Print this page
new smatch
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/tools/smatch/src/check_deref.c
+++ new/usr/src/tools/smatch/src/check_deref.c
1 1 /*
2 2 * Copyright (C) 2010 Dan Carpenter.
3 3 *
4 4 * This program is free software; you can redistribute it and/or
5 5 * modify it under the terms of the GNU General Public License
6 6 * as published by the Free Software Foundation; either version 2
7 7 * of the License, or (at your option) any later version.
8 8 *
9 9 * This program is distributed in the hope that it will be useful,
10 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 * GNU General Public License for more details.
13 13 *
14 14 * You should have received a copy of the GNU General Public License
15 15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 16 */
17 17
18 18 /*
19 19 * There was a previous null dereference test but it was too confusing and
20 20 * difficult to debug. This test is much simpler in its goals and scope.
21 21 *
22 22 * This test only complains about:
23 23 * 1) dereferencing uninitialized variables
24 24 * 2) dereferencing variables which were assigned as null.
25 25 * 3) dereferencing variables which were assigned a function the returns
26 26 * null.
27 27 *
28 28 * If we dereference something then we complain if any of those three
29 29 * are possible.
30 30 *
31 31 */
32 32
33 33 #include "smatch.h"
34 34 #include "smatch_slist.h"
35 35 #include "smatch_extra.h"
36 36
37 37 static int my_id;
38 38
39 39 #define __GFP_NOFAIL 0x800
40 40
41 41 STATE(null);
42 42 STATE(ok);
43 43 STATE(uninitialized);
44 44
45 45 static struct smatch_state *alloc_my_state(const char *name)
46 46 {
47 47 struct smatch_state *state;
48 48
49 49 state = __alloc_smatch_state(0);
50 50 state->name = name;
51 51 return state;
52 52 }
53 53
54 54 static struct smatch_state *unmatched_state(struct sm_state *sm)
55 55 {
56 56 return &ok;
57 57 }
58 58
59 59 static void is_ok(struct sm_state *sm, struct expression *mod_expr)
60 60 {
61 61 set_state(my_id, sm->name, sm->sym, &ok);
62 62 }
63 63
64 64 static void check_dereference(struct expression *expr)
65 65 {
66 66 struct sm_state *sm;
67 67 struct sm_state *tmp;
68 68
69 69 expr = strip_expr(expr);
70 70 if (is_static(expr))
71 71 return;
72 72 sm = get_sm_state_expr(my_id, expr);
73 73 if (!sm)
74 74 return;
75 75 if (is_ignored(my_id, sm->name, sm->sym))
76 76 return;
77 77 if (implied_not_equal(expr, 0))
78 78 return;
79 79 if (is_impossible_path())
80 80 return;
81 81
82 82 FOR_EACH_PTR(sm->possible, tmp) {
83 83 if (tmp->state == &merged)
84 84 continue;
85 85 if (tmp->state == &ok)
86 86 continue;
87 87 add_ignore(my_id, sm->name, sm->sym);
88 88 if (tmp->state == &null) {
89 89 if (option_spammy)
90 90 sm_error("potential NULL dereference '%s'.", tmp->name);
91 91 return;
92 92 }
93 93 if (tmp->state == &uninitialized) {
94 94 if (option_spammy)
95 95 sm_error("potentially dereferencing uninitialized '%s'.", tmp->name);
96 96 return;
97 97 }
98 98 sm_error("potential null dereference '%s'. (%s returns null)",
99 99 tmp->name, tmp->state->name);
100 100 return;
101 101 } END_FOR_EACH_PTR(tmp);
102 102 }
103 103
104 104 static void check_dereference_name_sym(char *name, struct symbol *sym)
105 105 {
106 106 struct sm_state *sm;
107 107 struct sm_state *tmp;
108 108
109 109 sm = get_sm_state(my_id, name, sym);
110 110 if (!sm)
111 111 return;
112 112 if (is_ignored(my_id, sm->name, sm->sym))
113 113 return;
114 114 if (implied_not_equal_name_sym(name, sym, 0))
115 115 return;
116 116 if (is_impossible_path())
117 117 return;
118 118
119 119 FOR_EACH_PTR(sm->possible, tmp) {
120 120 if (tmp->state == &merged)
121 121 continue;
122 122 if (tmp->state == &ok)
123 123 continue;
124 124 add_ignore(my_id, sm->name, sm->sym);
125 125 if (tmp->state == &null) {
126 126 if (option_spammy)
127 127 sm_error("potential NULL dereference '%s'.", tmp->name);
128 128 return;
129 129 }
130 130 if (tmp->state == &uninitialized) {
131 131 if (option_spammy)
132 132 sm_error("potentially dereferencing uninitialized '%s'.", tmp->name);
133 133 return;
134 134 }
135 135 sm_error("potential null dereference '%s'. (%s returns null)",
136 136 tmp->name, tmp->state->name);
137 137 return;
138 138 } END_FOR_EACH_PTR(tmp);
139 139 }
140 140
141 141 static void match_dereferences(struct expression *expr)
142 142 {
143 143 if (expr->type != EXPR_PREOP)
144 144 return;
145 145 check_dereference(expr->unop);
146 146 }
147 147
148 148 static void match_pointer_as_array(struct expression *expr)
149 149 {
150 150 if (!is_array(expr))
151 151 return;
152 152 check_dereference(get_array_base(expr));
153 153 }
154 154
155 155 static void set_param_dereferenced(struct expression *call, struct expression *arg, char *key, char *unused)
156 156 {
157 157 struct symbol *sym;
158 158 char *name;
159 159
160 160 name = get_variable_from_key(arg, key, &sym);
161 161 if (!name || !sym)
162 162 goto free;
163 163
164 164 check_dereference_name_sym(name, sym);
165 165 free:
166 166 free_string(name);
167 167 }
168 168
169 169 static void match_declarations(struct symbol *sym)
170 170 {
171 171 const char *name;
172 172
173 173 if ((get_base_type(sym))->type == SYM_ARRAY)
174 174 return;
175 175
176 176 if (!sym->ident)
177 177 return;
178 178 name = sym->ident->name;
|
↓ open down ↓ |
178 lines elided |
↑ open up ↑ |
179 179 if (!sym->initializer) {
180 180 set_state(my_id, name, sym, &uninitialized);
181 181 scoped_state(my_id, name, sym);
182 182 }
183 183 }
184 184
185 185 static void match_assign(struct expression *expr)
186 186 {
187 187 struct statement *stmt;
188 188
189 - if (!is_zero(expr->right))
189 + if (!expr_is_zero(expr->right))
190 190 return;
191 191
192 192 if (__in_fake_assign)
193 193 return;
194 194
195 195 FOR_EACH_PTR_REVERSE(big_statement_stack, stmt) {
196 196 if (stmt->type == STMT_DECLARATION)
197 197 return;
198 198 break;
199 199 } END_FOR_EACH_PTR_REVERSE(stmt);
200 200
201 201 set_state_expr(my_id, expr->left, &null);
202 202 }
203 203
204 204 static void match_assigns_address(struct expression *expr)
205 205 {
206 206 struct expression *right;
207 207
208 208 right = strip_expr(expr->right);
209 209 if (right->type != EXPR_PREOP || right->op != '&')
210 210 return;
211 211 set_state_expr(my_id, right, &ok);
212 212 }
213 213
214 214 static void match_condition(struct expression *expr)
215 215 {
216 216 if (expr->type == EXPR_ASSIGNMENT) {
217 217 match_condition(expr->right);
218 218 match_condition(expr->left);
219 219 }
220 220 if (!get_state_expr(my_id, expr))
221 221 return;
222 222 set_true_false_states_expr(my_id, expr, &ok, NULL);
223 223 }
224 224
225 225 static int called_with_no_fail(struct expression *call, int param)
226 226 {
227 227 struct expression *arg;
228 228 sval_t sval;
229 229
230 230 if (param == -1)
231 231 return 0;
232 232 call = strip_expr(call);
233 233 if (call->type != EXPR_CALL)
234 234 return 0;
235 235 arg = get_argument_from_call_expr(call->args, param);
236 236 if (get_value(arg, &sval) && (sval.uvalue & __GFP_NOFAIL))
237 237 return 1;
238 238 return 0;
239 239 }
240 240
241 241 static void match_assign_returns_null(const char *fn, struct expression *expr, void *_gfp)
242 242 {
243 243 struct smatch_state *state;
244 244 int gfp_param = PTR_INT(_gfp);
245 245
246 246 if (called_with_no_fail(expr->right, gfp_param))
247 247 return;
248 248 state = alloc_my_state(fn);
249 249 set_state_expr(my_id, expr->left, state);
250 250 }
251 251
252 252 static void register_allocation_funcs(void)
253 253 {
254 254 struct token *token;
255 255 const char *func;
256 256 int arg;
257 257
258 258 token = get_tokens_file("kernel.allocation_funcs_gfp");
259 259 if (!token)
260 260 return;
261 261 if (token_type(token) != TOKEN_STREAMBEGIN)
262 262 return;
263 263 token = token->next;
264 264 while (token_type(token) != TOKEN_STREAMEND) {
265 265 if (token_type(token) != TOKEN_IDENT)
266 266 return;
267 267 func = show_ident(token->ident);
268 268 token = token->next;
269 269 if (token_type(token) == TOKEN_IDENT)
270 270 arg = -1;
271 271 else if (token_type(token) == TOKEN_NUMBER)
272 272 arg = atoi(token->number);
273 273 else
274 274 return;
275 275 add_function_assign_hook(func, &match_assign_returns_null, INT_PTR(arg));
276 276 token = token->next;
277 277 }
278 278 clear_token_alloc();
279 279 }
280 280
281 281 void check_deref(int id)
282 282 {
283 283 my_id = id;
284 284
285 285 add_unmatched_state_hook(my_id, &unmatched_state);
286 286 add_modification_hook(my_id, &is_ok);
287 287 add_hook(&match_dereferences, DEREF_HOOK);
288 288 add_hook(&match_pointer_as_array, OP_HOOK);
289 289 select_return_implies_hook(DEREFERENCE, &set_param_dereferenced);
290 290 add_hook(&match_condition, CONDITION_HOOK);
291 291 add_hook(&match_declarations, DECLARATION_HOOK);
292 292 add_hook(&match_assign, ASSIGNMENT_HOOK);
293 293 add_hook(&match_assigns_address, ASSIGNMENT_HOOK);
294 294 if (option_project == PROJ_KERNEL)
295 295 register_allocation_funcs();
296 296 }
|
↓ open down ↓ |
97 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX