Open Menu /

Defined in 1 files as a function:

Referenced in 1 files:

Smatch caller information:

net/bluetooth/l2cap_core.c l2cap_create_basic_pdu() -> l2cap_skbuff_fromiovec()

Type Parameter Key Value
PARAM_VALUE 0 chan 4096-ptr_max
PARAM_VALUE 0 chan->chan_type 0-1,3-255
PARAM_VALUE 0 chan->conn 4096-ptr_max
PARAM_VALUE 0 chan->mode 0
PARAM_VALUE 0 chan->ops 4096-ptr_max
PARAM_VALUE 1 msg 4096-ptr_max
PARAM_VALUE 2 len 0-u16max
PARAM_VALUE 3 count 0-u16max
PARAM_VALUE 4 skb 4096-ptr_max
PARAM_VALUE 4 skb->data 4096-ptr_max
PARAM_VALUE 4 skb->data_len 0
BUF_SIZE 0 chan->data (-1)-s32max
BUF_SIZE 1 msg->msg_control (-1)-0,16,24,36-s32max
BUF_SIZE 1 msg->msg_name (-1)-0,12,28,128
BUF_SIZE 1 msg->msg_ubuf (-1),16
BUF_SIZE 4 skb 0-s32max
BUF_SIZE 4 skb 0-s32max
CAPPED_DATA 2 len 1
CAPPED_DATA 3 count 1
DATA_SOURCE 0 chan $0
DATA_SOURCE 1 msg $1
DATA_SOURCE 2 len $2
PARAM_COMPARE 2 len >= $3
PARAM_COMPARE 3 count <= $2
NOSPEC 1 msg->msg_controllen
NOSPEC 1 msg->msg_iter.count
NOSPEC 3 count
RX_PATH
TASK_NOT_RUNNING
HOST_DATA 2 len 1-u16max[c]
HOST_DATA 3 count 1-u16max[c]
USER_DATA 1 msg->msg_controllen 0-s32max[c]
USER_DATA 1 msg->msg_flags 0-u32max[c]
USER_DATA 1 msg->msg_iter.count 1-18446744073709551614
USER_DATA 1 msg->msg_iter.iov_offset 0-u64max[c]
USER_DATA 1 msg->msg_namelen 0-128
USER_DATA 1 *msg->msg_name s64min-s64max
USER_DATA 2 len 1-u16max[c]
USER_DATA 3 count 1-u16max[c]
UNITS 2 len unit_byte
UNITS 3 count unit_byte
USER_PTR 1 msg->msg_control
USER_PTR 1 msg->msg_name
HALF_LOCKED2 0 &chan->lock

net/bluetooth/l2cap_core.c l2cap_create_connless_pdu() -> l2cap_skbuff_fromiovec()

Type Parameter Key Value
PARAM_VALUE 0 chan 4096-ptr_max
PARAM_VALUE 0 chan->chan_type 2
PARAM_VALUE 0 chan->conn 4096-ptr_max
PARAM_VALUE 0 chan->ops 4096-ptr_max
PARAM_VALUE 1 msg 4096-ptr_max
PARAM_VALUE 4 skb 4096-ptr_max
PARAM_VALUE 4 skb->data 4096-ptr_max
PARAM_VALUE 4 skb->data_len 0
BUF_SIZE 0 chan->data (-1)-s32max
BUF_SIZE 1 msg->msg_control (-1)-0,16,24,36-s32max
BUF_SIZE 1 msg->msg_name (-1)-0,12,28,128
BUF_SIZE 1 msg->msg_ubuf (-1),16
BUF_SIZE 4 skb 0-s32max
BUF_SIZE 4 skb 0-s32max
CAPPED_DATA 3 count 1
DATA_SOURCE 0 chan $0
DATA_SOURCE 1 msg $1
DATA_SOURCE 2 len $2
PARAM_COMPARE 2 len >= $3
PARAM_COMPARE 3 count <= $2
NOSPEC 1 msg->msg_controllen
NOSPEC 1 msg->msg_iter.count
NOSPEC 3 count
RX_PATH
TASK_NOT_RUNNING
HOST_DATA 2 len 0-s32max[c]
HOST_DATA 3 count 1-s32max[c]
USER_DATA 1 msg->msg_controllen 0-s32max[c]
USER_DATA 1 msg->msg_flags 0-u32max[c]
USER_DATA 1 msg->msg_iter.count 1-18446744073709551614
USER_DATA 1 msg->msg_iter.iov_offset 0-u64max[c]
USER_DATA 1 msg->msg_namelen 0-128
USER_DATA 1 *msg->msg_name s64min-s64max
USER_DATA 2 len s32min-s32max
USER_DATA 3 count 1-s32max[c]
UNITS 2 len unit_byte
UNITS 3 count unit_byte
USER_PTR 1 msg->msg_control
USER_PTR 1 msg->msg_name
HALF_LOCKED2 0 &chan->lock

net/bluetooth/l2cap_core.c l2cap_create_iframe_pdu() -> l2cap_skbuff_fromiovec()

Type Parameter Key Value
PARAM_VALUE 0 chan 4096-ptr_max
PARAM_VALUE 0 chan->chan_type 0-1,3-255
PARAM_VALUE 0 chan->conn 4096-ptr_max
PARAM_VALUE 0 chan->mode 3-4
PARAM_VALUE 0 chan->ops 4096-ptr_max
PARAM_VALUE 1 msg 4096-ptr_max
PARAM_VALUE 2 len 0-u16max
PARAM_VALUE 3 count 0-u16max
PARAM_VALUE 4 skb 4096-ptr_max
PARAM_VALUE 4 skb->data 4096-ptr_max
PARAM_VALUE 4 skb->data_len 0
BUF_SIZE 0 chan->data (-1)-s32max
BUF_SIZE 1 msg->msg_control (-1)-0,16,24,36-s32max
BUF_SIZE 1 msg->msg_name (-1)-0,12,28,128
BUF_SIZE 1 msg->msg_ubuf (-1),16
BUF_SIZE 4 skb 0-s32max
BUF_SIZE 4 skb 0-s32max
CAPPED_DATA 2 len 1
CAPPED_DATA 3 count 1
DATA_SOURCE 0 chan $0
DATA_SOURCE 1 msg $1
DATA_SOURCE 2 len $2
PARAM_COMPARE 2 len >= $3
PARAM_COMPARE 3 count <= $2
NOSPEC 1 msg->msg_controllen
NOSPEC 1 msg->msg_iter.count
NOSPEC 3 count
RX_PATH
TASK_NOT_RUNNING
HOST_DATA 1 msg->msg_iter.iov_offset 1-4294967294[c]
HOST_DATA 2 len 2-u16max[c]
HOST_DATA 3 count 2-u16max[c]
USER_DATA 1 msg->msg_controllen 0-s32max[c]
USER_DATA 1 msg->msg_flags 0-u32max[c]
USER_DATA 1 msg->msg_iter.count 1-18446744073709551614
USER_DATA 1 msg->msg_iter.iov_offset 0-u64max[c]
USER_DATA 1 msg->msg_namelen 0-128
USER_DATA 1 *msg->msg_name s64min-s64max
USER_DATA 2 len 1-u16max[c]
USER_DATA 3 count 1-u16max[c]
UNITS 2 len unit_byte
UNITS 3 count unit_byte
USER_PTR 1 msg->msg_control
USER_PTR 1 msg->msg_name
HALF_LOCKED2 0 &chan->lock

net/bluetooth/l2cap_core.c l2cap_create_le_flowctl_pdu() -> l2cap_skbuff_fromiovec()

Type Parameter Key Value
PARAM_VALUE 0 chan 4096-ptr_max
PARAM_VALUE 0 chan->chan_type 0-1,3-255
PARAM_VALUE 0 chan->conn 4096-ptr_max
PARAM_VALUE 0 chan->mode 128-129
PARAM_VALUE 0 chan->ops 4096-ptr_max
PARAM_VALUE 1 msg 4096-ptr_max
PARAM_VALUE 2 len 0-u16max
PARAM_VALUE 3 count 0-u16max
PARAM_VALUE 4 skb 4096-ptr_max
PARAM_VALUE 4 skb->data 4096-ptr_max
PARAM_VALUE 4 skb->data_len 0
BUF_SIZE 0 chan->data (-1)-s32max
BUF_SIZE 1 msg->msg_control (-1)-0,16,24,36-s32max
BUF_SIZE 1 msg->msg_name (-1)-0,12,28,128
BUF_SIZE 1 msg->msg_ubuf (-1),16
BUF_SIZE 4 skb 0-s32max
BUF_SIZE 4 skb 0-s32max
CAPPED_DATA 2 len 1
CAPPED_DATA 3 count 1
DATA_SOURCE 0 chan $0
DATA_SOURCE 1 msg $1
DATA_SOURCE 2 len $2
PARAM_COMPARE 2 len >= $3
PARAM_COMPARE 3 count <= $2
NOSPEC 1 msg->msg_controllen
NOSPEC 1 msg->msg_iter.count
NOSPEC 3 count
RX_PATH
TASK_NOT_RUNNING
HOST_DATA 1 msg->msg_iter.iov_offset 1-4294967294[c]
HOST_DATA 2 len 2-u16max[c]
HOST_DATA 3 count 2-u16max[c]
USER_DATA 1 msg->msg_controllen 0-s32max[c]
USER_DATA 1 msg->msg_flags 0-u32max[c]
USER_DATA 1 msg->msg_iter.count 1-18446744073709551614
USER_DATA 1 msg->msg_iter.iov_offset 0-u64max[c]
USER_DATA 1 msg->msg_namelen 0-128
USER_DATA 1 *msg->msg_name s64min-s64max
USER_DATA 2 len 2-u16max[c]
USER_DATA 3 count 2-u16max[c]
UNITS 2 len unit_byte
UNITS 3 count unit_byte
USER_PTR 1 msg->msg_control
USER_PTR 1 msg->msg_name
HALF_LOCKED2 0 &chan->lock