Print this page
11506 smatch resync
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/tools/smatch/src/check_kernel.c
+++ new/usr/src/tools/smatch/src/check_kernel.c
1 1 /*
2 2 * Copyright (C) 2010 Dan Carpenter.
3 3 *
4 4 * This program is free software; you can redistribute it and/or
5 5 * modify it under the terms of the GNU General Public License
6 6 * as published by the Free Software Foundation; either version 2
7 7 * of the License, or (at your option) any later version.
8 8 *
9 9 * This program is distributed in the hope that it will be useful,
10 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 * GNU General Public License for more details.
13 13 *
14 14 * You should have received a copy of the GNU General Public License
15 15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
|
↓ open down ↓ |
15 lines elided |
↑ open up ↑ |
16 16 */
17 17
18 18 /*
19 19 * This is kernel specific stuff for smatch_extra.
20 20 */
21 21
22 22 #include "scope.h"
23 23 #include "smatch.h"
24 24 #include "smatch_extra.h"
25 25
26 +static sval_t err_ptr_min;
27 +static sval_t err_ptr_max;
28 +static sval_t null_ptr;
29 +
26 30 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
27 31 {
28 32 struct expression *arg;
29 33
30 34 arg = get_argument_from_call_expr(call->args, 0);
31 - if (!get_implied_rl(arg, rl))
32 - *rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(-1));
35 + if (!get_implied_rl(arg, rl)) {
36 + *rl = alloc_rl(err_ptr_min, err_ptr_max);
37 + *rl = cast_rl(get_type(arg), *rl);
38 + }
33 39 return 1;
34 40 }
35 41
36 42 static void hack_ERR_PTR(struct symbol *sym)
37 43 {
38 44 struct symbol *arg;
39 45 struct smatch_state *estate;
40 46 struct range_list *after;
41 47 sval_t low_error;
42 48 sval_t minus_one;
43 49 sval_t zero;
44 50
45 51 low_error.type = &long_ctype;
46 52 low_error.value = -4095;
47 53
48 54 minus_one.type = &long_ctype;
49 55 minus_one.value = -1;
50 56
51 57 zero.type = &long_ctype;
52 58 zero.value = 0;
53 59
54 60 if (!sym || !sym->ident)
55 61 return;
56 62 if (strcmp(sym->ident->name, "ERR_PTR") != 0)
57 63 return;
58 64
59 65 arg = first_ptr_list((struct ptr_list *)sym->ctype.base_type->arguments);
60 66 if (!arg || !arg->ident)
61 67 return;
62 68
63 69 estate = get_state(SMATCH_EXTRA, arg->ident->name, arg);
64 70 if (!estate) {
65 71 after = alloc_rl(low_error, minus_one);
66 72 } else {
67 73 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero));
68 74 if (rl_equiv(estate_rl(estate), after))
69 75 return;
70 76 }
|
↓ open down ↓ |
28 lines elided |
↑ open up ↑ |
71 77 set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after));
72 78 }
73 79
74 80 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
75 81 struct expression *assign_expr, void *_param)
76 82 {
77 83 int param = PTR_INT(_param);
78 84 struct expression *arg;
79 85 struct smatch_state *pre_state;
80 86 struct smatch_state *end_state;
87 + struct range_list *rl;
81 88
82 89 arg = get_argument_from_call_expr(call_expr->args, param);
83 90 pre_state = get_state_expr(SMATCH_EXTRA, arg);
84 - end_state = estate_filter_range(pre_state, ll_to_sval(-4095), ll_to_sval(0));
91 + if (estate_rl(pre_state)) {
92 + rl = estate_rl(pre_state);
93 + rl = remove_range(rl, null_ptr, null_ptr);
94 + rl = remove_range(rl, err_ptr_min, err_ptr_max);
95 + } else {
96 + rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
97 + }
98 + end_state = alloc_estate_rl(rl);
85 99 set_extra_expr_nomod(arg, end_state);
86 100 }
87 101
88 102 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
89 103 struct expression *assign_expr, void *_param)
90 104 {
91 105 int param = PTR_INT(_param);
92 106 struct expression *arg;
93 107 struct range_list *rl;
94 108 struct smatch_state *pre_state;
95 109 struct smatch_state *end_state;
96 110
97 111 arg = get_argument_from_call_expr(call_expr->args, param);
98 112 pre_state = get_state_expr(SMATCH_EXTRA, arg);
99 - rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(0));
113 + call_results_to_rl(call_expr, &ptr_ctype, "0,(-4095)-(-1)", &rl);
100 114 rl = rl_intersection(estate_rl(pre_state), rl);
101 - rl = cast_rl(estate_type(pre_state), rl);
115 + rl = cast_rl(get_type(arg), rl);
102 116 end_state = alloc_estate_rl(rl);
103 117 set_extra_expr_nomod(arg, end_state);
104 118 }
105 119
106 120 static void match_not_err(const char *fn, struct expression *call_expr,
107 121 struct expression *assign_expr, void *unused)
108 122 {
109 123 struct expression *arg;
110 124 struct smatch_state *pre_state;
111 - struct smatch_state *new_state;
125 + struct range_list *rl;
112 126
113 127 arg = get_argument_from_call_expr(call_expr->args, 0);
114 128 pre_state = get_state_expr(SMATCH_EXTRA, arg);
115 - new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-1));
116 - set_extra_expr_nomod(arg, new_state);
129 + if (estate_rl(pre_state)) {
130 + rl = estate_rl(pre_state);
131 + rl = remove_range(rl, err_ptr_min, err_ptr_max);
132 + } else {
133 + rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
134 + }
135 + rl = cast_rl(get_type(arg), rl);
136 + set_extra_expr_nomod(arg, alloc_estate_rl(rl));
117 137 }
118 138
119 139 static void match_err(const char *fn, struct expression *call_expr,
120 140 struct expression *assign_expr, void *unused)
121 141 {
122 142 struct expression *arg;
123 143 struct smatch_state *pre_state;
124 - struct smatch_state *new_state;
144 + struct range_list *rl;
125 145
126 146 arg = get_argument_from_call_expr(call_expr->args, 0);
127 147 pre_state = get_state_expr(SMATCH_EXTRA, arg);
128 - new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-4096));
129 - new_state = estate_filter_range(new_state, ll_to_sval(0), sval_type_max(&long_ctype));
130 - set_extra_expr_nomod(arg, new_state);
148 + rl = estate_rl(pre_state);
149 + if (!rl)
150 + rl = alloc_rl(err_ptr_min, err_ptr_max);
151 + rl = rl_intersection(rl, alloc_rl(err_ptr_min, err_ptr_max));
152 + rl = cast_rl(get_type(arg), rl);
153 + set_extra_expr_nomod(arg, alloc_estate_rl(rl));
131 154 }
132 155
133 156 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
134 157 {
135 158 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
136 159 }
137 160
138 161 static void match_container_of(struct expression *expr)
139 162 {
140 163 struct expression *right = expr->right;
141 164 char *macro;
142 165
143 166 /*
144 167 * The problem here is that sometimes the container_of() macro is itself
145 168 * inside a macro and get_macro() only returns the name of the outside
146 169 * macro.
147 170 */
148 171
149 172 /*
150 173 * This actually an expression statement assignment but smatch_flow
151 174 * pre-mangles it for us so we only get the last chunk:
152 175 * sk = (typeof(sk))((char *)__mptr - offsetof(...))
153 176 */
154 177
155 178 macro = get_macro_name(right->pos);
156 179 if (!macro)
157 180 return;
158 181 if (right->type != EXPR_CAST)
159 182 return;
160 183 right = strip_expr(right);
161 184 if (right->type != EXPR_BINOP || right->op != '-' ||
162 185 right->left->type != EXPR_CAST)
163 186 return;
164 187 right = strip_expr(right->left);
165 188 if (right->type != EXPR_SYMBOL)
166 189 return;
167 190 if (!right->symbol->ident ||
168 191 strcmp(right->symbol->ident->name, "__mptr") != 0)
169 192 return;
170 193 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
171 194 }
172 195
173 196 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl)
174 197 {
175 198 struct expression *start_arg;
176 199 struct expression *size_arg;
177 200 struct symbol *type;
178 201 sval_t min, max, tmp;
179 202
180 203 size_arg = get_argument_from_call_expr(call->args, 1);
181 204 /* btw. there isn't a start_arg for find_first_bit() */
182 205 start_arg = get_argument_from_call_expr(call->args, 2);
183 206
184 207 type = get_type(call);
185 208 min = sval_type_val(type, 0);
186 209 max = sval_type_val(type, sizeof(long long) * 8);
187 210
188 211 if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value)
189 212 max = tmp;
190 213 if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp))
191 214 min = tmp;
192 215 if (sval_cmp(min, max) > 0)
193 216 max = min;
194 217 min = sval_cast(type, min);
195 218 max = sval_cast(type, max);
196 219 *rl = alloc_rl(min, max);
197 220 return 1;
198 221 }
199 222
200 223 static int match_fls(struct expression *call, void *unused, struct range_list **rl)
201 224 {
202 225 struct expression *arg;
203 226 struct range_list *arg_rl;
204 227 sval_t zero = {};
205 228 sval_t start, end, sval;
206 229
207 230 start.type = &int_ctype;
208 231 start.value = 0;
209 232 end.type = &int_ctype;
210 233 end.value = 32;
211 234
212 235 arg = get_argument_from_call_expr(call->args, 0);
213 236 if (!get_implied_rl(arg, &arg_rl))
214 237 return 0;
215 238 if (rl_to_sval(arg_rl, &sval)) {
216 239 int i;
217 240
218 241 for (i = 63; i >= 0; i--) {
219 242 if (sval.uvalue & 1ULL << i)
220 243 break;
221 244 }
222 245 sval.value = i + 1;
223 246 *rl = alloc_rl(sval, sval);
224 247 return 1;
225 248 }
226 249 zero.type = rl_type(arg_rl);
227 250 if (!rl_has_sval(arg_rl, zero))
228 251 start.value = 1;
229 252 *rl = alloc_rl(start, end);
230 253 return 1;
231 254 }
232 255
233 256
234 257
235 258 static void find_module_init_exit(struct symbol_list *sym_list)
236 259 {
237 260 struct symbol *sym;
238 261 struct symbol *fn;
239 262 struct statement *stmt;
240 263 char *name;
241 264 int init;
242 265 int count;
243 266
244 267 /*
245 268 * This is more complicated because Sparse ignores the "alias"
246 269 * attribute. I search backwards because module_init() is normally at
247 270 * the end of the file.
248 271 */
249 272 count = 0;
250 273 FOR_EACH_PTR_REVERSE(sym_list, sym) {
251 274 if (sym->type != SYM_NODE)
252 275 continue;
253 276 if (!(sym->ctype.modifiers & MOD_STATIC))
254 277 continue;
255 278 fn = get_base_type(sym);
256 279 if (!fn)
257 280 continue;
258 281 if (fn->type != SYM_FN)
259 282 continue;
260 283 if (!sym->ident)
261 284 continue;
262 285 if (!fn->inline_stmt)
263 286 continue;
264 287 if (strcmp(sym->ident->name, "__inittest") == 0)
265 288 init = 1;
266 289 else if (strcmp(sym->ident->name, "__exittest") == 0)
267 290 init = 0;
268 291 else
269 292 continue;
270 293
271 294 count++;
272 295
273 296 stmt = first_ptr_list((struct ptr_list *)fn->inline_stmt->stmts);
274 297 if (!stmt || stmt->type != STMT_RETURN)
275 298 continue;
276 299 name = expr_to_var(stmt->ret_value);
277 300 if (!name)
278 301 continue;
279 302 if (init)
280 303 sql_insert_function_ptr(name, "(struct module)->init");
281 304 else
282 305 sql_insert_function_ptr(name, "(struct module)->exit");
283 306 free_string(name);
284 307 if (count >= 2)
285 308 return;
286 309 } END_FOR_EACH_PTR_REVERSE(sym);
287 310 }
288 311
289 312 static void match_end_file(struct symbol_list *sym_list)
290 313 {
291 314 struct symbol *sym;
292 315
293 316 /* find the last static symbol in the file */
294 317 FOR_EACH_PTR_REVERSE(sym_list, sym) {
295 318 if (!(sym->ctype.modifiers & MOD_STATIC))
296 319 continue;
297 320 if (!sym->scope)
298 321 continue;
299 322 find_module_init_exit(sym->scope->symbols);
300 323 return;
301 324 } END_FOR_EACH_PTR_REVERSE(sym);
302 325 }
303 326
304 327 static struct expression *get_val_expr(struct expression *expr)
305 328 {
306 329 struct symbol *sym, *val;
307 330
308 331 if (expr->type != EXPR_DEREF)
309 332 return NULL;
310 333 expr = expr->deref;
311 334 if (expr->type != EXPR_SYMBOL)
312 335 return NULL;
313 336 if (strcmp(expr->symbol_name->name, "__u") != 0)
314 337 return NULL;
315 338 sym = get_base_type(expr->symbol);
316 339 val = first_ptr_list((struct ptr_list *)sym->symbol_list);
317 340 if (!val || strcmp(val->ident->name, "__val") != 0)
318 341 return NULL;
319 342 return member_expression(expr, '.', val->ident);
320 343 }
321 344
322 345 static void match__write_once_size(const char *fn, struct expression *call,
323 346 void *unused)
324 347 {
325 348 struct expression *dest, *data, *assign;
326 349 struct range_list *rl;
327 350
328 351 dest = get_argument_from_call_expr(call->args, 0);
329 352 if (dest->type != EXPR_PREOP || dest->op != '&')
330 353 return;
331 354 dest = strip_expr(dest->unop);
332 355
333 356 data = get_argument_from_call_expr(call->args, 1);
334 357 data = get_val_expr(data);
335 358 if (!data)
336 359 return;
337 360 get_absolute_rl(data, &rl);
338 361 assign = assign_expression(dest, '=', data);
339 362
340 363 __in_fake_assign++;
341 364 __split_expr(assign);
342 365 __in_fake_assign--;
343 366 }
344 367
345 368 static void match__read_once_size(const char *fn, struct expression *call,
346 369 void *unused)
347 370 {
348 371 struct expression *dest, *data, *assign;
349 372 struct symbol *type, *val_sym;
350 373
351 374 /*
352 375 * We want to change:
353 376 * __read_once_size_nocheck(&(x), __u.__c, sizeof(x));
354 377 * into a fake assignment:
355 378 * __u.val = x;
356 379 *
357 380 */
358 381
359 382 data = get_argument_from_call_expr(call->args, 0);
360 383 if (data->type != EXPR_PREOP || data->op != '&')
361 384 return;
362 385 data = strip_parens(data->unop);
363 386
364 387 dest = get_argument_from_call_expr(call->args, 1);
365 388 if (dest->type != EXPR_DEREF || dest->op != '.')
366 389 return;
367 390 if (!dest->member || strcmp(dest->member->name, "__c") != 0)
368 391 return;
369 392 dest = dest->deref;
370 393 type = get_type(dest);
371 394 if (!type)
|
↓ open down ↓ |
231 lines elided |
↑ open up ↑ |
372 395 return;
373 396 val_sym = first_ptr_list((struct ptr_list *)type->symbol_list);
374 397 dest = member_expression(dest, '.', val_sym->ident);
375 398
376 399 assign = assign_expression(dest, '=', data);
377 400 __in_fake_assign++;
378 401 __split_expr(assign);
379 402 __in_fake_assign--;
380 403 }
381 404
405 +bool is_ignored_kernel_data(const char *name)
406 +{
407 + if (option_project != PROJ_KERNEL)
408 + return false;
409 +
410 + /*
411 + * On the file I was looking at lockdep was 25% of the DB.
412 + */
413 + if (strstr(name, ".dep_map."))
414 + return true;
415 + if (strstr(name, ".lockdep_map."))
416 + return true;
417 + return false;
418 +}
419 +
382 420 void check_kernel(int id)
383 421 {
384 422 if (option_project != PROJ_KERNEL)
385 423 return;
386 424
425 + err_ptr_min.type = &ptr_ctype;
426 + err_ptr_min.value = -4095;
427 + err_ptr_max.type = &ptr_ctype;
428 + err_ptr_max.value = -1l;
429 + null_ptr.type = &ptr_ctype;
430 + null_ptr.value = 0;
431 +
432 + err_ptr_min = sval_cast(&ptr_ctype, err_ptr_min);
433 + err_ptr_max = sval_cast(&ptr_ctype, err_ptr_max);
434 +
387 435 add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
388 436 add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
389 437 add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
390 438 add_hook(hack_ERR_PTR, AFTER_DEF_HOOK);
391 439 return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
392 440 return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
393 441 return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
394 442 return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
395 443 return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
396 444
397 445 add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
398 446 add_hook(match_container_of, ASSIGNMENT_HOOK);
399 447
400 448 add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
401 449 add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
402 450 add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
403 451 add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
404 452
405 453 add_implied_return_hook("fls", &match_fls, NULL);
406 454 add_implied_return_hook("fls64", &match_fls, NULL);
407 455
408 456 add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL);
409 457 add_function_hook("__write_once_size", &match__write_once_size, NULL);
410 458
411 459 add_function_hook("__read_once_size", &match__read_once_size, NULL);
412 460 add_function_hook("__read_once_size_nocheck", &match__read_once_size, NULL);
413 461
414 462 if (option_info)
415 463 add_hook(match_end_file, END_FILE_HOOK);
416 464 }
|
↓ open down ↓ |
20 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX