Ssv 26770 codeql consolidated - #116

Draft

datacore-senthil wants to merge 12 commits into

codeQl-fix-newfrom

SSV-26770-codeql-consolidated

Commits on Aug 13, 2026

Fix wrong-size free, use-after-free and double-free in kmem_vasprintf

datacore-senthil
and
claude
committed
099ab36
Fix stack buffer overflow in printBuffer

datacore-senthil
and
claude
committed
fa63e06
Restore the full-buffer clear for the zpoolHealthState IOCTL field

datacore-senthil
and
claude
committed
2c415e7
Restore the zero-fill lost converting strncpy in dodefault

datacore-senthil
and
claude
committed
c40d638
Restore pool-quota accounting and raise-on-failure in BufferUserBuffer

datacore-senthil
and
claude
committed
3fde64a
Bound the running offset in fletcher_4_param_get against truncation

datacore-senthil
and
claude
committed
98ce0f5
Take __dprintf's prefix length from strlen, not snprintf's return value

datacore-senthil
and
claude
committed
86e0814
Fix zfs_dbgmsg size accounting: strlcpy bound and wrong-size kmem_free

datacore-senthil
and
claude
committed
90fc11d
Restore the never-NULL contract in kmem_asprintf

datacore-senthil
and
claude
committed
f5eeaf9
Raise SPL_VSNPRINTF_PROBE_MIN to 1024 to keep __dprintf off the allocator

datacore-senthil
and
claude
committed
ac316fd
Add the scoped CodeQL analysis script used to produce these findings

datacore-senthil
and
claude
committed
99984fe
Use the existing strlcpy/strlcat instead of duplicating them as spl_*

datacore-senthil
and
claude
committed
84a3799