Print this page
11506 smatch resync


   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17 
  18 /*
  19  * This is kernel specific stuff for smatch_extra.
  20  */
  21 
  22 #include "scope.h"
  23 #include "smatch.h"
  24 #include "smatch_extra.h"
  25 




  26 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
  27 {
  28         struct expression *arg;
  29 
  30         arg = get_argument_from_call_expr(call->args, 0);
  31         if (!get_implied_rl(arg, rl))
  32                 *rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(-1));


  33         return 1;
  34 }
  35 
  36 static void hack_ERR_PTR(struct symbol *sym)
  37 {
  38         struct symbol *arg;
  39         struct smatch_state *estate;
  40         struct range_list *after;
  41         sval_t low_error;
  42         sval_t minus_one;
  43         sval_t zero;
  44 
  45         low_error.type = &long_ctype;
  46         low_error.value = -4095;
  47 
  48         minus_one.type = &long_ctype;
  49         minus_one.value = -1;
  50 
  51         zero.type = &long_ctype;
  52         zero.value = 0;


  61                 return;
  62 
  63         estate = get_state(SMATCH_EXTRA, arg->ident->name, arg);
  64         if (!estate) {
  65                 after = alloc_rl(low_error, minus_one);
  66         } else {
  67                 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero));
  68                 if (rl_equiv(estate_rl(estate), after))
  69                         return;
  70         }
  71         set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after));
  72 }
  73 
  74 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
  75                         struct expression *assign_expr, void *_param)
  76 {
  77         int param = PTR_INT(_param);
  78         struct expression *arg;
  79         struct smatch_state *pre_state;
  80         struct smatch_state *end_state;

  81 
  82         arg = get_argument_from_call_expr(call_expr->args, param);
  83         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  84         end_state = estate_filter_range(pre_state, ll_to_sval(-4095), ll_to_sval(0));







  85         set_extra_expr_nomod(arg, end_state);
  86 }
  87 
  88 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
  89                         struct expression *assign_expr, void *_param)
  90 {
  91         int param = PTR_INT(_param);
  92         struct expression *arg;
  93         struct range_list *rl;
  94         struct smatch_state *pre_state;
  95         struct smatch_state *end_state;
  96 
  97         arg = get_argument_from_call_expr(call_expr->args, param);
  98         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  99         rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(0));
 100         rl = rl_intersection(estate_rl(pre_state), rl);
 101         rl = cast_rl(estate_type(pre_state), rl);
 102         end_state = alloc_estate_rl(rl);
 103         set_extra_expr_nomod(arg, end_state);
 104 }
 105 
 106 static void match_not_err(const char *fn, struct expression *call_expr,
 107                         struct expression *assign_expr, void *unused)
 108 {
 109         struct expression *arg;
 110         struct smatch_state *pre_state;
 111         struct smatch_state *new_state;
 112 
 113         arg = get_argument_from_call_expr(call_expr->args, 0);
 114         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 115         new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-1));
 116         set_extra_expr_nomod(arg, new_state);






 117 }
 118 
 119 static void match_err(const char *fn, struct expression *call_expr,
 120                         struct expression *assign_expr, void *unused)
 121 {
 122         struct expression *arg;
 123         struct smatch_state *pre_state;
 124         struct smatch_state *new_state;
 125 
 126         arg = get_argument_from_call_expr(call_expr->args, 0);
 127         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 128         new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-4096));
 129         new_state = estate_filter_range(new_state, ll_to_sval(0), sval_type_max(&long_ctype));
 130         set_extra_expr_nomod(arg, new_state);



 131 }
 132 
 133 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
 134 {
 135         set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 136 }
 137 
 138 static void match_container_of(struct expression *expr)
 139 {
 140         struct expression *right = expr->right;
 141         char *macro;
 142 
 143         /*
 144          * The problem here is that sometimes the container_of() macro is itself
 145          * inside a macro and get_macro() only returns the name of the outside
 146          * macro.
 147          */
 148 
 149         /*
 150          * This actually an expression statement assignment but smatch_flow


 362         data = strip_parens(data->unop);
 363 
 364         dest = get_argument_from_call_expr(call->args, 1);
 365         if (dest->type != EXPR_DEREF || dest->op != '.')
 366                 return;
 367         if (!dest->member || strcmp(dest->member->name, "__c") != 0)
 368                 return;
 369         dest = dest->deref;
 370         type = get_type(dest);
 371         if (!type)
 372                 return;
 373         val_sym = first_ptr_list((struct ptr_list *)type->symbol_list);
 374         dest = member_expression(dest, '.', val_sym->ident);
 375 
 376         assign = assign_expression(dest, '=', data);
 377         __in_fake_assign++;
 378         __split_expr(assign);
 379         __in_fake_assign--;
 380 }
 381 















 382 void check_kernel(int id)
 383 {
 384         if (option_project != PROJ_KERNEL)
 385                 return;
 386 










 387         add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
 388         add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
 389         add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
 390         add_hook(hack_ERR_PTR, AFTER_DEF_HOOK);
 391         return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
 392         return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
 393         return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
 394         return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
 395         return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
 396 
 397         add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
 398         add_hook(match_container_of, ASSIGNMENT_HOOK);
 399 
 400         add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
 401         add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
 402         add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
 403         add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
 404 
 405         add_implied_return_hook("fls", &match_fls, NULL);
 406         add_implied_return_hook("fls64", &match_fls, NULL);


   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17 
  18 /*
  19  * This is kernel specific stuff for smatch_extra.
  20  */
  21 
  22 #include "scope.h"
  23 #include "smatch.h"
  24 #include "smatch_extra.h"
  25 
  26 static sval_t err_ptr_min;
  27 static sval_t err_ptr_max;
  28 static sval_t null_ptr;
  29 
  30 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
  31 {
  32         struct expression *arg;
  33 
  34         arg = get_argument_from_call_expr(call->args, 0);
  35         if (!get_implied_rl(arg, rl)) {
  36                 *rl = alloc_rl(err_ptr_min, err_ptr_max);
  37                 *rl = cast_rl(get_type(arg), *rl);
  38         }
  39         return 1;
  40 }
  41 
  42 static void hack_ERR_PTR(struct symbol *sym)
  43 {
  44         struct symbol *arg;
  45         struct smatch_state *estate;
  46         struct range_list *after;
  47         sval_t low_error;
  48         sval_t minus_one;
  49         sval_t zero;
  50 
  51         low_error.type = &long_ctype;
  52         low_error.value = -4095;
  53 
  54         minus_one.type = &long_ctype;
  55         minus_one.value = -1;
  56 
  57         zero.type = &long_ctype;
  58         zero.value = 0;


