check_err_ptr_deref.c

   1 /*
   2  * Copyright 2023 Linaro Ltd.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include "smatch.h"
  19 #include "smatch_extra.h"
  20
  21 static int my_id;
  22
  23 /* These functions do not necessarily need to be checked */
  24 static const char *safe_fns[] = {
  25         "exynos_drm_crtc_get_by_type",
  26         "mdp5_crtc_get_mixer",
  27         "mdp5_crtc_get_pipeline",
  28         "mlx5_eswitch_get_vport",
  29         "mtk_vdec_h264_get_ctrl_ptr",
  30         "nand_get_sdr_timings",
  31         "tc358746_get_format_by_code",
  32         "to_caam_req",
  33         "uverbs_attr_get",
  34         "uverbs_attr_get_alloced_ptr",
  35         "uverbs_attr_get_obj",
  36         "uverbs_attr_get_uobject",
  37 };
  38
  39 static bool from_safe_fn(struct expression *expr)
  40 {
  41         struct expression *prev;
  42         int i;
  43
  44         prev = get_assigned_expr(expr);
  45         if (!prev)
  46                 return false;
  47         if (prev->type != EXPR_CALL)
  48                 return false;
  49
  50         for (i = 0; i < ARRAY_SIZE(safe_fns); i++) {
  51                 if (sym_name_is(safe_fns[i], prev->fn))
  52                         return true;
  53         }
  54         return false;
  55 }
  56
  57 static void deref_hook(struct expression *expr)
  58 {
  59         char *name;
  60
  61         if (!possible_err_ptr(expr))
  62                 return;
  63         if (from_safe_fn(expr))
  64                 return;
  65         if (is_impossible_path())
  66                 return;
  67
  68         name = expr_to_str(expr);
  69         sm_error("'%s' dereferencing possible ERR_PTR()", name);
  70         free_string(name);
  71 }
  72
  73 void check_err_ptr_deref(int id)
  74 {
  75         my_id = id;
  76
  77         if (option_project != PROJ_KERNEL)
  78                 return;
  79
  80         add_dereference_hook(deref_hook);
  81 }