Defined in 1 files as a prototype:
Defined in 1 files as a function:
Referenced in 7 files:
- net/ipv4/ip_sockglue.c, line 443
- net/ipv4/ping.c, line 584
- net/ipv4/raw.c, line 269
- net/ipv4/tcp_ipv4.c, line 619
- net/ipv4/udp.c, line 999
- net/l2tp/l2tp_core.c, line 1126
- net/rxrpc/local_object.c, line 34
Smatch caller information:
net/ipv4/tcp_ipv4.c tcp_v4_err() -> ip_icmp_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| PARAM_VALUE | 0 | sk->__sk_common.skc_state | 2-3 |
| PARAM_VALUE | 0 | sk->sk_lock.slock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 1 | skb | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->data | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.tcp_death_row.hashinfo | 4096-ptr_max |
| PARAM_VALUE | 5 | payload | 4096-ptr_max |
| CAPPED_DATA | 0 | sk | 1 |
| CAPPED_DATA | 1 | skb->dev->nd_net.net | 1 |
| DATA_SOURCE | 0 | sk | r __inet_lookup_established |
| DATA_SOURCE | 1 | skb | $0 |
| DATA_SOURCE | 4 | info | $1 |
| PREEMPT_ADD | <- disables preempt | ||
| NOCHECK_CALL | |||
| USER_DATA | 3 | port | 0-u16max[u] |
| USER_DATA | 5 | *payload | 0-255 |
| UNITS | 5 | payload | unit_byte |
| USER_PTR | 5 | payload | |
| LOCK2 | 0 | &sk->sk_lock.slock | |
| TYPE_LOCK | (struct socket_lock_t)->slock |
net/l2tp/l2tp_core.c l2tp_udp_encap_err_recv() -> ip_icmp_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| PARAM_VALUE | 0 | sk->sk_callback_lock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | sk->sk_dst_cache->dev_rcu->rtnl_link_ops->maxtype | 0-6,8-10,15,18,20,22,24,34,50 |
| PARAM_VALUE | 0 | sk->sk_error_report | 4096-ptr_max |
| PARAM_VALUE | 1 | skb | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.udp_table | 4096-ptr_max |
| CAPPED_DATA | 0 | sk | 1 |
| CAPPED_DATA | 1 | skb->dev->nd_net.net | 1 |
| DATA_SOURCE | 0 | sk | $0 |
| DATA_SOURCE | 1 | skb | $1 |
| DATA_SOURCE | 2 | err | $2 |
| DATA_SOURCE | 3 | port | $3 |
| DATA_SOURCE | 4 | info | $4 |
| DATA_SOURCE | 5 | payload | $5 |
| USER_DATA | 3 | port | 0-u16max[u] |
| USER_DATA | 4 | info | 0-u32max |
| USER_DATA | 5 | *payload | 0-255 |
| USER_PTR | 5 | payload |
net/ipv4/ping.c ping_err() -> ip_icmp_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| PARAM_VALUE | 0 | sk->__sk_common.skc_family | 2,10 |
| PARAM_VALUE | 0 | sk->__sk_common.skc_net.net->ipv4.fib_main->tb_data->kv->key | 0-4294967295 |
| PARAM_VALUE | 1 | skb | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->create_rxfh_context | 0-s64max |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->get_link_ext_state | 0-s64max |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->get_mm_stats | 0-s64max |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->modify_rxfh_context | 0-s64max |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->remove_rxfh_context | 0-s64max |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->rxfh_max_num_contexts | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->supported_coalesce_params | 0-s64max |
| PARAM_VALUE | 1 | skb->dev->ip_ptr->ifa_list->ifa_address | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->ip_ptr->ifa_list->ifa_broadcast | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->ip_ptr->ifa_list->ifa_flags | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->ip_ptr->ifa_list->ifa_local | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->ip_ptr->ifa_list->ifa_mask | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->ip_ptr->ifa_list->ifa_preferred_lft | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->ip_ptr->ifa_list->ifa_prefixlen | 0-255 |
