Defined in 1 files as a prototype:
Defined in 1 files as a function:
Referenced in 7 files:
- net/bluetooth/iso.c, line 1588
- net/bluetooth/l2cap_sock.c, line 1168
- net/bluetooth/sco.c, line 870
- net/can/raw.c, line 990
- net/core/sock.c, line 3142
- net/ipv4/tcp.c, line 1134
- net/packet/af_packet.c
Smatch caller information:
net/can/raw.c raw_sendmsg() -> sock_cmsg_send()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| PARAM_VALUE | 0 | sk->__sk_common.skc_refcnt.refs.counter | (-1073741824),0-s32max |
| PARAM_VALUE | 1 | msg | 4096-ptr_max |
| PARAM_VALUE | 1 | msg->msg_controllen | 1-u64max |
| PARAM_VALUE | 1 | msg->msg_iter.__iov | 4096-u64max |
| PARAM_VALUE | 1 | msg->msg_iter.bvec | 4096-u64max |
| PARAM_VALUE | 1 | msg->msg_iter.folioq | 1-u64max |
| PARAM_VALUE | 1 | msg->msg_iter.kvec | 4096-u64max |
| PARAM_VALUE | 1 | msg->msg_name | 0,4096-ptr_max |
| PARAM_VALUE | 2 | sockc | 325024513322582016 |
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16,24,36-s32max |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,28,128 |
| BUF_SIZE | 1 | msg->msg_ubuf | (-1),16 |
| CAPPED_DATA | 0 | sk->__sk_common.skc_net.net | 1 |
| DATA_SOURCE | 1 | msg | $1 |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_controllen | 1-s32max[c] |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 1-18446744073709551614 |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | msg->msg_namelen | 0-128 |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| UNITS | 0 | sk | unit_byte |
| USER_PTR | 1 | msg->msg_control | |
| USER_PTR | 1 | msg->msg_name | |
| HALF_LOCKED2 | &vq->mutex | ||
| HALF_LOCKED2 | sk |
net/packet/af_packet.c packet_sendmsg_spkt() -> sock_cmsg_send()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| PARAM_VALUE | 0 | sk->__sk_common.skc_refcnt.refs.counter | (-1073741824),0-s32max |
| PARAM_VALUE | 1 | msg | 4096-ptr_max |
| PARAM_VALUE | 1 | msg->msg_controllen | 1-u64max |
| PARAM_VALUE | 1 | msg->msg_iter.folioq | 1-u64max |
| PARAM_VALUE | 1 | msg->msg_iter.kvec | 4096-u64max |
| PARAM_VALUE | 1 | msg->msg_name | 4096-ptr_max |
| PARAM_VALUE | 1 | msg->msg_namelen | s32min-(-1),16-s32max |
| PARAM_VALUE | 2 | sockc | 5798240594105733120 |
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16,24,36-s32max |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,28,128 |
| BUF_SIZE | 1 | msg->msg_ubuf | (-1),16 |
| CAPPED_DATA | 0 | sk->__sk_common.skc_net.net | 1 |
| DATA_SOURCE | 1 | msg | $1 |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_controllen | 1-s32max[c] |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 1-18446744073709551614 |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | msg->msg_namelen | 16-17,19-128 |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| UNITS | 0 | sk | unit_byte |
| USER_PTR | 1 | msg->msg_control | |
| USER_PTR | 1 | msg->msg_name | |
| LOCK2 | rcu_read | ||
| HALF_LOCKED2 | sk |
net/packet/af_packet.c packet_snd() -> sock_cmsg_send()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| PARAM_VALUE | 1 | msg | 4096-ptr_max |
| PARAM_VALUE | 1 | msg->msg_controllen | 1-u64max |
| PARAM_VALUE | 1 | msg->msg_name | 0,4096-ptr_max |
| PARAM_VALUE | 1 | msg->msg_namelen | s32min-(-1),20-s32max |
| PARAM_VALUE | 2 | sockc | 2028865319573905408 |
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16,24,36-s32max |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,28,128 |
| BUF_SIZE | 1 | msg->msg_ubuf | (-1),16 |
| DATA_SOURCE | 1 | msg | $1 |
| FUZZY_MAX | 1 | msg->msg_namelen | 20 |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_controllen | 1-s32max[c] |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 1-18446744073709551614 |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | msg->msg_namelen | 20-128 |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| UNITS | 0 | sk | unit_byte |
| USER_PTR | 1 | msg->msg_control | |
| USER_PTR | 1 | msg->msg_name | |
| HALF_LOCKED2 | &vq->mutex |
net/packet/af_packet.c tpacket_snd() -> sock_cmsg_send()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| PARAM_VALUE | 0 | sk->sk_socket | 4096-ptr_max |
| PARAM_VALUE | 1 | msg | 4096-ptr_max |
| PARAM_VALUE | 1 | msg->msg_controllen | 1-u64max |
| PARAM_VALUE | 1 | msg->msg_name | 0,4096-ptr_max |
| PARAM_VALUE | 1 | msg->msg_namelen | s32min-(-1),20-s32max |
| PARAM_VALUE | 2 | sockc | 2007998961182048256 |
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16,24,36-s32max |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,28,128 |
| BUF_SIZE | 1 | msg->msg_ubuf | (-1),16 |
| DATA_SOURCE | 1 | msg | $1 |
| FUZZY_MAX | 1 | msg->msg_namelen | 20 |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_controllen | 1-s32max[c] |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 1-18446744073709551614 |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | msg->msg_namelen | 20-128 |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| USER_PTR | 1 | msg->msg_control | |
| USER_PTR | 1 | msg->msg_name | |
| LOCK2 | &po->pg_vec_lock | ||
| HALF_LOCKED2 | &vq->mutex | ||
| TYPE_LOCK | (struct packet_sock)->pg_vec_lock |
net/bluetooth/sco.c sco_sock_sendmsg() -> sock_cmsg_send()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| PARAM_VALUE | 1 | msg | 4096-ptr_max |
| PARAM_VALUE | 1 | msg->msg_controllen | 1-u64max |
| PARAM_VALUE | 2 | sockc | 4732871205469659136 |
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16,24,36-s32max |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,28,128 |
| BUF_SIZE | 1 | msg->msg_ubuf | (-1),16 |
| DATA_SOURCE | 1 | msg | $1 |
| BIT_INFO | 1 | msg->msg_flags | 0x0,0xfffffffe |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_controllen | 1-s32max[c] |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 1-18446744073709551614 |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | msg->msg_namelen | 0-128 |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| UNITS | 0 | sk | unit_byte |
| USER_PTR | 1 | msg->msg_control | |
| USER_PTR | 1 | msg->msg_name | |
| HALF_LOCKED2 | &vq->mutex | ||
| HALF_LOCKED2 | sk |
net/bluetooth/l2cap_sock.c l2cap_sock_sendmsg() -> sock_cmsg_send()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| PARAM_VALUE | 0 | sk->__sk_common.skc_state | 1 |
| PARAM_VALUE | 1 | msg | 4096-ptr_max |
| PARAM_VALUE | 1 | msg->msg_controllen | 1-u64max |
| PARAM_VALUE | 2 | sockc | 5569145794011197440 |
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16,24,36-s32max |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,28,128 |
| BUF_SIZE | 1 | msg->msg_ubuf | (-1),16 |
| DATA_SOURCE | 1 | msg | $1 |
| BIT_INFO | 1 | msg->msg_flags | 0x0,0xfffffffe |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_controllen | 1-s32max[c] |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 1-18446744073709551614 |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | msg->msg_namelen | 0-128 |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| UNITS | 0 | sk | unit_byte |
| USER_PTR | 1 | msg->msg_control | |
| USER_PTR | 1 | msg->msg_name | |
| HALF_LOCKED2 | &vq->mutex | ||
| HALF_LOCKED2 | sk |
net/bluetooth/iso.c iso_sock_sendmsg() -> sock_cmsg_send()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | sk | 4096-ptr_max |
| PARAM_VALUE | 1 | msg | 4096-ptr_max |
| PARAM_VALUE | 1 | msg->msg_controllen | 1-u64max |
| PARAM_VALUE | 2 | sockc | 3148177575769989120 |
| BUF_SIZE | 1 | msg->msg_control | (-1)-0,16,24,36-s32max |
| BUF_SIZE | 1 | msg->msg_name | (-1)-0,12,28,128 |
| BUF_SIZE | 1 | msg->msg_ubuf | (-1),16 |
| DATA_SOURCE | 1 | msg | $1 |
| BIT_INFO | 1 | msg->msg_flags | 0x0,0xfffffffe |
| NOSPEC | 1 | msg->msg_iter.count | |
| RX_PATH | |||
| TASK_NOT_RUNNING | |||
| USER_DATA | 1 | msg->msg_controllen | 1-s32max[c] |
| USER_DATA | 1 | msg->msg_flags | 0-u32max[c] |
| USER_DATA | 1 | msg->msg_iter.count | 1-18446744073709551614 |
| USER_DATA | 1 | msg->msg_iter.iov_offset | 0-u64max[c] |
| USER_DATA | 1 | msg->msg_namelen | 0-128 |
| USER_DATA | 1 | *msg->msg_name | s64min-s64max |
| NO_OVERFLOW_SIMPLE | 0 | sk->sk_backlog.len | |
| UNITS | 0 | sk | unit_byte |
| USER_PTR | 1 | msg->msg_control | |
| USER_PTR | 1 | msg->msg_name | |
| HALF_LOCKED2 | &vq->mutex | ||
| HALF_LOCKED2 | sk |