Defined in 1 files as a function:

Referenced in 2 files:

Smatch caller information:

lib/iov_iter.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 4096-ptr_max
PARAM_VALUE 2 len 1-u64max
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
PARAM_COMPARE 0 to == $2
NOSPEC 2 len
NOSPEC 2 len
RX_PATH
TASK_NOT_RUNNING
HOST_DATA 0 to 4096-ptr_max[c]
HOST_DATA 2 len 1-s32max[c]
USER_DATA 0 to 4096-ptr_max[c][u]
USER_DATA 2 len 1-u64max[c]
UNITS 0 to unit_byte
UNITS 1 from unit_byte
UNITS 2 len unit_byte
BYTE_COUNT 0 ==to2 8050

lib/iov_iter.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 4096-ptr_max
PARAM_VALUE 1 from 4096-ptr_max
PARAM_VALUE 2 len 1-u64max
CAPPED_DATA 0 to 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
PARAM_COMPARE 1 from == $2
NOSPEC 2 len
NOSPEC 2 len
RX_PATH
TASK_NOT_RUNNING
HOST_DATA 1 from 4096-ptr_max[c]
HOST_DATA 2 len 1-s32max[c]
USER_DATA 1 from 4096-ptr_max[c][u]
USER_DATA 2 len 1-u64max[c]
UNITS 0 to unit_byte
UNITS 1 from unit_byte
UNITS 2 len unit_byte
BYTE_COUNT 1 ==from2 8050

arch/x86/lib/copy_mc.c copy_mc_to_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 4096-ptr_max
PARAM_VALUE 1 from 4096-ptr_max
CAPPED_DATA 0 to 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
PARAM_COMPARE 1 from == $2
NOSPEC 2 len
NOSPEC 2 len
RX_PATH
TASK_NOT_RUNNING
HOST_DATA 1 from 4096-ptr_max[c]
HOST_DATA 2 len 1-s32max[c]
USER_DATA 1 from 4096-ptr_max[c][u]
USER_DATA 2 len 0-u32max[c]
UNITS 0 to unit_byte
UNITS 1 from unit_byte
UNITS 2 len unit_byte
BYTE_COUNT 1 ==from2 8050

drivers/vhost/vhost.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 5686255541217935360
PARAM_VALUE 1 from 1-u64max
PARAM_VALUE 2 len 16
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
RX_PATH
TASK_NOT_RUNNING
UNITS 2 len unit_byte
HALF_LOCKED2 &vq->mutex
TYPE_LOCK (struct vhost_virtqueue)->mutex

drivers/vhost/vhost.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 1-u64max
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
RX_PATH
TASK_NOT_RUNNING
NO_OVERFLOW_SIMPLE 1 from
HALF_LOCKED2 &vq->mutex

drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 16,4096-ptr_max
PARAM_VALUE 2 len 0-2147483648
BUF_SIZE 0 to (-1),8,512
BUF_SIZE 0 to (-1),8,512
CAPPED_DATA 0 to 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
UNITS 2 len unit_byte

arch/x86/lib/usercopy.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
BUF_SIZE 0 to (-1),15,64
BUF_SIZE 0 to (-1),15,64
CAPPED_DATA 1 from 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
PREEMPT_ADD
RX_PATH
TASK_NOT_RUNNING
USER_DATA 0 to 4096-ptr_max[u]
USER_DATA 2 len 0-327675[c]
NO_OVERFLOW_SIMPLE 2 len
UNITS 2 len unit_byte
HALF_LOCKED2 rcu_read

kernel/trace/trace_syscalls.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 2 len 0-169
BUF_SIZE 0 to (-1),510,4096
BUF_SIZE 0 to (-1),510,4096
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
FUZZY_MAX 2 len 169
USER_DATA 2 len 0-169[c]
NO_OVERFLOW_SIMPLE 0 to

mm/maccess.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
BUF_SIZE 0 to (-1),8,256
BUF_SIZE 0 to (-1),8,256
CAPPED_DATA 1 from 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
TASK_NOT_RUNNING
NO_OVERFLOW_SIMPLE 0 to
UNITS 0 to unit_byte
UNITS 1 from unit_byte
UNITS 2 len unit_byte
USER_PTR 0 to

