4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 * There was a previous null dereference test but it was too confusing and
12 * difficult to debug. This test is much simpler in its goals and scope.
14 * This test only complains about:
15 * 1) dereferencing uninitialized variables
16 * 2) dereferencing variables which were assigned as null.
17 * 3) dereferencing variables which were assigned a function the returns
20 * If we dereference something then we complain if any of those three
26 #include "smatch_slist.h"
27 #include "smatch_extra.h"
31 #define __GFP_NOFAIL 0x800
37 static struct smatch_state
*alloc_my_state(const char *name
)
39 struct smatch_state
*state
;
41 state
= __alloc_smatch_state(0);
46 static struct smatch_state
*unmatched_state(struct sm_state
*sm
)
51 static void is_ok(struct sm_state
*sm
)
53 set_state(my_id
, sm
->name
, sm
->sym
, &ok
);
56 static void check_dereference(struct expression
*expr
)
61 expr
= strip_expr(expr
);
62 sm
= get_sm_state_expr(my_id
, expr
);
65 if (is_ignored(my_id
, sm
->name
, sm
->sym
))
67 if (implied_not_equal(expr
, 0))
70 FOR_EACH_PTR(sm
->possible
, tmp
) {
71 if (tmp
->state
== &merged
)
73 if (tmp
->state
== &ok
)
75 add_ignore(my_id
, sm
->name
, sm
->sym
);
76 if (tmp
->state
== &null
) {
78 sm_msg("error: potential NULL dereference '%s'.", tmp
->name
);
81 if (tmp
->state
== &uninitialized
) {
82 sm_msg("error: potentially dereferencing uninitialized '%s'.", tmp
->name
);
85 sm_msg("error: potential null dereference '%s'. (%s returns null)",
86 tmp
->name
, tmp
->state
->name
);
88 } END_FOR_EACH_PTR(tmp
);
91 static void match_dereferences(struct expression
*expr
)
93 if (expr
->type
!= EXPR_PREOP
)
95 check_dereference(expr
->unop
);
98 static void match_pointer_as_array(struct expression
*expr
)
102 check_dereference(expr
->unop
->left
);
105 static void set_param_dereferenced(struct expression
*arg
, char *unused
)
107 check_dereference(arg
);
110 static void match_declarations(struct symbol
*sym
)
114 if ((get_base_type(sym
))->type
== SYM_ARRAY
)
117 name
= sym
->ident
->name
;
118 if (!sym
->initializer
) {
119 set_state(my_id
, name
, sym
, &uninitialized
);
120 scoped_state(my_id
, name
, sym
);
124 static void match_assign(struct expression
*expr
)
126 if (is_zero(expr
->right
)) {
127 set_state_expr(my_id
, expr
->left
, &null
);
132 static void match_condition(struct expression
*expr
)
134 if (expr
->type
== EXPR_ASSIGNMENT
) {
135 match_condition(expr
->right
);
136 match_condition(expr
->left
);
138 if (!get_state_expr(my_id
, expr
))
140 set_true_false_states_expr(my_id
, expr
, &ok
, NULL
);
143 static int called_with_no_fail(struct expression
*call
, int param
)
145 struct expression
*arg
;
150 call
= strip_expr(call
);
151 if (call
->type
!= EXPR_CALL
)
153 arg
= get_argument_from_call_expr(call
->args
, param
);
154 if (get_value(arg
, &sval
) && (sval
.uvalue
& __GFP_NOFAIL
))
159 static void match_assign_returns_null(const char *fn
, struct expression
*expr
, void *_gfp
)
161 struct smatch_state
*state
;
162 int gfp_param
= PTR_INT(_gfp
);
164 if (called_with_no_fail(expr
->right
, gfp_param
))
166 state
= alloc_my_state(fn
);
167 set_state_expr(my_id
, expr
->left
, state
);
170 static void register_allocation_funcs(void)
176 token
= get_tokens_file("kernel.allocation_funcs_gfp");
179 if (token_type(token
) != TOKEN_STREAMBEGIN
)
182 while (token_type(token
) != TOKEN_STREAMEND
) {
183 if (token_type(token
) != TOKEN_IDENT
)
185 func
= show_ident(token
->ident
);
187 if (token_type(token
) == TOKEN_IDENT
)
189 else if (token_type(token
) == TOKEN_NUMBER
)
190 arg
= atoi(token
->number
);
193 add_function_assign_hook(func
, &match_assign_returns_null
, INT_PTR(arg
));
199 void check_deref(int id
)
203 add_unmatched_state_hook(my_id
, &unmatched_state
);
204 add_modification_hook(my_id
, &is_ok
);
205 add_hook(&match_dereferences
, DEREF_HOOK
);
206 add_hook(&match_pointer_as_array
, OP_HOOK
);
207 add_db_fn_call_callback(DEREFERENCE
, &set_param_dereferenced
);
208 add_hook(&match_condition
, CONDITION_HOOK
);
209 add_hook(&match_declarations
, DECLARATION_HOOK
);
210 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
211 if (option_project
== PROJ_KERNEL
)
212 register_allocation_funcs();