Defined in 1 files as a prototype:
Defined in 1 files as a function:
Referenced in 7 files:
- net/ipv6/datagram.c, line 1094
- net/ipv6/ip6_flowlabel.c, line 409
- net/ipv6/ipv6_sockglue.c, line 844
- net/ipv6/ping.c, line 130
- net/ipv6/raw.c, line 843
- net/ipv6/udp.c, line 1615
- net/l2tp/l2tp_ip6.c, line 598
Smatch caller information:
net/ipv6/udp.c udpv6_sendmsg() -> ip6_datagram_send_ctl()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 1 | sk | 4096-ptr_max |
| PARAM_VALUE | 2 | msg | 4096-ptr_max |
| PARAM_VALUE | 2 | msg->msg_controllen | 16-u64max |
| PARAM_VALUE | 2 | msg->msg_name | 0,4096-ptr_max |
| PARAM_VALUE | 2 | *msg->msg_name | s32min-s32max |
| PARAM_VALUE | 3 | fl6 | 4096-ptr_max |
| PARAM_VALUE | 4 | ipc6 | 4941898643751067648 |
| PARAM_VALUE | 4 | ipc6->opt | 3231808632903888896 |
| BUF_SIZE | 2 | msg->msg_control | (-1)-0,16,24,36-s32max |
| BUF_SIZE | 2 | msg->msg_name | (-1)-0,12,28,128 |
| BUF_SIZE | 2 | msg->msg_ubuf | (-1),16 |
| BUF_SIZE | 3 | fl6 | 88 |
| CAPPED_DATA | 1 | sk | 1 |
| CAPPED_DATA | 1 | sk->__sk_common.skc_net.net | 1 |
| DATA_SOURCE | 1 | sk | $0 |
| DATA_SOURCE | 2 | msg | $1 |
| BIT_INFO | 3 | fl6->__fl_common.flowic_uid | 0x0,0x7fffffff |
| NOSPEC | 2 | msg->msg_iter.count | |
| NOSPEC | 3 | fl6->flowlabel | |
| MEM_ZERO | 3 | fl6 | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 2 | msg->msg_controllen | 16-s32max[c] |
| USER_DATA | 2 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 2 | msg->msg_iter.count | 1-18446744073709551614 |
| USER_DATA | 2 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 2 | msg->msg_namelen | 0-128 |
| USER_DATA | 2 | *msg->msg_name | s64min-s64max |
| USER_DATA | 3 | fl6->__fl_common.flowic_oif | s32min-(-1),1-s32max[u] |
| USER_DATA | 3 | fl6->flowlabel | 0-268435455[c] |
| USER_DATA | 3 | fl6->uli.ports.dport | 1-u16max[u] |
| USER_DATA | 4 | ipc6->gso_size | 0-u16max |
| NO_OVERFLOW_SIMPLE | 1 | sk->sk_backlog.len | |
| UNITS | 1 | sk | unit_byte |
| USER_PTR | 2 | msg->msg_control | |
| USER_PTR | 2 | msg->msg_name |
net/ipv6/ping.c ping_v6_sendmsg() -> ip6_datagram_send_ctl()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 1 | sk | 4096-ptr_max |
| PARAM_VALUE | 1 | sk->__sk_common.skc_prot | 4096-ptr_max |
| PARAM_VALUE | 1 | sk->__sk_common.skc_state | 1 |
| PARAM_VALUE | 2 | msg | 4096-ptr_max |
| PARAM_VALUE | 2 | msg->msg_controllen | 1-u64max |
| PARAM_VALUE | 2 | msg->msg_iter.__iov | 4096-u64max |
| PARAM_VALUE | 2 | msg->msg_iter.bvec | 4096-u64max |
| PARAM_VALUE | 2 | msg->msg_iter.folioq | 1-u64max |
| PARAM_VALUE | 2 | msg->msg_iter.kvec | 4096-u64max |
| PARAM_VALUE | 2 | msg->msg_name | 0,4096-ptr_max |
| PARAM_VALUE | 3 | fl6 | 547411931194654720 |
| PARAM_VALUE | 4 | ipc6 | 2189001213010419712 |
| PARAM_VALUE | 4 | ipc6->opt | 485551381784649728 |
| BUF_SIZE | 2 | msg->msg_control | (-1)-0,16,24,36-s32max |
