smatch_data/db/fixup_kernel.sh

   1 #!/bin/bash
   2
   3 db_file=$1
   4 cat << EOF | sqlite3 $db_file
   5 /* we only care about the main ->read/write() functions. */
   6 delete from caller_info where function = '(struct file_operations)->read' and file != 'fs/read_write.c';
   7 delete from caller_info where function = '(struct file_operations)->write' and file != 'fs/read_write.c';
   8 delete from function_ptr where function = '(struct file_operations)->read';
   9 delete from function_ptr where function = '(struct file_operations)->write';
  10 delete from caller_info where function = '__vfs_write' and caller != 'vfs_write';
  11
  12 /* delete these function pointers which cause false positives */
  13 delete from caller_info where function = '(struct file_operations)->open' and type != 0;
  14 delete from caller_info where function = '(struct notifier_block)->notifier_call' and type != 0;
  15 delete from caller_info where function = '(struct mISDNchannel)->send' and type != 0;
  16 delete from caller_info where function = '(struct irq_router)->get' and type != 0;
  17 delete from caller_info where function = '(struct irq_router)->set' and type != 0;
  18 delete from caller_info where function = '(struct net_device_ops)->ndo_change_mtu' and caller = 'i40e_dbg_netdev_ops_write';
  19 delete from caller_info where function = '(struct timer_list)->function' and type != 0;
  20
  21 /* type 1003 is USER_DATA */
  22 delete from caller_info where caller = 'hid_input_report' and type = 1003;
  23 delete from caller_info where caller = 'nes_process_iwarp_aeqe' and type = 1003;
  24 delete from caller_info where caller = 'oz_process_ep0_urb' and type = 1003;
  25 delete from caller_info where function = 'dev_hard_start_xmit' and key = '\$' and type = 1003;
  26 delete from caller_info where function like '%->ndo_start_xmit' and key = '\$' and type = 1003;
  27 delete from caller_info where caller = 'packet_rcv_fanout' and function = '(struct packet_type)->func' and parameter = 1 and type = 1003;
  28 delete from caller_info where caller = 'hptiop_probe' and type = 1003;
  29 delete from caller_info where caller = 'p9_fd_poll' and function = '(struct file_operations)->poll' and type = 1003;
  30 delete from caller_info where caller = 'proc_reg_poll' and function = 'proc_reg_poll ptr poll' and type = 1003;
  31 delete from caller_info where function = 'blkdev_ioctl' and type = 1003 and parameter = 0 and key = '\$';
  32
  33 insert into caller_info values ('userspace', '', 'compat_sys_ioctl', 0, 0, 1003, 0, '\$', '1');
  34 insert into caller_info values ('userspace', '', 'compat_sys_ioctl', 0, 0, 1003, 1, '\$', '1');
  35 insert into caller_info values ('userspace', '', 'compat_sys_ioctl', 0, 0, 1003, 2, '\$', '1');
  36
  37 delete from caller_info where function = '(struct timer_list)->function' and parameter = 0;
  38
  39 /*
  40  * rw_verify_area is a very central function for the kernel.  The 1000000000
  41  * isn't accurate but I've picked it so that we can add "pos + count" without
  42  * wrapping on 32 bits.
  43  */
  44 delete from return_states where function = 'rw_verify_area';
  45 insert into return_states values ('faked', 'rw_verify_area', 0, 1, '0-1000000000[<=\$3]', 0, 0,   -1,      '', '');
  46 insert into return_states values ('faked', 'rw_verify_area', 0, 1, '0-1000000000[<=\$3]', 0, 104,  2, '*\$', '0-1000000000');
  47 insert into return_states values ('faked', 'rw_verify_area', 0, 1, '0-1000000000[<=\$3]', 0, 103, 3,  '\$', '0-1000000000');
  48 insert into return_states values ('faked', 'rw_verify_area', 0, 2, '(-4095)-(-1)',     0, 0,   -1,      '', '');
  49
  50 /*
  51  * I am a bad person for doing this to __kmalloc() which is a very deep function
  52  * and can easily be removed instead of to kmalloc().  But kmalloc() is an
  53  * inline function so it ends up being recorded thousands of times in the
  54  * database.  Doing this is easier.
