Priority Summary — 20260820_150608

Priority Summary — 20260820_150608_mm

Date: 2026-08-20 15:07:16 Source: mm Total: 18 findings Medium: 18 By category: Cat G2: 18 LLM: 0 real | 18 FP | 0 unanalyzed Kernel: v7.2-rc7-32-gaf5a019bf97e Branch: work/fscache-fixes

32 local commit(s) since origin/master

af5a019bf97e cifs: fix i_size inconsistency in smb2_duplicate_extents() on FSCTL failure
e6a9c11309cd cifs: call pagecache_isize_extended() in cifs_setsize() when extending
5fce3864d8e5 smb: client: restore the data_offset bound in is_valid_oplock_break()
7f11fbcc7141 cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
1e13b07759b9 smb: client: Avoid leaking sensitive data to the heap in connect.c
d91fefcf00b0 smb: client: Clear sensitive stack data in smb1encrypt.c
24ec30094b95 smb: client: Clear sensitive stack data in cifsencrypt.c
3e200e7995cc smb: client: Clear sensitive stack and heap data in smb2ops.c
13881ad0a8d9 smb: client: Clear sensitive stack data in smb2transport.c
3356da3ae12b Revert "cifs: remove all cifs files before kill super"
98dfc0f0348c smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
442beae405ea smb: client: fix ALIGN() overflow in symlink_data() error context loop
67b83682e9c5 smb: client: simplify __build_path_from_dentry_optional_prefix()
cb4c026ddc77 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
f1e640a65f45 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
e56686589295 smb/client: decode reparse metadata using its payload type
0a09b6270c91 smb/client: preserve open info type across compound queries
c2f17b3a404d smb/client: mark missing nlink values as unknown
746f8bb16e15 cifs: fix clearing stats for fastest execution of each smb2 command
7886f8ae3173 smb/client: remove unused file flags ioctl handlers
1f852aaa3c8c smb/client: implement fileattr_set for compression flags
77d852c76342 smb/client: fix nlink of an overwritten open file
60be95527bc8 cifs: remove dead size-update blocks in cifs_setattr_unix/nounix
297d8026a570 cifs: remove redundant size-update block in cifs_remap_file_range()
32a7af68df73 cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem
364b18323058 cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
b1b741cf8e7c smb: client: clear ce->tgthint in free_tgts()
bf86c08123c6 smb: client: harden DFS cache against invalid target hints
b8e5dc4f95e5 smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
45f84cf25a08 smb: client: set replay flag on the read send-error retry path
deb6468f4164 smb: client: fix request buffer leak in smb2_new_read_req()
a2f9fb451c68 smb/client: return EOPNOTSUPP for unsupported O_TMPFILE

All Findings — Ranked by Priority

#	Tier	Score	Cat	Function	File	Variable	Sink	Guard	LLM
1	Medium	60	G2	`copy_folio_from_user`	mm/memory.c	`PAGE_SIZE`	copy_from_user() unvalidated size	no	FP
2	Medium	60	G2	`copy_user_test_oob`	mm/kasan/kasan_test_c.c	`size + 1`	copy_from_user() unvalidated size	no	FP
3	Medium	60	G2	`copy_user_test_oob`	mm/kasan/kasan_test_c.c	`size + 1`	copy_to_user() unvalidated size	no	FP
4	Medium	60	G2	`copy_user_test_oob`	mm/kasan/kasan_test_c.c	`size + 1`	__copy_from_user() unvalidated size	no	FP
5	Medium	60	G2	`copy_user_test_oob`	mm/kasan/kasan_test_c.c	`size + 1`	__copy_to_user() unvalidated size	no	FP
6	Medium	60	G2	`copy_user_test_oob`	mm/kasan/kasan_test_c.c	`size`	copy_to_user() unvalidated size	no	FP
7	Medium	60	G2	`do_pages_stat`	mm/migrate.c	`chunk_nr * sizeof(*chunk_pages)`	copy_from_user() unvalidated size	no	FP
8	Medium	60	G2	`do_pages_stat`	mm/migrate.c	`chunk_nr * sizeof(*status)`	copy_to_user() unvalidated size	no	FP
9	Medium	60	G2	`get_bitmap`	mm/mempolicy.c	`nlongs * sizeof(unsigned long)`	copy_from_user() unvalidated size	no	FP
10	Medium	60	G2	`lru_gen_seq_write`	mm/vmscan.c	`len`	copy_from_user() unvalidated size	no	FP
11	Medium	60	G2	`memdup_user`	mm/util.c	`len`	copy_from_user() unvalidated size	no	FP
12	Medium	60	G2	`memdup_user_nul`	mm/util.c	`len`	copy_from_user() unvalidated size	no	FP
13	Medium	60	G2	`mfill_copy_folio_locked`	mm/userfaultfd.c	`PAGE_SIZE`	copy_from_user() unvalidated size	no	FP
14	Medium	60	G2	`mfill_copy_folio_retry`	mm/userfaultfd.c	`PAGE_SIZE`	copy_from_user() unvalidated size	no	FP
15	Medium	60	G2	`pin_longterm_test_read`	mm/gup_test.c	`PAGE_SIZE`	copy_to_user() unvalidated size	no	FP
16	Medium	60	G2	`shrinker_debugfs_scan_write`	mm/shrinker_debug.c	`read_len`	copy_from_user() unvalidated size	no	FP
17	Medium	60	G2	`split_huge_pages_write`	mm/huge_memory.c	`min_t(size_t, count, MAX_INPUT_BUF_SZ)`	copy_from_user() unvalidated size	no	FP
18	Medium	60	G2	`vmemdup_user`	mm/util.c	`len`	copy_from_user() unvalidated size	no	FP

Findings by File

File	Findings
mm/kasan/kasan_test_c.c	5
mm/util.c	3
mm/migrate.c	2
mm/userfaultfd.c	2
mm/memory.c	1
mm/mempolicy.c	1
mm/vmscan.c	1
mm/gup_test.c	1
mm/shrinker_debug.c	1
mm/huge_memory.c	1