1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17 
  18 /*
  19  * This is kernel specific stuff for smatch_extra.
  20  */
  21 
  22 #include "scope.h"
  23 #include "smatch.h"
  24 #include "smatch_extra.h"
  25 
  26 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
  27 {
  28         struct expression *arg;
  29 
  30         arg = get_argument_from_call_expr(call->args, 0);
  31         if (!get_implied_rl(arg, rl))
  32                 *rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(-1));
  33         return 1;
  34 }
  35 
  36 static void hack_ERR_PTR(struct symbol *sym)
  37 {
  38         struct symbol *arg;
  39         struct smatch_state *estate;
  40         struct range_list *after;
  41         sval_t low_error;
  42         sval_t minus_one;
  43         sval_t zero;
  44 
  45         low_error.type = &long_ctype;
  46         low_error.value = -4095;
  47 
  48         minus_one.type = &long_ctype;
  49         minus_one.value = -1;
  50 
  51         zero.type = &long_ctype;
  52         zero.value = 0;
  53 
  54         if (!sym || !sym->ident)
  55                 return;
  56         if (strcmp(sym->ident->name, "ERR_PTR") != 0)
  57                 return;
  58 
  59         arg = first_ptr_list((struct ptr_list *)sym->ctype.base_type->arguments);
  60         if (!arg || !arg->ident)
  61                 return;
  62 
  63         estate = get_state(SMATCH_EXTRA, arg->ident->name, arg);
  64         if (!estate) {
  65                 after = alloc_rl(low_error, minus_one);
  66         } else {
  67                 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero));
  68                 if (rl_equiv(estate_rl(estate), after))
  69                         return;
  70         }
  71         set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after));
  72 }
  73 
  74 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
  75                         struct expression *assign_expr, void *_param)
  76 {
  77         int param = PTR_INT(_param);
  78         struct expression *arg;
  79         struct smatch_state *pre_state;
  80         struct smatch_state *end_state;
  81 
  82         arg = get_argument_from_call_expr(call_expr->args, param);
  83         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  84         end_state = estate_filter_range(pre_state, ll_to_sval(-4095), ll_to_sval(0));
  85         set_extra_expr_nomod(arg, end_state);
  86 }
  87 
  88 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
  89                         struct expression *assign_expr, void *_param)
  90 {
  91         int param = PTR_INT(_param);
  92         struct expression *arg;
  93         struct range_list *rl;
  94         struct smatch_state *pre_state;
  95         struct smatch_state *end_state;
  96 
  97         arg = get_argument_from_call_expr(call_expr->args, param);
  98         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  99         rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(0));
 100         rl = rl_intersection(estate_rl(pre_state), rl);
 101         rl = cast_rl(estate_type(pre_state), rl);
 102         end_state = alloc_estate_rl(rl);
 103         set_extra_expr_nomod(arg, end_state);
 104 }
 105 
 106 static void match_not_err(const char *fn, struct expression *call_expr,
 107                         struct expression *assign_expr, void *unused)
 108 {
 109         struct expression *arg;
 110         struct smatch_state *pre_state;
 111         struct smatch_state *new_state;
 112 
 113         arg = get_argument_from_call_expr(call_expr->args, 0);
 114         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 115         new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-1));
 116         set_extra_expr_nomod(arg, new_state);
 117 }
 118 
 119 static void match_err(const char *fn, struct expression *call_expr,
 120                         struct expression *assign_expr, void *unused)
 121 {
 122         struct expression *arg;
 123         struct smatch_state *pre_state;
 124         struct smatch_state *new_state;
 125 
 126         arg = get_argument_from_call_expr(call_expr->args, 0);
 127         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 128         new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-4096));
 129         new_state = estate_filter_range(new_state, ll_to_sval(0), sval_type_max(&long_ctype));
 130         set_extra_expr_nomod(arg, new_state);
 131 }
 132 
 133 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
 134 {
 135         set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 136 }
 137 
 138 static void match_container_of(struct expression *expr)
 139 {
 140         struct expression *right = expr->right;
 141         char *macro;
 142 
 143         /*
 144          * The problem here is that sometimes the container_of() macro is itself
 145          * inside a macro and get_macro() only returns the name of the outside
 146          * macro.
 147          */
 148 
 149         /*
 150          * This actually an expression statement assignment but smatch_flow
 151          * pre-mangles it for us so we only get the last chunk:
 152          * sk = (typeof(sk))((char *)__mptr - offsetof(...))
 153          */
 154 
 155         macro = get_macro_name(right->pos);
 156         if (!macro)
 157                 return;
 158         if (right->type != EXPR_CAST)
 159                 return;
 160         right = strip_expr(right);
 161         if (right->type != EXPR_BINOP || right->op != '-' ||
 162             right->left->type != EXPR_CAST)
 163                 return;
 164         right = strip_expr(right->left);
 165         if (right->type != EXPR_SYMBOL)
 166                 return;
 167         if (!right->symbol->ident ||
 168             strcmp(right->symbol->ident->name, "__mptr") != 0)
 169                 return;
 170         set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 171 }
 172 
 173 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl)
 174 {
 175         struct expression *start_arg;
 176         struct expression *size_arg;
 177         struct symbol *type;
 178         sval_t min, max, tmp;
 179 
 180         size_arg = get_argument_from_call_expr(call->args, 1);
 181         /* btw. there isn't a start_arg for find_first_bit() */
 182         start_arg = get_argument_from_call_expr(call->args, 2);
 183 
 184         type = get_type(call);
 185         min = sval_type_val(type, 0);
 186         max = sval_type_val(type, sizeof(long long) * 8);
 187 
 188         if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value)
 189                 max = tmp;
 190         if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp))
 191                 min = tmp;
 192         if (sval_cmp(min, max) > 0)
 193                 max = min;
 194         min = sval_cast(type, min);
 195         max = sval_cast(type, max);
 196         *rl = alloc_rl(min, max);
 197         return 1;
 198 }
 199 
 200 static int match_fls(struct expression *call, void *unused, struct range_list **rl)
 201 {
 202         struct expression *arg;
 203         struct range_list *arg_rl;
 204         sval_t zero = {};
 205         sval_t start, end, sval;
 206 
 207         start.type = &int_ctype;
 208         start.value = 0;
 209         end.type = &int_ctype;
 210         end.value = 32;
 211 
 212         arg = get_argument_from_call_expr(call->args, 0);
 213         if (!get_implied_rl(arg, &arg_rl))
 214                 return 0;
 215         if (rl_to_sval(arg_rl, &sval)) {
 216                 int i;
 217 
 218                 for (i = 63; i >= 0; i--) {
 219                         if (sval.uvalue & 1ULL << i)
 220                                 break;
 221                 }
 222                 sval.value = i + 1;
 223                 *rl = alloc_rl(sval, sval);
 224                 return 1;
 225         }
 226         zero.type = rl_type(arg_rl);
 227         if (!rl_has_sval(arg_rl, zero))
 228                 start.value = 1;
 229         *rl = alloc_rl(start, end);
 230         return 1;
 231 }
 232 
 233 
 234 
 235 static void find_module_init_exit(struct symbol_list *sym_list)
 236 {
 237         struct symbol *sym;
 238         struct symbol *fn;
 239         struct statement *stmt;
 240         char *name;
 241         int init;
 242         int count;
 243 
 244         /*
 245          * This is more complicated because Sparse ignores the "alias"
 246          * attribute.  I search backwards because module_init() is normally at
 247          * the end of the file.
 248          */
 249         count = 0;
 250         FOR_EACH_PTR_REVERSE(sym_list, sym) {
 251                 if (sym->type != SYM_NODE)
 252                         continue;
 253                 if (!(sym->ctype.modifiers & MOD_STATIC))
 254                         continue;
 255                 fn = get_base_type(sym);
 256                 if (!fn)
 257                         continue;
 258                 if (fn->type != SYM_FN)
 259                         continue;
 260                 if (!sym->ident)
 261                         continue;
 262                 if (!fn->inline_stmt)
 263                         continue;
 264                 if (strcmp(sym->ident->name, "__inittest") == 0)
 265                         init = 1;
 266                 else if (strcmp(sym->ident->name, "__exittest") == 0)
 267                         init = 0;
 268                 else
 269                         continue;
 270 
 271                 count++;
 272 
 273                 stmt = first_ptr_list((struct ptr_list *)fn->inline_stmt->stmts);
 274                 if (!stmt || stmt->type != STMT_RETURN)
 275                         continue;
 276                 name = expr_to_var(stmt->ret_value);
 277                 if (!name)
 278                         continue;
 279                 if (init)
 280                         sql_insert_function_ptr(name, "(struct module)->init");
 281                 else
 282                         sql_insert_function_ptr(name, "(struct module)->exit");
 283                 free_string(name);
 284                 if (count >= 2)
 285                         return;
 286         } END_FOR_EACH_PTR_REVERSE(sym);
 287 }
 288 
 289 static void match_end_file(struct symbol_list *sym_list)
 290 {
 291         struct symbol *sym;
 292 
 293         /* find the last static symbol in the file */
 294         FOR_EACH_PTR_REVERSE(sym_list, sym) {
 295                 if (!(sym->ctype.modifiers & MOD_STATIC))
 296                         continue;
 297                 if (!sym->scope)
 298                         continue;
 299                 find_module_init_exit(sym->scope->symbols);
 300                 return;
 301         } END_FOR_EACH_PTR_REVERSE(sym);
 302 }
 303 
 304 static struct expression *get_val_expr(struct expression *expr)
 305 {
 306         struct symbol *sym, *val;
 307 
 308         if (expr->type != EXPR_DEREF)
 309                 return NULL;
 310         expr = expr->deref;
 311         if (expr->type != EXPR_SYMBOL)
 312                 return NULL;
 313         if (strcmp(expr->symbol_name->name, "__u") != 0)
 314                 return NULL;
 315         sym = get_base_type(expr->symbol);
 316         val = first_ptr_list((struct ptr_list *)sym->symbol_list);
 317         if (!val || strcmp(val->ident->name, "__val") != 0)
 318                 return NULL;
 319         return member_expression(expr, '.', val->ident);
 320 }
 321 
 322 static void match__write_once_size(const char *fn, struct expression *call,
 323                                void *unused)
 324 {
 325         struct expression *dest, *data, *assign;
 326         struct range_list *rl;
 327 
 328         dest = get_argument_from_call_expr(call->args, 0);
 329         if (dest->type != EXPR_PREOP || dest->op != '&')
 330                 return;
 331         dest = strip_expr(dest->unop);
 332 
 333         data = get_argument_from_call_expr(call->args, 1);
 334         data = get_val_expr(data);
 335         if (!data)
 336                 return;
 337         get_absolute_rl(data, &rl);
 338         assign = assign_expression(dest, '=', data);
 339 
 340         __in_fake_assign++;
 341         __split_expr(assign);
 342         __in_fake_assign--;
 343 }
 344 
 345 static void match__read_once_size(const char *fn, struct expression *call,
 346                                void *unused)
 347 {
 348         struct expression *dest, *data, *assign;
 349         struct symbol *type, *val_sym;
 350 
 351         /*
 352          * We want to change:
 353          *      __read_once_size_nocheck(&(x), __u.__c, sizeof(x));
 354          * into a fake assignment:
 355          *      __u.val = x;
 356          *
 357          */
 358 
 359         data = get_argument_from_call_expr(call->args, 0);
 360         if (data->type != EXPR_PREOP || data->op != '&')
 361                 return;
 362         data = strip_parens(data->unop);
 363 
 364         dest = get_argument_from_call_expr(call->args, 1);
 365         if (dest->type != EXPR_DEREF || dest->op != '.')
 366                 return;
 367         if (!dest->member || strcmp(dest->member->name, "__c") != 0)
 368                 return;
 369         dest = dest->deref;
 370         type = get_type(dest);
 371         if (!type)
 372                 return;
 373         val_sym = first_ptr_list((struct ptr_list *)type->symbol_list);
 374         dest = member_expression(dest, '.', val_sym->ident);
 375 
 376         assign = assign_expression(dest, '=', data);
 377         __in_fake_assign++;
 378         __split_expr(assign);
 379         __in_fake_assign--;
 380 }
 381 
 382 void check_kernel(int id)
 383 {
 384         if (option_project != PROJ_KERNEL)
 385                 return;
 386 
 387         add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
 388         add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
 389         add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
 390         add_hook(hack_ERR_PTR, AFTER_DEF_HOOK);
 391         return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
 392         return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
 393         return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
 394         return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
 395         return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
 396 
 397         add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
 398         add_hook(match_container_of, ASSIGNMENT_HOOK);
 399 
 400         add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
 401         add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
 402         add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
 403         add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
 404 
 405         add_implied_return_hook("fls", &match_fls, NULL);
 406         add_implied_return_hook("fls64", &match_fls, NULL);
 407 
 408         add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL);
 409         add_function_hook("__write_once_size", &match__write_once_size, NULL);
 410 
 411         add_function_hook("__read_once_size", &match__read_once_size, NULL);
 412         add_function_hook("__read_once_size_nocheck", &match__read_once_size, NULL);
 413 
 414         if (option_info)
 415                 add_hook(match_end_file, END_FILE_HOOK);
 416 }