Print this page
11972 resync smatch
Split |
Close |
Expand all |
Collapse all |
--- old/usr/src/tools/smatch/src/check_kernel.c
+++ new/usr/src/tools/smatch/src/check_kernel.c
1 1 /*
2 2 * Copyright (C) 2010 Dan Carpenter.
3 3 *
4 4 * This program is free software; you can redistribute it and/or
5 5 * modify it under the terms of the GNU General Public License
6 6 * as published by the Free Software Foundation; either version 2
7 7 * of the License, or (at your option) any later version.
8 8 *
9 9 * This program is distributed in the hope that it will be useful,
10 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 * GNU General Public License for more details.
13 13 *
14 14 * You should have received a copy of the GNU General Public License
15 15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 16 */
17 17
18 18 /*
19 19 * This is kernel specific stuff for smatch_extra.
20 20 */
21 21
22 22 #include "scope.h"
23 23 #include "smatch.h"
24 24 #include "smatch_extra.h"
25 25
26 26 static sval_t err_ptr_min;
27 27 static sval_t err_ptr_max;
28 28 static sval_t null_ptr;
29 29
30 30 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
31 31 {
32 32 struct expression *arg;
33 33
34 34 arg = get_argument_from_call_expr(call->args, 0);
35 35 if (!get_implied_rl(arg, rl)) {
36 36 *rl = alloc_rl(err_ptr_min, err_ptr_max);
37 37 *rl = cast_rl(get_type(arg), *rl);
38 38 }
39 39 return 1;
40 40 }
41 41
42 42 static void hack_ERR_PTR(struct symbol *sym)
43 43 {
44 44 struct symbol *arg;
45 45 struct smatch_state *estate;
46 46 struct range_list *after;
47 47 sval_t low_error;
48 48 sval_t minus_one;
49 49 sval_t zero;
50 50
51 51 low_error.type = &long_ctype;
52 52 low_error.value = -4095;
53 53
54 54 minus_one.type = &long_ctype;
55 55 minus_one.value = -1;
56 56
57 57 zero.type = &long_ctype;
58 58 zero.value = 0;
59 59
60 60 if (!sym || !sym->ident)
61 61 return;
62 62 if (strcmp(sym->ident->name, "ERR_PTR") != 0)
63 63 return;
64 64
65 65 arg = first_ptr_list((struct ptr_list *)sym->ctype.base_type->arguments);
66 66 if (!arg || !arg->ident)
67 67 return;
68 68
69 69 estate = get_state(SMATCH_EXTRA, arg->ident->name, arg);
70 70 if (!estate) {
71 71 after = alloc_rl(low_error, minus_one);
72 72 } else {
73 73 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero));
74 74 if (rl_equiv(estate_rl(estate), after))
75 75 return;
76 76 }
77 77 set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after));
78 78 }
79 79
80 80 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
81 81 struct expression *assign_expr, void *_param)
82 82 {
83 83 int param = PTR_INT(_param);
84 84 struct expression *arg;
85 85 struct smatch_state *pre_state;
86 86 struct smatch_state *end_state;
87 87 struct range_list *rl;
88 88
89 89 arg = get_argument_from_call_expr(call_expr->args, param);
90 90 pre_state = get_state_expr(SMATCH_EXTRA, arg);
91 91 if (estate_rl(pre_state)) {
92 92 rl = estate_rl(pre_state);
93 93 rl = remove_range(rl, null_ptr, null_ptr);
94 94 rl = remove_range(rl, err_ptr_min, err_ptr_max);
95 95 } else {
96 96 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
↓ open down ↓ |
96 lines elided |
↑ open up ↑ |
97 97 }
98 98 end_state = alloc_estate_rl(rl);
99 99 set_extra_expr_nomod(arg, end_state);
100 100 }
101 101
102 102 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
103 103 struct expression *assign_expr, void *_param)
104 104 {
105 105 int param = PTR_INT(_param);
106 106 struct expression *arg;
107 - struct range_list *rl;
107 + struct range_list *pre, *rl;
108 108 struct smatch_state *pre_state;
109 109 struct smatch_state *end_state;
110 110
111 111 arg = get_argument_from_call_expr(call_expr->args, param);
112 112 pre_state = get_state_expr(SMATCH_EXTRA, arg);
113 + if (pre_state)
114 + pre = estate_rl(pre_state);
115 + else
116 + pre = alloc_whole_rl(&ptr_ctype);
113 117 call_results_to_rl(call_expr, &ptr_ctype, "0,(-4095)-(-1)", &rl);
