core: silence some false positives from parsing invalid code
[smatch.git] / check_zero_to_err_ptr.c
blob29196b7bbe73007b2500c555a265a20948f09167
1 /*
2 * Copyright (C) 2013 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
18 #include "smatch.h"
19 #include "smatch_extra.h"
20 #include "smatch_slist.h"
22 static int my_id;
24 static int is_comparison_call(struct expression *expr)
26 expr = expr_get_parent_expr(expr);
27 if (!expr || expr->type != EXPR_COMPARE)
28 return 0;
29 if (expr->op != SPECIAL_EQUAL && expr->op != SPECIAL_NOTEQUAL)
30 return 0;
31 return 1;
34 static int next_line_is_if(struct expression *expr)
36 struct expression *next;
38 if (!__next_stmt || __next_stmt->type != STMT_IF)
39 return 0;
41 next = strip_expr(__next_stmt->if_conditional);
42 while (next->type == EXPR_PREOP && next->op == '!')
43 next = strip_expr(next->unop);
44 if (expr_equiv(expr, next))
45 return 1;
46 return 0;
49 static int next_line_checks_IS_ERR(struct expression *call, struct expression *arg)
51 struct expression *next;
52 struct expression *tmp;
54 tmp = expr_get_parent_expr(call);
55 if (tmp && tmp->type == EXPR_ASSIGNMENT) {
56 if (next_line_checks_IS_ERR(NULL, tmp->left))
57 return 1;
60 if (!__next_stmt || __next_stmt->type != STMT_IF)
61 return 0;
63 next = strip_expr(__next_stmt->if_conditional);
64 while (next->type == EXPR_PREOP && next->op == '!')
65 next = strip_expr(next->unop);
66 if (!next || next->type != EXPR_CALL)
67 return 0;
68 if (next->fn->type != EXPR_SYMBOL || !next->fn->symbol ||
69 !next->fn->symbol->ident ||
70 (strcmp(next->fn->symbol->ident->name, "IS_ERR") != 0 &&
71 strcmp(next->fn->symbol->ident->name, "IS_ERR_OR_NULL") != 0))
72 return 0;
73 next = get_argument_from_call_expr(next->args, 0);
74 return expr_equiv(next, arg);
77 static int is_valid_ptr(sval_t sval)
79 if (sval.type == &int_ctype &&
80 (sval.value == INT_MIN || sval.value == INT_MAX))
81 return 0;
83 if (sval_cmp(valid_ptr_min_sval, sval) <= 0 &&
84 sval_cmp(valid_ptr_max_sval, sval) >= 0)
85 return 1;
86 return 0;
89 static void match_err_ptr(const char *fn, struct expression *expr, void *data)
91 struct expression *arg_expr;
92 struct sm_state *sm, *tmp;
93 sval_t sval;
95 arg_expr = get_argument_from_call_expr(expr->args, 0);
96 sm = get_sm_state_expr(SMATCH_EXTRA, arg_expr);
97 if (!sm)
98 return;
100 if (is_comparison_call(expr))
101 return;
103 if (next_line_checks_IS_ERR(expr, arg_expr))
104 return;
105 if (strcmp(fn, "ERR_PTR") == 0 &&
106 next_line_is_if(arg_expr))
107 return;
109 FOR_EACH_PTR(sm->possible, tmp) {
110 if (!estate_rl(tmp->state))
111 continue;
112 if (is_valid_ptr(estate_min(tmp->state)) &&
113 is_valid_ptr(estate_max(tmp->state))) {
114 sm_msg("warn: passing a valid pointer to '%s'", fn);
115 return;
117 if (!rl_to_sval(estate_rl(tmp->state), &sval))
118 continue;
119 if (sval.value != 0)
120 continue;
121 sm_msg("warn: passing zero to '%s'", fn);
122 return;
123 } END_FOR_EACH_PTR(tmp);
126 void check_zero_to_err_ptr(int id)
128 if (option_project != PROJ_KERNEL)
129 return;
131 my_id = id;
132 add_function_hook("ERR_PTR", &match_err_ptr, NULL);
133 add_function_hook("ERR_CAST", &match_err_ptr, NULL);
134 add_function_hook("PTR_ERR", &match_err_ptr, NULL);