4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 * There was a previous null dereference test but it was too confusing and
12 * difficult to debug. This test is much simpler in its goals and scope.
14 * This test only complains about:
15 * 1) dereferencing uninitialized variables
16 * 2) dereferencing variables which were assigned as null.
17 * 3) dereferencing variables which were assigned a function the returns
20 * If we dereference something then we complain if any of those three
26 #include "smatch_slist.h"
27 #include "smatch_extra.h"
31 #define __GFP_NOFAIL 0x800
37 static struct smatch_state
*alloc_my_state(const char *name
)
39 struct smatch_state
*state
;
41 state
= malloc(sizeof(*state
));
46 static struct smatch_state
*unmatched_state(struct sm_state
*sm
)
51 static void is_ok(struct sm_state
*sm
)
53 set_state(my_id
, sm
->name
, sm
->sym
, &ok
);
56 static void check_dereference(struct expression
*expr
)
61 expr
= strip_expr(expr
);
62 sm
= get_sm_state_expr(my_id
, expr
);
65 if (is_ignored(my_id
, sm
->name
, sm
->sym
))
67 if (implied_not_equal(expr
, 0))
70 FOR_EACH_PTR(sm
->possible
, tmp
) {
71 if (tmp
->state
== &merged
)
73 if (tmp
->state
== &ok
)
75 add_ignore(my_id
, sm
->name
, sm
->sym
);
76 if (tmp
->state
== &null
) {
77 sm_msg("error: potential NULL dereference '%s'.", tmp
->name
);
80 if (tmp
->state
== &uninitialized
) {
81 sm_msg("error: potentially derefencing uninitialized '%s'.", tmp
->name
);
84 sm_msg("error: potential null dereference '%s'. (%s returns null)",
85 tmp
->name
, tmp
->state
->name
);
87 } END_FOR_EACH_PTR(tmp
);
90 static void match_dereferences(struct expression
*expr
)
92 if (expr
->type
!= EXPR_PREOP
)
94 check_dereference(expr
->unop
);
97 static void match_pointer_as_array(struct expression
*expr
)
101 check_dereference(expr
->unop
->left
);
104 static void set_param_dereferenced(struct expression
*arg
, char *unused
)
106 check_dereference(arg
);
109 static void match_declarations(struct symbol
*sym
)
113 if ((get_base_type(sym
))->type
== SYM_ARRAY
)
116 name
= sym
->ident
->name
;
117 if (!sym
->initializer
) {
118 set_state(my_id
, name
, sym
, &uninitialized
);
119 scoped_state(my_id
, name
, sym
);
123 static void match_assign(struct expression
*expr
)
125 if (is_zero(expr
->right
)) {
126 set_state_expr(my_id
, expr
->left
, &null
);
131 static void match_condition(struct expression
*expr
)
133 if (expr
->type
== EXPR_ASSIGNMENT
) {
134 match_condition(expr
->right
);
135 match_condition(expr
->left
);
137 if (!get_state_expr(my_id
, expr
))
139 set_true_false_states_expr(my_id
, expr
, &ok
, NULL
);
142 static int called_with_no_fail(struct expression
*call
, int param
)
144 struct expression
*arg
;
149 call
= strip_expr(call
);
150 if (call
->type
!= EXPR_CALL
)
152 arg
= get_argument_from_call_expr(call
->args
, param
);
153 if (get_value_sval(arg
, &sval
) && (sval
.uvalue
& __GFP_NOFAIL
))
158 static void match_assign_returns_null(const char *fn
, struct expression
*expr
, void *_gfp
)
160 struct smatch_state
*state
;
161 int gfp_param
= PTR_INT(_gfp
);
163 if (called_with_no_fail(expr
->right
, gfp_param
))
165 state
= alloc_my_state(fn
);
166 set_state_expr(my_id
, expr
->left
, state
);
169 static void register_allocation_funcs(void)
175 token
= get_tokens_file("kernel.allocation_funcs_gfp");
178 if (token_type(token
) != TOKEN_STREAMBEGIN
)
181 while (token_type(token
) != TOKEN_STREAMEND
) {
182 if (token_type(token
) != TOKEN_IDENT
)
184 func
= show_ident(token
->ident
);
186 if (token_type(token
) == TOKEN_IDENT
)
188 else if (token_type(token
) == TOKEN_NUMBER
)
189 arg
= atoi(token
->number
);
192 add_function_assign_hook(func
, &match_assign_returns_null
, INT_PTR(arg
));
198 void check_deref(int id
)
202 add_unmatched_state_hook(my_id
, &unmatched_state
);
203 add_modification_hook(my_id
, &is_ok
);
204 add_hook(&match_dereferences
, DEREF_HOOK
);
205 add_hook(&match_pointer_as_array
, OP_HOOK
);
206 add_db_fn_call_callback(DEREFERENCE
, &set_param_dereferenced
);
207 add_hook(&match_condition
, CONDITION_HOOK
);
208 add_hook(&match_declarations
, DECLARATION_HOOK
);
209 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
210 if (option_project
== PROJ_KERNEL
)
211 register_allocation_funcs();