expressions: make assign_expression() take an op argument
[smatch.git] / check_kernel.c
blob9ae7a0be34caeefa696eab51d272a9afe7e40b59
1 /*
2 * Copyright (C) 2010 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * This is kernel specific stuff for smatch_extra.
22 #include "scope.h"
23 #include "smatch.h"
24 #include "smatch_extra.h"
26 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
28 struct expression *arg;
30 arg = get_argument_from_call_expr(call->args, 0);
31 if (!get_implied_rl(arg, rl))
32 *rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(-1));
33 return 1;
36 static void hack_ERR_PTR(struct symbol *sym)
38 struct symbol *arg;
39 struct smatch_state *estate;
40 struct range_list *after;
41 sval_t low_error = {
42 .type = &long_ctype,
43 .value = -4095,
45 sval_t minus_one = {
46 .type = &long_ctype,
47 .value = -1,
49 sval_t zero = {
50 .type = &long_ctype,
51 .value = 0,
54 if (!sym || !sym->ident)
55 return;
56 if (strcmp(sym->ident->name, "ERR_PTR") != 0)
57 return;
59 arg = first_ptr_list((struct ptr_list *)sym->ctype.base_type->arguments);
60 if (!arg || !arg->ident || strcmp(arg->ident->name, "error") != 0)
61 return;
63 estate = get_state(SMATCH_EXTRA, "error", arg);
64 if (!estate) {
65 after = alloc_rl(low_error, minus_one);
66 } else {
67 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero));
68 if (rl_equiv(estate_rl(estate), after))
69 return;
71 set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after));
74 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
75 struct expression *assign_expr, void *_param)
77 int param = PTR_INT(_param);
78 struct expression *arg;
79 struct smatch_state *pre_state;
80 struct smatch_state *end_state;
82 arg = get_argument_from_call_expr(call_expr->args, param);
83 pre_state = get_state_expr(SMATCH_EXTRA, arg);
84 end_state = estate_filter_range(pre_state, ll_to_sval(-4095), ll_to_sval(0));
85 set_extra_expr_nomod(arg, end_state);
88 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
89 struct expression *assign_expr, void *_param)
91 int param = PTR_INT(_param);
92 struct expression *arg;
93 struct range_list *rl;
94 struct smatch_state *pre_state;
95 struct smatch_state *end_state;
97 arg = get_argument_from_call_expr(call_expr->args, param);
98 pre_state = get_state_expr(SMATCH_EXTRA, arg);
99 rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(0));
100 rl = rl_intersection(estate_rl(pre_state), rl);
101 rl = cast_rl(estate_type(pre_state), rl);
102 end_state = alloc_estate_rl(rl);
103 set_extra_expr_nomod(arg, end_state);
106 static void match_not_err(const char *fn, struct expression *call_expr,
107 struct expression *assign_expr, void *unused)
109 struct expression *arg;
110 struct smatch_state *pre_state;
111 struct smatch_state *new_state;
113 arg = get_argument_from_call_expr(call_expr->args, 0);
114 pre_state = get_state_expr(SMATCH_EXTRA, arg);
115 new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-1));
116 set_extra_expr_nomod(arg, new_state);
119 static void match_err(const char *fn, struct expression *call_expr,
120 struct expression *assign_expr, void *unused)
122 struct expression *arg;
123 struct smatch_state *pre_state;
124 struct smatch_state *new_state;
126 arg = get_argument_from_call_expr(call_expr->args, 0);
127 pre_state = get_state_expr(SMATCH_EXTRA, arg);
128 new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-4096));
129 new_state = estate_filter_range(new_state, ll_to_sval(0), sval_type_max(&long_ctype));
130 set_extra_expr_nomod(arg, new_state);
133 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
135 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
138 static void match_container_of(struct expression *expr)
140 struct expression *right = expr->right;
141 char *macro;
144 * The problem here is that sometimes the container_of() macro is itself
145 * inside a macro and get_macro() only returns the name of the outside
146 * macro.
150 * This actually an expression statement assignment but smatch_flow
151 * pre-mangles it for us so we only get the last chunk:
152 * sk = (typeof(sk))((char *)__mptr - offsetof(...))