| PARAM_VALUE | 1 | skb->dev->ip_ptr->ifa_list->ifa_proto | 0-255 |
| PARAM_VALUE | 1 | skb->dev->ip_ptr->ifa_list->ifa_rt_priority | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->ip_ptr->ifa_list->ifa_scope | 0-255 |
| PARAM_VALUE | 1 | skb->dev->ip_ptr->ifa_list->ifa_valid_lft | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fib_default->tb_data->stats->gets | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fib_default->tb_data->stats->semantic_match_passed | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fib_main->tb_data->kv->bits | 1-255 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fib_main->tb_data->kv->key | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fib_main->tb_data->kv->pos | 0-254 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fib_main->tb_data->kv->slen | 1-255 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fib_main->tb_data->stats->backtrack | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fib_main->tb_data->stats->gets | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fib_main->tb_data->stats->null_node_hit | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fib_main->tb_data->stats->semantic_match_miss | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fib_main->tb_data->stats->semantic_match_passed | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fqdir->f->frag_expire | 0,663510801442193408,1753052602134376448,4007388366431105024,8876081723503042560 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fqdir->f->qsize | 0,304,320 |
| PARAM_VALUE | 1 | skb->dev->ndisc_ops->fill_addr_option | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->ndisc_ops->parse_options | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->ndisc_ops->update | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->rtnl_link_ops->maxtype | 0-6,8-10,15,18,20,22,24,34,50 |
| PARAM_VALUE | 1 | skb->dev->rtnl_link_ops->priv_size | 0,8,32,40,48,56,88,112,120,144,160,224,240,256,296,616,624,728,744,1056,1128,1336,1616,2176,2240,2272,2560,3296,3544,3552,9688-u64max |
| PARAM_VALUE | 1 | skb->protocol | 2048 |
| PARAM_VALUE | 3 | port | 0 |
| PARAM_VALUE | 5 | payload | 4096-ptr_max |
| BUF_SIZE | 1 | skb | (-1)-s32max |
| BUF_SIZE | 1 | skb | (-1)-s32max |
| CAPPED_DATA | 0 | sk->__sk_common.skc_net.net | 1 |
| CAPPED_DATA | 1 | skb->dev | 1 |
| CAPPED_DATA | 1 | skb->dev->nd_net.net | 1 |
| CAPPED_DATA | 5 | payload->un.echo.id | 1 |
| DATA_SOURCE | 0 | sk | r ping_lookup |
| DATA_SOURCE | 1 | skb | $0 |
| DATA_SOURCE | 4 | info | $2 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL | |||
| HOST_DATA | 1 | skb->csum | 0-4294967041[c] |
| HOST_DATA | 1 | skb->csum_offset | 0-u16max |
| HOST_DATA | 1 | skb->prev->csum_offset | 0-u16max |
| HOST_DATA | 1 | skb->prev->data_len | 0-u32max[c] |
| HOST_DATA | 1 | skb->prev->len | 1-u32max[c] |
| HOST_DATA | 1 | skb->prev->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 1 | skb->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 1 | skb->users.refs.counter | s32min-0,2-s32max |
| HOST_DATA | 1 | *skb->data | 0-255 |
| USER_DATA | 4 | info | 0-u32max |
| USER_DATA | 5 | *payload | 0-255 |
| NO_OVERFLOW_SIMPLE | 1 | skb->data_len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->group | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->num_tc | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->real_num_rx_queues | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->real_num_tx_queues | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->stats.rx_bytes | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->stats.tx_bytes | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->tx_queue_len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->end | |
