2 * sparse/check_kernel.c
4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 * This is kernel specific stuff for smatch_extra.
15 #include "smatch_extra.h"
17 static int implied_err_cast_return(struct expression
*call
, void *unused
, struct range_list
**rl
)
19 struct expression
*arg
;
21 arg
= get_argument_from_call_expr(call
->args
, 0);
22 if (!get_implied_rl(arg
, rl
))
23 *rl
= alloc_rl(ll_to_sval(-4095), ll_to_sval(-1));
27 static int implied_copy_return(struct expression
*call
, void *unused
, struct range_list
**rl
)
29 struct expression
*arg
;
32 arg
= get_argument_from_call_expr(call
->args
, 2);
33 get_absolute_max(arg
, &max
);
34 *rl
= alloc_rl(ll_to_sval(0), max
);
38 static void match_param_valid_ptr(const char *fn
, struct expression
*call_expr
,
39 struct expression
*assign_expr
, void *_param
)
41 int param
= PTR_INT(_param
);
42 struct expression
*arg
;
43 struct smatch_state
*pre_state
;
44 struct smatch_state
*end_state
;
46 arg
= get_argument_from_call_expr(call_expr
->args
, param
);
47 pre_state
= get_state_expr(SMATCH_EXTRA
, arg
);
48 end_state
= estate_filter_range(pre_state
, ll_to_sval(-4095), ll_to_sval(0));
49 set_extra_expr_nomod(arg
, end_state
);
52 static void match_param_err_or_null(const char *fn
, struct expression
*call_expr
,
53 struct expression
*assign_expr
, void *_param
)
55 int param
= PTR_INT(_param
);
56 struct expression
*arg
;
57 struct range_list
*rl
;
58 struct smatch_state
*pre_state
;
59 struct smatch_state
*end_state
;
61 arg
= get_argument_from_call_expr(call_expr
->args
, param
);
62 pre_state
= get_state_expr(SMATCH_EXTRA
, arg
);
63 rl
= alloc_rl(ll_to_sval(-4095), ll_to_sval(0));
64 rl
= rl_intersection(estate_rl(pre_state
), rl
);
65 rl
= cast_rl(estate_type(pre_state
), rl
);
66 end_state
= alloc_estate_rl(rl
);
67 set_extra_expr_nomod(arg
, end_state
);
70 static void match_not_err(const char *fn
, struct expression
*call_expr
,
71 struct expression
*assign_expr
, void *unused
)
73 struct expression
*arg
;
74 struct smatch_state
*pre_state
;
75 struct smatch_state
*new_state
;
77 arg
= get_argument_from_call_expr(call_expr
->args
, 0);
78 pre_state
= get_state_expr(SMATCH_EXTRA
, arg
);
79 new_state
= estate_filter_range(pre_state
, sval_type_min(&long_ctype
), ll_to_sval(-1));
80 set_extra_expr_nomod(arg
, new_state
);
83 static void match_err(const char *fn
, struct expression
*call_expr
,
84 struct expression
*assign_expr
, void *unused
)
86 struct expression
*arg
;
87 struct smatch_state
*pre_state
;
88 struct smatch_state
*new_state
;
90 arg
= get_argument_from_call_expr(call_expr
->args
, 0);
91 pre_state
= get_state_expr(SMATCH_EXTRA
, arg
);
92 new_state
= estate_filter_range(pre_state
, sval_type_min(&long_ctype
), ll_to_sval(-4096));
93 new_state
= estate_filter_range(new_state
, ll_to_sval(0), sval_type_max(&long_ctype
));
94 set_extra_expr_nomod(arg
, new_state
);
97 static void match_container_of(const char *fn
, struct expression
*expr
, void *unused
)
99 set_extra_expr_mod(expr
->left
, alloc_estate_range(valid_ptr_min_sval
, valid_ptr_max_sval
));
102 static int match_next_bit(struct expression
*call
, void *unused
, struct range_list
**rl
)
104 struct expression
*start_arg
;
105 struct expression
*size_arg
;
107 sval_t min
, max
, tmp
;
109 size_arg
= get_argument_from_call_expr(call
->args
, 1);
110 /* btw. there isn't a start_arg for find_first_bit() */
111 start_arg
= get_argument_from_call_expr(call
->args
, 2);
113 type
= get_type(call
);
114 min
= sval_type_val(type
, 0);
115 max
= sval_type_val(type
, sizeof(long long) * 8);
117 if (get_implied_max(size_arg
, &tmp
) && tmp
.uvalue
< max
.value
)
119 if (start_arg
&& get_implied_min(start_arg
, &tmp
) && !sval_is_negative(tmp
))
121 if (sval_cmp(min
, max
) > 0)
123 min
= sval_cast(type
, min
);
124 max
= sval_cast(type
, max
);
125 *rl
= alloc_rl(min
, max
);
129 void check_kernel(int id
)
131 if (option_project
!= PROJ_KERNEL
)
134 add_implied_return_hook("ERR_PTR", &implied_err_cast_return
, NULL
);
135 add_implied_return_hook("ERR_CAST", &implied_err_cast_return
, NULL
);
136 add_implied_return_hook("PTR_ERR", &implied_err_cast_return
, NULL
);
137 return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr
, (void *)0);
138 return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null
, (void *)0);
139 return_implies_state("IS_ERR", 0, 0, &match_not_err
, NULL
);
140 return_implies_state("IS_ERR", 1, 1, &match_err
, NULL
);
141 return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr
, (void *)0);
142 add_macro_assign_hook_extra("container_of", &match_container_of
, NULL
);
144 add_implied_return_hook("copy_to_user", &implied_copy_return
, NULL
);
145 add_implied_return_hook("__copy_to_user", &implied_copy_return
, NULL
);
146 add_implied_return_hook("copy_from_user", &implied_copy_return
, NULL
);
147 add_implied_return_hook("__copy_fom_user", &implied_copy_return
, NULL
);
148 add_implied_return_hook("clear_user", &implied_copy_return
, NULL
);
150 add_implied_return_hook("find_next_bit", &match_next_bit
, NULL
);
151 add_implied_return_hook("find_next_zero_bit", &match_next_bit
, NULL
);
152 add_implied_return_hook("find_first_bit", &match_next_bit
, NULL
);
153 add_implied_return_hook("find_first_zero_bit", &match_next_bit
, NULL
);
155 add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook
, NULL
);