Defined in 1 files as a function:
Referenced in 1 files:
Smatch caller information:
net/bluetooth/hidp/core.c hidp_connection_del() -> hidp_send_ctrl_message()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | session | 4096-ptr_max |
| PARAM_VALUE | 1 | hdr | 21 |
| PARAM_VALUE | 2 | data | 0 |
| PARAM_VALUE | 3 | size | 0 |
| DATA_SOURCE | 0 | session | r hidp_session_find |
| CAPABLE | 0 | 12 | |
| NOCHECK_CALL | |||
| HALF_LOCKED2 | &smc->sk |
net/bluetooth/hidp/core.c hidp_get_raw_report() -> hidp_send_ctrl_message()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | session | 4096-ptr_max |
| PARAM_VALUE | 0 | session->report_mutex.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->report_mutex.first_waiter | 0,4096-5159360019465732095,5159360019465732097-ptr_max |
| PARAM_VALUE | 0 | session->report_mutex.first_waiter->list.prev->next | 5159360019465732096 |
| PARAM_VALUE | 0 | session->report_mutex.osq.tail.counter | 0-s32max |
| PARAM_VALUE | 0 | session->report_mutex.wait_lock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->report_mutex.wait_lock.owner | (-1) |
| PARAM_VALUE | 0 | session->report_mutex.wait_lock.owner_cpu | u32max |
| PARAM_VALUE | 0 | session->terminate.counter | 0 |
| PARAM_VALUE | 0 | session->waiting_report_number | (-1)-255 |
| PARAM_VALUE | 0 | session->waiting_report_type | 0-3 |
| PARAM_VALUE | 1 | hdr | 65-67 |
| PARAM_VALUE | 2 | data | 4096-ptr_max |
| PARAM_VALUE | 3 | size | 1 |
| BUF_SIZE | 0 | session | s32min-(-2),1-s32max |
| BUF_SIZE | 0 | session | s32min-(-2),1-s32max |
| BUF_SIZE | 2 | data | (-1)-s32max |
| BUF_SIZE | 2 | data | (-1)-s32max |
| CAPPED_DATA | 0 | &session->report_mutex | 1 |
| DATA_SOURCE | 1 | hdr | $4 [m] |
| DATA_SOURCE | 2 | data | $2 |
| FUZZY_MAX | 1 | hdr | 67 |
| BIT_INFO | 1 | hdr | 0x40,0x43 |
| HARD_MAX | 1 | hdr | 67 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 0 | session->waiting_report_number | 0-255 |
| USER_DATA | 2 | *data | 0-255 |
| USER_PTR | 2 | data | |
| LOCK2 | 0 | &session->report_mutex | |
| HALF_LOCKED2 | &hid->driver_input_lock | ||
| HALF_LOCKED2 | &hid->ll_open_lock | ||
| HALF_LOCKED2 | global &minors_rwsem | ||
| TYPE_LOCK | (struct hidp_session)->report_mutex |
net/bluetooth/hidp/core.c hidp_process_data() -> hidp_send_ctrl_message()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | session | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock->sk | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->__sk_common.skc_state | 1 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->ns_tracker->alloc_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->ns_tracker->dead | 0-1 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->ns_tracker->free_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->sk_receive_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->hid->driver_input_lock.first_waiter->up | 0-1 |
| PARAM_VALUE | 0 | session->input->mt->slot | s32min-s32max |
| PARAM_VALUE | 0 | session->intr_sock | 4096-ptr_max |
| PARAM_VALUE | 0 | session->intr_sock->sk | 4096-ptr_max |
| PARAM_VALUE | 0 | session->intr_sock->sk->__sk_common.skc_u16hashes | 0-u32max |
| PARAM_VALUE | 0 | session->intr_sock->sk->ns_tracker->alloc_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->intr_sock->sk->ns_tracker->dead | 0-1 |
| PARAM_VALUE | 0 | session->intr_sock->sk->ns_tracker->free_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->intr_sock->sk->sk_receive_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->intr_transmit.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->state_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->timer.entry->pprev | 4096-ptr_max |