| NO_OVERFLOW_SIMPLE | 1 | skb->len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->next->data_len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->next->end | |
| NO_OVERFLOW_SIMPLE | 1 | skb->next->len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->next->tail | |
| NO_OVERFLOW_SIMPLE | 1 | skb->next->truesize | |
| NO_OVERFLOW_SIMPLE | 1 | skb->prev->data_len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->prev->end | |
| NO_OVERFLOW_SIMPLE | 1 | skb->prev->len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->prev->tail | |
| NO_OVERFLOW_SIMPLE | 1 | skb->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 1 | skb->sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->tail | |
| NO_OVERFLOW_SIMPLE | 1 | skb->truesize | |
| UNITS | 5 | payload | unit_byte |
| USER_PTR | 5 | payload |
net/ipv4/raw.c raw_err() -> ip_icmp_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| PARAM_VALUE | 1 | skb | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->csum_valid | 1 |
| PARAM_VALUE | 1 | skb->data | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->create_rxfh_context | 0,4,1193890977307893760,3411743749688197120,4061224044846587904,4457498795121053696,4492625381564977152,6869898235061968896 |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->get_link_ext_state | 0,8,1281650680815353856,1471363006793740288,2066653251895574528,8975973974715154432,9149564991109386240 |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->get_mm_stats | 0,88,181867277093580800,5657799486394183680,5747745173089693696,8861185814274375680 |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->modify_rxfh_context | 0,5,2274879766485979136,2866542652935299072,4642694651803070464,5251344010917244928,5947095161631043584,7301979924060471296 |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->remove_rxfh_context | 0,170,106227240452722688,513622018430513152,1648226983112282112,1705969192382881792,5541829826254528512,7874787804778274816 |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->rxfh_max_num_contexts | 0,2,8,16,33 |
| PARAM_VALUE | 1 | skb->dev->ethtool_ops->supported_coalesce_params | 0-3,17,19,34-35,48,51,59,63,204,236,273,511,513,529,547,561,563,595,597,1553,1587,1681,132625,135697,657041,677393,2029107,2097665,2300433,2300595,3653155,12583935,12584499,13239859,117440512,536870912,536872499-s64max |
| PARAM_VALUE | 1 | skb->dev->hwprov->source | 0-2 |
| PARAM_VALUE | 1 | skb->dev->ip6_ptr->mc_query_work.wq->dfl_pwq | 0-s64max |
| PARAM_VALUE | 1 | skb->dev->ip6_ptr->mc_query_work.wq->saved_max_active | s32min-s32max |
| PARAM_VALUE | 1 | skb->dev->ip6_ptr->mc_query_work.wq->saved_min_active | s32min-s32max |
| PARAM_VALUE | 1 | skb->dev->ip6_ptr->mc_report_work.wq->dfl_pwq | 0-s64max |
| PARAM_VALUE | 1 | skb->dev->ip6_ptr->mc_report_work.wq->saved_max_active | s32min-s32max |
| PARAM_VALUE | 1 | skb->dev->ip6_ptr->mc_report_work.wq->saved_min_active | s32min-s32max |
| PARAM_VALUE | 1 | skb->dev->ip6_ptr->stats.proc_dir_entry | 0,4806605944481423360 |
| PARAM_VALUE | 1 | skb->dev->linkwatch_dev_tracker->alloc_stack_handle | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->linkwatch_dev_tracker->free_stack_handle | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->gen->s.len | 0-s32max |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fqdir->f | 0,2623593239163551744,2848917907979182080,2914521387540934656,3268414198954766336 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fqdir->f->frag_expire | 0,663510801442193408,1753052602134376448,4007388366431105024,8876081723503042560 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fqdir->f->qsize | 0,304,320 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fqdir->rhashtable.tbl->hash_rnd | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fqdir->rhashtable.tbl->nest | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.fqdir->rhashtable.tbl->size | 0-4294967295 |
| PARAM_VALUE | 1 | skb->dev->ndisc_ops->fill_addr_option | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->ndisc_ops->parse_options | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->ndisc_ops->update | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->priomap->priomap_len | 0,27,59 |
| PARAM_VALUE | 1 | skb->dev->rtnl_link_ops->maxtype | 0-6,8-10,15,18,20,22,24,34,50 |
| PARAM_VALUE | 1 | skb->dev->rtnl_link_ops->priv_size | 0,8,32,40,48,56,88,112,120,144,160,224,240,256,296,616,624,728,744,1056,1128,1336,1616,2176,2240,2272,2560,3296,3544,3552,9688-u64max |
| PARAM_VALUE | 1 | skb->extensions | 0 |
| PARAM_VALUE | 1 | skb->ip_summed | 0,2-3 |
| PARAM_VALUE | 1 | skb->next->sk->ns_tracker->alloc_stack_handle | 0-4294967295 |
| PARAM_VALUE | 1 | skb->next->sk->ns_tracker->dead | 0-1 |
| PARAM_VALUE | 1 | skb->next->sk->ns_tracker->free_stack_handle | 0-4294967295 |
| PARAM_VALUE | 1 | skb->next->sk->sk_peer_cred->process_keyring->user->qnbytes | s32min-s32max |
| PARAM_VALUE | 1 | skb->next->sk->sk_peer_cred->process_keyring->user->qnkeys | s32min-s32max |
| PARAM_VALUE | 1 | skb->next->sk->sk_peer_cred->request_key_auth->user->qnbytes | s32min-s32max |
| PARAM_VALUE | 1 | skb->next->sk->sk_peer_cred->request_key_auth->user->qnkeys | s32min-s32max |
| PARAM_VALUE | 1 | skb->next->sk->sk_peer_cred->session_keyring->user->qnbytes | s32min-s32max |
| PARAM_VALUE | 1 | skb->next->sk->sk_peer_cred->session_keyring->user->qnkeys | s32min-s32max |
| PARAM_VALUE | 1 | skb->next->sk->sk_peer_cred->thread_keyring->user->qnbytes | s32min-s32max |
| PARAM_VALUE | 1 | skb->next->sk->sk_peer_cred->thread_keyring->user->qnkeys | s32min-s32max |
| PARAM_VALUE | 1 | skb->sk->__sk_common.skc_net.net->gen->s.len | 0-s32max |
| PARAM_VALUE | 1 | skb->sk->__sk_common.skc_net.net->xfrm.nat_keepalive_work.wq->dfl_pwq | 0-s64max |
| PARAM_VALUE | 1 | skb->sk->__sk_common.skc_net.net->xfrm.nat_keepalive_work.wq->saved_max_active | s32min-s32max |
| PARAM_VALUE | 1 | skb->sk->__sk_common.skc_net.net->xfrm.nat_keepalive_work.wq->saved_min_active | s32min-s32max |
| PARAM_VALUE | 1 | skb->sk->ns_tracker->alloc_stack_handle | 0-4294967295 |
| PARAM_VALUE | 1 | skb->sk->ns_tracker->dead | 0-1 |
| PARAM_VALUE | 1 | skb->sk->ns_tracker->free_stack_handle | 0-4294967295 |
| PARAM_VALUE | 1 | skb->sk->sk_peer_cred->process_keyring->user->qnbytes | s32min-s32max |
| PARAM_VALUE | 1 | skb->sk->sk_peer_cred->process_keyring->user->qnkeys | s32min-s32max |
| PARAM_VALUE | 1 | skb->sk->sk_peer_cred->request_key_auth->user->qnbytes | s32min-s32max |
| PARAM_VALUE | 1 | skb->sk->sk_peer_cred->request_key_auth->user->qnkeys | s32min-s32max |
| PARAM_VALUE | 1 | skb->sk->sk_peer_cred->session_keyring->user->qnbytes | s32min-s32max |
| PARAM_VALUE | 1 | skb->sk->sk_peer_cred->session_keyring->user->qnkeys | s32min-s32max |
| PARAM_VALUE | 1 | skb->sk->sk_peer_cred->thread_keyring->user->qnbytes | s32min-s32max |
| PARAM_VALUE | 1 | skb->sk->sk_peer_cred->thread_keyring->user->qnkeys | s32min-s32max |
| PARAM_VALUE | 3 | port | 0 |
| BUF_SIZE | 1 | skb | (-1)-s32max |
| BUF_SIZE | 1 | skb | (-1)-s32max |
| BUF_SIZE | 5 | payload | (-1),1-s32max |
| BUF_SIZE | 5 | payload | (-1),1-s32max |
