param_key: fix container of when no struct member is referenced
[smatch.git] / check_deref.c
blob41f05ecbcb4f1bd785a7706f9bf2b485dbe057ef
1 /*
2 * Copyright (C) 2010 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * There was a previous null dereference test but it was too confusing and
20 * difficult to debug. This test is much simpler in its goals and scope.
22 * This test only complains about:
23 * 1) dereferencing uninitialized variables
24 * 2) dereferencing variables which were assigned as null.
25 * 3) dereferencing variables which were assigned a function the returns
26 * null.
28 * If we dereference something then we complain if any of those three
29 * are possible.
33 #include "smatch.h"
34 #include "smatch_slist.h"
35 #include "smatch_extra.h"
37 static int my_id;
39 #define __GFP_NOFAIL 0x800
41 STATE(null);
42 STATE(ok);
43 STATE(uninitialized);
45 static struct smatch_state *alloc_my_state(const char *name)
47 struct smatch_state *state;
49 state = __alloc_smatch_state(0);
50 state->name = name;
51 return state;
54 static struct smatch_state *unmatched_state(struct sm_state *sm)
56 return &ok;
59 static void is_ok(struct sm_state *sm, struct expression *mod_expr)
61 set_state(my_id, sm->name, sm->sym, &ok);
64 static bool is_possibly_zero(const char *name, struct symbol *sym)
66 struct sm_state *sm, *tmp;
68 sm = get_sm_state(SMATCH_EXTRA, name, sym);
69 if (!sm)
70 return false;
71 FOR_EACH_PTR(sm->possible, tmp) {
72 if (!estate_rl(tmp->state))
73 continue;
74 if (rl_min(estate_rl(tmp->state)).value == 0 &&
75 rl_max(estate_rl(tmp->state)).value == 0)
76 return true;
77 } END_FOR_EACH_PTR(tmp);
79 return false;
82 static void check_dereference(struct expression *expr)
84 struct sm_state *sm;
85 struct sm_state *tmp;
87 expr = strip_expr(expr);
88 if (is_static(expr))
89 return;
90 sm = get_sm_state_expr(my_id, expr);
91 if (!sm)
92 return;
93 if (is_ignored(my_id, sm->name, sm->sym))
94 return;
95 if (!is_possibly_zero(sm->name, sm->sym))
96 return;
97 if (is_impossible_path())
98 return;
100 FOR_EACH_PTR(sm->possible, tmp) {
101 if (tmp->state == &merged)
102 continue;
103 if (tmp->state == &ok)
104 continue;
105 add_ignore(my_id, sm->name, sm->sym);
106 if (tmp->state == &null)
107 return;
108 if (tmp->state == &uninitialized)
109 return;
110 sm_error("potential null dereference '%s'. (%s returns null)",
111 tmp->name, tmp->state->name);
112 return;
113 } END_FOR_EACH_PTR(tmp);
116 static void check_dereference_name_sym(char *name, struct symbol *sym)
118 struct sm_state *sm;
119 struct sm_state *tmp;
121 sm = get_sm_state(my_id, name, sym);
122 if (!sm)
123 return;
124 if (is_ignored(my_id, sm->name, sm->sym))
125 return;
126 if (!is_possibly_zero(sm->name, sm->sym))
127 return;
128 if (is_impossible_path())
129 return;
131 FOR_EACH_PTR(sm->possible, tmp) {
132 if (tmp->state == &merged)
133 continue;
134 if (tmp->state == &ok)
135 continue;
136 add_ignore(my_id, sm->name, sm->sym);
137 if (tmp->state == &null)
138 return;
139 if (tmp->state == &uninitialized)
140 return;
141 sm_error("potential null dereference '%s'. (%s returns null)",
142 tmp->name, tmp->state->name);
143 return;
144 } END_FOR_EACH_PTR(tmp);
147 static void match_dereferences(struct expression *expr)
149 if (expr->type != EXPR_PREOP)
150 return;
151 check_dereference(expr->unop);
154 static void match_pointer_as_array(struct expression *expr)
156 if (!is_array(expr))
157 return;
158 check_dereference(get_array_base(expr));
161 static void set_param_dereferenced(struct expression *call, struct expression *arg, char *key, char *unused)
163 struct symbol *sym;
164 char *name;
166 name = get_variable_from_key(arg, key, &sym);
167 if (!name || !sym)
168 goto free;
170 check_dereference_name_sym(name, sym);
171 free:
172 free_string(name);
175 static void match_declarations(struct symbol *sym)
177 const char *name;
179 if ((get_base_type(sym))->type == SYM_ARRAY)
180 return;
182 if (!sym->ident)
183 return;
184 name = sym->ident->name;
185 if (!sym->initializer) {
186 set_state(my_id, name, sym, &uninitialized);
187 scoped_state(my_id, name, sym);
191 static void match_assign(struct expression *expr)
193 struct statement *stmt;
195 if (!expr_is_zero(expr->right))
196 return;
198 if (__in_fake_assign)
199 return;
201 stmt = get_current_statement();
202 if (stmt && stmt->type == STMT_DECLARATION)
203 return;
205 set_state_expr(my_id, expr->left, &null);
208 static void match_assigns_address(struct expression *expr)
210 struct expression *right;
212 right = strip_expr(expr->right);
213 if (right->type != EXPR_PREOP || right->op != '&')
214 return;
215 set_state_expr(my_id, right, &ok);
218 static void match_condition(struct expression *expr)
220 if (expr->type == EXPR_ASSIGNMENT) {
221 match_condition(expr->right);
222 match_condition(expr->left);
224 if (!get_state_expr(my_id, expr))
225 return;
226 set_true_false_states_expr(my_id, expr, &ok, NULL);
229 static int called_with_no_fail(struct expression *call, int param)
231 struct expression *arg;
232 sval_t sval;
234 if (param == -1)
235 return 0;
236 call = strip_expr(call);
237 if (call->type != EXPR_CALL)
238 return 0;
239 arg = get_argument_from_call_expr(call->args, param);
240 if (get_value(arg, &sval) && (sval.uvalue & __GFP_NOFAIL))
241 return 1;
242 return 0;
245 static void match_assign_returns_null(const char *fn, struct expression *expr, void *_gfp)
247 struct smatch_state *state;
248 int gfp_param = PTR_INT(_gfp);
250 if (called_with_no_fail(expr->right, gfp_param))
251 return;
252 state = alloc_my_state(fn);
253 set_state_expr(my_id, expr->left, state);
256 static void register_allocation_funcs(void)
258 struct token *token;
259 const char *func;
260 int arg;
262 token = get_tokens_file("kernel.allocation_funcs_gfp");
263 if (!token)
264 return;
265 if (token_type(token) != TOKEN_STREAMBEGIN)
266 return;
267 token = token->next;
268 while (token_type(token) != TOKEN_STREAMEND) {
269 if (token_type(token) != TOKEN_IDENT)
270 return;
271 func = show_ident(token->ident);
272 token = token->next;
273 if (token_type(token) == TOKEN_IDENT)
274 arg = -1;
275 else if (token_type(token) == TOKEN_NUMBER)
276 arg = atoi(token->number);
277 else
278 return;
279 add_function_assign_hook(func, &match_assign_returns_null, INT_PTR(arg));
280 token = token->next;
282 clear_token_alloc();
285 void check_deref(int id)
287 my_id = id;
289 add_unmatched_state_hook(my_id, &unmatched_state);
290 add_modification_hook(my_id, &is_ok);
291 add_hook(&match_dereferences, DEREF_HOOK);
292 add_hook(&match_pointer_as_array, OP_HOOK);
293 select_return_implies_hook(DEREFERENCE, &set_param_dereferenced);
294 add_hook(&match_condition, CONDITION_HOOK);
295 add_hook(&match_declarations, DECLARATION_HOOK);
296 add_hook(&match_assign, ASSIGNMENT_HOOK);
297 add_hook(&match_assigns_address, ASSIGNMENT_HOOK);
298 if (option_project == PROJ_KERNEL)
299 register_allocation_funcs();