6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 /*
19 * This is kernel specific stuff for smatch_extra.
20 */
21
22 #include "scope.h"
23 #include "smatch.h"
24 #include "smatch_extra.h"
25
26 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
27 {
28 struct expression *arg;
29
30 arg = get_argument_from_call_expr(call->args, 0);
31 if (!get_implied_rl(arg, rl))
32 *rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(-1));
33 return 1;
34 }
35
36 static void hack_ERR_PTR(struct symbol *sym)
37 {
38 struct symbol *arg;
39 struct smatch_state *estate;
40 struct range_list *after;
41 sval_t low_error;
42 sval_t minus_one;
43 sval_t zero;
44
45 low_error.type = &long_ctype;
46 low_error.value = -4095;
47
48 minus_one.type = &long_ctype;
49 minus_one.value = -1;
50
51 zero.type = &long_ctype;
52 zero.value = 0;
61 return;
62
63 estate = get_state(SMATCH_EXTRA, arg->ident->name, arg);
64 if (!estate) {
65 after = alloc_rl(low_error, minus_one);
66 } else {
67 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero));
68 if (rl_equiv(estate_rl(estate), after))
69 return;
70 }
71 set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after));
72 }
73
74 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
75 struct expression *assign_expr, void *_param)
76 {
77 int param = PTR_INT(_param);
78 struct expression *arg;
79 struct smatch_state *pre_state;
80 struct smatch_state *end_state;
81
82 arg = get_argument_from_call_expr(call_expr->args, param);
83 pre_state = get_state_expr(SMATCH_EXTRA, arg);
84 end_state = estate_filter_range(pre_state, ll_to_sval(-4095), ll_to_sval(0));
85 set_extra_expr_nomod(arg, end_state);
86 }
87
88 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
89 struct expression *assign_expr, void *_param)
90 {
91 int param = PTR_INT(_param);
92 struct expression *arg;
93 struct range_list *rl;
94 struct smatch_state *pre_state;
95 struct smatch_state *end_state;
96
97 arg = get_argument_from_call_expr(call_expr->args, param);
98 pre_state = get_state_expr(SMATCH_EXTRA, arg);
99 rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(0));
100 rl = rl_intersection(estate_rl(pre_state), rl);
101 rl = cast_rl(estate_type(pre_state), rl);
102 end_state = alloc_estate_rl(rl);
103 set_extra_expr_nomod(arg, end_state);
104 }
105
106 static void match_not_err(const char *fn, struct expression *call_expr,
107 struct expression *assign_expr, void *unused)
108 {
109 struct expression *arg;
110 struct smatch_state *pre_state;
111 struct smatch_state *new_state;
112
113 arg = get_argument_from_call_expr(call_expr->args, 0);
114 pre_state = get_state_expr(SMATCH_EXTRA, arg);
115 new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-1));
116 set_extra_expr_nomod(arg, new_state);
117 }
118
119 static void match_err(const char *fn, struct expression *call_expr,
120 struct expression *assign_expr, void *unused)
121 {
122 struct expression *arg;
123 struct smatch_state *pre_state;
124 struct smatch_state *new_state;
125
126 arg = get_argument_from_call_expr(call_expr->args, 0);
127 pre_state = get_state_expr(SMATCH_EXTRA, arg);
128 new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-4096));
129 new_state = estate_filter_range(new_state, ll_to_sval(0), sval_type_max(&long_ctype));
130 set_extra_expr_nomod(arg, new_state);
131 }
132
133 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
134 {
135 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
136 }
137
138 static void match_container_of(struct expression *expr)
139 {
140 struct expression *right = expr->right;
141 char *macro;
142
143 /*
144 * The problem here is that sometimes the container_of() macro is itself
145 * inside a macro and get_macro() only returns the name of the outside
146 * macro.
147 */
148
149 /*
150 * This actually an expression statement assignment but smatch_flow
362 data = strip_parens(data->unop);
363
364 dest = get_argument_from_call_expr(call->args, 1);
365 if (dest->type != EXPR_DEREF || dest->op != '.')
366 return;
367 if (!dest->member || strcmp(dest->member->name, "__c") != 0)
368 return;
369 dest = dest->deref;
370 type = get_type(dest);
371 if (!type)
372 return;
373 val_sym = first_ptr_list((struct ptr_list *)type->symbol_list);
374 dest = member_expression(dest, '.', val_sym->ident);
375
376 assign = assign_expression(dest, '=', data);
377 __in_fake_assign++;
378 __split_expr(assign);
379 __in_fake_assign--;
380 }
381
382 void check_kernel(int id)
383 {
384 if (option_project != PROJ_KERNEL)
385 return;
386
387 add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
388 add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
389 add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
390 add_hook(hack_ERR_PTR, AFTER_DEF_HOOK);
391 return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
392 return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
393 return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
394 return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
395 return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
396
397 add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
398 add_hook(match_container_of, ASSIGNMENT_HOOK);
399
400 add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
401 add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
402 add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
403 add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
404
405 add_implied_return_hook("fls", &match_fls, NULL);
406 add_implied_return_hook("fls64", &match_fls, NULL);
|
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 /*
19 * This is kernel specific stuff for smatch_extra.
20 */
21
22 #include "scope.h"
23 #include "smatch.h"
24 #include "smatch_extra.h"
25
26 static sval_t err_ptr_min;
27 static sval_t err_ptr_max;
28 static sval_t null_ptr;
29
30 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
31 {
32 struct expression *arg;
33
34 arg = get_argument_from_call_expr(call->args, 0);
35 if (!get_implied_rl(arg, rl)) {
36 *rl = alloc_rl(err_ptr_min, err_ptr_max);
37 *rl = cast_rl(get_type(arg), *rl);
38 }
39 return 1;
40 }
41
42 static void hack_ERR_PTR(struct symbol *sym)
43 {
44 struct symbol *arg;
45 struct smatch_state *estate;
46 struct range_list *after;
47 sval_t low_error;
48 sval_t minus_one;
49 sval_t zero;
50
51 low_error.type = &long_ctype;
52 low_error.value = -4095;
53
54 minus_one.type = &long_ctype;
55 minus_one.value = -1;
56
57 zero.type = &long_ctype;
58 zero.value = 0;
67 return;
68
69 estate = get_state(SMATCH_EXTRA, arg->ident->name, arg);
70 if (!estate) {
71 after = alloc_rl(low_error, minus_one);
72 } else {
73 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero));
74 if (rl_equiv(estate_rl(estate), after))
75 return;
76 }
77 set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after));
78 }
79
80 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
81 struct expression *assign_expr, void *_param)
82 {
83 int param = PTR_INT(_param);
84 struct expression *arg;
85 struct smatch_state *pre_state;
86 struct smatch_state *end_state;
87 struct range_list *rl;
88
89 arg = get_argument_from_call_expr(call_expr->args, param);
90 pre_state = get_state_expr(SMATCH_EXTRA, arg);
91 if (estate_rl(pre_state)) {
92 rl = estate_rl(pre_state);
93 rl = remove_range(rl, null_ptr, null_ptr);
94 rl = remove_range(rl, err_ptr_min, err_ptr_max);
95 } else {
96 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
97 }
98 end_state = alloc_estate_rl(rl);
99 set_extra_expr_nomod(arg, end_state);
100 }
101
102 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
103 struct expression *assign_expr, void *_param)
104 {
105 int param = PTR_INT(_param);
106 struct expression *arg;
107 struct range_list *rl;
108 struct smatch_state *pre_state;
109 struct smatch_state *end_state;
110
111 arg = get_argument_from_call_expr(call_expr->args, param);
112 pre_state = get_state_expr(SMATCH_EXTRA, arg);
113 call_results_to_rl(call_expr, &ptr_ctype, "0,(-4095)-(-1)", &rl);
114 rl = rl_intersection(estate_rl(pre_state), rl);
115 rl = cast_rl(get_type(arg), rl);
116 end_state = alloc_estate_rl(rl);
117 set_extra_expr_nomod(arg, end_state);
118 }
119
120 static void match_not_err(const char *fn, struct expression *call_expr,
121 struct expression *assign_expr, void *unused)
122 {
123 struct expression *arg;
124 struct smatch_state *pre_state;
125 struct range_list *rl;
126
127 arg = get_argument_from_call_expr(call_expr->args, 0);
128 pre_state = get_state_expr(SMATCH_EXTRA, arg);
129 if (estate_rl(pre_state)) {
130 rl = estate_rl(pre_state);
131 rl = remove_range(rl, err_ptr_min, err_ptr_max);
132 } else {
133 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
134 }
135 rl = cast_rl(get_type(arg), rl);
136 set_extra_expr_nomod(arg, alloc_estate_rl(rl));
137 }
138
139 static void match_err(const char *fn, struct expression *call_expr,
140 struct expression *assign_expr, void *unused)
141 {
142 struct expression *arg;
143 struct smatch_state *pre_state;
144 struct range_list *rl;
145
146 arg = get_argument_from_call_expr(call_expr->args, 0);
147 pre_state = get_state_expr(SMATCH_EXTRA, arg);
148 rl = estate_rl(pre_state);
149 if (!rl)
150 rl = alloc_rl(err_ptr_min, err_ptr_max);
151 rl = rl_intersection(rl, alloc_rl(err_ptr_min, err_ptr_max));
152 rl = cast_rl(get_type(arg), rl);
153 set_extra_expr_nomod(arg, alloc_estate_rl(rl));
154 }
155
156 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
157 {
158 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
159 }
160
161 static void match_container_of(struct expression *expr)
162 {
163 struct expression *right = expr->right;
164 char *macro;
165
166 /*
167 * The problem here is that sometimes the container_of() macro is itself
168 * inside a macro and get_macro() only returns the name of the outside
169 * macro.
170 */
171
172 /*
173 * This actually an expression statement assignment but smatch_flow
385 data = strip_parens(data->unop);
386
387 dest = get_argument_from_call_expr(call->args, 1);
388 if (dest->type != EXPR_DEREF || dest->op != '.')
389 return;
390 if (!dest->member || strcmp(dest->member->name, "__c") != 0)
391 return;
392 dest = dest->deref;
393 type = get_type(dest);
394 if (!type)
395 return;
396 val_sym = first_ptr_list((struct ptr_list *)type->symbol_list);
397 dest = member_expression(dest, '.', val_sym->ident);
398
399 assign = assign_expression(dest, '=', data);
400 __in_fake_assign++;
401 __split_expr(assign);
402 __in_fake_assign--;
403 }
404
405 bool is_ignored_kernel_data(const char *name)
406 {
407 if (option_project != PROJ_KERNEL)
408 return false;
409
410 /*
411 * On the file I was looking at lockdep was 25% of the DB.
412 */
413 if (strstr(name, ".dep_map."))
414 return true;
415 if (strstr(name, ".lockdep_map."))
416 return true;
417 return false;
418 }
419
420 void check_kernel(int id)
421 {
422 if (option_project != PROJ_KERNEL)
423 return;
424
425 err_ptr_min.type = &ptr_ctype;
426 err_ptr_min.value = -4095;
427 err_ptr_max.type = &ptr_ctype;
428 err_ptr_max.value = -1l;
429 null_ptr.type = &ptr_ctype;
430 null_ptr.value = 0;
431
432 err_ptr_min = sval_cast(&ptr_ctype, err_ptr_min);
433 err_ptr_max = sval_cast(&ptr_ctype, err_ptr_max);
434
435 add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
436 add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
437 add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
438 add_hook(hack_ERR_PTR, AFTER_DEF_HOOK);
439 return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
440 return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
441 return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
442 return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
443 return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
444
445 add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
446 add_hook(match_container_of, ASSIGNMENT_HOOK);
447
448 add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
449 add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
450 add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
451 add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
452
453 add_implied_return_hook("fls", &match_fls, NULL);
454 add_implied_return_hook("fls64", &match_fls, NULL);
|