Documented in 1 files:
Defined in 1 files as a function:
Referenced in 5 files:
- net/ipv4/icmp.c
- net/ipv4/ip_options.c, line 622
- net/ipv4/netfilter.c, line 72
- net/ipv6/netfilter.c, line 70
- net/xfrm/xfrm_policy.c, line 3894
Smatch caller information:
net/ipv4/ip_options.c ip_options_rcv_srr() -> skb_dstref_steal()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | skb | 4096-ptr_max |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| DATA_SOURCE | 0 | skb | $0 |
| PREEMPT_ADD | |||
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| HOST_DATA | 0 | skb->csum | 0-126976[c] |
| HOST_DATA | 0 | skb->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->prev->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->len | 1-u32max[c] |
| HOST_DATA | 0 | skb->prev->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->truesize | 0-u32max |
| HOST_DATA | 0 | skb->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->users.refs.counter | s32min-0,2-s32max |
| HOST_DATA | 0 | *skb->data | 0-255 |
| NO_OVERFLOW_SIMPLE | 0 | skb->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->group | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->num_tc | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->proto_down | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_rx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_tx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.rx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.tx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->tx_queue_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | skb->sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->truesize | |
| UNITS | 0 | skb | unit_byte |
| HALF_LOCKED2 | bh | ||
| HALF_LOCKED2 | rcu_read |
net/ipv6/netfilter.c ip6_route_me_harder() -> skb_dstref_steal()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | skb | 4096-ptr_max |
| PARAM_VALUE | 0 | skb->_skb_refdst | 4096-18446744073709547520 |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| DATA_SOURCE | 0 | skb | $2 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL | |||
| HOST_DATA | 0 | skb->csum | 0-192512[c] |
| HOST_DATA | 0 | skb->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->prev->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->protocol | 1-255 |
| HOST_DATA | 0 | skb->truesize | 0-u32max |
| HOST_DATA | 0 | skb->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->users.refs.counter | s32min-0,2-s32max |
| HOST_DATA | 0 | *skb->data | 0-255 |
| NO_OVERFLOW_SIMPLE | 0 | skb->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->group | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->num_tc | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_rx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_tx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.rx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.tx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->tx_queue_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->extensions | |
| NO_OVERFLOW_SIMPLE | 0 | skb->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | skb->sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->truesize | |
| UNITS | 0 | skb | unit_byte |
net/ipv4/icmp.c icmp_route_lookup() -> skb_dstref_steal()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | skb | 4096-ptr_max |
| PARAM_VALUE | 0 | skb->_skb_refdst | 1-u64max |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| CAPPED_DATA | 0 | skb->head | 1 |
| DATA_SOURCE | 0 | skb | $2 |
| PREEMPT_ADD | |||
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| HOST_DATA | 0 | skb->csum | 0-4294967040[c] |
| HOST_DATA | 0 | skb->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->inner_protocol | 1-255 |
| HOST_DATA | 0 | skb->len | 0-u32max[c] |
| HOST_DATA | 0 | skb->next->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->next->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->next->len | 1-u32max[c] |
| HOST_DATA | 0 | skb->prev->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->prev->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->truesize | 0-u32max |
| HOST_DATA | 0 | skb->prev->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->prev->users.refs.counter | s32min-0,2-s32max |
| HOST_DATA | 0 | skb->protocol | 1-255 |
| HOST_DATA | 0 | skb->truesize | 0-u32max |
| HOST_DATA | 0 | skb->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->users.refs.counter | s32min-0,2-s32max |
| HOST_DATA | 0 | *skb->data | 0-255 |
| NO_OVERFLOW_SIMPLE | 0 | skb->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->group | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->num_tc | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->proto_down | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_rx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_tx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.rx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.tx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->tx_queue_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | skb->sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->truesize | |
| UNITS | 0 | skb | unit_byte |
| LOCK2 | bh | ||
| HALF_LOCKED2 | &x->lock | ||
| HALF_LOCKED2 | rcu_read |
net/ipv4/icmp.c icmp_route_lookup() -> skb_dstref_steal()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | skb | 4096-ptr_max |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| CAPPED_DATA | 0 | skb->head | 1 |
| DATA_SOURCE | 0 | skb | $2 |
| PREEMPT_ADD | |||
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL | |||
| HOST_DATA | 0 | skb->csum | 0-4294967040[c] |
| HOST_DATA | 0 | skb->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->inner_protocol | 1-255 |
| HOST_DATA | 0 | skb->len | 0-u32max[c] |
| HOST_DATA | 0 | skb->next->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->next->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->next->len | 1-u32max[c] |
| HOST_DATA | 0 | skb->prev->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->prev->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->truesize | 0-u32max |
| HOST_DATA | 0 | skb->prev->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->prev->users.refs.counter | s32min-0,2-s32max |
| HOST_DATA | 0 | skb->protocol | 1-255 |
| HOST_DATA | 0 | skb->truesize | 0-u32max |
| HOST_DATA | 0 | skb->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->users.refs.counter | s32min-0,2-s32max |
| HOST_DATA | 0 | *skb->data | 0-255 |
| NO_OVERFLOW_SIMPLE | 0 | skb->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->group | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->num_tc | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->proto_down | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_rx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_tx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.rx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.tx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->tx_queue_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | skb->sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->truesize | |
| UNITS | 0 | skb | unit_byte |
| LOCK2 | bh | ||
| HALF_LOCKED2 | &x->lock | ||
| HALF_LOCKED2 | rcu_read |
net/ipv4/netfilter.c ip_route_me_harder() -> skb_dstref_steal()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | skb | 4096-ptr_max |
| PARAM_VALUE | 0 | skb->_skb_refdst | 0-18446744073709547520 |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| DATA_SOURCE | 0 | skb | $2 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL | |||
| HOST_DATA | 0 | skb->csum | 0-192512[c] |
| HOST_DATA | 0 | skb->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->inner_protocol | 1-255 |
| HOST_DATA | 0 | skb->len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->prev->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->protocol | 1-255 |
| HOST_DATA | 0 | skb->truesize | 0-u32max |
| HOST_DATA | 0 | skb->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->users.refs.counter | s32min-0,2-s32max |
| HOST_DATA | 0 | *skb->data | 0-255 |
| NO_OVERFLOW_SIMPLE | 0 | skb->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->group | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->num_tc | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->proto_down | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_rx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_tx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.rx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.tx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->tx_queue_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->extensions | |
| NO_OVERFLOW_SIMPLE | 0 | skb->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | skb->sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->truesize | |
| UNITS | 0 | skb | unit_byte |
net/xfrm/xfrm_policy.c __xfrm_route_forward() -> skb_dstref_steal()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | skb | 4096-ptr_max |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| BUF_SIZE | 0 | skb | (-1)-s32max |
| CAPPED_DATA | 0 | skb->dev->nd_net.net | 1 |
| DATA_SOURCE | 0 | skb | $0 |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL | |||
| HOST_DATA | 0 | skb->csum | 0-192512[c] |
| HOST_DATA | 0 | skb->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->data_len | 0-1[c] |
| HOST_DATA | 0 | skb->len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->csum_offset | 0-u16max |
| HOST_DATA | 0 | skb->prev->data_len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->len | 0-u32max[c] |
| HOST_DATA | 0 | skb->prev->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->truesize | 0-u32max |
| HOST_DATA | 0 | skb->tstamp | 500000002-4294967299794967295[c] |
| HOST_DATA | 0 | skb->users.refs.counter | s32min-0,2-s32max |
| HOST_DATA | 0 | *skb->data | 0-255 |
| NO_OVERFLOW_SIMPLE | 0 | skb->data_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->group | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->num_tc | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_rx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->real_num_tx_queues | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.rx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->stats.tx_bytes | |
| NO_OVERFLOW_SIMPLE | 0 | skb->dev->tx_queue_len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->next->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->end | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->prev->truesize | |
| NO_OVERFLOW_SIMPLE | 0 | skb->sk->sk_backlog.len | |
| NO_OVERFLOW_SIMPLE | 0 | skb->tail | |
| NO_OVERFLOW_SIMPLE | 0 | skb->truesize | |
| UNITS | 0 | skb | unit_byte |
| HALF_LOCKED2 | &pool->lock | ||
| HALF_LOCKED2 | bh | ||
| HALF_LOCKED2 | rcu_read |