check_unchecked_allocation.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  * Copyright (C) 2021 Oracle.
   4  *
   5  * This program is free software; you can redistribute it and/or
   6  * modify it under the terms of the GNU General Public License
   7  * as published by the Free Software Foundation; either version 2
   8  * of the License, or (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  17  */
  18
  19 #include "smatch.h"
  20 #include "smatch_slist.h"
  21 #include "smatch_extra.h"
  22
  23 static int my_id;
  24
  25 #define __GFP_NOFAIL 0x8000u
  26
  27 STATE(null);
  28
  29 static unsigned long GFP_NOFAIL(void)
  30 {
  31         static unsigned long saved_flags = -1;
  32         struct symbol *macro_sym;
  33
  34         if (saved_flags != -1)
  35                 return saved_flags;
  36
  37         macro_sym = lookup_macro_symbol("___GFP_NOFAIL");
  38         if (!macro_sym)
  39                 macro_sym = lookup_macro_symbol("__GFP_NOFAIL");
  40         if (!macro_sym || !macro_sym->expansion)
  41                 return __GFP_NOFAIL;
  42         if (token_type(macro_sym->expansion) != TOKEN_NUMBER)
  43                 return __GFP_NOFAIL;
  44
  45         saved_flags = strtoul(macro_sym->expansion->number, NULL, 0);
  46         return saved_flags;
  47 }
  48
  49 static void pre_merge_hook(struct sm_state *cur, struct sm_state *other)
  50 {
  51         struct smatch_state *state;
  52
  53         if (is_impossible_path()) {
  54                 set_state(my_id, cur->name, cur->sym, &undefined);
  55                 return;
  56         }
  57
  58         state = get_state(SMATCH_EXTRA, cur->name, cur->sym);
  59         if (!state || !estate_rl(state))
  60                 return;
  61         if (!rl_has_sval(estate_rl(state), ptr_null))
  62                 set_state(my_id, cur->name, cur->sym, &undefined);
  63 }
  64
  65 static bool is_possibly_zero(const char *name, struct symbol *sym)
  66 {
  67         struct sm_state *sm, *tmp;
  68
  69         sm = get_sm_state(SMATCH_EXTRA, name, sym);
  70         if (!sm)
  71                 return false;
  72         FOR_EACH_PTR(sm->possible, tmp) {
  73                 if (!estate_rl(tmp->state))
  74                         continue;
  75                 if (rl_min(estate_rl(tmp->state)).value == 0 &&
  76                     rl_max(estate_rl(tmp->state)).value == 0)
  77                         return true;
  78         } END_FOR_EACH_PTR(tmp);
  79
  80         return false;
  81 }
  82
  83 static const char *get_allocation_fn_name(const char *name, struct symbol *sym)
  84 {
  85         struct expression *expr;
  86
  87         expr = get_assigned_expr_name_sym(name, sym);
  88         if (!expr)
  89                 return "<unknown>";
  90         if (expr->type == EXPR_CALL &&
  91             expr->fn->type == EXPR_SYMBOL &&
  92             expr->fn->symbol && expr->fn->symbol->ident)
  93                 return expr->fn->symbol->ident->name;
  94
  95         return "<unknown>";
  96 }
  97
  98 static void deref_hook(struct expression *expr)
  99 {
 100         struct sm_state *sm;
 101         const char *fn_name;
 102
 103         sm = get_sm_state_expr(my_id, expr);
 104         if (!sm)
 105                 return;
 106         if (is_ignored(my_id, sm->name, sm->sym))
 107                 return;
 108         if (!is_possibly_zero(sm->name, sm->sym))
 109                 return;
 110         if (is_impossible_path())
 111                 return;
 112         if (!slist_has_state(sm->possible, &null))
 113                 return;
 114
 115         fn_name = get_allocation_fn_name(sm->name, sm->sym);
 116         sm_error("potential null dereference '%s'.  (%s returns null)",
 117                  sm->name, fn_name);
 118 }
 119
 120 static int called_with_no_fail(struct expression *call, int param)
 121 {
 122         struct expression *arg;
 123         sval_t sval;
 124
 125         if (param == -1)
 126                 return 0;
 127         call = strip_expr(call);
 128         if (call->type != EXPR_CALL)
 129                 return 0;
 130         arg = get_argument_from_call_expr(call->args, param);
 131         if (get_value(arg, &sval) && (sval.uvalue & GFP_NOFAIL()))
 132                 return 1;
 133         return 0;
 134 }
 135
 136 static void match_assign_returns_null(const char *fn, struct expression *expr, void *_gfp)
 137 {
 138         int gfp_param = PTR_INT(_gfp);
 139
 140         if (called_with_no_fail(expr->right, gfp_param))
 141                 return;
 142         set_state_expr(my_id, expr->left, &null);
 143 }
 144
 145 static void register_allocation_funcs(void)
 146 {
 147         char filename[256];
 148         struct token *token;
 149         const char *func;
 150         int arg;
 151
 152         snprintf(filename, sizeof(filename), "%s.allocation_funcs_gfp", option_project_str);
 153         token = get_tokens_file(filename);
 154         if (!token)
 155                 return;
 156         if (token_type(token) != TOKEN_STREAMBEGIN)
 157                 return;
 158         token = token->next;
 159         while (token_type(token) != TOKEN_STREAMEND) {
 160                 if (token_type(token) != TOKEN_IDENT) {
 161                         printf("error parsing '%s' line %d\n", filename, token->pos.line);
 162                         return;
 163                 }
 164                 func = show_ident(token->ident);
 165                 token = token->next;
 166                 if (token_type(token) == TOKEN_IDENT)
 167                         arg = -1;
 168                 else if (token_type(token) == TOKEN_NUMBER)
 169                         arg = atoi(token->number);
 170                 else {
 171                         printf("error parsing '%s' line %d\n", filename, token->pos.line);
 172                         return;
 173                 }
 174                 add_function_assign_hook(func, &match_assign_returns_null, INT_PTR(arg));
 175                 token = token->next;
 176         }
 177         clear_token_alloc();
 178 }
 179
 180 void check_unchecked_allocation(int id)
 181 {
 182         my_id = id;
 183
 184         add_modification_hook(my_id, &set_undefined);
 185         add_pre_merge_hook(my_id, &pre_merge_hook);
 186         add_dereference_hook(deref_hook);
 187         register_allocation_funcs();
 188 }