param_used: fix use after free
[smatch.git] / validation / sm_skb2.c
blobab96555ecf54e6b6964c0ac4d8f0ec759d1c97f6
1 #include "check_debug.h"
3 struct sk_buff {
4 unsigned char *head, *data;
5 unsigned short network_header;
6 };
8 struct foo {
9 int a, b, c;
12 static inline unsigned char *skb_network_header(const struct sk_buff *skb)
14 return skb->head + skb->network_header;
17 static inline int skb_network_offset(const struct sk_buff *skb)
19 return skb_network_header(skb) - skb->data;
22 int frob(struct sk_buff *skb)
24 struct foo *p;
25 int x, y;
27 __smatch_user_rl(*skb->data);
28 __smatch_user_rl(skb->data + 1);
29 __smatch_user_rl(*(int *)skb->data);
30 __smatch_user_rl(skb->data - skb_network_header(skb));
32 p = skb->data;
33 x = *(int *)skb->data;
34 y = skb->data[1];
36 __smatch_user_rl(p->a);
37 __smatch_user_rl(x);
38 __smatch_user_rl(y);
40 return 0;
44 * check-name: smatch: userdata from skb
45 * check-command: smatch -p=kernel -I.. sm_skb2.c
47 * check-output-start
48 sm_skb2.c:27 frob() user rl: '*skb->data' = '0-255'
49 sm_skb2.c:28 frob() user rl: 'skb->data + 1' = ''
50 sm_skb2.c:29 frob() user rl: '*skb->data' = 's32min-s32max'
51 sm_skb2.c:30 frob() user rl: 'skb->data - skb_network_header(skb)' = ''
52 sm_skb2.c:36 frob() user rl: 'p->a' = 's32min-s32max'
53 sm_skb2.c:37 frob() user rl: 'x' = 's32min-s32max'
54 sm_skb2.c:38 frob() user rl: 'y' = '0-255'
55 * check-output-end