2 * smatch/check_return_efault.c
4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 * This tries to find places which should probably return -EFAULT
12 * but return the number of bytes to copy instead.
16 #include "smatch_slist.h"
17 #include "smatch_extra.h"
24 static void ok_to_use(struct sm_state
*sm
)
27 set_state(my_id
, sm
->name
, sm
->sym
, &ok
);
30 static void match_copy(const char *fn
, struct expression
*expr
, void *unused
)
32 if (expr
->op
== SPECIAL_SUB_ASSIGN
)
34 set_state_expr(my_id
, expr
->left
, &remaining
);
37 static void match_condition(struct expression
*expr
)
39 if (!get_state_expr(my_id
, expr
))
41 /* If the variable is zero that's ok */
42 set_true_false_states_expr(my_id
, expr
, NULL
, &ok
);
46 * This function is biased in favour of print out errors.
47 * The heuristic to print is:
48 * If we have a potentially positive return from copy_to_user
49 * and there is a possibility that we return negative as well
52 static void match_return(struct expression
*ret_value
)
54 struct smatch_state
*state
;
58 sm
= get_sm_state_expr(my_id
, ret_value
);
61 if (!slist_has_state(sm
->possible
, &remaining
))
63 state
= get_state_expr(SMATCH_EXTRA
, ret_value
);
66 if (!get_absolute_min_sval(ret_value
, &min
))
70 sm_msg("warn: maybe return -EFAULT instead of the bytes remaining?");
73 void check_return_efault(int id
)
75 if (option_project
!= PROJ_KERNEL
)
79 add_function_assign_hook("copy_to_user", &match_copy
, NULL
);
80 add_function_assign_hook("__copy_to_user", &match_copy
, NULL
);
81 add_function_assign_hook("copy_from_user", &match_copy
, NULL
);
82 add_function_assign_hook("__copy_from_user", &match_copy
, NULL
);
83 add_function_assign_hook("clear_user", &match_copy
, NULL
);
84 add_hook(&match_condition
, CONDITION_HOOK
);
85 add_hook(&match_return
, RETURN_HOOK
);
86 add_modification_hook(my_id
, &ok_to_use
);