| PARAM_VALUE | 0 | *session->intr_sock->sk->sk_backlog.head->dev->name | 0-255 |
| PARAM_VALUE | 1 | hdr | 4 |
| PARAM_VALUE | 2 | data | 0 |
| PARAM_VALUE | 3 | size | 0 |
| BUF_SIZE | 0 | session | 128 |
| BUF_SIZE | 0 | session | 128 |
| DATA_SOURCE | 0 | session | $0 |
| NOCHECK_CALL |
net/bluetooth/hidp/core.c hidp_process_handshake() -> hidp_send_ctrl_message()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | session | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock->sk | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->__sk_common.skc_state | 1 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->ns_tracker->alloc_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->ns_tracker->dead | 0-1 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->ns_tracker->free_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->sk_receive_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->hid->driver_input_lock.first_waiter->up | 0-1 |
| PARAM_VALUE | 0 | session->input->mt->slot | s32min-s32max |
| PARAM_VALUE | 0 | session->intr_sock | 4096-ptr_max |
| PARAM_VALUE | 0 | session->intr_sock->sk | 4096-ptr_max |
| PARAM_VALUE | 0 | session->intr_sock->sk->__sk_common.skc_u16hashes | 0-u32max |
| PARAM_VALUE | 0 | session->intr_sock->sk->ns_tracker->alloc_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->intr_sock->sk->ns_tracker->dead | 0-1 |
| PARAM_VALUE | 0 | session->intr_sock->sk->ns_tracker->free_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->intr_sock->sk->sk_receive_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->intr_transmit.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->output_report_success | 0 |
| PARAM_VALUE | 0 | session->state_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->timer.entry->pprev | 4096-ptr_max |
| PARAM_VALUE | 0 | *session->intr_sock->sk->sk_backlog.head->dev->name | 0-255 |
| PARAM_VALUE | 1 | hdr | 18 |
| PARAM_VALUE | 2 | data | 0 |
| PARAM_VALUE | 3 | size | 0 |
| BUF_SIZE | 0 | session | 128 |
| BUF_SIZE | 0 | session | 128 |
| DATA_SOURCE | 0 | session | $0 |
| NOCHECK_CALL |
net/bluetooth/hidp/core.c hidp_process_handshake() -> hidp_send_ctrl_message()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | session | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock->sk | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->__sk_common.skc_state | 1 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->ns_tracker->alloc_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->ns_tracker->dead | 0-1 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->ns_tracker->free_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->sk_receive_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->hid->driver_input_lock.first_waiter->up | 0-1 |
| PARAM_VALUE | 0 | session->input->mt->slot | s32min-s32max |
| PARAM_VALUE | 0 | session->intr_sock | 4096-ptr_max |
| PARAM_VALUE | 0 | session->intr_sock->sk | 4096-ptr_max |
| PARAM_VALUE | 0 | session->intr_sock->sk->__sk_common.skc_u16hashes | 0-u32max |
| PARAM_VALUE | 0 | session->intr_sock->sk->ns_tracker->alloc_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->intr_sock->sk->ns_tracker->dead | 0-1 |
| PARAM_VALUE | 0 | session->intr_sock->sk->ns_tracker->free_stack_handle | 0-4294967295 |
| PARAM_VALUE | 0 | session->intr_sock->sk->sk_receive_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->intr_transmit.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->output_report_success | 0 |