| BUF_SIZE | 2 | msg->msg_name | (-1)-0,12,28,128 |
| BUF_SIZE | 2 | msg->msg_ubuf | (-1),16 |
| CAPPED_DATA | 1 | sk | 1 |
| CAPPED_DATA | 1 | sk->__sk_common.skc_net.net | 1 |
| DATA_SOURCE | 1 | sk | $0 |
| DATA_SOURCE | 2 | msg | $1 |
| NOSPEC | 2 | msg->msg_iter.count | |
| MEM_ZERO | 3 | fl6 | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 2 | msg->msg_controllen | 1-s32max[c] |
| USER_DATA | 2 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 2 | msg->msg_iter.count | 1-18446744073709551614 |
| USER_DATA | 2 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 2 | msg->msg_namelen | 0-128 |
| USER_DATA | 2 | *msg->msg_name | s64min-s64max |
| USER_DATA | 3 | fl6->__fl_common.flowic_oif | s32min-(-1),1-s32max[u] |
| USER_DATA | 3 | fl6->flowlabel | 0-268435455[c] |
| NO_OVERFLOW_SIMPLE | 1 | sk->sk_backlog.len | |
| UNITS | 1 | sk | unit_byte |
| USER_PTR | 2 | msg->msg_control | |
| USER_PTR | 2 | msg->msg_name | |
| HALF_LOCKED2 | &vq->mutex |
net/l2tp/l2tp_ip6.c l2tp_ip6_sendmsg() -> ip6_datagram_send_ctl()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 1 | sk | 4096-ptr_max |
| PARAM_VALUE | 1 | sk->__sk_common.skc_prot | 4096-ptr_max |
| PARAM_VALUE | 2 | msg | 4096-ptr_max |
| PARAM_VALUE | 2 | msg->msg_controllen | 1-u64max |
| PARAM_VALUE | 2 | msg->msg_name | 0,4096-ptr_max |
| PARAM_VALUE | 3 | fl6 | 8491236259787087872 |
| PARAM_VALUE | 4 | ipc6 | 9175465522676625408 |
| PARAM_VALUE | 4 | ipc6->opt | 8507732767125807104 |
| BUF_SIZE | 2 | msg->msg_control | (-1)-0,16,24,36-s32max |
| BUF_SIZE | 2 | msg->msg_name | (-1)-0,12,28,128 |
| BUF_SIZE | 2 | msg->msg_ubuf | (-1),16 |
| CAPPED_DATA | 1 | sk | 1 |
| CAPPED_DATA | 1 | sk->__sk_common.skc_net.net | 1 |
| DATA_SOURCE | 1 | sk | $0 |
| DATA_SOURCE | 2 | msg | $1 |
| BIT_INFO | 2 | msg->msg_flags | 0x0,0xfffffffe |
| NOSPEC | 2 | msg->msg_iter.count | |
| MEM_ZERO | 3 | fl6 | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 2 | msg->msg_controllen | 1-s32max[c] |
| USER_DATA | 2 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 2 | msg->msg_iter.count | 1-18446744073709551614 |
| USER_DATA | 2 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 2 | msg->msg_namelen | 0-128 |
| USER_DATA | 2 | *msg->msg_name | s64min-s64max |
| USER_DATA | 3 | fl6->__fl_common.flowic_oif | s32min-(-1),1-s32max[u] |
| USER_DATA | 3 | fl6->flowlabel | 0-268435455[c] |
| NO_OVERFLOW_SIMPLE | 1 | sk->sk_backlog.len | |
| UNITS | 1 | sk | unit_byte |
| USER_PTR | 2 | msg->msg_control | |
| USER_PTR | 2 | msg->msg_name | |
| HALF_LOCKED2 | &vq->mutex |
net/ipv6/ipv6_sockglue.c do_ipv6_setsockopt() -> ip6_datagram_send_ctl()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 1 | sk | 4096-ptr_max |
| PARAM_VALUE | 1 | sk->__sk_common.skc_family | 10 |
| PARAM_VALUE | 2 | msg | 957518161132777472 |
| PARAM_VALUE | 2 | msg->msg_controllen | 1-65536 |
