openssl-0004 + uwsgi-0001: 2 new defects (500x/249x); all 10 missing whitepaper entries restored; count 590→592

defects/linux/patch/linux-deeper-CLEAN.md

@@ -0,0 +1,51 @@
+# linux: CWE-407 deeper scan — net/core, kernel/ CLEAN
+
+## Subsystems scanned
+
+| Subsystem | Files | Verdict |
+|-----------|-------|---------|
+| `net/core/dev.c` | for_each_netdev, adjacency lists | CLEAN |
+| `net/core/fib_rules.c` | rule_find, rule_exists, list_for_each_entry | CLEAN |
+| `net/core/sock.c` | proto_register, assign_proto_idx | CLEAN |
+| `kernel/groups.c` | groups_search, supplementary GIDs | CLEAN |
+| `kernel/user_namespace.c` | mappings_overlap, uid/gid extents | BOUNDED |
+| `kernel/sched/topology.c` | find_pd, for_each_cpu perf domains | CLEAN |
+| `kernel/sched/core.c` | for_each_cpu + smt_mask, cpumask_andnot | CLEAN |
+| `kernel/workqueue.c` | for_each_pwq, for_each_pool | CLEAN |
+| `kernel/notifier.c` | raw_notifier_call_chain | CLEAN |
+
+## Notes
+
+### net/core/dev.c — `__dev_alloc_name`
+Outer `for_each_netdev` with inner `netdev_for_each_altname` scans a bitmap of
+used slots — sets a bit per slot using `bitmap_zalloc(max_netdevices)`.
+Not a membership test inside a growing list; the bitmap is reset fresh each call.
+CLEAN.
+
+### net/core/fib_rules.c — `rule_find`, `rule_exists`
+Both do a single sequential pass over `ops->rules_list`.  The three sequential
+passes in `fib_nl_newrule` (ctarget scan, pref-order scan, unresolved-rules
+update) are not nested — each is O(R) standalone.  CLEAN.
+
+### kernel/user_namespace.c — `mappings_overlap`
+Called in outer loop over lines in the UID/GID map file; inner loop checks
+overlap against already-accepted extents.  **Technically O(E²)** but bounded by
+`UID_GID_MAP_MAX_EXTENTS = 340`.  Peak: 340² = 115,600 comparisons on one
+`write()` call.  Not network-facing; attacker must have a user namespace.
+Below threshold for a new defect ticket; noted here for completeness.
+
+### kernel/sched/topology.c — `find_pd`
+`find_pd()` walks a short linked list of `perf_domain` objects (O(P), where P =
+number of distinct CPU performance domains — typically 1–4 on real hardware)
+inside `for_each_cpu(i, cpu_map)`.  Worst case O(C×P) but P is structurally
+bounded by hardware topology, not attacker-controlled.  CLEAN.
+
+### net/ipv4/, fs/, mm/ — NOT IN SPARSE CLONE
+The sparse clone does not include `net/ipv4/`, `fs/`, or `mm/`.  Those
+subsystems require a fresh clone or broader sparse-checkout configuration.
+
+## Conclusion
+
+No new CWE-407 defects found in the scanned kernel subsystems beyond
+linux-0001..0008.  The sparse clone limits further scanning of `net/ipv4/`,
+`fs/`, and `mm/`.