Documented in 1 files:
Defined in 1 files as a function:
Referenced in 29 files:
- arch/powerpc/kvm/powerpc.c, line 2530
- drivers/fwctl/main.c, line 196
- drivers/gpu/drm/imagination/pvr_drv.c
- drivers/gpu/drm/panthor/panthor_drv.c
- drivers/infiniband/core/ib_core_uverbs.c, line 446
- drivers/infiniband/core/uverbs_cmd.c, line 92
- drivers/iommu/iommufd/main.c, line 552
- drivers/platform/surface/surface_aggregator_cdev.c
- drivers/platform/x86/amd/hsmp/hsmp.c, line 359
- drivers/vfio/device_cdev.c, line 111
- fs/file_attr.c, line 452
- fs/namespace.c
- fs/open.c, line 1456
- fs/proc/task_mmu.c, line 704
- fs/xattr.c
- include/linux/iommu.h
- include/linux/sockptr.h, line 91
- io_uring/openclose.c, line 116
- kernel/events/core.c, line 13634
- kernel/fork.c, line 2933
- kernel/liveupdate/luo_core.c, line 411
- kernel/liveupdate/luo_session.c, line 434
- kernel/nstree.c, line 440
- kernel/sched/syscalls.c, line 890
- kernel/seccomp.c, line 1725
- kernel/trace/rv/monitors/deadline/deadline.h, line 116
- kernel/trace/trace_events_user.c
- lib/tests/usercopy_kunit.c
- security/landlock/syscalls.c, line 85
Smatch caller information:
drivers/infiniband/core/ib_core_uverbs.c _ib_copy_validate_udata_in() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 0,4096-ptr_max |
| PARAM_VALUE | 1 | ksize | 0,8,16,24,32,40,48,56,64 |
| PARAM_VALUE | 3 | usize | 0-524280,18446744073709551361-u64max |
| BUF_SIZE | 0 | dst | (-1),8,16,24,32,40,48,64 |
| BUF_SIZE | 0 | dst | (-1),8,16,24,32,40,48,64 |
| BUF_SIZE | 2 | src | 8 |
| DATA_SOURCE | 0 | dst | $1 |
| DATA_SOURCE | 1 | ksize | $2 |
| HARD_MAX | 1 | ksize | 64 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 3 | usize | 0-524280,18446744073709551361-u64max |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 2 | src | unit_byte |
| UNITS | 3 | usize | unit_byte |
| HALF_LOCKED2 | &cq->mutex | ||
| HALF_LOCKED2 | &cq->resize_mutex | ||
| HALF_LOCKED2 | &file->hw_destroy_rwsem | ||
| HALF_LOCKED2 | &file->ucontext_lock |
kernel/fork.c copy_clone_args_from_user() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 4810756430272700416 |
| PARAM_VALUE | 1 | ksize | 88 |
| PARAM_VALUE | 3 | usize | 64-4096 |
| BUF_SIZE | 0 | dst | 88 |
| DATA_SOURCE | 2 | src | $1 |
| DATA_SOURCE | 3 | usize | $2 |
| FUZZY_MAX | 3 | usize | 64 |
| USER_DATA | 3 | usize | 64-4096 |
| UNITS | 1 | ksize | unit_byte |
drivers/iommu/intel/nested.c __iommu_copy_struct_from_user() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 3486215956406792192,6844498047168790528 |
| PARAM_VALUE | 1 | ksize | 24 |
| PARAM_VALUE | 3 | usize | 24 |
| BUF_SIZE | 0 | dst | 24 |
| BUF_SIZE | 0 | dst | 24 |
| DATA_SOURCE | 0 | dst | $0 |
| DATA_SOURCE | 1 | ksize | $3 |
| PARAM_COMPARE | 1 | ksize | == $3 |
| PARAM_COMPARE | 1 | ksize | == $3 |
| PARAM_COMPARE | 3 | usize | == $1 |
| USER_DATA | 3 | usize | 24[u] |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
fs/xattr.c __do_sys_getxattrat() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 535706951321997312 |
| PARAM_VALUE | 1 | ksize | 16 |
| PARAM_VALUE | 3 | usize | 16-4096 |
| BUF_SIZE | 0 | dst | 16 |
| DATA_SOURCE | 2 | src | $4 |
| DATA_SOURCE | 3 | usize | $5 |
| FUZZY_MAX | 3 | usize | 4096 |
| HARD_MAX | 3 | usize | 4096 |
| USER_DATA | 3 | usize | 16-4096 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
fs/xattr.c __do_sys_getxattrat() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 535706951321997312 |
| PARAM_VALUE | 1 | ksize | 16 |
| PARAM_VALUE | 3 | usize | 16-4096 |
| BUF_SIZE | 0 | dst | 16 |
| DATA_SOURCE | 2 | src | $4 |
| DATA_SOURCE | 3 | usize | $5 |
| FUZZY_MAX | 3 | usize | 4096 |
| HARD_MAX | 3 | usize | 4096 |
| USER_DATA | 3 | usize | 16-4096 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
fs/xattr.c __do_sys_setxattrat() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 2785588984667115520 |
| PARAM_VALUE | 1 | ksize | 16 |
| PARAM_VALUE | 3 | usize | 16-4096 |
| BUF_SIZE | 0 | dst | 16 |
| DATA_SOURCE | 2 | src | $4 |
| DATA_SOURCE | 3 | usize | $5 |
| FUZZY_MAX | 3 | usize | 4096 |
| HARD_MAX | 3 | usize | 4096 |
| USER_DATA | 3 | usize | 16-4096 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
fs/xattr.c __do_sys_setxattrat() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 2785588984667115520 |
| PARAM_VALUE | 1 | ksize | 16 |
| PARAM_VALUE | 3 | usize | 16-4096 |
| BUF_SIZE | 0 | dst | 16 |
| DATA_SOURCE | 2 | src | $4 |
| DATA_SOURCE | 3 | usize | $5 |
| FUZZY_MAX | 3 | usize | 4096 |
| HARD_MAX | 3 | usize | 4096 |
| USER_DATA | 3 | usize | 16-4096 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
kernel/trace/trace_events_user.c user_reg_get() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 8221378194274328576 |
| PARAM_VALUE | 1 | ksize | 28 |
| PARAM_VALUE | 3 | usize | 28-4096 |
| DATA_SOURCE | 0 | dst | $1 |
| DATA_SOURCE | 2 | src | $0 |
| USER_DATA | 3 | usize | 28-4096 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
| LOCK2 | &group->reg_mutex | ||
| TYPE_LOCK | (struct user_event_group)->reg_mutex |
kernel/trace/trace_events_user.c user_unreg_get() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 6984655940592680960 |
| PARAM_VALUE | 1 | ksize | 16 |
| PARAM_VALUE | 3 | usize | 16-4096 |
| DATA_SOURCE | 0 | dst | $1 |
| DATA_SOURCE | 2 | src | $0 |
| USER_DATA | 3 | usize | 16-4096 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
| LOCK2 | &group->reg_mutex | ||
| TYPE_LOCK | (struct user_event_group)->reg_mutex |
drivers/iommu/iommufd/selftest.c __iommu_copy_struct_from_user() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 6233472872367022080,6854258902142087168,7605252107949400064,9018156585747120128 |
| PARAM_VALUE | 1 | ksize | 8,24 |
| PARAM_VALUE | 3 | usize | 4-24 |
| BUF_SIZE | 0 | dst | 8,24 |
| BUF_SIZE | 0 | dst | 8,24 |
| CAPPED_DATA | 3 | usize | 1 |
| CAPPED_DATA | 3 | usize | 1 |
| DATA_SOURCE | 0 | dst | $0 |
| DATA_SOURCE | 1 | ksize | $3 |
| FUZZY_MAX | 3 | usize | 24 |
| PARAM_COMPARE | 1 | ksize | >= $3 |
| PARAM_COMPARE | 1 | ksize | >= $3 |
| PARAM_COMPARE | 3 | usize | <= $1 |
| HARD_MAX | 1 | ksize | 24 |
| HARD_MAX | 3 | usize | 24 |
| RX_PATH | |||
| USER_DATA | 3 | usize | 4-24[c] |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
| HALF_LOCKED2 | &ioas->mutex |
drivers/iommu/iommufd/selftest.c iommu_copy_struct_from_full_user_array() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 4096-ptr_max |
| PARAM_VALUE | 1 | ksize | 12 |
| PARAM_VALUE | 2 | src | 4096-ptr_max |
| PARAM_VALUE | 3 | usize | 0-11,13-u32max |
| DATA_SOURCE | 1 | ksize | $1 |
| PARAM_COMPARE | 1 | ksize | >= $3 |
| PARAM_COMPARE | 1 | ksize | >= $3 |
| PARAM_COMPARE | 3 | usize | <= $1 |
| USER_DATA | 3 | usize | 0-11,13-u32max[u] |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
drivers/iommu/amd/nested.c __iommu_copy_struct_from_user() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 4096-ptr_max |
| PARAM_VALUE | 1 | ksize | 32 |
| PARAM_VALUE | 3 | usize | 32 |
| BUF_SIZE | 0 | dst | 32 |
| BUF_SIZE | 0 | dst | 32 |
| DATA_SOURCE | 0 | dst | $0 |
| DATA_SOURCE | 1 | ksize | $3 |
| PARAM_COMPARE | 1 | ksize | == $3 |
| PARAM_COMPARE | 1 | ksize | == $3 |
| PARAM_COMPARE | 3 | usize | == $1 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
kernel/liveupdate/luo_session.c luo_session_ioctl() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 6055933402883768320 |
| PARAM_VALUE | 3 | usize | 8-u32max |
| BUF_SIZE | 0 | dst | 72 |
| BUF_SIZE | 0 | dst | 72 |
| DATA_SOURCE | 2 | src | $2 |
| USER_DATA | 3 | usize | 8-u32max |
io_uring/openclose.c io_openat2_prep() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 4096-ptr_max |
| PARAM_VALUE | 1 | ksize | 24 |
| PARAM_VALUE | 3 | usize | 24-u32max |
| BUF_SIZE | 0 | dst | 24 |
| UNITS | 1 | ksize | unit_byte |
| LOCK2 | &ctx->uring_lock | ||
| HALF_LOCKED2 | &sqd->lock | ||
| TYPE_LOCK | (struct io_ring_ctx)->uring_lock |
kernel/liveupdate/luo_core.c luo_ioctl() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 3622384865138298880 |
| PARAM_VALUE | 3 | usize | 8-u32max |
| BUF_SIZE | 0 | dst | 72 |
| BUF_SIZE | 0 | dst | 72 |
| DATA_SOURCE | 2 | src | $2 |
| USER_DATA | 3 | usize | 8-u32max |
fs/file_attr.c __do_sys_file_setattr() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 7003299514857758720 |
| PARAM_VALUE | 1 | ksize | 24 |
| PARAM_VALUE | 3 | usize | 24-4096 |
| BUF_SIZE | 0 | dst | 24 |
| DATA_SOURCE | 2 | src | $2 |
| DATA_SOURCE | 3 | usize | $3 |
| FUZZY_MAX | 3 | usize | 24 |
| HARD_MAX | 3 | usize | 4096 |
| USER_DATA | 3 | usize | 24-4096 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
fs/file_attr.c __do_sys_file_setattr() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 7003299514857758720 |
| PARAM_VALUE | 1 | ksize | 24 |
| PARAM_VALUE | 3 | usize | 24-4096 |
| BUF_SIZE | 0 | dst | 24 |
| DATA_SOURCE | 2 | src | $2 |
| DATA_SOURCE | 3 | usize | $3 |
| FUZZY_MAX | 3 | usize | 24 |
| HARD_MAX | 3 | usize | 4096 |
| USER_DATA | 3 | usize | 24-4096 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
drivers/platform/surface/surface_aggregator_cdev.c ssam_cdev_event_disable() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 9109667235566088192 |
| PARAM_VALUE | 1 | ksize | 7 |
| PARAM_VALUE | 3 | usize | 7 |
| BUF_SIZE | 0 | dst | 7 |
| DATA_SOURCE | 2 | src | $1 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
| LOCK2 | &client->cdev->lock | ||
| TYPE_LOCK | (struct ssam_cdev)->lock |
drivers/platform/surface/surface_aggregator_cdev.c ssam_cdev_event_enable() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 4320896369451761664 |
| PARAM_VALUE | 1 | ksize | 7 |
| PARAM_VALUE | 3 | usize | 7 |
| BUF_SIZE | 0 | dst | 7 |
| DATA_SOURCE | 2 | src | $1 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
| LOCK2 | &client->cdev->lock | ||
| TYPE_LOCK | (struct ssam_cdev)->lock |
drivers/platform/surface/surface_aggregator_cdev.c ssam_cdev_notif_register() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 4255671599226576896 |
| PARAM_VALUE | 1 | ksize | 5 |
| PARAM_VALUE | 3 | usize | 5 |
| BUF_SIZE | 0 | dst | 5 |
| DATA_SOURCE | 2 | src | $1 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
| LOCK2 | &client->cdev->lock | ||
| TYPE_LOCK | (struct ssam_cdev)->lock |
drivers/platform/surface/surface_aggregator_cdev.c ssam_cdev_notif_unregister() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 7055368577548992512 |
| PARAM_VALUE | 1 | ksize | 5 |
| PARAM_VALUE | 3 | usize | 5 |
| BUF_SIZE | 0 | dst | 5 |
| DATA_SOURCE | 2 | src | $1 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
| LOCK2 | &client->cdev->lock | ||
| TYPE_LOCK | (struct ssam_cdev)->lock |
drivers/platform/surface/surface_aggregator_cdev.c ssam_cdev_request() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 7236455239842918400 |
| PARAM_VALUE | 1 | ksize | 40 |
| PARAM_VALUE | 3 | usize | 40 |
| BUF_SIZE | 0 | dst | 40 |
| DATA_SOURCE | 2 | src | $1 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
| LOCK2 | &client->cdev->lock | ||
| TYPE_LOCK | (struct ssam_cdev)->lock |
fs/proc/task_mmu.c do_procmap_query() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 2297223280348213248 |
| PARAM_VALUE | 1 | ksize | 104 |
| PARAM_VALUE | 3 | usize | 24-4096 |
| BUF_SIZE | 0 | dst | 104 |
| DATA_SOURCE | 2 | src | $1 |
| FUZZY_MAX | 3 | usize | 24 |
| HARD_MAX | 3 | usize | 4096 |
| USER_DATA | 3 | usize | 24-4096 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
drivers/vfio/device_cdev.c vfio_df_ioctl_bind_iommufd() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 6685077689615126528 |
| PARAM_VALUE | 1 | ksize | 24 |
| PARAM_VALUE | 3 | usize | 16-u32max |
| BUF_SIZE | 0 | dst | 24 |
| DATA_SOURCE | 2 | src | $1 |
| USER_DATA | 3 | usize | 16-u32max |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
lib/tests/usercopy_kunit.c usercopy_test_copy_struct_from_user() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 1 | ksize | 0,8192 |
| PARAM_VALUE | 2 | src | 0-18446744073709551614 |
| PARAM_VALUE | 3 | usize | 0,8192 |
| BUF_SIZE | 0 | dst | 8192 |
| CAPPED_DATA | 1 | ksize | 1 |
| CAPPED_DATA | 1 | ksize | 1 |
| CAPPED_DATA | 3 | usize | 1 |
| CAPPED_DATA | 3 | usize | 1 |
| PARAM_COMPARE | 1 | ksize | == $3 |
| PARAM_COMPARE | 1 | ksize | == $3 |
| PARAM_COMPARE | 3 | usize | == $1 |
lib/tests/usercopy_kunit.c usercopy_test_copy_struct_from_user() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 1 | ksize | 0,8192 |
| PARAM_VALUE | 2 | src | 0-18446744073709551614 |
| PARAM_VALUE | 3 | usize | 0,4096 |
| BUF_SIZE | 0 | dst | 8192 |
| CAPPED_DATA | 1 | ksize | 1 |
| CAPPED_DATA | 1 | ksize | 1 |
| CAPPED_DATA | 3 | usize | 1 |
| CAPPED_DATA | 3 | usize | 1 |
lib/tests/usercopy_kunit.c usercopy_test_copy_struct_from_user() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 1 | ksize | 0,4096 |
| PARAM_VALUE | 2 | src | 0-18446744073709551614 |
| PARAM_VALUE | 3 | usize | 0,8192 |
| BUF_SIZE | 0 | dst | 8192 |
| CAPPED_DATA | 1 | ksize | 1 |
| CAPPED_DATA | 1 | ksize | 1 |
| CAPPED_DATA | 3 | usize | 1 |
| CAPPED_DATA | 3 | usize | 1 |
| PARAM_COMPARE | 1 | ksize | < $3 |
| PARAM_COMPARE | 1 | ksize | < $3 |
| PARAM_COMPARE | 3 | usize | > $1 |
lib/tests/usercopy_kunit.c usercopy_test_copy_struct_from_user() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 1 | ksize | 0,4096 |
| PARAM_VALUE | 2 | src | 0-18446744073709551614 |
| PARAM_VALUE | 3 | usize | 0,8192 |
| BUF_SIZE | 0 | dst | 8192 |
| CAPPED_DATA | 1 | ksize | 1 |
| CAPPED_DATA | 1 | ksize | 1 |
| CAPPED_DATA | 3 | usize | 1 |
| CAPPED_DATA | 3 | usize | 1 |
| PARAM_COMPARE | 1 | ksize | < $3 |
| PARAM_COMPARE | 1 | ksize | < $3 |
| PARAM_COMPARE | 3 | usize | > $1 |
net/bluetooth/sco.c copy_struct_from_sockptr() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 5162893955060338688 |
| PARAM_VALUE | 1 | ksize | 255 |
| PARAM_VALUE | 3 | usize | 1-255 |
| BUF_SIZE | 0 | dst | 255 |
| BUF_SIZE | 0 | dst | 255 |
| DATA_SOURCE | 0 | dst | $0 |
| DATA_SOURCE | 1 | ksize | $1 |
| DATA_SOURCE | 3 | usize | $3 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 3 | usize | 1-255 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
| LOCK2 | sk |
security/landlock/syscalls.c copy_min_struct_from_user() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 208800929369686016 |
| PARAM_VALUE | 1 | ksize | 48 |
| PARAM_VALUE | 2 | src | 1-u64max |
| PARAM_VALUE | 3 | usize | 8-4096 |
| BUF_SIZE | 0 | dst | 48 |
| BUF_SIZE | 0 | dst | 48 |
| DATA_SOURCE | 0 | dst | $0 |
| DATA_SOURCE | 1 | ksize | $1 |
| DATA_SOURCE | 2 | src | $3 |
| DATA_SOURCE | 3 | usize | $4 |
| FUZZY_MAX | 3 | usize | 4096 |
| HARD_MAX | 3 | usize | 4096 |
| USER_DATA | 3 | usize | 8-4096 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
drivers/gpu/drm/panthor/panthor_drv.c panthor_get_uobj_array() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 1-u64max |
| PARAM_VALUE | 1 | ksize | 8,16,24,40,48 |
| BUF_SIZE | 0 | dst | 8,16,24,40,48,u64max |
| BUF_SIZE | 0 | dst | 8,16,24,40,48,u64max |
| CAPPED_DATA | 1 | ksize | 1 |
| DATA_SOURCE | 1 | ksize | $2 |
| PARAM_COMPARE | 1 | ksize | != $3 |
| PARAM_COMPARE | 3 | usize | != $1 |
| HARD_MAX | 1 | ksize | 48 |
| USER_DATA | 0 | *dst | s64min-s64max |
| USER_DATA | 2 | src | 4096-ptr_max[c][u] |
| USER_DATA | 3 | usize | 0-u32max |
| NO_OVERFLOW_SIMPLE | 1 | ksize | |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
| HALF_LOCKED2 | global &drm_unplug_srcu |
drivers/gpu/drm/panthor/panthor_drv.c panthor_ioctl_dev_query() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 4133422501857652736 |
| PARAM_VALUE | 1 | ksize | 56 |
| PARAM_VALUE | 2 | src | 1-u64max |
| BUF_SIZE | 0 | dst | 56 |
| USER_DATA | 3 | usize | 0-u32max[u] |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
kernel/nstree.c copy_ns_id_req() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 3154010544823013376 |
| PARAM_VALUE | 1 | ksize | 32 |
| PARAM_VALUE | 3 | usize | 32-4096 |
| DATA_SOURCE | 0 | dst | $1 |
| DATA_SOURCE | 2 | src | $0 |
| BIT_INFO | 3 | usize | 0x0,0xffffffff |
| USER_DATA | 3 | usize | 32-4096 |
| UNITS | 1 | ksize | unit_byte |
drivers/iommu/iommufd/main.c iommufd_fops_ioctl() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 8421750914493251584 |
| PARAM_VALUE | 3 | usize | 8-u32max |
| BUF_SIZE | 0 | dst | 72 |
| BUF_SIZE | 0 | dst | 72 |
| DATA_SOURCE | 2 | src | $2 |
| USER_DATA | 3 | usize | 8-u32max |
kernel/sched/build_policy.c sched_copy_attr() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 971500483485368320 |
| PARAM_VALUE | 1 | ksize | 56 |
| PARAM_VALUE | 2 | src | 1-u64max |
| PARAM_VALUE | 3 | usize | 48-4096 |
| DATA_SOURCE | 0 | dst | $1 |
| DATA_SOURCE | 2 | src | $0 |
| FUZZY_MAX | 3 | usize | 48 |
| USER_DATA | 3 | usize | 48-4096 |
| UNITS | 1 | ksize | unit_byte |
drivers/fwctl/main.c fwctl_fops_ioctl() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 5618618625254842368 |
| PARAM_VALUE | 3 | usize | 24-u32max |
| BUF_SIZE | 0 | dst | 32 |
| BUF_SIZE | 0 | dst | 32 |
| DATA_SOURCE | 2 | src | $2 |
| USER_DATA | 3 | usize | 24-u32max |
fs/namespace.c copy_mnt_id_req() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 3564055940026851328,5220502030810562560 |
| PARAM_VALUE | 1 | ksize | 32 |
| PARAM_VALUE | 3 | usize | 24-4096 |
| DATA_SOURCE | 0 | dst | $1 |
| DATA_SOURCE | 2 | src | $0 |
| BIT_INFO | 3 | usize | 0x0,0xffffffff |
| USER_DATA | 3 | usize | 24-4096 |
| UNITS | 1 | ksize | unit_byte |
fs/namespace.c wants_mount_setattr() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 2024676514551037952 |
| PARAM_VALUE | 1 | ksize | 32 |
| PARAM_VALUE | 3 | usize | 32-4096 |
| BUF_SIZE | 0 | dst | 32 |
| DATA_SOURCE | 2 | src | $0 |
| DATA_SOURCE | 3 | usize | $1 |
| FUZZY_MAX | 3 | usize | 32 |
| USER_DATA | 3 | usize | 32-4096 |
| UNITS | 1 | ksize | unit_byte |
drivers/infiniband/core/uverbs_cmd.c uverbs_request() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 4096-ptr_max |
| PARAM_VALUE | 1 | ksize | 4,8,16,24,32,40,48,56,64,112,120 |
| PARAM_VALUE | 3 | usize | 0-524280,18446744073709551608-u64max |
| BUF_SIZE | 0 | dst | 4,8,16,24,32,40,48,56,64,112,120 |
| BUF_SIZE | 0 | dst | 4,8,16,24,32,40,48,56,64,112,120 |
| BUF_SIZE | 2 | src | 8 |
| DATA_SOURCE | 0 | dst | $1 |
| DATA_SOURCE | 1 | ksize | $2 |
| HARD_MAX | 1 | ksize | 120 |
| USER_DATA | 3 | usize | 0-524280,18446744073709551608-u64max |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 2 | src | unit_byte |
| UNITS | 3 | usize | unit_byte |
| HALF_LOCKED2 | &file->device->disassociate_srcu |
kernel/trace/rv/monitors/nomiss/nomiss.c extract_params() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 7867495645288247296 |
| PARAM_VALUE | 1 | ksize | 16 |
| PARAM_VALUE | 3 | usize | 16 |
| BUF_SIZE | 0 | dst | 56 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
kernel/events/core.c perf_copy_attr() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 8430341497750159360 |
| PARAM_VALUE | 1 | ksize | 144 |
| PARAM_VALUE | 3 | usize | 64-4096 |
| DATA_SOURCE | 0 | dst | $1 |
| DATA_SOURCE | 2 | src | $0 |
| FUZZY_MAX | 3 | usize | 64 |
| USER_DATA | 3 | usize | 64-4096 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
drivers/platform/x86/amd/hsmp/hsmp.c hsmp_ioctl_msg() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 7540206931311525888 |
| PARAM_VALUE | 1 | ksize | 44 |
| PARAM_VALUE | 3 | usize | 44 |
| BUF_SIZE | 0 | dst | 44 |
| DATA_SOURCE | 2 | src | $1 |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
net/ipv4/tcp_ao.c copy_struct_from_sockptr() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 1074578579916222464,5656103863403188224,6416500981342851072,7335738032602746880,7365238214517592064,7693648453914558464 |
| PARAM_VALUE | 1 | ksize | 16,48,144,288,304 |
| PARAM_VALUE | 3 | usize | 1-u32max,18446744071562067968-u64max |
| BUF_SIZE | 0 | dst | 16,48,144,288,304 |
| BUF_SIZE | 0 | dst | 16,48,144,288,304 |
| DATA_SOURCE | 0 | dst | $0 |
| DATA_SOURCE | 1 | ksize | $1 |
| DATA_SOURCE | 3 | usize | $3 |
| FUZZY_MAX | 3 | usize | 16 |
| HARD_MAX | 1 | ksize | 304 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 3 | usize | 1-s32max |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |
| HALF_LOCKED2 | sk |
fs/open.c __do_sys_openat2() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 7577751251957542912 |
| PARAM_VALUE | 1 | ksize | 24 |
| PARAM_VALUE | 3 | usize | 24-4096 |
| BUF_SIZE | 0 | dst | 24 |
| DATA_SOURCE | 2 | src | $2 |
| DATA_SOURCE | 3 | usize | $3 |
| FUZZY_MAX | 3 | usize | 4096 |
| USER_DATA | 3 | usize | 24-4096 |
| UNITS | 1 | ksize | unit_byte |
fs/open.c __do_sys_openat2() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 7577751251957542912 |
| PARAM_VALUE | 1 | ksize | 24 |
| PARAM_VALUE | 3 | usize | 24-4096 |
| BUF_SIZE | 0 | dst | 24 |
| DATA_SOURCE | 2 | src | $2 |
| DATA_SOURCE | 3 | usize | $3 |
| FUZZY_MAX | 3 | usize | 4096 |
| USER_DATA | 3 | usize | 24-4096 |
| UNITS | 1 | ksize | unit_byte |
kernel/seccomp.c seccomp_notify_addfd() -> copy_struct_from_user()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | dst | 5569707275681603584 |
| PARAM_VALUE | 1 | ksize | 24 |
| PARAM_VALUE | 3 | usize | 24-4095 |
| BUF_SIZE | 0 | dst | 24 |
| DATA_SOURCE | 2 | src | $1 |
| DATA_SOURCE | 3 | usize | $2 |
| HARD_MAX | 3 | usize | 4095 |
| USER_DATA | 3 | usize | 24-4095[c] |
| UNITS | 1 | ksize | unit_byte |
| UNITS | 3 | usize | unit_byte |