check_kernel.c

   1 /*
   2  * sparse/check_kernel.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * This is kernel specific stuff for smatch_extra.
  12  */
  13
  14 #include "smatch.h"
  15 #include "smatch_extra.h"
  16
  17 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
  18 {
  19         struct expression *arg;
  20
  21         arg = get_argument_from_call_expr(call->args, 0);
  22         if (!get_implied_rl(arg, rl))
  23                 *rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(-1));
  24         return 1;
  25 }
  26
  27 static int implied_copy_return(struct expression *call, void *unused, struct range_list **rl)
  28 {
  29         struct expression *arg;
  30         sval_t max;
  31
  32         arg = get_argument_from_call_expr(call->args, 2);
  33         get_absolute_max(arg, &max);
  34         *rl = alloc_rl(ll_to_sval(0), max);
  35         return 1;
  36 }
  37
  38 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
  39                         struct expression *assign_expr, void *_param)
  40 {
  41         int param = PTR_INT(_param);
  42         struct expression *arg;
  43         struct smatch_state *pre_state;
  44         struct smatch_state *end_state;
  45
  46         arg = get_argument_from_call_expr(call_expr->args, param);
  47         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  48         end_state = estate_filter_range(pre_state, ll_to_sval(-4095), ll_to_sval(0));
  49         set_extra_expr_nomod(arg, end_state);
  50 }
  51
  52 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
  53                         struct expression *assign_expr, void *_param)
  54 {
  55         int param = PTR_INT(_param);
  56         struct expression *arg;
  57         struct range_list *rl;
  58         struct smatch_state *pre_state;
  59         struct smatch_state *end_state;
  60
  61         arg = get_argument_from_call_expr(call_expr->args, param);
  62         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  63         rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(0));
  64         rl = rl_intersection(estate_rl(pre_state), rl);
  65         rl = cast_rl(estate_type(pre_state), rl);
  66         end_state = alloc_estate_rl(rl);
  67         set_extra_expr_nomod(arg, end_state);
  68 }
  69
  70 static void match_not_err(const char *fn, struct expression *call_expr,
  71                         struct expression *assign_expr, void *unused)
  72 {
  73         struct expression *arg;
  74         struct smatch_state *pre_state;
  75         struct smatch_state *new_state;
  76
  77         arg = get_argument_from_call_expr(call_expr->args, 0);
  78         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  79         new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-1));
  80         set_extra_expr_nomod(arg, new_state);
  81 }
  82
  83 static void match_err(const char *fn, struct expression *call_expr,
  84                         struct expression *assign_expr, void *unused)
  85 {
  86         struct expression *arg;
  87         struct smatch_state *pre_state;
  88         struct smatch_state *new_state;
  89
  90         arg = get_argument_from_call_expr(call_expr->args, 0);
  91         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  92         new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-4096));
  93         new_state = estate_filter_range(new_state, ll_to_sval(0), sval_type_max(&long_ctype));
  94         set_extra_expr_nomod(arg, new_state);
  95 }
  96
  97 static void match_container_of(const char *fn, struct expression *expr, void *unused)
  98 {
  99         set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 100 }
 101
 102 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl)
 103 {
 104         struct expression *start_arg;
 105         struct expression *size_arg;
 106         struct symbol *type;
 107         sval_t min, max, tmp;
 108
 109         size_arg = get_argument_from_call_expr(call->args, 1);
 110         /* btw. there isn't a start_arg for find_first_bit() */
 111         start_arg = get_argument_from_call_expr(call->args, 2);
 112
 113         type = get_type(call);
 114         min = sval_type_val(type, 0);
 115         max = sval_type_val(type, sizeof(long long) * 8);
 116
 117         if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value)
 118                 max = tmp;
 119         if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp))
 120                 min = tmp;
 121         if (sval_cmp(min, max) > 0)
 122                 max = min;
 123         min = sval_cast(type, min);
 124         max = sval_cast(type, max);
 125         *rl = alloc_rl(min, max);
 126         return 1;
 127 }
 128
 129 void check_kernel(int id)
 130 {
 131         if (option_project != PROJ_KERNEL)
 132                 return;
 133
 134         add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
 135         add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
 136         add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
 137         return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
 138         return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
 139         return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
 140         return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
 141         return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
 142         add_macro_assign_hook_extra("container_of", &match_container_of, NULL);
 143
 144         add_implied_return_hook("copy_to_user", &implied_copy_return, NULL);
 145         add_implied_return_hook("__copy_to_user", &implied_copy_return, NULL);
 146         add_implied_return_hook("copy_from_user", &implied_copy_return, NULL);
 147         add_implied_return_hook("__copy_fom_user", &implied_copy_return, NULL);
 148         add_implied_return_hook("clear_user", &implied_copy_return, NULL);
 149
 150         add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
 151         add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
 152         add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
 153         add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
 154
 155         add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL);
 156 }