2 * sparse/check_err_ptr_deref.c
4 * Copyright (C) 2009 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 #include "smatch_slist.h"
12 #include "smatch_extra.h"
19 static void check_is_err_ptr(struct sm_state
*sm
)
24 if (slist_has_state(sm
->possible
, &err_ptr
)) {
25 sm_msg("error: '%s' dereferencing possible ERR_PTR()",
27 set_state(my_id
, sm
->name
, sm
->sym
, &checked
);
31 static void match_returns_err_ptr(const char *fn
, struct expression
*expr
,
34 set_state_expr(my_id
, expr
->left
, &err_ptr
);
37 static void match_is_err(const char *fn
, struct expression
*expr
,
40 expr
= get_argument_from_call_expr(expr
->args
, 0);
41 if (expr
->type
== EXPR_ASSIGNMENT
)
43 set_true_false_states_expr(my_id
, expr
, &err_ptr
, &checked
);
46 static void match_dereferences(struct expression
*expr
)
50 if (expr
->type
!= EXPR_PREOP
)
52 expr
= strip_expr(expr
->unop
);
54 sm
= get_sm_state_expr(my_id
, expr
);
58 static void register_err_ptr_funcs(void)
63 token
= get_tokens_file("kernel.returns_err_ptr");
66 if (token_type(token
) != TOKEN_STREAMBEGIN
)
69 while (token_type(token
) != TOKEN_STREAMEND
) {
70 if (token_type(token
) != TOKEN_IDENT
)
72 func
= show_ident(token
->ident
);
73 add_function_assign_hook(func
, &match_returns_err_ptr
, NULL
);
79 static void match_err_ptr(const char *fn
, struct expression
*expr
, void *unused
)
81 struct expression
*arg
;
86 long long min
= whole_range
.max
;
87 long long max
= whole_range
.min
;
89 arg
= get_argument_from_call_expr(expr
->args
, 0);
90 sm
= get_sm_state_expr(SMATCH_EXTRA
, arg
);
93 FOR_EACH_PTR(sm
->possible
, tmp
) {
94 tmp_min
= get_dinfo_min(get_dinfo(tmp
->state
));
95 if (tmp_min
!= whole_range
.min
&& tmp_min
< min
)
97 tmp_max
= get_dinfo_max(get_dinfo(tmp
->state
));
98 if (tmp_max
!= whole_range
.max
&& tmp_max
> max
)
100 } END_FOR_EACH_PTR(tmp
);
102 sm_msg("error: %lld too low for ERR_PTR", min
);
104 sm_msg("error: passing non neg %lld to ERR_PTR", max
);
107 static void match_ptr_err(const char *fn
, struct expression
*expr
, void *unused
)
109 struct expression
*arg
;
110 struct expression
*right
;
112 right
= strip_expr(expr
->right
);
113 arg
= get_argument_from_call_expr(right
->args
, 0);
114 if (get_state_expr(my_id
, arg
) == &err_ptr
) {
115 set_state_expr(SMATCH_EXTRA
, expr
->left
, alloc_extra_state_range(-4095, -1));
119 void check_err_ptr_deref(int id
)
121 if (option_project
!= PROJ_KERNEL
)
125 add_conditional_hook("IS_ERR", &match_is_err
, NULL
);
126 register_err_ptr_funcs();
127 add_hook(&match_dereferences
, DEREF_HOOK
);
128 add_function_hook("ERR_PTR", &match_err_ptr
, NULL
);
129 add_function_assign_hook("PTR_ERR", &match_ptr_err
, NULL
);