  55  *
  56  */
  57 delete from return_states where function = '__kmalloc';
  58 insert into return_states values ('faked', '__kmalloc', 0, 1, '16', 0,    0,  -1, '', '');
  59 insert into return_states values ('faked', '__kmalloc', 0, 1, '16', 0, 103,   0, '\$', '0');
  60 insert into return_states values ('faked', '__kmalloc', 0, 2, '0,500000000-577777777', 0,    0, -1, '', '');
  61 insert into return_states values ('faked', '__kmalloc', 0, 2, '0,500000000-577777777', 0, 103,  0, '\$', '1-4000000');
  62 insert into return_states values ('faked', '__kmalloc', 0, 3, '0', 0,    0,  -1, '', '');
  63 insert into return_states values ('faked', '__kmalloc', 0, 3, '0', 0,    103,  0, '\$', '4000000-long_max');
  64
  65 delete from return_states where function = 'vmalloc';
  66 insert into return_states values ('faked', 'vmalloc', 0, 1, '0,600000000-677777777', 0,    0, -1, '', '');
  67 insert into return_states values ('faked', 'vmalloc', 0, 1, '0,600000000-677777777', 0, 103,  0, '\$', '1-128000000');
  68 insert into return_states values ('faked', 'vmalloc', 0, 2, '0', 0,    0,  -1, '', '');
  69
  70 delete from return_states where function = 'ksize';
  71 insert into return_states values ('faked', 'ksize', 0, 1, '0', 0,    0, -1, '', '');
  72 insert into return_states values ('faked', 'ksize', 0, 1, '0', 0, 103,  0, '\$', '16');
  73 insert into return_states values ('faked', 'ksize', 0, 2, '1-4000000', 0,    0,  -1, '', '');
  74
  75 /* store a bunch of capped functions */
  76 update return_states set return = '0-u32max[<=\$2]' where function = 'copy_to_user';
  77 update return_states set return = '0-u32max[<=\$2]' where function = '_copy_to_user';
  78 update return_states set return = '0-u32max[<=\$2]' where function = '__copy_to_user';
  79 update return_states set return = '0-u32max[<=\$2]' where function = 'copy_from_user';
  80 update return_states set return = '0-u32max[<=\$2]' where function = '_copy_from_user';
  81 update return_states set return = '0-u32max[<=\$2]' where function = '__copy_from_user';
  82
  83 /* 64 CPUs aught to be enough for anyone */
  84 update return_states set return = '1-64' where function = 'cpumask_weight';
  85
  86 update return_states set return = '0-8' where function = '__arch_hweight8';
  87 update return_states set return = '0-16' where function = '__arch_hweight16';
  88 update return_states set return = '0-32' where function = '__arch_hweight32';
  89 update return_states set return = '0-64' where function = '__arch_hweight64';
  90
  91 /*
  92  * Preserve the value across byte swapping.  By the time we use it for math it
  93  * will be byte swapped back to CPU endian.
  94  */
  95 update return_states set return = '0-u64max[==\$0]' where function = '__fswab64';
  96 update return_states set return = '0-u32max[==\$0]' where function = '__fswab32';
  97 update return_states set return = '0-u16max[==\$0]' where function = '__fswab16';
  98
  99 delete from return_states where function = 'bitmap_allocate_region' and return = '1';
 100 delete from return_states where function = 'pci_bus_read_config_word' and return = 135;
 101 delete from return_states where function = 'pci_bus_write_config_word' and return = 135;
 102
 103 update return_states set return = '(-4095)-s32max[<=\$3]' where function = 'get_user_pages' and return = 's32min-s32max';
 104 update return_states set return = '(-4095)-s64max[<=\$3]' where function = 'get_user_pages' and return = 's64min-s64max';
 105
 106 /* Smatch can't parse wait_for_completion() */
 107 update return_states set return = '(-108),(-22),0' where function = '__spi_sync' and return = '(-115),(-108),(-22)';
 108
 109 delete from caller_info where caller = '__kernel_write';
 110
 111 EOF
 112
 113 call_id=$(echo "select distinct call_id from caller_info where function = '__kernel_write';" | sqlite3 $db_file)
 114 for id in $call_id ; do
 115     echo "insert into caller_info values ('fake', '', '__kernel_write', $id, 0, 1, 1003, '*\$', '0-1000000000');" | sqlite3 $db_file
 116 done
 117
 118 for i in $(echo "select distinct return from return_states where function = 'clear_user';" | sqlite3 $db_file ) ; do
 119     echo "update return_states set return = \"$i[<=\$1]\" where return = \"$i\" and function = 'clear_user';" | sqlite3 $db_file
 120 done
 121
 122 echo "select distinct file, function from function_ptr where ptr='(struct rtl_hal_ops)->set_hw_reg';" \
 123         | sqlite3 smatch_db.sqlite | sed -e 's/|/ /' | while read file function ; do
 124
 125     drv=$(echo $file | perl -ne 's/.*\/rtlwifi\/(.*?)\/sw.c/$1/; print')
 126     if [ $drv = "" ] ; then
 127         continue
 128     fi
 129
 130     echo "FILE='$file'"
 131     echo "FUNCTION='$function'"
 132     echo $drv
 133
 134     echo "update caller_info
 135           set function = '$drv (struct rtl_hal_ops)->set_hw_reg'
 136           where function = '(struct rtl_hal_ops)->set_hw_reg' and file like 'drivers/net/wireless/rtlwifi/$drv/%';" \
 137          | sqlite3 smatch_db.sqlite
 138
 139     echo "insert into function_ptr values ('$file', '$function', '$drv (struct rtl_hal_ops)->set_hw_reg', 1);" \
 140          | sqlite3 smatch_db.sqlite
 141 done
 142