155 macro = get_macro_name(right->pos);
156 if (!macro)
157 return;
158 if (right->type != EXPR_CAST)
159 return;
160 right = strip_expr(right);
161 if (right->type != EXPR_BINOP || right->op != '-' ||
162 right->left->type != EXPR_CAST)
163 return;
164 right = strip_expr(right->left);
165 if (right->type != EXPR_SYMBOL)
166 return;
167 if (!right->symbol->ident ||
168 strcmp(right->symbol->ident->name, "__mptr") != 0)
169 return;
170 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
173 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl)
175 struct expression *start_arg;
176 struct expression *size_arg;
177 struct symbol *type;
178 sval_t min, max, tmp;
180 size_arg = get_argument_from_call_expr(call->args, 1);
181 /* btw. there isn't a start_arg for find_first_bit() */
182 start_arg = get_argument_from_call_expr(call->args, 2);
184 type = get_type(call);
185 min = sval_type_val(type, 0);
186 max = sval_type_val(type, sizeof(long long) * 8);
188 if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value)
189 max = tmp;
190 if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp))
191 min = tmp;
192 if (sval_cmp(min, max) > 0)
193 max = min;
194 min = sval_cast(type, min);
195 max = sval_cast(type, max);
196 *rl = alloc_rl(min, max);
197 return 1;
200 static int match_fls(struct expression *call, void *unused, struct range_list **rl)
202 struct expression *arg;
203 struct range_list *arg_rl;
204 sval_t zero = {};
205 sval_t start = {
206 .type = &int_ctype,
207 .value = 0,
209 sval_t end = {
210 .type = &int_ctype,
211 .value = 32,
213 sval_t sval;
215 arg = get_argument_from_call_expr(call->args, 0);
216 if (!get_implied_rl(arg, &arg_rl))
217 return 0;
218 if (rl_to_sval(arg_rl, &sval)) {
219 int i;
221 for (i = 63; i >= 0; i--) {
222 if (sval.uvalue & 1ULL << i)
223 break;
225 sval.value = i + 1;
226 *rl = alloc_rl(sval, sval);
227 return 1;
229 zero.type = rl_type(arg_rl);
230 if (!rl_has_sval(arg_rl, zero))
231 start.value = 1;
232 *rl = alloc_rl(start, end);
233 return 1;
238 static void find_module_init_exit(struct symbol_list *sym_list)
240 struct symbol *sym;
241 struct symbol *fn;
242 struct statement *stmt;
243 char *name;
244 int init;
245 int count;
248 * This is more complicated because Sparse ignores the "alias"
249 * attribute. I search backwards because module_init() is normally at
250 * the end of the file.
252 count = 0;
253 FOR_EACH_PTR_REVERSE(sym_list, sym) {
254 if (sym->type != SYM_NODE)
255 continue;
256 if (!(sym->ctype.modifiers & MOD_STATIC))
257 continue;
258 fn = get_base_type(sym);
259 if (!fn)
260 continue;
261 if (fn->type != SYM_FN)
262 continue;
263 if (!sym->ident)
264 continue;
265 if (!fn->inline_stmt)
266 continue;
267 if (strcmp(sym->ident->name, "__inittest") == 0)
268 init = 1;
269 else if (strcmp(sym->ident->name, "__exittest") == 0)
270 init = 0;
271 else
272 continue;
274 count++;
276 stmt = first_ptr_list((struct ptr_list *)fn->inline_stmt->stmts);
277 if (!stmt || stmt->type != STMT_RETURN)
278 continue;
279 name = expr_to_var(stmt->ret_value);
280 if (!name)
281 continue;
282 if (init)
283 sql_insert_function_ptr(name, "(struct module)->init");
284 else
285 sql_insert_function_ptr(name, "(struct module)->exit");
286 free_string(name);
287 if (count >= 2)
288 return;
289 } END_FOR_EACH_PTR_REVERSE(sym);
292 static void match_end_file(struct symbol_list *sym_list)
294 struct symbol *sym;
296 /* find the last static symbol in the file */
297 FOR_EACH_PTR_REVERSE(sym_list, sym) {
298 if (!(sym->ctype.modifiers & MOD_STATIC))
299 continue;
300 if (!sym->scope)
301 continue;
302 find_module_init_exit(sym->scope->symbols);
303 return;
304 } END_FOR_EACH_PTR_REVERSE(sym);
307 static struct expression *get_val_expr(struct expression *expr)
309 struct symbol *sym, *val;
311 if (expr->type != EXPR_DEREF)
312 return NULL;
313 expr = expr->deref;
314 if (expr->type != EXPR_SYMBOL)
315 return NULL;
316 if (strcmp(expr->symbol_name->name, "__u") != 0)
317 return NULL;
318 sym = get_base_type(expr->symbol);
319 val = first_ptr_list((struct ptr_list *)sym->symbol_list);
320 if (!val || strcmp(val->ident->name, "__val") != 0)
321 return NULL;
322 return member_expression(expr, '.', val->ident);
325 static void match__write_once_size(const char *fn, struct expression *call,
326 void *unused)
328 struct expression *dest, *data, *assign;
329 struct range_list *rl;
331 dest = get_argument_from_call_expr(call->args, 0);
332 if (dest->type != EXPR_PREOP || dest->op != '&')
333 return;
334 dest = strip_expr(dest->unop);
336 data = get_argument_from_call_expr(call->args, 1);
337 data = get_val_expr(data);
338 if (!data)
339 return;
340 get_absolute_rl(data, &rl);
341 assign = assign_expression(dest, '=', data);
343 __in_fake_assign++;
344 __split_expr(assign);
345 __in_fake_assign--;
348 void check_kernel(int id)
350 if (option_project != PROJ_KERNEL)
351 return;
353 add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
354 add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
355 add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
356 add_hook(hack_ERR_PTR, AFTER_DEF_HOOK);
357 return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
358 return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
359 return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
360 return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
361 return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
363 add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
364 add_hook(match_container_of, ASSIGNMENT_HOOK);
366 add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
367 add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
368 add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
369 add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
371 add_implied_return_hook("fls", &match_fls, NULL);
372 add_implied_return_hook("fls64", &match_fls, NULL);
374 add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL);
375 add_function_hook("__write_once_size", &match__write_once_size, NULL);
377 if (option_info)
378 add_hook(match_end_file, END_FILE_HOOK);