| PARAM_VALUE | 3 | fl6 | 5274244628913147904 |
| PARAM_VALUE | 4 | ipc6 | 6612724922240475136 |
| PARAM_VALUE | 4 | ipc6->opt | 4096-ptr_max |
| CAPPED_DATA | 1 | sk->__sk_common.skc_net.net | 1 |
| DATA_SOURCE | 1 | sk | $0 |
| MEM_ZERO | 3 | fl6 | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 2 | msg->msg_controllen | 1-65536 |
| NO_OVERFLOW_SIMPLE | 1 | sk->sk_backlog.len | |
| UNITS | 0 | net | unit_byte |
| UNITS | 1 | sk | unit_byte |
| HALF_LOCKED2 | 1 | sk |
net/ipv6/ip6_flowlabel.c fl_create() -> ip6_datagram_send_ctl()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 1 | sk | 4096-ptr_max |
| PARAM_VALUE | 1 | sk->__sk_common.skc_family | 10 |
| PARAM_VALUE | 2 | msg | 1678086614541692928 |
| PARAM_VALUE | 2 | msg->msg_controllen | 1-65536 |
| PARAM_VALUE | 3 | fl6 | 5647966629157601280 |
| PARAM_VALUE | 4 | ipc6 | 913069565419700224 |
| PARAM_VALUE | 4 | ipc6->opt | 4096-ptr_max |
| CAPPED_DATA | 1 | sk->__sk_common.skc_net.net | 1 |
| DATA_SOURCE | 0 | net | $0 |
| DATA_SOURCE | 1 | sk | $1 |
| MEM_ZERO | 3 | fl6 | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 2 | msg->msg_controllen | 1-65536 |
| NO_OVERFLOW_SIMPLE | 1 | sk->sk_backlog.len | |
| UNITS | 0 | net | unit_byte |
| UNITS | 1 | sk | unit_byte |
| HALF_LOCKED2 | 1 | sk |
net/ipv6/raw.c rawv6_sendmsg() -> ip6_datagram_send_ctl()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 1 | sk | 4096-ptr_max |
| PARAM_VALUE | 1 | sk->__sk_common.skc_prot | 4096-ptr_max |
| PARAM_VALUE | 2 | msg | 4096-ptr_max |
| PARAM_VALUE | 2 | msg->msg_controllen | 1-u64max |
| PARAM_VALUE | 2 | msg->msg_name | 0,4096-ptr_max |
| PARAM_VALUE | 3 | fl6 | 147540059252310016 |
| PARAM_VALUE | 4 | ipc6 | 5497335225115070464 |
| PARAM_VALUE | 4 | ipc6->opt | 9108378292234457088 |
| BUF_SIZE | 2 | msg->msg_control | (-1)-0,16,24,36-s32max |
| BUF_SIZE | 2 | msg->msg_name | (-1)-0,12,28,128 |
| BUF_SIZE | 2 | msg->msg_ubuf | (-1),16 |
| CAPPED_DATA | 1 | sk | 1 |
| CAPPED_DATA | 1 | sk->__sk_common.skc_net.net | 1 |
| DATA_SOURCE | 1 | sk | $0 |
| DATA_SOURCE | 2 | msg | $1 |
| BIT_INFO | 2 | msg->msg_flags | 0x0,0xfffffffe |
| NOSPEC | 2 | msg->msg_iter.count | |
| MEM_ZERO | 3 | fl6 | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 2 | msg->msg_controllen | 1-s32max[c] |
| USER_DATA | 2 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 2 | msg->msg_iter.count | 1-18446744073709551614 |
| USER_DATA | 2 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 2 | msg->msg_namelen | 0-128 |
| USER_DATA | 2 | *msg->msg_name | s64min-s64max |
| USER_DATA | 3 | fl6->__fl_common.flowic_oif | s32min-(-1),1-s32max[u] |
| USER_DATA | 3 | fl6->flowlabel | 0-268435455[c] |
| NO_OVERFLOW_SIMPLE | 1 | sk->sk_backlog.len | |
| UNITS | 1 | sk | unit_byte |
| USER_PTR | 2 | msg->msg_control | |
| USER_PTR | 2 | msg->msg_name | |
| HALF_LOCKED2 | &vq->mutex |