Documented in 1 files:
Defined in 1 files as a prototype:
Defined in 1 files as a function:
Referenced in 6 files:
- include/linux/sockptr.h, line 164
- include/linux/uaccess.h, line 407
- kernel/bpf/syscall.c, line 107
- kernel/seccomp.c, line 1558
- lib/tests/usercopy_kunit.c, line 95
- lib/usercopy.c, line 81
Smatch caller information:
drivers/infiniband/core/ib_core_uverbs.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-524280,18446744073709551552-u64max |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | size | 0-524280,18446744073709551552-u64max[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
| HALF_LOCKED2 | &cq->mutex | ||
| HALF_LOCKED2 | &cq->resize_mutex | ||
| HALF_LOCKED2 | &file->hw_destroy_rwsem | ||
| HALF_LOCKED2 | &file->ucontext_lock |
kernel/fork.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4032 |
| USER_DATA | 1 | size | 0-4032[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
drivers/iommu/intel/nested.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0 |
| USER_DATA | 1 | size | 0[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
fs/xattr.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4080 |
| USER_DATA | 1 | size | 0-4080[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
kernel/trace/trace_events_user.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4080,18446744073709551604-u64max |
| USER_DATA | 1 | size | 0-4080,18446744073709551604-u64max[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
| LOCK2 | &group->reg_mutex | ||
| TYPE_LOCK | (struct user_event_group)->reg_mutex |
drivers/iommu/iommufd/selftest.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-u32max,18446744073709551600-u64max |
| RX_PATH | |||
| USER_DATA | 1 | size | 0-u32max,18446744073709551600-u64max[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
drivers/iommu/amd/nested.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0 |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
kernel/liveupdate/luo_session.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
io_uring/openclose.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4294967271 |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
| LOCK2 | &ctx->uring_lock | ||
| HALF_LOCKED2 | &sqd->lock | ||
| TYPE_LOCK | (struct io_ring_ctx)->uring_lock |
kernel/liveupdate/luo_core.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
fs/file_attr.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4072 |
| USER_DATA | 1 | size | 0-4072[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
drivers/platform/surface/surface_aggregator_cdev.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0,2,33,35,18446744073709551581,18446744073709551583,18446744073709551614 |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
| LOCK2 | &client->cdev->lock | ||
| TYPE_LOCK | (struct ssam_cdev)->lock |
fs/proc/task_mmu.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4072 |
| USER_DATA | 1 | size | 0-4072[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
kernel/bpf/syscall.c bpf_check_uarg_tail_zero() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 1-4088 |
| USER_DATA | 1 | size | 1-4088 |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
net/ipv4/tcp.c check_zeroed_sockptr() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 1-2147483583 |
| DATA_SOURCE | 1 | size | $2 |
| RX_PATH | |||
| USER_DATA | 1 | size | 1-2147483583 |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
| HALF_LOCKED2 | sk |
drivers/vfio/device_cdev.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4294967279 |
| USER_DATA | 1 | size | 0-4294967279[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
lib/tests/usercopy_kunit.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 0-18446744073709551614 |
| PARAM_VALUE | 1 | size | 0,4096,8192,18446744073709543424,18446744073709547520 |
lib/tests/usercopy_kunit.c usercopy_test_check_nonzero_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | *from | 0-255 |
| PARAM_VALUE | 1 | size | 1-1024 |
| FUZZY_MAX | 1 | size | 1024 |
| HARD_MAX | 1 | size | 1024 |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
net/bluetooth/sco.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-254 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | size | 0-254[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
| LOCK2 | sk | ||
| HALF_LOCKED2 | &smc->clcsock_release_lock |
security/landlock/syscalls.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4088 |
| USER_DATA | 1 | size | 0-4088[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
drivers/gpu/drm/panthor/panthor_drv.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| USER_DATA | 1 | size | 0-u32max,18446744073709551568-u64max[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
kernel/nstree.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4064 |
| USER_DATA | 1 | size | 0-4064[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
drivers/iommu/iommufd/main.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
kernel/sched/build_policy.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4048 |
| USER_DATA | 1 | size | 0-4048[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
drivers/fwctl/main.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
fs/namespace.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4072 |
| USER_DATA | 1 | size | 0-4072[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
net/tls/tls_main.c check_zeroed_sockptr() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4294967291 |
| DATA_SOURCE | 1 | size | $2 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | size | 0-2147483643 |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
| HALF_LOCKED2 | &smc->clcsock_release_lock |
drivers/infiniband/core/uverbs_cmd.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-524280,18446744073709551500-u64max |
| USER_DATA | 1 | size | 0-524280,18446744073709551500-u64max[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
| HALF_LOCKED2 | &file->device->disassociate_srcu |
kernel/trace/rv/monitors/nomiss/nomiss.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0 |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
kernel/events/core.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4032 |
| USER_DATA | 1 | size | 0-4032[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
drivers/platform/x86/amd/hsmp/hsmp.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0 |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
net/ipv4/tcp_ao.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4294967294,18446744073709551328-u64max |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | size | 0-2147483646,18446744073709551328-u64max[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
| HALF_LOCKED2 | sk |
fs/open.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4072 |
| USER_DATA | 1 | size | 0-4072[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
kernel/seccomp.c copy_struct_from_user() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | from | 4096-ptr_max |
| PARAM_VALUE | 1 | size | 0-4071 |
| USER_DATA | 1 | size | 0-4071[c] |
| UNITS | 0 | from | unit_byte |
| UNITS | 1 | size | unit_byte |
kernel/seccomp.c seccomp_notify_recv() -> check_zeroed_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 1 | size | 80 |
| DATA_SOURCE | 0 | from | $1 |
| UNITS | 1 | size | unit_byte |