114 - rl = rl_intersection(estate_rl(pre_state), rl);
118 + rl = rl_intersection(pre, rl);
115 119 rl = cast_rl(get_type(arg), rl);
116 120 end_state = alloc_estate_rl(rl);
117 121 set_extra_expr_nomod(arg, end_state);
118 122 }
119 123
120 124 static void match_not_err(const char *fn, struct expression *call_expr,
121 125 struct expression *assign_expr, void *unused)
122 126 {
123 127 struct expression *arg;
124 128 struct smatch_state *pre_state;
125 129 struct range_list *rl;
126 130
127 131 arg = get_argument_from_call_expr(call_expr->args, 0);
128 132 pre_state = get_state_expr(SMATCH_EXTRA, arg);
129 133 if (estate_rl(pre_state)) {
130 134 rl = estate_rl(pre_state);
131 135 rl = remove_range(rl, err_ptr_min, err_ptr_max);
132 136 } else {
133 137 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
134 138 }
135 139 rl = cast_rl(get_type(arg), rl);
136 140 set_extra_expr_nomod(arg, alloc_estate_rl(rl));
137 141 }
138 142
139 143 static void match_err(const char *fn, struct expression *call_expr,
140 144 struct expression *assign_expr, void *unused)
141 145 {
142 146 struct expression *arg;
143 147 struct smatch_state *pre_state;
144 148 struct range_list *rl;
145 149
146 150 arg = get_argument_from_call_expr(call_expr->args, 0);
147 151 pre_state = get_state_expr(SMATCH_EXTRA, arg);
148 152 rl = estate_rl(pre_state);
149 153 if (!rl)
150 154 rl = alloc_rl(err_ptr_min, err_ptr_max);
151 155 rl = rl_intersection(rl, alloc_rl(err_ptr_min, err_ptr_max));
152 156 rl = cast_rl(get_type(arg), rl);
153 157 set_extra_expr_nomod(arg, alloc_estate_rl(rl));
154 158 }
155 159
156 160 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
157 161 {
158 162 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
159 163 }
160 164
161 165 static void match_container_of(struct expression *expr)
162 166 {
163 167 struct expression *right = expr->right;
164 168 char *macro;
165 169
166 170 /*
167 171 * The problem here is that sometimes the container_of() macro is itself
168 172 * inside a macro and get_macro() only returns the name of the outside
169 173 * macro.
170 174 */
171 175
172 176 /*
173 177 * This actually an expression statement assignment but smatch_flow
174 178 * pre-mangles it for us so we only get the last chunk:
175 179 * sk = (typeof(sk))((char *)__mptr - offsetof(...))
176 180 */
177 181
178 182 macro = get_macro_name(right->pos);
179 183 if (!macro)
180 184 return;
181 185 if (right->type != EXPR_CAST)
182 186 return;
183 187 right = strip_expr(right);
184 188 if (right->type != EXPR_BINOP || right->op != '-' ||
185 189 right->left->type != EXPR_CAST)
186 190 return;
187 191 right = strip_expr(right->left);
188 192 if (right->type != EXPR_SYMBOL)
189 193 return;
190 194 if (!right->symbol->ident ||
191 195 strcmp(right->symbol->ident->name, "__mptr") != 0)
192 196 return;
193 197 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
194 198 }
195 199
196 200 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl)
197 201 {
198 202 struct expression *start_arg;
199 203 struct expression *size_arg;
200 204 struct symbol *type;
201 205 sval_t min, max, tmp;
202 206
203 207 size_arg = get_argument_from_call_expr(call->args, 1);
204 208 /* btw. there isn't a start_arg for find_first_bit() */
205 209 start_arg = get_argument_from_call_expr(call->args, 2);
206 210
207 211 type = get_type(call);
208 212 min = sval_type_val(type, 0);
209 213 max = sval_type_val(type, sizeof(long long) * 8);
210 214
211 215 if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value)
212 216 max = tmp;
213 217 if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp))
214 218 min = tmp;
215 219 if (sval_cmp(min, max) > 0)
216 220 max = min;
217 221 min = sval_cast(type, min);
218 222 max = sval_cast(type, max);
219 223 *rl = alloc_rl(min, max);
220 224 return 1;
221 225 }
222 226
223 227 static int match_fls(struct expression *call, void *unused, struct range_list **rl)
