1 /*
2 * Copyright (C) 2010 Dan Carpenter.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 /*
19 * This is kernel specific stuff for smatch_extra.
20 */
21
22 #include "scope.h"
23 #include "smatch.h"
24 #include "smatch_extra.h"
25
26 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
27 {
28 struct expression *arg;
29
30 arg = get_argument_from_call_expr(call->args, 0);
31 if (!get_implied_rl(arg, rl))
32 *rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(-1));
33 return 1;
34 }
35
36 static void hack_ERR_PTR(struct symbol *sym)
37 {
38 struct symbol *arg;
39 struct smatch_state *estate;
40 struct range_list *after;
41 sval_t low_error;
42 sval_t minus_one;
43 sval_t zero;
44
45 low_error.type = &long_ctype;
46 low_error.value = -4095;
47
48 minus_one.type = &long_ctype;
49 minus_one.value = -1;
50
51 zero.type = &long_ctype;
52 zero.value = 0;
53
54 if (!sym || !sym->ident)
55 return;
56 if (strcmp(sym->ident->name, "ERR_PTR") != 0)
57 return;
58
59 arg = first_ptr_list((struct ptr_list *)sym->ctype.base_type->arguments);
60 if (!arg || !arg->ident)
61 return;
62
63 estate = get_state(SMATCH_EXTRA, arg->ident->name, arg);
64 if (!estate) {
65 after = alloc_rl(low_error, minus_one);
66 } else {
67 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero));
68 if (rl_equiv(estate_rl(estate), after))
69 return;
70 }
71 set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after));
72 }
73
74 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
75 struct expression *assign_expr, void *_param)
76 {
77 int param = PTR_INT(_param);
78 struct expression *arg;
79 struct smatch_state *pre_state;
80 struct smatch_state *end_state;
81
82 arg = get_argument_from_call_expr(call_expr->args, param);
83 pre_state = get_state_expr(SMATCH_EXTRA, arg);
84 end_state = estate_filter_range(pre_state, ll_to_sval(-4095), ll_to_sval(0));
85 set_extra_expr_nomod(arg, end_state);
86 }
87
88 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
89 struct expression *assign_expr, void *_param)
90 {
91 int param = PTR_INT(_param);
92 struct expression *arg;
93 struct range_list *rl;
94 struct smatch_state *pre_state;
95 struct smatch_state *end_state;
96
97 arg = get_argument_from_call_expr(call_expr->args, param);
98 pre_state = get_state_expr(SMATCH_EXTRA, arg);
99 rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(0));
100 rl = rl_intersection(estate_rl(pre_state), rl);
101 rl = cast_rl(estate_type(pre_state), rl);
102 end_state = alloc_estate_rl(rl);
103 set_extra_expr_nomod(arg, end_state);
104 }
105
106 static void match_not_err(const char *fn, struct expression *call_expr,
107 struct expression *assign_expr, void *unused)
108 {
109 struct expression *arg;
110 struct smatch_state *pre_state;
111 struct smatch_state *new_state;
112
113 arg = get_argument_from_call_expr(call_expr->args, 0);
114 pre_state = get_state_expr(SMATCH_EXTRA, arg);
115 new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-1));
116 set_extra_expr_nomod(arg, new_state);
117 }
118
119 static void match_err(const char *fn, struct expression *call_expr,
120 struct expression *assign_expr, void *unused)
121 {
122 struct expression *arg;
123 struct smatch_state *pre_state;
124 struct smatch_state *new_state;
125
126 arg = get_argument_from_call_expr(call_expr->args, 0);
127 pre_state = get_state_expr(SMATCH_EXTRA, arg);
128 new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-4096));
129 new_state = estate_filter_range(new_state, ll_to_sval(0), sval_type_max(&long_ctype));
130 set_extra_expr_nomod(arg, new_state);
131 }
132
133 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
134 {
135 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
136 }
137
138 static void match_container_of(struct expression *expr)
139 {
140 struct expression *right = expr->right;
141 char *macro;
142
143 /*
144 * The problem here is that sometimes the container_of() macro is itself
145 * inside a macro and get_macro() only returns the name of the outside
146 * macro.