  67                 return;
  68 
  69         estate = get_state(SMATCH_EXTRA, arg->ident->name, arg);
  70         if (!estate) {
  71                 after = alloc_rl(low_error, minus_one);
  72         } else {
  73                 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero));
  74                 if (rl_equiv(estate_rl(estate), after))
  75                         return;
  76         }
  77         set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after));
  78 }
  79 
  80 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
  81                         struct expression *assign_expr, void *_param)
  82 {
  83         int param = PTR_INT(_param);
  84         struct expression *arg;
  85         struct smatch_state *pre_state;
  86         struct smatch_state *end_state;
  87         struct range_list *rl;
  88 
  89         arg = get_argument_from_call_expr(call_expr->args, param);
  90         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  91         if (estate_rl(pre_state)) {
  92                 rl = estate_rl(pre_state);
  93                 rl = remove_range(rl, null_ptr, null_ptr);
  94                 rl = remove_range(rl, err_ptr_min, err_ptr_max);
  95         } else {
  96                 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
  97         }
  98         end_state = alloc_estate_rl(rl);
  99         set_extra_expr_nomod(arg, end_state);
 100 }
 101 
 102 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
 103                         struct expression *assign_expr, void *_param)
 104 {
 105         int param = PTR_INT(_param);
 106         struct expression *arg;
 107         struct range_list *rl;
 108         struct smatch_state *pre_state;
 109         struct smatch_state *end_state;
 110 
 111         arg = get_argument_from_call_expr(call_expr->args, param);
 112         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 113         call_results_to_rl(call_expr, &ptr_ctype, "0,(-4095)-(-1)", &rl);
 114         rl = rl_intersection(estate_rl(pre_state), rl);
 115         rl = cast_rl(get_type(arg), rl);
 116         end_state = alloc_estate_rl(rl);
 117         set_extra_expr_nomod(arg, end_state);
 118 }
 119 
 120 static void match_not_err(const char *fn, struct expression *call_expr,
 121                         struct expression *assign_expr, void *unused)
 122 {
 123         struct expression *arg;
 124         struct smatch_state *pre_state;
 125         struct range_list *rl;
 126 
 127         arg = get_argument_from_call_expr(call_expr->args, 0);
 128         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 129         if (estate_rl(pre_state)) {
 130                 rl = estate_rl(pre_state);
 131                 rl = remove_range(rl, err_ptr_min, err_ptr_max);
 132         } else {
 133                 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
 134         }
 135         rl = cast_rl(get_type(arg), rl);
 136         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 137 }
 138 
 139 static void match_err(const char *fn, struct expression *call_expr,
 140                         struct expression *assign_expr, void *unused)
 141 {
 142         struct expression *arg;
 143         struct smatch_state *pre_state;
 144         struct range_list *rl;
 145 
 146         arg = get_argument_from_call_expr(call_expr->args, 0);
 147         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 148         rl = estate_rl(pre_state);
 149         if (!rl)
 150                 rl = alloc_rl(err_ptr_min, err_ptr_max);
 151         rl = rl_intersection(rl, alloc_rl(err_ptr_min, err_ptr_max));
 152         rl = cast_rl(get_type(arg), rl);
 153         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 154 }
 155 
 156 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
 157 {
 158         set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 159 }
 160 
 161 static void match_container_of(struct expression *expr)
 162 {
 163         struct expression *right = expr->right;
 164         char *macro;
 165 
 166         /*
 167          * The problem here is that sometimes the container_of() macro is itself
 168          * inside a macro and get_macro() only returns the name of the outside
 169          * macro.
 170          */
 171 
 172         /*
 173          * This actually an expression statement assignment but smatch_flow


 385         data = strip_parens(data->unop);
 386 
 387         dest = get_argument_from_call_expr(call->args, 1);
 388         if (dest->type != EXPR_DEREF || dest->op != '.')
 389                 return;
 390         if (!dest->member || strcmp(dest->member->name, "__c") != 0)
 391                 return;
 392         dest = dest->deref;
 393         type = get_type(dest);
 394         if (!type)
 395                 return;
 396         val_sym = first_ptr_list((struct ptr_list *)type->symbol_list);
 397         dest = member_expression(dest, '.', val_sym->ident);
 398 
 399         assign = assign_expression(dest, '=', data);
 400         __in_fake_assign++;
 401         __split_expr(assign);
 402         __in_fake_assign--;
 403 }
 404 
 405 bool is_ignored_kernel_data(const char *name)
 406 {
 407         if (option_project != PROJ_KERNEL)
 408                 return false;
 409 
 410         /*
 411          * On the file I was looking at lockdep was 25% of the DB.
 412          */
 413         if (strstr(name, ".dep_map."))
 414                 return true;
 415         if (strstr(name, ".lockdep_map."))
 416                 return true;
 417         return false;
 418 }
 419 
 420 void check_kernel(int id)
 421 {
 422         if (option_project != PROJ_KERNEL)
 423                 return;
 424 
 425         err_ptr_min.type = &ptr_ctype;
 426         err_ptr_min.value = -4095;
 427         err_ptr_max.type = &ptr_ctype;
 428         err_ptr_max.value = -1l;
 429         null_ptr.type = &ptr_ctype;
 430         null_ptr.value = 0;
 431 
 432         err_ptr_min = sval_cast(&ptr_ctype, err_ptr_min);
 433         err_ptr_max = sval_cast(&ptr_ctype, err_ptr_max);
 434 
 435         add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
 436         add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
 437         add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
 438         add_hook(hack_ERR_PTR, AFTER_DEF_HOOK);
 439         return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
 440         return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
 441         return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
 442         return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
 443         return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
 444 
 445         add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
 446         add_hook(match_container_of, ASSIGNMENT_HOOK);
 447 
 448         add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
 449         add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
 450         add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
 451         add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
 452 
 453         add_implied_return_hook("fls", &match_fls, NULL);
 454         add_implied_return_hook("fls64", &match_fls, NULL);