mm/maccess.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
BUF_SIZE 1 from (-1),32
BUF_SIZE 1 from (-1),32
CAPPED_DATA 0 to 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
PARAM_COMPARE 1 from == $2
PREEMPT_ADD
RX_PATH
TASK_NOT_RUNNING
HOST_DATA 1 from 4096-ptr_max[c]
HOST_DATA 2 len 1-s32max[c]
USER_DATA 1 from 4096-ptr_max[c][u]
USER_DATA 2 len 1-u64max[c]
NO_OVERFLOW_SIMPLE 2 len
UNITS 0 to unit_byte
UNITS 1 from unit_byte
UNITS 2 len unit_byte
BYTE_COUNT 1 ==from2 8050
HALF_LOCKED2 &vcpu->kvm->srcu

arch/x86/lib/insn-eval.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 2 len 15
BUF_SIZE 0 to 15
BUF_SIZE 0 to 15
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
PREEMPT_ADD
NO_OVERFLOW_SIMPLE 0 to

arch/x86/kvm/vmx/sgx.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 18379471554275704832,18446612682070032384
PARAM_VALUE 2 len 4096
CAPPED_DATA 0 to 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
UNITS 2 len unit_byte

mm/kasan/kasan_test_c.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 16,4096-ptr_max
PARAM_VALUE 1 from 1-18446744073709551614
PARAM_VALUE 2 len 1-s32max
BUF_SIZE 0 to 120
BUF_SIZE 0 to 120
CAPPED_DATA 0 to 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
USER_PTR 0 to

mm/kasan/kasan_test_c.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 1-18446744073709551614
PARAM_VALUE 1 from 16,4096-ptr_max
PARAM_VALUE 2 len 1-s32max
BUF_SIZE 1 from 120
BUF_SIZE 1 from 120
CAPPED_DATA 1 from 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
USER_PTR 1 from

drivers/gpu/drm/i915/i915_query.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 1 from 5148302030943776768,5403522287358320640
PARAM_VALUE 2 len 16,88
BUF_SIZE 1 from 16,88
BUF_SIZE 1 from 16,88
CAPPED_DATA 1 from 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
HARD_MAX 2 len 88
UNITS 0 to unit_byte
UNITS 2 len unit_byte

mm/memory.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 18379471554275704832,18446612682070032384
PARAM_VALUE 1 from 0,4096-u64max
PARAM_VALUE 2 len 4096
CAPPED_DATA 0 to 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
RX_PATH
TASK_NOT_RUNNING
UNITS 2 len unit_byte
HALF_LOCKED2 &mm->mmap_lock
HALF_LOCKED2 vmf->ptl

kernel/trace/trace.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 2 len 0-4096
BUF_SIZE 0 to 510,4096
BUF_SIZE 0 to 510,4096
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
FUZZY_MAX 2 len 4096
USER_DATA 2 len 0-4096[c]
NO_OVERFLOW_SIMPLE 0 to
UNITS 2 len unit_byte

fs/select.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 1-u64max
PARAM_VALUE 1 from 4096-ptr_max
PARAM_VALUE 2 len 0-268435456
CAPPED_DATA 1 from 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
USER_DATA 2 len 0-268435456[c]

arch/x86/kernel/fpu/regset.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 1865865750782967808,2996045642319462400,4812849990974570496
PARAM_VALUE 2 len 8,108,512
CAPPED_DATA 0 to 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2

drivers/gpu/drm/i915/i915_gem.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 4096-ptr_max
PARAM_VALUE 0 *to 0-255
PARAM_VALUE 2 len 1-4096
CAPPED_DATA 0 to 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
USER_DATA 2 len 2-4096[c]
NO_OVERFLOW_SIMPLE 2 len

