check_access_ok_math.c

   1 /*
   2  * smatch/check_access_ok_math.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 #include "smatch.h"
  11
  12 static int my_id;
  13 extern int check_assigned_expr_id;
  14
  15 static struct expression *get_assigned_expr(struct expression *expr)
  16 {
  17         struct smatch_state *state;
  18
  19         state = get_state_expr(check_assigned_expr_id, expr);
  20         if (!state)
  21                 return NULL;
  22         return (struct expression *)state->data;
  23 }
  24
  25 static int can_overflow(struct expression *expr)
  26 {
  27         long long max;
  28         int uncapped = 0;
  29
  30         expr = strip_expr(expr);
  31
  32         if (expr->type == EXPR_BINOP) {
  33                 uncapped += can_overflow(expr->left);
  34                 uncapped += can_overflow(expr->right);
  35
  36                 if (uncapped &&
  37                         (expr->op == '+' || expr->op == '*' || expr->op == SPECIAL_LEFTSHIFT))
  38                         return 1;
  39
  40                 return 0;
  41         }
  42
  43         if (get_implied_max(expr, &max))
  44                 return 0;
  45         if (get_absolute_max(expr, &max) && max <= 4096)
  46                 return 0;
  47         return 1;
  48 }
  49
  50 static void match_size(struct expression *size_expr)
  51 {
  52         char *name;
  53
  54         size_expr = strip_expr(size_expr);
  55         if (!size_expr)
  56                 return;
  57         if (size_expr->type != EXPR_BINOP) {
  58                 size_expr = get_assigned_expr(size_expr);
  59                 if (!size_expr || size_expr->type != EXPR_BINOP)
  60                         return;
  61         }
  62         if (!can_overflow(size_expr))
  63                 return;
  64
  65         name = get_variable_from_expr_complex(size_expr, NULL);
  66         sm_msg("warn: math in access_ok() is dangerous '%s'", name);
  67
  68         free_string(name);
  69 }
  70
  71 static void match_access_ok(const char *fn, struct expression *expr, void *data)
  72 {
  73         struct expression *size_expr;
  74
  75         size_expr = get_argument_from_call_expr(expr->args, 1);
  76         match_size(size_expr);
  77 }
  78
  79 static void split_asm_constraints(struct expression_list *expr_list)
  80 {
  81         struct expression *expr;
  82         int state = 0;
  83         int i;
  84
  85         i = 0;
  86         FOR_EACH_PTR(expr_list, expr) {
  87
  88                 switch (state) {
  89                 case 0: /* identifier */
  90                 case 1: /* constraint */
  91                         state++;
  92                         continue;
  93                 case 2: /* expression */
  94                         state = 0;
  95                         if (i == 1)
  96                                 match_size(expr);
  97                         i++;
  98                         continue;
  99                 }
 100         } END_FOR_EACH_PTR(expr);
 101 }
 102
 103 static void match_asm_stmt(struct statement *stmt)
 104 {
 105         char *name;
 106
 107         name = get_macro_name(&stmt->pos);
 108         if (!name || strcmp(name, "access_ok") != 0)
 109                 return;
 110         split_asm_constraints(stmt->asm_inputs);
 111 }
 112
 113 void check_access_ok_math(int id)
 114 {
 115         my_id = id;
 116         if (option_project != PROJ_KERNEL)
 117                 return;
 118         add_function_hook("__access_ok", &match_access_ok, NULL);
 119         add_hook(&match_asm_stmt, ASM_HOOK);
 120 }