlenstrncmp()yes?FP
198Low 40Bcheck_wsl_easfs/smb/client/smb2inode.cnlenstrncmp()yes?FP
199Low 40Bcheck_wsl_easfs/smb/client/smb2inode.cnlenstrncmp()yes?FP
200Low 40Bcifs_query_path_infofs/smb/client/smb1ops.ceamemcmp() in CIFSSMBQAllEAs()yes?FP
201Low 40Bcifs_query_path_infofs/smb/client/smb1ops.ceamemcpy() in CIFSSMBQAllEAs()yes?FP
202Low 40Bcifs_query_path_infofs/smb/client/smb1ops.ceamemcpy() in CIFSSMBQAllEAs()yes?FP
203Low 40Bcoalesce_t2fs/smb/client/smb1transport.ctotal_in_srcmemcpy()yes?FP
204Low 40Hcrypt_messagefs/smb/client/smb2ops.crctruncationnoFP
205Low 40Hmap_smb_to_linux_errorfs/smb/client/smb1maperror.csmberrclasstruncationnoFP
206Low 40Hmap_smb_to_linux_errorfs/smb/client/smb1maperror.csmberrcodetruncationnoFP
207Low 40Bmove_smb2_ea_to_cifsfs/smb/client/smb2ops.cvalue_lenmemcpy()yes?FP
208Low 40Bparse_posix_ctxtfs/smb/client/smb2pdu.csid_lenmemcpy()yes?FP
209Low 40Bparse_posix_ctxtfs/smb/client/smb2pdu.csid_lenmemcpy()yes?FP
210Low 40Bparse_posix_sidsfs/smb/client/smb2inode.cowner_lenmemcpy()yes?FP
211Low 40Bparse_posix_sidsfs/smb/client/smb2inode.cgroup_lenmemcpy()yes?FP
212Low 40Bparse_reparse_native_symlinkfs/smb/client/reparse.coffskmalloc() in smb2_parse_native_symlink()yes?FP
213Low 40Bparse_reparse_native_symlinkfs/smb/client/reparse.clenkmalloc() in smb2_parse_native_symlink()yes?FP
214Low 40Bparse_reparse_native_symlinkfs/smb/client/reparse.coffsmemcpy() in smb2_parse_native_symlink()yes?FP
215Low 40Bparse_reparse_native_symlinkfs/smb/client/reparse.clenmemcpy() in smb2_parse_native_symlink()yes?FP
216Low 40Bparse_reparse_native_symlinkfs/smb/client/reparse.coffskmalloc() in smb2_parse_native_symlink()yes?FP
217Low 40Bparse_reparse_native_symlinkfs/smb/client/reparse.clenkmalloc() in smb2_parse_native_symlink()yes?FP
218Low 40Bparse_reparse_native_symlinkfs/smb/client/reparse.coffsmemcpy() in smb2_parse_native_symlink()yes?FP
219Low 40Bparse_reparse_native_symlinkfs/smb/client/reparse.clenmemcpy() in smb2_parse_native_symlink()yes?FP
220Low 40Bparse_reparse_nfsfs/smb/client/reparse.clenkmalloc() in cifs_strndup_from_utf16()yes?FP
221Low 40Bparse_reparse_wsl_symlinkfs/smb/client/reparse.csymname_utf16_lenkmalloc() in cifs_strndup_from_utf16()yes?FP
222Low 40Bposix_info_parsefs/smb/client/smb2pdu.cowner_lenmemcpy()yes?FP
223Low 40Bposix_info_parsefs/smb/client/smb2pdu.cgroup_lenmemcpy()yes?FP
224Low 40Breceive_encrypted_standardfs/smb/client/smb2ops.cnext_cmdmemcpy()yes?FP
225Low 40Hsmb2_calc_signaturefs/smb/client/smb2transport.crctruncationnoFP
226Low 40Csmb2_check_messagefs/smb/client/smb2misc.ccommandsubscriptyes?FP
227Low 40Bsmb2_parse_contextsfs/smb/client/smb2pdu.cccmemcpy() in parse_posix_ctxt()yes?FP
228Low 40Bsmb2_parse_contextsfs/smb/client/smb2pdu.cccmemcpy() in parse_posix_ctxt()yes?FP
229Low 40Bsmb2_parse_symlink_responsefs/smb/client/smb2file.csub_offskmalloc() in smb2_parse_native_symlink()yes?FP