| CAPPED_DATA | 0 | sk->__sk_common.skc_net.net | 1 |
| CAPPED_DATA | 1 | skb | 1 |
| CAPPED_DATA | 1 | skb->dev->nd_net.net | 1 |
| DATA_SOURCE | 0 | sk | $0 |
| DATA_SOURCE | 1 | skb | $1 |
| DATA_SOURCE | 4 | info | $2 |
| CONSTRAINT | 1 | skb | <=49 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL | |||
| HOST_DATA | 1 | skb->csum | 0-4294967040[c] |
| HOST_DATA | 1 | skb->csum_offset | 0-u16max |
| HOST_DATA | 1 | skb->prev->csum_offset | 0-u16max |
| HOST_DATA | 1 | skb->prev->data_len | 0-u32max[c] |
| HOST_DATA | 1 | skb->prev->len | 1-u32max[c] |
| HOST_DATA | 1 | skb->prev->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 1 | skb->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 1 | skb->users.refs.counter | s32min-0,2-s32max |
| HOST_DATA | 1 | *skb->data | 0-255 |
| HOST_DATA | 5 | *payload | 0-255 |
| USER_DATA | 4 | info | 0-u32max |
| USER_DATA | 5 | *payload | 0-255 |
| NO_OVERFLOW_SIMPLE | 1 | skb->data_len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->group | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->num_tc | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->real_num_rx_queues | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->real_num_tx_queues | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->stats.rx_bytes | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->stats.tx_bytes | |
| NO_OVERFLOW_SIMPLE | 1 | skb->dev->tx_queue_len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->end | |
| NO_OVERFLOW_SIMPLE | 1 | skb->len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->next->data_len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->next->end | |
| NO_OVERFLOW_SIMPLE | 1 | skb->next->len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->next->tail | |
| NO_OVERFLOW_SIMPLE | 1 | skb->next->truesize | |
| NO_OVERFLOW_SIMPLE | 1 | skb->prev->end | |
| NO_OVERFLOW_SIMPLE | 1 | skb->prev->len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->prev->tail | |
| NO_OVERFLOW_SIMPLE | 1 | skb->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 1 | skb->sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 1 | skb->tail | |
| NO_OVERFLOW_SIMPLE | 1 | skb->truesize | |
| UNITS | 4 | info | unit_byte |
| UNITS | 5 | payload | unit_byte |
| USER_PTR | 5 | payload | |
| LOCK2 | rcu_read |
net/ipv4/udp.c udp_err() -> ip_icmp_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 1-ptr_max |
| PARAM_VALUE | 1 | skb | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->data | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.udp_table | 4096-ptr_max |
| CAPPED_DATA | 1 | skb->dev->nd_net.net | 1 |
| DATA_SOURCE | 0 | sk | r __udp4_lib_lookup |
| DATA_SOURCE | 1 | skb | $0 |
| DATA_SOURCE | 4 | info | $1 |
| NOCHECK_CALL | |||
| USER_DATA | 3 | port | 0-u16max[u] |
| USER_DATA | 5 | *payload | 0-255 |
| UNITS | 5 | payload | unit_byte |
| USER_PTR | 5 | payload |
net/rxrpc/local_object.c rxrpc_encap_err_rcv() -> ip_icmp_error()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 1-ptr_max |
| PARAM_VALUE | 1 | skb | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev | 4096-ptr_max |
| PARAM_VALUE | 1 | skb->dev->nd_net.net->ipv4.udp_table | 4096-ptr_max |
| CAPPED_DATA | 0 | sk | 1 |
| CAPPED_DATA | 1 | skb->dev->nd_net.net | 1 |
| DATA_SOURCE | 0 | sk | $0 |
| DATA_SOURCE | 1 | skb | $1 |
| DATA_SOURCE | 2 | err | $2 |
| DATA_SOURCE | 3 | port | $3 |
| DATA_SOURCE | 4 | info | $4 |
| DATA_SOURCE | 5 | payload | $5 |
| USER_DATA | 3 | port | 0-u16max[u] |
| USER_DATA | 4 | info | 0-u32max |
| USER_DATA | 5 | *payload | 0-255 |
| USER_PTR | 5 | payload |