Q: Given the following code slice:
```
1 #define ICMP6MSGOUT_INC_STATS(net, idev, field)		\
2 	_DEVINC_ATOMIC_ATOMIC(net, icmpv6msg, idev, field +256)
3 
4 struct sk_buff *__ip6_make_skb(struct sock *sk,
5 			       struct sk_buff_head *queue,
6 			       struct inet_cork_full *cork,
7 			       struct inet6_cork *v6_cork)
8 {
9 	struct sk_buff *skb, *tmp_skb;
10 	struct sk_buff **tail_skb;
11 	struct in6_addr *final_dst;
12 	struct net *net = sock_net(sk);
13 	struct ipv6hdr *hdr;
14 	struct ipv6_txoptions *opt = v6_cork->opt;
15 	struct rt6_info *rt = (struct rt6_info *)cork->base.dst;
16 	struct flowi6 *fl6 = &cork->fl.u.ip6;
17 	unsigned char proto = fl6->flowi6_proto;
18 
19 	skb = __skb_dequeue(queue);
20 	if (!skb)
21 		goto out;
22 	tail_skb = &(skb_shinfo(skb)->frag_list);
23 
24 	/* move skb->data to ip header from ext header */
25 	if (skb->data < skb_network_header(skb))
26 		__skb_pull(skb, skb_network_offset(skb));
27 	while ((tmp_skb = __skb_dequeue(queue)) != NULL) {
28 		__skb_pull(tmp_skb, skb_network_header_len(skb));
29 		*tail_skb = tmp_skb;
30 		tail_skb = &(tmp_skb->next);
31 		skb->len += tmp_skb->len;
32 		skb->data_len += tmp_skb->len;
33 		skb->truesize += tmp_skb->truesize;
34 		tmp_skb->destructor = NULL;
35 		tmp_skb->sk = NULL;
36 	}
37 
38 	/* Allow local fragmentation. */
39 	skb->ignore_df = ip6_sk_ignore_df(sk);
40 	__skb_pull(skb, skb_network_header_len(skb));
41 
42 	final_dst = &fl6->daddr;
43 	if (opt && opt->opt_flen)
44 		ipv6_push_frag_opts(skb, opt, &proto);
45 	if (opt && opt->opt_nflen)
46 		ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst, &fl6->saddr);
47 
48 	skb_push(skb, sizeof(struct ipv6hdr));
49 	skb_reset_network_header(skb);
50 	hdr = ipv6_hdr(skb);
51 
52 	ip6_flow_hdr(hdr, v6_cork->tclass,
53 		     ip6_make_flowlabel(net, skb, fl6->flowlabel,
54 					ip6_autoflowlabel(net, sk), fl6));
55 	hdr->hop_limit = v6_cork->hop_limit;
56 	hdr->nexthdr = proto;
57 	hdr->saddr = fl6->saddr;
58 	hdr->daddr = *final_dst;
59 
60 	skb->priority = READ_ONCE(sk->sk_priority);
61 	skb->mark = cork->base.mark;
62 	skb->tstamp = cork->base.transmit_time;
63 
64 	ip6_cork_steal_dst(skb, cork);
65 	IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
66 	if (proto == IPPROTO_ICMPV6) {
67 		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
68 		u8 icmp6_type;
69 
70 		if (sk->sk_socket->type == SOCK_RAW &&
71 		   !inet_test_bit(HDRINCL, sk))
72 			icmp6_type = fl6->fl6_icmp_type;
73 		else
74 			icmp6_type = icmp6_hdr(skb)->icmp6_type;
75 		ICMP6MSGOUT_INC_STATS(net, idev, icmp6_type);
76 		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
77 	}
78 
79 	ip6_cork_release(cork, v6_cork);
80 out:
81 	return skb;
82 }
83 static inline void skb_reset_network_header(struct sk_buff *skb)
84 {
85 	skb->network_header = skb->data - skb->head;
86 }
87 static inline struct dst_entry *skb_dst(const struct sk_buff *skb)
88 {
89 	/* If refdst was not refcounted, check we still are in a
90 	 * rcu_read_lock section
91 	 */
92 	WARN_ON((skb->_skb_refdst & SKB_DST_NOREF) &&
93 		!rcu_read_lock_held() &&
94 		!rcu_read_lock_bh_held());
95 	return (struct dst_entry *)(skb->_skb_refdst & SKB_DST_PTRMASK);
96 }
97 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
98 			    struct ipv6_rt_hdr *opt,
99 			    struct in6_addr **addr_p, struct in6_addr *saddr)
100 {
101 	switch (opt->type) {
102 	case IPV6_SRCRT_TYPE_0:
103 	case IPV6_SRCRT_STRICT:
104 	case IPV6_SRCRT_TYPE_2:
105 		ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
106 		break;
107 	case IPV6_SRCRT_TYPE_4:
108 		ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
109 		break;
110 	default:
111 		break;
112 	}
113 }
114 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
115 {
116 	struct ipv6_opt_hdr *h = skb_push(skb, ipv6_optlen(opt));
117 
118 	memcpy(h, opt, ipv6_optlen(opt));
119 	h->nexthdr = *proto;
120 	*proto = type;
121 }
122 static inline __u32 skb_get_hash_flowi6(struct sk_buff *skb, const struct flowi6 *fl6)
123 {
124 	if (!skb->l4_hash && !skb->sw_hash) {
125 		struct flow_keys keys;
126 		__u32 hash = __get_hash_from_flowi6(fl6, &keys);
127 
128 		__skb_set_sw_hash(skb, hash, flow_keys_have_l4(&keys));
129 	}
130 
131 	return skb->hash;
132 }
133 static inline int ip6_default_np_autolabel(struct net *net)
134 {
135 	switch (net->ipv6.sysctl.auto_flowlabels) {
136 	case IP6_AUTO_FLOW_LABEL_OFF:
137 	case IP6_AUTO_FLOW_LABEL_OPTIN:
138 	default:
139 		return 0;
140 	case IP6_AUTO_FLOW_LABEL_OPTOUT:
141 	case IP6_AUTO_FLOW_LABEL_FORCED:
142 		return 1;
143 	}
144 }
145 int rcu_read_lock_bh_held(void)
146 {
147 	bool ret;
148 
149 	if (rcu_read_lock_held_common(&ret))
150 		return ret;
151 	return in_softirq() || irqs_disabled();
152 }
153 static void skb_panic(struct sk_buff *skb, unsigned int sz, void *addr,
154 		      const char msg[])
155 {
156 	pr_emerg("%s: text:%px len:%d put:%d head:%px data:%px tail:%#lx end:%#lx dev:%s\n",
157 		 msg, addr, skb->len, sz, skb->head, skb->data,
158 		 (unsigned long)skb->tail, (unsigned long)skb->end,
159 		 skb->dev ? skb->dev->name : "<NULL>");
160 	BUG();
161 }
162 static inline struct ipv6hdr *ipv6_hdr(const struct sk_buff *skb)
163 {
164 	return (struct ipv6hdr *)skb_network_header(skb);
165 }
166 static inline struct sk_buff *skb_peek(const struct sk_buff_head *list_)
167 {
168 	struct sk_buff *skb = list_->next;
169 
170 	if (skb == (struct sk_buff *)list_)
171 		skb = NULL;
172 	return skb;
173 }
174 static __always_inline __u32 rol32(__u32 word, unsigned int shift)
175 {
176 	return (word << shift) | (word >> ((-shift) & 31));
177 }
178 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
179 			     struct ipv6_rt_hdr *opt,
180 			     struct in6_addr **addr_p, struct in6_addr *saddr)
181 {
182 	struct rt0_hdr *phdr, *ihdr;
183 	int hops;
184 
185 	ihdr = (struct rt0_hdr *) opt;
186 
187 	phdr = skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
188 	memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
189 
190 	hops = ihdr->rt_hdr.hdrlen >> 1;
191 
192 	if (hops > 1)
193 		memcpy(phdr->addr, ihdr->addr + 1,
194 		       (hops - 1) * sizeof(struct in6_addr));
195 
196 	phdr->addr[hops - 1] = **addr_p;
197 	*addr_p = ihdr->addr;
198 
199 	phdr->rt_hdr.nexthdr = *proto;
200 	*proto = NEXTHDR_ROUTING;
201 }
202 static inline u32 skb_network_header_len(const struct sk_buff *skb)
203 {
204 	return skb->transport_header - skb->network_header;
205 }
206 static inline unsigned char *skb_transport_header(const struct sk_buff *skb)
207 {
208 	DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb));
209 	return skb->head + skb->transport_header;
210 }
211 static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
212 {
213 	struct sk_buff *next, *prev;
214 
215 	WRITE_ONCE(list->qlen, list->qlen - 1);
216 	next	   = skb->next;
217 	prev	   = skb->prev;
218 	skb->next  = skb->prev = NULL;
219 	WRITE_ONCE(next->prev, prev);
220 	WRITE_ONCE(prev->next, next);
221 }
222 static inline void
223 __skb_set_sw_hash(struct sk_buff *skb, __u32 hash, bool is_l4)
224 {
225 	__skb_set_hash(skb, hash, true, is_l4);
226 }
227 static void ip6_cork_steal_dst(struct sk_buff *skb, struct inet_cork_full *cork)
228 {
229 	struct dst_entry *dst = cork->base.dst;
230 
231 	cork->base.dst = NULL;
232 	cork->base.flags &= ~IPCORK_ALLFRAG;
233 	skb_dst_set(skb, dst);
234 }
235 void *skb_push(struct sk_buff *skb, unsigned int len)
236 {
237 	skb->data -= len;
238 	skb->len  += len;
239 	if (unlikely(skb->data < skb->head))
240 		skb_under_panic(skb, len, __builtin_return_address(0));
241 	return skb->data;
242 }
243 static inline void ip6_flow_hdr(struct ipv6hdr *hdr, unsigned int tclass,
244 				__be32 flowlabel)
245 {
246 	*(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | flowlabel;
247 }
248 static inline bool ip6_sk_ignore_df(const struct sock *sk)
249 {
250 	return inet6_sk(sk)->pmtudisc < IPV6_PMTUDISC_DO ||
251 	       inet6_sk(sk)->pmtudisc == IPV6_PMTUDISC_OMIT;
252 }
253 __u32 __get_hash_from_flowi6(const struct flowi6 *fl6, struct flow_keys *keys)
254 {
255 	memset(keys, 0, sizeof(*keys));
256 
257 	memcpy(&keys->addrs.v6addrs.src, &fl6->saddr,
258 	    sizeof(keys->addrs.v6addrs.src));
259 	memcpy(&keys->addrs.v6addrs.dst, &fl6->daddr,
260 	    sizeof(keys->addrs.v6addrs.dst));
261 	keys->control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
262 	keys->ports.src = fl6->fl6_sport;
263 	keys->ports.dst = fl6->fl6_dport;
264 	keys->keyid.keyid = fl6->fl6_gre_key;
265 	keys->tags.flow_label = (__force u32)flowi6_get_flowlabel(fl6);
266 	keys->basic.ip_proto = fl6->flowi6_proto;
267 
268 	return flow_hash_from_keys(keys);
269 }
270 static inline struct sk_buff *__skb_dequeue(struct sk_buff_head *list)
271 {
272 	struct sk_buff *skb = skb_peek(list);
273 	if (skb)
274 		__skb_unlink(skb, list);
275 	return skb;
276 }
277 static inline bool sk_fullsock(const struct sock *sk)
278 {
279 	return (1 << sk->sk_state) & ~(TCPF_TIME_WAIT | TCPF_NEW_SYN_RECV);
280 }
281 static bool rcu_read_lock_held_common(bool *ret)
282 {
283 	if (!debug_lockdep_rcu_enabled()) {
284 		*ret = true;
285 		return true;
286 	}
287 	if (!rcu_is_watching()) {
288 		*ret = false;
289 		return true;
290 	}
291 	if (!rcu_lockdep_current_cpu_online()) {
292 		*ret = false;
293 		return true;
294 	}
295 	return false;
296 }
297 static inline struct icmp6hdr *icmp6_hdr(const struct sk_buff *skb)
298 {
299 	return (struct icmp6hdr *)skb_transport_header(skb);
300 }
301 int rcu_read_lock_held(void)
302 {
303 	bool ret;
304 
305 	if (rcu_read_lock_held_common(&ret))
306 		return ret;
307 	return lock_is_held(&rcu_lock_map);
308 }
309 static inline struct ipv6_pinfo *inet6_sk(const struct sock *__sk)
310 {
311 	return sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL;
312 }
313 static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
314 {
315 	return ((struct rt6_info *)dst)->rt6i_idev;
316 }
317 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
318 {
319 	if (opt->dst1opt)
320 		ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
321 }
322 static inline int skb_network_offset(const struct sk_buff *skb)
323 {
324 	return skb_network_header(skb) - skb->data;
325 }
326 static inline unsigned char *skb_network_header(const struct sk_buff *skb)
327 {
328 	return skb->head + skb->network_header;
329 }
330 static void skb_under_panic(struct sk_buff *skb, unsigned int sz, void *addr)
331 {
332 	skb_panic(skb, sz, addr, __func__);
333 }
334 static inline void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)
335 {
336 	skb->slow_gro |= !!dst;
337 	skb->_skb_refdst = (unsigned long)dst;
338 }
339 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
340 			  u8 *proto,
341 			  struct in6_addr **daddr, struct in6_addr *saddr)
342 {
343 	if (opt->srcrt) {
344 		ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
345 		/*
346 		 * IPV6_RTHDRDSTOPTS is ignored
347 		 * unless IPV6_RTHDR is set (RFC3542).
348 		 */
349 		if (opt->dst0opt)
350 			ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
351 	}
352 	if (opt->hopopt)
353 		ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
354 }
355 static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb,
356 					__be32 flowlabel, bool autolabel,
357 					struct flowi6 *fl6)
358 {
359 	u32 hash;
360 
361 	/* @flowlabel may include more than a flow label, eg, the traffic class.
362 	 * Here we want only the flow label value.
363 	 */
364 	flowlabel &= IPV6_FLOWLABEL_MASK;
365 
366 	if (flowlabel ||
367 	    net->ipv6.sysctl.auto_flowlabels == IP6_AUTO_FLOW_LABEL_OFF ||
368 	    (!autolabel &&
369 	     net->ipv6.sysctl.auto_flowlabels != IP6_AUTO_FLOW_LABEL_FORCED))
370 		return flowlabel;
371 
372 	hash = skb_get_hash_flowi6(skb, fl6);
373 
374 	/* Since this is being sent on the wire obfuscate hash a bit
375 	 * to minimize possbility that any useful information to an
376 	 * attacker is leaked. Only lower 20 bits are relevant.
377 	 */
378 	hash = rol32(hash, 16);
379 
380 	flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK;
381 
382 	if (net->ipv6.sysctl.flowlabel_state_ranges)
383 		flowlabel |= IPV6_FLOWLABEL_STATELESS_FLAG;
384 
385 	return flowlabel;
386 }
387 bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np)
388 {
389 	if (!np->autoflowlabel_set)
390 		return ip6_default_np_autolabel(net);
391 	else
392 		return np->autoflowlabel;
393 }
```
which has a vulnerability among CWE-416,CWE-190,CWE-476,CWE-125 and among lines:
```
29 		*tail_skb = tmp_skb;
49 	skb_reset_network_header(skb);
65 	IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
75 		ICMP6MSGOUT_INC_STATS(net, idev, icmp6_type);
76 		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
```
Please generate five possible patches for the vulnerability.