Q: Given the following code slice:
```
1 static inline void *__skb_push(struct sk_buff *skb, unsigned int len)
2 {
3 	DEBUG_NET_WARN_ON_ONCE(len > INT_MAX);
4 
5 	skb->data -= len;
6 	skb->len  += len;
7 	return skb->data;
8 }
9 static inline void skb_reset_network_header(struct sk_buff *skb)
10 {
11 	skb->network_header = skb->data - skb->head;
12 }
13 static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
14 				       netdev_features_t features)
15 {
16 	struct sk_buff *segs = ERR_PTR(-EINVAL);
17 	u16 mac_offset = skb->mac_header;
18 	unsigned int nsh_len, mac_len;
19 	__be16 proto;
20 
21 	skb_reset_network_header(skb);
22 
23 	mac_len = skb->mac_len;
24 
25 	if (unlikely(!pskb_may_pull(skb, NSH_BASE_HDR_LEN)))
26 		goto out;
27 	nsh_len = nsh_hdr_len(nsh_hdr(skb));
28 	if (nsh_len < NSH_BASE_HDR_LEN)
29 		goto out;
30 	if (unlikely(!pskb_may_pull(skb, nsh_len)))
31 		goto out;
32 
33 	proto = tun_p_to_eth_p(nsh_hdr(skb)->np);
34 	if (!proto)
35 		goto out;
36 
37 	__skb_pull(skb, nsh_len);
38 
39 	skb_reset_mac_header(skb);
40 	skb->mac_len = proto == htons(ETH_P_TEB) ? ETH_HLEN : 0;
41 	skb->protocol = proto;
42 
43 	features &= NETIF_F_SG;
44 	segs = skb_mac_gso_segment(skb, features);
45 	if (IS_ERR_OR_NULL(segs)) {
46 		skb_gso_error_unwind(skb, htons(ETH_P_NSH), nsh_len,
47 				     mac_offset, mac_len);
48 		goto out;
49 	}
50 
51 	for (skb = segs; skb; skb = skb->next) {
52 		skb->protocol = htons(ETH_P_NSH);
53 		__skb_push(skb, nsh_len);
54 		skb->mac_header = mac_offset;
55 		skb->network_header = skb->mac_header + mac_len;
56 		skb->mac_len = mac_len;
57 	}
58 
59 out:
60 	return segs;
61 }
62 void *__pskb_pull_tail(struct sk_buff *skb, int delta)
63 {
64 	/* If skb has not enough free space at tail, get new one
65 	 * plus 128 bytes for future expansions. If we have enough
66 	 * room at tail, reallocate without expansion only if skb is cloned.
67 	 */
68 	int i, k, eat = (skb->tail + delta) - skb->end;
69 
70 	if (eat > 0 || skb_cloned(skb)) {
71 		if (pskb_expand_head(skb, 0, eat > 0 ? eat + 128 : 0,
72 				     GFP_ATOMIC))
73 			return NULL;
74 	}
75 
76 	BUG_ON(skb_copy_bits(skb, skb_headlen(skb),
77 			     skb_tail_pointer(skb), delta));
78 
79 	/* Optimization: no fragments, no reasons to preestimate
80 	 * size of pulled pages. Superb.
81 	 */
82 	if (!skb_has_frag_list(skb))
83 		goto pull_pages;
84 
85 	/* Estimate size of pulled pages. */
86 	eat = delta;
87 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
88 		int size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
89 
90 		if (size >= eat)
91 			goto pull_pages;
92 		eat -= size;
93 	}
94 
95 	/* If we need update frag list, we are in troubles.
96 	 * Certainly, it is possible to add an offset to skb data,
97 	 * but taking into account that pulling is expected to
98 	 * be very rare operation, it is worth to fight against
99 	 * further bloating skb head and crucify ourselves here instead.
100 	 * Pure masohism, indeed. 8)8)
101 	 */
102 	if (eat) {
103 		struct sk_buff *list = skb_shinfo(skb)->frag_list;
104 		struct sk_buff *clone = NULL;
105 		struct sk_buff *insp = NULL;
106 
107 		do {
108 			if (list->len <= eat) {
109 				/* Eaten as whole. */
110 				eat -= list->len;
111 				list = list->next;
112 				insp = list;
113 			} else {
114 				/* Eaten partially. */
115 				if (skb_is_gso(skb) && !list->head_frag &&
116 				    skb_headlen(list))
117 					skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
118 
119 				if (skb_shared(list)) {
120 					/* Sucks! We need to fork list. :-( */
121 					clone = skb_clone(list, GFP_ATOMIC);
122 					if (!clone)
123 						return NULL;
124 					insp = list->next;
125 					list = clone;
126 				} else {
127 					/* This may be pulled without
128 					 * problems. */
129 					insp = list;
130 				}
131 				if (!pskb_pull(list, eat)) {
132 					kfree_skb(clone);
133 					return NULL;
134 				}
135 				break;
136 			}
137 		} while (eat);
138 
139 		/* Free pulled out fragments. */
140 		while ((list = skb_shinfo(skb)->frag_list) != insp) {
141 			skb_shinfo(skb)->frag_list = list->next;
142 			consume_skb(list);
143 		}
144 		/* And insert new clone at head. */
145 		if (clone) {
146 			clone->next = list;
147 			skb_shinfo(skb)->frag_list = clone;
148 		}
149 	}
150 	/* Success! Now we may commit changes to skb data. */
151 
152 pull_pages:
153 	eat = delta;
154 	k = 0;
155 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
156 		int size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
157 
158 		if (size <= eat) {
159 			skb_frag_unref(skb, i);
160 			eat -= size;
161 		} else {
162 			skb_frag_t *frag = &skb_shinfo(skb)->frags[k];
163 
164 			*frag = skb_shinfo(skb)->frags[i];
165 			if (eat) {
166 				skb_frag_off_add(frag, eat);
167 				skb_frag_size_sub(frag, eat);
168 				if (!i)
169 					goto end;
170 				eat = 0;
171 			}
172 			k++;
173 		}
174 	}
175 	skb_shinfo(skb)->nr_frags = k;
176 
177 end:
178 	skb->tail     += delta;
179 	skb->data_len -= delta;
180 
181 	if (!skb->data_len)
182 		skb_zcopy_clear(skb, false);
183 
184 	return skb_tail_pointer(skb);
185 }
186 static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy_success)
187 {
188 	struct ubuf_info *uarg = skb_zcopy(skb);
189 
190 	if (uarg) {
191 		if (!skb_zcopy_is_nouarg(skb))
192 			uarg->callback(skb, uarg, zerocopy_success);
193 
194 		skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY;
195 	}
196 }
197 static inline void *__skb_push(struct sk_buff *skb, unsigned int len)
198 {
199 	DEBUG_NET_WARN_ON_ONCE(len > INT_MAX);
200 
201 	skb->data -= len;
202 	skb->len  += len;
203 	return skb->data;
204 }
205 static inline bool skb_has_frag_list(const struct sk_buff *skb)
206 {
207 	return skb_shinfo(skb)->frag_list != NULL;
208 }
209 __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
210 {
211 	__be16 type = skb->protocol;
212 
213 	/* Tunnel gso handlers can set protocol to ethernet. */
214 	if (type == htons(ETH_P_TEB)) {
215 		struct ethhdr *eth;
216 
217 		if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr))))
218 			return 0;
219 
220 		eth = (struct ethhdr *)skb->data;
221 		type = eth->h_proto;
222 	}
223 
224 	return vlan_get_protocol_and_depth(skb, type, depth);
225 }
226 int __weak skb_copy_bits(const struct sk_buff *skb, int offset, void *to,
227 			 int len)
228 {
229 	return -EFAULT;
230 }
231 static inline bool skb_is_gso(const struct sk_buff *skb)
232 {
233 	return skb_shinfo(skb)->gso_size;
234 }
235 static inline __be16 tun_p_to_eth_p(u8 proto)
236 {
237 	switch (proto) {
238 	case TUN_P_IPV4:
239 		return htons(ETH_P_IP);
240 	case TUN_P_IPV6:
241 		return htons(ETH_P_IPV6);
242 	case TUN_P_ETHERNET:
243 		return htons(ETH_P_TEB);
244 	case TUN_P_NSH:
245 		return htons(ETH_P_NSH);
246 	case TUN_P_MPLS_UC:
247 		return htons(ETH_P_MPLS_UC);
248 	}
249 	return 0;
250 }
251 static inline long __must_check IS_ERR_OR_NULL(const void *ptr)
252 {
253 	return !ptr || IS_ERR_VALUE((unsigned long)ptr);
254 }
255 struct sk_buff *skb_mac_gso_segment(struct sk_buff *skb,
256 				    netdev_features_t features)
257 {
258 	struct sk_buff *segs = ERR_PTR(-EPROTONOSUPPORT);
259 	struct packet_offload *ptype;
260 	int vlan_depth = skb->mac_len;
261 	__be16 type = skb_network_protocol(skb, &vlan_depth);
262 
263 	if (unlikely(!type))
264 		return ERR_PTR(-EINVAL);
265 
266 	__skb_pull(skb, vlan_depth);
267 
268 	rcu_read_lock();
269 	list_for_each_entry_rcu(ptype, &offload_base, list) {
270 		if (ptype->type == type && ptype->callbacks.gso_segment) {
271 			segs = ptype->callbacks.gso_segment(skb, features);
272 			break;
273 		}
274 	}
275 	rcu_read_unlock();
276 
277 	__skb_push(skb, skb->data - skb_mac_header(skb));
278 
279 	return segs;
280 }
281 static inline unsigned int skb_headlen(const struct sk_buff *skb)
282 {
283 	return skb->len - skb->data_len;
284 }
285 static inline void skb_reset_transport_header(struct sk_buff *skb)
286 {
287 	skb->transport_header = skb->data - skb->head;
288 }
289 static inline u16 nsh_hdr_len(const struct nshhdr *nsh)
290 {
291 	return ((ntohs(nsh->ver_flags_ttl_len) & NSH_LEN_MASK)
292 		>> NSH_LEN_SHIFT) << 2;
293 }
294 static inline void skb_gso_error_unwind(struct sk_buff *skb, __be16 protocol,
295 					int pulled_hlen, u16 mac_offset,
296 					int mac_len)
297 {
298 	skb->protocol = protocol;
299 	skb->encapsulation = 1;
300 	skb_push(skb, pulled_hlen);
301 	skb_reset_transport_header(skb);
302 	skb->mac_header = mac_offset;
303 	skb->network_header = skb->mac_header + mac_len;
304 	skb->mac_len = mac_len;
305 }
306 static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len)
307 {
308 	DEBUG_NET_WARN_ON_ONCE(len > INT_MAX);
309 
310 	if (likely(len <= skb_headlen(skb)))
311 		return true;
312 	if (unlikely(len > skb->len))
313 		return false;
314 	return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL;
315 }
316 static inline void skb_frag_size_sub(skb_frag_t *frag, int delta)
317 {
318 	frag->bv_len -= delta;
319 }
320 static inline int skb_cloned(const struct sk_buff *skb)
321 {
322 	return skb->cloned &&
323 	       (atomic_read(&skb_shinfo(skb)->dataref) & SKB_DATAREF_MASK) != 1;
324 }
325 static inline void skb_frag_unref(struct sk_buff *skb, int f)
326 {
327 	struct skb_shared_info *shinfo = skb_shinfo(skb);
328 
329 	if (!skb_zcopy_managed(skb))
330 		__skb_frag_unref(&shinfo->frags[f], skb->pp_recycle);
331 }
332 static inline void skb_reset_mac_header(struct sk_buff *skb)
333 {
334 	skb->mac_header = skb->data - skb->head;
335 }
336 static inline struct nshhdr *nsh_hdr(struct sk_buff *skb)
337 {
338 	return (struct nshhdr *)skb_network_header(skb);
339 }
340 struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
341 {
342 	struct sk_buff_fclones *fclones = container_of(skb,
343 						       struct sk_buff_fclones,
344 						       skb1);
345 	struct sk_buff *n;
346 
347 	if (skb_orphan_frags(skb, gfp_mask))
348 		return NULL;
349 
350 	if (skb->fclone == SKB_FCLONE_ORIG &&
351 	    refcount_read(&fclones->fclone_ref) == 1) {
352 		n = &fclones->skb2;
353 		refcount_set(&fclones->fclone_ref, 2);
354 		n->fclone = SKB_FCLONE_CLONE;
355 	} else {
356 		if (skb_pfmemalloc(skb))
357 			gfp_mask |= __GFP_MEMALLOC;
358 
359 		n = kmem_cache_alloc(skbuff_head_cache, gfp_mask);
360 		if (!n)
361 			return NULL;
362 
363 		n->fclone = SKB_FCLONE_UNAVAILABLE;
364 	}
365 
366 	return __skb_clone(n, skb);
367 }
368 static inline void skb_frag_off_add(skb_frag_t *frag, int delta)
369 {
370 	frag->bv_offset += delta;
371 }
```
which has a vulnerability among CWE-787 and among lines:
```
3 	DEBUG_NET_WARN_ON_ONCE(len > INT_MAX);
```
Please generate five possible patches for the vulnerability.