230Low 40Bsmb2_parse_symlink_responsefs/smb/client/smb2file.csub_lenkmalloc() in smb2_parse_native_symlink()yes?FP
231Low 40Bsmb2_parse_symlink_responsefs/smb/client/smb2file.csub_offsmemcpy() in smb2_parse_native_symlink()yes?FP
232Low 40Bsmb2_parse_symlink_responsefs/smb/client/smb2file.csub_lenmemcpy() in smb2_parse_native_symlink()yes?FP
233Low 40Bsmb2_parse_symlink_responsefs/smb/client/smb2file.csub_offskmalloc() in smb2_parse_native_symlink()yes?FP
234Low 40Bsmb2_parse_symlink_responsefs/smb/client/smb2file.csub_lenkmalloc() in smb2_parse_native_symlink()yes?FP
235Low 40Bsmb2_parse_symlink_responsefs/smb/client/smb2file.csub_offsmemcpy() in smb2_parse_native_symlink()yes?FP
236Low 40Bsmb2_parse_symlink_responsefs/smb/client/smb2file.csub_lenmemcpy() in smb2_parse_native_symlink()yes?FP
237Low 40Bsmb2_query_easfs/smb/client/smb2ops.cinfomemcmp() in move_smb2_ea_to_cifs()yes?FP
238Low 40Bsmb2_query_easfs/smb/client/smb2ops.cinfomemcpy() in move_smb2_ea_to_cifs()yes?FP
239Low 40Bsmb2_query_easfs/smb/client/smb2ops.cle32_to_cpu(rsp->OutputBufferLength)memcpy() in move_smb2_ea_to_cifs()yes?FP
240Low 40Bsmb2_query_easfs/smb/client/smb2ops.cinfomemcpy() in move_smb2_ea_to_cifs()yes?FP
241Low 40Hsmb2_tcon_find_pending_open_leasefs/smb/client/smb2misc.clease_statetruncationnoFP
242Low 40Hsmb2_tcon_has_leasefs/smb/client/smb2misc.clease_statetruncationnoFP
243Low 40Hsmb3_calc_signaturefs/smb/client/smb2transport.crctruncationnoFP
244Low 40Hsmb3_fiemapfs/smb/client/smb2ops.crctruncationnoFP
245Low 40Hsmb3_simple_fallocate_rangefs/smb/client/smb2ops.crctruncationnoFP
246Low 30FCIFSSMBQAllEAsfs/smb/client/cifssmb.clist_lenloop boundyes?FP
247Low 30Fbuild_sec_descfs/smb/client/cifsacl.cdacl_ptrloop boundyes?FP
248Low 30Fcifs_query_path_infofs/smb/client/smb1ops.cealoop boundyes?FP
249Low 30Fdecode_compress_ctxfs/smb/client/smb2pdu.ccountloop boundyes?FP
250Low 30Fid_mode_to_cifs_aclfs/smb/client/cifsacl.cdacl_ptrloop boundyes?FP
251Low 30Fparse_daclfs/smb/client/cifsacl.cppaceloop boundyes?FP
252Low 30Fparse_daclfs/smb/client/cifsacl.cnum_acesloop boundyes?FP
253Low 30Fparse_dfs_referralsfs/smb/client/misc.cpath_consumedloop boundyes?FP
254Low 30Fparse_sec_descfs/smb/client/cifsacl.cdacl_ptrloop boundyes?FP
255Low 30Fsmb311_decode_neg_contextfs/smb/client/smb2pdu.cpctxloop boundyes?FP
256Low 30Fvalidate_daclfs/smb/client/cifsacl.cnum_acesloop boundyes?FP
257Low 20Hcheck_wsl_easfs/smb/client/smb2inode.cnlentruncationyes?FP

Findings by File

FileFindings
fs/smb/client/cifssmb.c65
fs/smb/client/cifsacl.c37
fs/smb/client/smb2pdu.c33
fs/smb/client/smb1ops.c27
fs/smb/client/smb2inode.c27
fs/smb/client/reparse.c16
fs/smb/client/smb2ops.c13
fs/smb/client/smb2file.c11
fs/smb/client/transport.c10
fs/smb/client/smb2misc.c4
fs/smb/client/misc.c3
fs/smb/client/smb1transport.c3
fs/smb/client/smb2transport.c3
fs/smb/client/smb1maperror.c2
fs/smb/client/smb1misc.c1
fs/smb/client/cached_dir.c1
fs/smb/client/netmisc.c1