147 */
148
149 /*
150 * This actually an expression statement assignment but smatch_flow
151 * pre-mangles it for us so we only get the last chunk:
152 * sk = (typeof(sk))((char *)__mptr - offsetof(...))
153 */
154
155 macro = get_macro_name(right->pos);
156 if (!macro)
157 return;
158 if (right->type != EXPR_CAST)
159 return;
160 right = strip_expr(right);
161 if (right->type != EXPR_BINOP || right->op != '-' ||
162 right->left->type != EXPR_CAST)
163 return;
164 right = strip_expr(right->left);
165 if (right->type != EXPR_SYMBOL)
166 return;
167 if (!right->symbol->ident ||
168 strcmp(right->symbol->ident->name, "__mptr") != 0)
169 return;
170 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
171 }
172
173 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl)
174 {
175 struct expression *start_arg;
176 struct expression *size_arg;
177 struct symbol *type;
178 sval_t min, max, tmp;
179
180 size_arg = get_argument_from_call_expr(call->args, 1);
181 /* btw. there isn't a start_arg for find_first_bit() */
182 start_arg = get_argument_from_call_expr(call->args, 2);
183
184 type = get_type(call);
185 min = sval_type_val(type, 0);
186 max = sval_type_val(type, sizeof(long long) * 8);
187
188 if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value)
189 max = tmp;
190 if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp))
191 min = tmp;
192 if (sval_cmp(min, max) > 0)
193 max = min;
194 min = sval_cast(type, min);
195 max = sval_cast(type, max);
196 *rl = alloc_rl(min, max);
197 return 1;
198 }
199
200 static int match_fls(struct expression *call, void *unused, struct range_list **rl)
201 {
202 struct expression *arg;
203 struct range_list *arg_rl;
204 sval_t zero = {};
205 sval_t start, end, sval;
206
207 start.type = &int_ctype;
208 start.value = 0;
209 end.type = &int_ctype;
210 end.value = 32;
211
212 arg = get_argument_from_call_expr(call->args, 0);
213 if (!get_implied_rl(arg, &arg_rl))
214 return 0;
215 if (rl_to_sval(arg_rl, &sval)) {
216 int i;
217
218 for (i = 63; i >= 0; i--) {
219 if (sval.uvalue & 1ULL << i)
220 break;
221 }
222 sval.value = i + 1;
223 *rl = alloc_rl(sval, sval);
224 return 1;
225 }
226 zero.type = rl_type(arg_rl);
227 if (!rl_has_sval(arg_rl, zero))
228 start.value = 1;
229 *rl = alloc_rl(start, end);
230 return 1;
231 }
232
233
234
235 static void find_module_init_exit(struct symbol_list *sym_list)
236 {
237 struct symbol *sym;
238 struct symbol *fn;
239 struct statement *stmt;
240 char *name;
241 int init;
242 int count;
243
244 /*
245 * This is more complicated because Sparse ignores the "alias"
246 * attribute. I search backwards because module_init() is normally at
247 * the end of the file.
248 */
249 count = 0;
250 FOR_EACH_PTR_REVERSE(sym_list, sym) {
251 if (sym->type != SYM_NODE)
252 continue;
253 if (!(sym->ctype.modifiers & MOD_STATIC))
254 continue;
255 fn = get_base_type(sym);
256 if (!fn)
257 continue;
258 if (fn->type != SYM_FN)
259 continue;
260 if (!sym->ident)
261 continue;
262 if (!fn->inline_stmt)
263 continue;
264 if (strcmp(sym->ident->name, "__inittest") == 0)
265 init = 1;
266 else if (strcmp(sym->ident->name, "__exittest") == 0)
267 init = 0;
268 else
269 continue;
270
271 count++;
272
273 stmt = first_ptr_list((struct ptr_list *)fn->inline_stmt->stmts);
274 if (!stmt || stmt->type != STMT_RETURN)
275 continue;
276 name = expr_to_var(stmt->ret_value);
277 if (!name)
278 continue;
279 if (init)
280 sql_insert_function_ptr(name, "(struct module)->init");
281 else
282 sql_insert_function_ptr(name, "(struct module)->exit");
283 free_string(name);
284 if (count >= 2)
285 return;
286 } END_FOR_EACH_PTR_REVERSE(sym);
287 }
288
289 static void match_end_file(struct symbol_list *sym_list)
290 {
291 struct symbol *sym;
292
293 /* find the last static symbol in the file */
294 FOR_EACH_PTR_REVERSE(sym_list, sym) {
295 if (!(sym->ctype.modifiers & MOD_STATIC))
296 continue;
297 if (!sym->scope)
298 continue;
299 find_module_init_exit(sym->scope->symbols);
300 return;
301 } END_FOR_EACH_PTR_REVERSE(sym);
302 }
303
304 static struct expression *get_val_expr(struct expression *expr)
305 {
306 struct symbol *sym, *val;
307
308 if (expr->type != EXPR_DEREF)
309 return NULL;
310 expr = expr->deref;
311 if (expr->type != EXPR_SYMBOL)
312 return NULL;
313 if (strcmp(expr->symbol_name->name, "__u") != 0)
314 return NULL;
315 sym = get_base_type(expr->symbol);
316 val = first_ptr_list((struct ptr_list *)sym->symbol_list);
317 if (!val || strcmp(val->ident->name, "__val") != 0)
318 return NULL;
319 return member_expression(expr, '.', val->ident);
320 }
321
322 static void match__write_once_size(const char *fn, struct expression *call,
323 void *unused)
324 {
325 struct expression *dest, *data, *assign;
326 struct range_list *rl;
327
328 dest = get_argument_from_call_expr(call->args, 0);
329 if (dest->type != EXPR_PREOP || dest->op != '&')
330 return;
331 dest = strip_expr(dest->unop);
332
333 data = get_argument_from_call_expr(call->args, 1);
334 data = get_val_expr(data);
335 if (!data)
336 return;
337 get_absolute_rl(data, &rl);
338 assign = assign_expression(dest, '=', data);
339
340 __in_fake_assign++;
341 __split_expr(assign);
342 __in_fake_assign--;
343 }
344
345 static void match__read_once_size(const char *fn, struct expression *call,
346 void *unused)
347 {
348 struct expression *dest, *data, *assign;
349 struct symbol *type, *val_sym;
350
351 /*
352 * We want to change:
353 * __read_once_size_nocheck(&(x), __u.__c, sizeof(x));
354 * into a fake assignment:
355 * __u.val = x;
356 *
357 */
358
359 data = get_argument_from_call_expr(call->args, 0);
360 if (data->type != EXPR_PREOP || data->op != '&')
361 return;
362 data = strip_parens(data->unop);
363
364 dest = get_argument_from_call_expr(call->args, 1);
365 if (dest->type != EXPR_DEREF || dest->op != '.')
366 return;
367 if (!dest->member || strcmp(dest->member->name, "__c") != 0)
368 return;
369 dest = dest->deref;
370 type = get_type(dest);
371 if (!type)
372 return;
373 val_sym = first_ptr_list((struct ptr_list *)type->symbol_list);
374 dest = member_expression(dest, '.', val_sym->ident);
375
376 assign = assign_expression(dest, '=', data);
377 __in_fake_assign++;
378 __split_expr(assign);
379 __in_fake_assign--;
380 }
381
382 void check_kernel(int id)
383 {
384 if (option_project != PROJ_KERNEL)
385 return;
386
387 add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
388 add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
389 add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
390 add_hook(hack_ERR_PTR, AFTER_DEF_HOOK);
391 return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
392 return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
393 return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
394 return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
395 return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
396
397 add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
398 add_hook(match_container_of, ASSIGNMENT_HOOK);
399
400 add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
401 add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
402 add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
403 add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
404
405 add_implied_return_hook("fls", &match_fls, NULL);
406 add_implied_return_hook("fls64", &match_fls, NULL);
407
408 add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL);
409 add_function_hook("__write_once_size", &match__write_once_size, NULL);
410
411 add_function_hook("__read_once_size", &match__read_once_size, NULL);
412 add_function_hook("__read_once_size_nocheck", &match__read_once_size, NULL);
413
414 if (option_info)
415 add_hook(match_end_file, END_FILE_HOOK);
416 }