drivers/gpu/drm/i915/i915_gem.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 1 from 4096-ptr_max
PARAM_VALUE 2 len 1-4096
CAPPED_DATA 1 from 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
NOSPEC 2 len
PREEMPT_ADD
USER_DATA 2 len 2-4096[c]
NO_OVERFLOW_SIMPLE 2 len
UNITS 1 from unit_byte
UNITS 2 len unit_byte

lib/usercopy.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2

lib/usercopy.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
CAPPED_DATA 0 to 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2

drivers/vhost/scsi.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 1 from 4096-ptr_max
PARAM_VALUE 2 len 16
BUF_SIZE 1 from 16
BUF_SIZE 1 from 16
CAPPED_DATA 1 from 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
RX_PATH
TASK_NOT_RUNNING
UNITS 0 to unit_byte
UNITS 2 len unit_byte
LOCK2 &vq->mutex
TYPE_LOCK (struct vhost_virtqueue)->mutex

arch/x86/kvm/../../../virt/kvm/kvm_main.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 1 from 0-ptr_max
PARAM_VALUE 2 len 1-4096
BUF_SIZE 0 to (-1),1-65536
BUF_SIZE 0 to (-1),1-65536
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
RX_PATH
TASK_NOT_RUNNING
USER_DATA 0 to 4096-ptr_max[c][u]
USER_DATA 0 *to s64min-s64max
USER_DATA 2 len 1-4096[c]
NO_OVERFLOW_SIMPLE 2 len
UNITS 1 from unit_byte
UNITS 2 len unit_byte
USER_PTR 0 to

arch/x86/kvm/../../../virt/kvm/kvm_main.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 0-ptr_max
PARAM_VALUE 2 len 0-s32max,18446744071562067968-u64max
BUF_SIZE 1 from s32min,(-1),1-65536
BUF_SIZE 1 from s32min,(-1),1-65536
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
USER_DATA 1 from 4096-ptr_max[c][u]
USER_DATA 1 *from s64min-s64max
USER_DATA 2 len 2-4095[c]
NO_OVERFLOW_SIMPLE 2 len
UNITS 0 to unit_byte
UNITS 2 len unit_byte
USER_PTR 1 from
HALF_LOCKED2 &kvm->srcu

arch/x86/kvm/vmx/vmx.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 4096-ptr_max
PARAM_VALUE 1 from 4685813931918262272,6639183754634768384,18379471554275704832,18446612682070032384
PARAM_VALUE 2 len 1-2,4,4096
BUF_SIZE 1 from (-1),2,4
BUF_SIZE 1 from (-1),2,4
CAPPED_DATA 1 from 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
HARD_MAX 2 len 4096
UNITS 2 len unit_byte
HALF_LOCKED2 &kvm->slots_lock

arch/x86/kernel/fpu/signal.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 1 from 1-u64max
PARAM_VALUE 2 len 48,108,512
BUF_SIZE 0 to (-1),108,512
BUF_SIZE 0 to (-1),108,512
BUF_SIZE 1 from (-1),48
BUF_SIZE 1 from (-1),48
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
HARD_MAX 2 len 512
UNITS 1 from unit_byte
UNITS 2 len unit_byte

arch/x86/kernel/fpu/signal.c raw_copy_to_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 0,64-u64max
PARAM_VALUE 1 from 7801372520113164288,8523954333531799552
PARAM_VALUE 2 len 48,108
BUF_SIZE 0 to (-1),48
BUF_SIZE 0 to (-1),48
BUF_SIZE 1 from 48,108
BUF_SIZE 1 from 48,108
CAPPED_DATA 1 from 1
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2
HARD_MAX 2 len 108
RX_PATH
TASK_NOT_RUNNING
UNITS 2 len unit_byte

arch/x86/kernel/tls.c raw_copy_from_user() -> copy_user_generic()

Type Parameter Key Value
PARAM_VALUE 0 to 2787234788068900864
BUF_SIZE 0 to 48
BUF_SIZE 0 to 48
CAPPED_DATA 2 len 1
CAPPED_DATA 2 len 1
DATA_SOURCE 0 to $0
DATA_SOURCE 1 from $1
DATA_SOURCE 2 len $2