Defined in 1 files as a prototype:
Defined in 1 files as a function:
Referenced in 7 files:
- net/ipv4/af_inet.c, line 1592
- net/ipv4/ping.c, line 857
- net/ipv4/tcp.c, line 2936
- net/ipv4/tcp_bpf.c
- net/ipv4/udp_bpf.c, line 70
- net/mptcp/protocol.c, line 2324
- net/sctp/socket.c, line 2112
Smatch caller information:
net/ipv4/ping.c ping_recvmsg() -> inet_recv_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16-17,24 |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,128 |
| DATA_SOURCE | 0 | sk | $0 |
| DATA_SOURCE | 1 | msg | $1 |
| DATA_SOURCE | 2 | len | $2 |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_control | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_control_user | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_controllen | 0-u64max |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 0-u64max |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| USER_DATA | 2 | len | s32min-s32max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->truesize | |
| UNITS | 0 | sk | unit_byte |
| UNITS | 2 | len | unit_byte |
net/ipv4/tcp.c tcp_recvmsg() -> inet_recv_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16-17,24 |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,128 |
| DATA_SOURCE | 0 | sk | $0 |
| DATA_SOURCE | 1 | msg | $1 |
| DATA_SOURCE | 2 | len | $2 |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_control | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_control_user | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_controllen | 0-u64max |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 0-u64max |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| USER_DATA | 2 | len | s32min-s32max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_prot_creator->twsk_prot->twsk_slab->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->truesize | |
| UNITS | 0 | sk | unit_byte |
| UNITS | 2 | len | unit_byte |
net/ipv4/udp_bpf.c udp_bpf_recvmsg() -> inet_recv_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16-17,24 |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,128 |
| DATA_SOURCE | 0 | sk | $0 |
| DATA_SOURCE | 1 | msg | $1 |
| DATA_SOURCE | 2 | len | $2 |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_control | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_control_user | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_controllen | 0-u64max |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 0-u64max |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| USER_DATA | 2 | len | s32min-s32max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->truesize | |
| UNITS | 0 | sk | unit_byte |
| UNITS | 2 | len | unit_byte |
net/sctp/socket.c sctp_recvmsg() -> inet_recv_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16-17,24 |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,128 |
| DATA_SOURCE | 0 | sk | $0 |
| DATA_SOURCE | 1 | msg | $1 |
| DATA_SOURCE | 2 | len | $2 |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_control | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_control_user | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_controllen | 0-u64max |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 0-u64max |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| USER_DATA | 2 | len | s32min-s32max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->truesize | |
| UNITS | 0 | sk | unit_byte |
| UNITS | 2 | len | unit_byte |
net/mptcp/protocol.c mptcp_recvmsg() -> inet_recv_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16-17,24 |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,128 |
| DATA_SOURCE | 0 | sk | $0 |
| DATA_SOURCE | 1 | msg | $1 |
| DATA_SOURCE | 2 | len | $2 |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_control | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_control_user | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_controllen | 0-u64max |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 0-u64max |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| USER_DATA | 2 | len | s32min-s32max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->truesize | |
| UNITS | 0 | sk | unit_byte |
| UNITS | 2 | len | unit_byte |
net/ipv4/tcp_bpf.c tcp_bpf_recvmsg() -> inet_recv_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16-17,24 |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,128 |
| DATA_SOURCE | 0 | sk | $0 |
| DATA_SOURCE | 1 | msg | $1 |
| DATA_SOURCE | 2 | len | $2 |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_control | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_control_user | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_controllen | 0-u64max |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 0-u64max |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| USER_DATA | 2 | len | s32min-s32max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->truesize | |
| UNITS | 0 | sk | unit_byte |
| UNITS | 2 | len | unit_byte |
net/ipv4/tcp_bpf.c tcp_bpf_recvmsg_parser() -> inet_recv_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16-17,24 |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,128 |
| DATA_SOURCE | 0 | sk | $0 |
| DATA_SOURCE | 1 | msg | $1 |
| DATA_SOURCE | 2 | len | $2 |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_control | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_control_user | 4096-ptr_max[c][u] |
| USER_DATA | 1 | msg->msg_controllen | 0-u64max |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 0-u64max |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| USER_DATA | 2 | len | s32min-s32max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->next->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_receive_queue.prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_write_queue.next->truesize | |
| UNITS | 0 | sk | unit_byte |
| UNITS | 2 | len | unit_byte |