| PARAM_VALUE | 0 | session->state_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->timer.entry->pprev | 4096-ptr_max |
| PARAM_VALUE | 0 | *session->intr_sock->sk->sk_backlog.head->dev->name | 0-255 |
| PARAM_VALUE | 1 | hdr | 4 |
| PARAM_VALUE | 2 | data | 0 |
| PARAM_VALUE | 3 | size | 0 |
| BUF_SIZE | 0 | session | 128 |
| BUF_SIZE | 0 | session | 128 |
| DATA_SOURCE | 0 | session | $0 |
| NOCHECK_CALL |
net/bluetooth/hidp/core.c hidp_recv_ctrl_frame() -> hidp_send_ctrl_message()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | session | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock->sk | 4096-ptr_max |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->__sk_common.skc_state | 1 |
| PARAM_VALUE | 0 | session->ctrl_sock->sk->sk_receive_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->hid->driver_input_lock.first_waiter->up | 0-1 |
| PARAM_VALUE | 0 | session->intr_sock | 4096-ptr_max |
| PARAM_VALUE | 0 | session->intr_sock->sk | 4096-ptr_max |
| PARAM_VALUE | 0 | session->intr_sock->sk->__sk_common.skc_state | 1 |
| PARAM_VALUE | 0 | session->intr_sock->sk->sk_receive_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->intr_transmit.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->state_queue.lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->timer.entry->pprev | 4096-ptr_max |
| PARAM_VALUE | 0 | *session->intr_sock->sk->sk_backlog.head->dev->name | 0-255 |
| PARAM_VALUE | 1 | hdr | 3 |
| PARAM_VALUE | 2 | data | 0 |
| PARAM_VALUE | 3 | size | 0 |
| BUF_SIZE | 0 | session | 128 |
| BUF_SIZE | 0 | session | 128 |
| DATA_SOURCE | 0 | session | $0 |
| NOCHECK_CALL | |||
| NO_OVERFLOW_SIMPLE | 0 | session->report_return->end | |
| NO_OVERFLOW_SIMPLE | 0 | session->report_return->len |
net/bluetooth/hidp/core.c hidp_set_raw_report() -> hidp_send_ctrl_message()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | session | 4096-ptr_max |
| PARAM_VALUE | 0 | session->report_mutex.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->report_mutex.first_waiter | 0,4096-5159360019465732095,5159360019465732097-ptr_max |
| PARAM_VALUE | 0 | session->report_mutex.first_waiter->list.prev->next | 5159360019465732096 |
| PARAM_VALUE | 0 | session->report_mutex.osq.tail.counter | 0-s32max |
| PARAM_VALUE | 0 | session->report_mutex.wait_lock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | session->report_mutex.wait_lock.owner | (-1) |
| PARAM_VALUE | 0 | session->report_mutex.wait_lock.owner_cpu | u32max |
| PARAM_VALUE | 1 | hdr | 81-83 |
| PARAM_VALUE | 2 | data | 4096-ptr_max |
| PARAM_VALUE | 3 | size | 1-16384 |
| BUF_SIZE | 0 | session | s32min-(-2),1-s32max |
| BUF_SIZE | 0 | session | s32min-(-2),1-s32max |
| BUF_SIZE | 2 | data | (-1)-s32max |
| BUF_SIZE | 2 | data | (-1)-s32max |
| CAPPED_DATA | 0 | &session->report_mutex | 1 |
| CAPPED_DATA | 3 | size | 1 |
| DATA_SOURCE | 1 | hdr | $4 [m] |
| DATA_SOURCE | 2 | data | $2 |
| DATA_SOURCE | 3 | size | $3 |
| FUZZY_MAX | 1 | hdr | 83 |
| PARAM_COMPARE | 2 | data | == $3 |
| BIT_INFO | 1 | hdr | 0x50,0x53 |
| NOSPEC | 3 | size | |
| NOSPEC | 3 | size | |
| HARD_MAX | 1 | hdr | 83 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 2 | *data | 0-255 |
| USER_DATA | 3 | size | 3-16384[c] |
| BYTE_COUNT | 2 | ==data3 | 8050 |
| USER_PTR | 2 | data | |
| LOCK2 | 0 | &session->report_mutex | |
| HALF_LOCKED2 | &hid->driver_input_lock | ||
| HALF_LOCKED2 | &hid->ll_open_lock | ||
| HALF_LOCKED2 | global &minors_rwsem | ||
| TYPE_LOCK | (struct hidp_session)->report_mutex |