Defined in 2 files as a function:
Referenced in 1 files:
Smatch caller information:
fs/exec.c copy_string_kernel() -> valid_arg_len()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | bprm | 4096-ptr_max |
| PARAM_VALUE | 1 | len | 1-131073 |
| BUF_SIZE | 0 | bprm | (-1),1-s32max |
| BUF_SIZE | 0 | bprm | (-1),1-s32max |
| CAPPED_DATA | 1 | len | 1 |
| DATA_SOURCE | 0 | bprm | $1 |
| USER_DATA | 0 | bprm->is_check | 0-1 |
| NO_OVERFLOW_SIMPLE | 0 | bprm->envc | |
| NO_OVERFLOW_SIMPLE | 0 | bprm->exec | |
| NO_OVERFLOW_SIMPLE | 0 | bprm->file->f_path.dentry->d_inode->i_size | |
| NO_OVERFLOW_SIMPLE | 0 | bprm->file->f_path.moved->d_inode->i_size | |
| NO_OVERFLOW_SIMPLE | 0 | bprm->p |
fs/exec.c copy_strings() -> valid_arg_len()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | bprm | 4096-ptr_max |
| PARAM_VALUE | 1 | len | s32min-(-1),1-s32max |
| BUF_SIZE | 0 | bprm | 472 |
| CAPPED_DATA | 0 | bprm->argmin | 1 |
| CAPPED_DATA | 0 | bprm->fdpath | 1 |
| CAPPED_DATA | 1 | len | 1 |
| DATA_SOURCE | 0 | bprm | $2 |
| DATA_SOURCE | 1 | len | r strnlen_user |
| TERMINATED | 0 | bprm->vma->vmlock_dep_map.name | 1 |
| USER_DATA | 0 | bprm->is_check | 0-1 |
| NO_OVERFLOW_SIMPLE | 0 | bprm->envc | |
| NO_OVERFLOW_SIMPLE | 0 | bprm->exec | |
| NO_OVERFLOW_SIMPLE | 0 | bprm->p |