224 228 {
225 229 struct expression *arg;
226 230 struct range_list *arg_rl;
227 231 sval_t zero = {};
228 232 sval_t start, end, sval;
229 233
230 234 start.type = &int_ctype;
231 235 start.value = 0;
232 236 end.type = &int_ctype;
233 237 end.value = 32;
234 238
235 239 arg = get_argument_from_call_expr(call->args, 0);
236 240 if (!get_implied_rl(arg, &arg_rl))
237 241 return 0;
238 242 if (rl_to_sval(arg_rl, &sval)) {
239 243 int i;
240 244
241 245 for (i = 63; i >= 0; i--) {
242 246 if (sval.uvalue & 1ULL << i)
243 247 break;
244 248 }
245 249 sval.value = i + 1;
246 250 *rl = alloc_rl(sval, sval);
247 251 return 1;
248 252 }
249 253 zero.type = rl_type(arg_rl);
250 254 if (!rl_has_sval(arg_rl, zero))
251 255 start.value = 1;
252 256 *rl = alloc_rl(start, end);
253 257 return 1;
254 258 }
255 259
256 260
257 261
258 262 static void find_module_init_exit(struct symbol_list *sym_list)
259 263 {
260 264 struct symbol *sym;
261 265 struct symbol *fn;
262 266 struct statement *stmt;
263 267 char *name;
264 268 int init;
265 269 int count;
266 270
267 271 /*
268 272 * This is more complicated because Sparse ignores the "alias"
269 273 * attribute. I search backwards because module_init() is normally at
270 274 * the end of the file.
271 275 */
272 276 count = 0;
273 277 FOR_EACH_PTR_REVERSE(sym_list, sym) {
274 278 if (sym->type != SYM_NODE)
275 279 continue;
276 280 if (!(sym->ctype.modifiers & MOD_STATIC))
277 281 continue;
278 282 fn = get_base_type(sym);
279 283 if (!fn)
280 284 continue;
281 285 if (fn->type != SYM_FN)
282 286 continue;
283 287 if (!sym->ident)
284 288 continue;
285 289 if (!fn->inline_stmt)
286 290 continue;
287 291 if (strcmp(sym->ident->name, "__inittest") == 0)
288 292 init = 1;
289 293 else if (strcmp(sym->ident->name, "__exittest") == 0)
290 294 init = 0;
291 295 else
292 296 continue;
293 297
294 298 count++;
295 299
296 300 stmt = first_ptr_list((struct ptr_list *)fn->inline_stmt->stmts);
297 301 if (!stmt || stmt->type != STMT_RETURN)
298 302 continue;
299 303 name = expr_to_var(stmt->ret_value);
300 304 if (!name)
301 305 continue;
302 306 if (init)
303 307 sql_insert_function_ptr(name, "(struct module)->init");
304 308 else
305 309 sql_insert_function_ptr(name, "(struct module)->exit");
306 310 free_string(name);
307 311 if (count >= 2)
308 312 return;
309 313 } END_FOR_EACH_PTR_REVERSE(sym);
310 314 }
311 315
312 316 static void match_end_file(struct symbol_list *sym_list)
313 317 {
314 318 struct symbol *sym;
315 319
316 320 /* find the last static symbol in the file */
317 321 FOR_EACH_PTR_REVERSE(sym_list, sym) {
318 322 if (!(sym->ctype.modifiers & MOD_STATIC))
319 323 continue;
320 324 if (!sym->scope)
321 325 continue;
322 326 find_module_init_exit(sym->scope->symbols);
323 327 return;
324 328 } END_FOR_EACH_PTR_REVERSE(sym);
325 329 }
326 330
327 331 static struct expression *get_val_expr(struct expression *expr)
328 332 {
329 333 struct symbol *sym, *val;
330 334
331 335 if (expr->type != EXPR_DEREF)
332 336 return NULL;
333 337 expr = expr->deref;
334 338 if (expr->type != EXPR_SYMBOL)
335 339 return NULL;
336 340 if (strcmp(expr->symbol_name->name, "__u") != 0)
337 341 return NULL;
338 342 sym = get_base_type(expr->symbol);
339 343 val = first_ptr_list((struct ptr_list *)sym->symbol_list);
340 344 if (!val || strcmp(val->ident->name, "__val") != 0)
341 345 return NULL;
342 346 return member_expression(expr, '.', val->ident);
343 347 }
344 348
345 349 static void match__write_once_size(const char *fn, struct expression *call,
346 350 void *unused)
347 351 {
348 352 struct expression *dest, *data, *assign;
349 353 struct range_list *rl;
350 354
351 355 dest = get_argument_from_call_expr(call->args, 0);
352 356 if (dest->type != EXPR_PREOP || dest->op != '&')
353 357 return;
354 358 dest = strip_expr(dest->unop);
355 359
356 360 data = get_argument_from_call_expr(call->args, 1);
357 361 data = get_val_expr(data);
358 362 if (!data)
359 363 return;
360 364 get_absolute_rl(data, &rl);
361 365 assign = assign_expression(dest, '=', data);
362 366
363 367 __in_fake_assign++;
364 368 __split_expr(assign);
365 369 __in_fake_assign--;
366 370 }
367 371
368 372 static void match__read_once_size(const char *fn, struct expression *call,
369 373 void *unused)
370 374 {
371 375 struct expression *dest, *data, *assign;
372 376 struct symbol *type, *val_sym;
373 377
374 378 /*
375 379 * We want to change:
376 380 * __read_once_size_nocheck(&(x), __u.__c, sizeof(x));
377 381 * into a fake assignment:
378 382 * __u.val = x;
379 383 *
380 384 */
381 385
382 386 data = get_argument_from_call_expr(call->args, 0);
383 387 if (data->type != EXPR_PREOP || data->op != '&')
384 388 return;
385 389 data = strip_parens(data->unop);
386 390
387 391 dest = get_argument_from_call_expr(call->args, 1);
388 392 if (dest->type != EXPR_DEREF || dest->op != '.')
389 393 return;
390 394 if (!dest->member || strcmp(dest->member->name, "__c") != 0)
391 395 return;
392 396 dest = dest->deref;
393 397 type = get_type(dest);
394 398 if (!type)
395 399 return;
396 400 val_sym = first_ptr_list((struct ptr_list *)type->symbol_list);
397 401 dest = member_expression(dest, '.', val_sym->ident);
398 402
399 403 assign = assign_expression(dest, '=', data);
400 404 __in_fake_assign++;
401 405 __split_expr(assign);
402 406 __in_fake_assign--;
403 407 }
404 408
405 409 bool is_ignored_kernel_data(const char *name)
406 410 {
407 411 if (option_project != PROJ_KERNEL)
408 412 return false;
409 413
410 414 /*
411 415 * On the file I was looking at lockdep was 25% of the DB.
412 416 */
413 417 if (strstr(name, ".dep_map."))
414 418 return true;
415 419 if (strstr(name, ".lockdep_map."))
416 420 return true;
417 421 return false;
418 422 }
419 423
420 424 void check_kernel(int id)
421 425 {
422 426 if (option_project != PROJ_KERNEL)
423 427 return;
424 428
425 429 err_ptr_min.type = &ptr_ctype;
426 430 err_ptr_min.value = -4095;
427 431 err_ptr_max.type = &ptr_ctype;
428 432 err_ptr_max.value = -1l;
429 433 null_ptr.type = &ptr_ctype;
430 434 null_ptr.value = 0;
431 435
432 436 err_ptr_min = sval_cast(&ptr_ctype, err_ptr_min);
433 437 err_ptr_max = sval_cast(&ptr_ctype, err_ptr_max);
434 438
435 439 add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
436 440 add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
437 441 add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
438 442 add_hook(hack_ERR_PTR, AFTER_DEF_HOOK);
439 443 return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
440 444 return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
441 445 return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
442 446 return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
443 447 return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
444 448
445 449 add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
446 450 add_hook(match_container_of, ASSIGNMENT_HOOK);
447 451
448 452 add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
449 453 add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
450 454 add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
451 455 add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
452 456
453 457 add_implied_return_hook("fls", &match_fls, NULL);
454 458 add_implied_return_hook("fls64", &match_fls, NULL);
455 459
456 460 add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL);
457 461 add_function_hook("__write_once_size", &match__write_once_size, NULL);
458 462
459 463 add_function_hook("__read_once_size", &match__read_once_size, NULL);
460 464 add_function_hook("__read_once_size_nocheck", &match__read_once_size, NULL);
461 465
462 466 if (option_info)
463 467 add_hook(match_end_file, END_FILE_HOOK);
464 468 }
↓ open down ↓ |
340 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX