2 * Copyright (C) 2010 Dan Carpenter.
3 * Copyright (C) 2021 Oracle.
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License
7 * as published by the Free Software Foundation; either version 2
8 * of the License, or (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
20 #include "smatch_slist.h"
21 #include "smatch_extra.h"
25 #define __GFP_NOFAIL 0x8000u
29 static unsigned long GFP_NOFAIL(void)
31 static unsigned long saved_flags
= -1;
32 struct symbol
*macro_sym
;
34 if (saved_flags
!= -1)
37 macro_sym
= lookup_macro_symbol("___GFP_NOFAIL");
39 macro_sym
= lookup_macro_symbol("__GFP_NOFAIL");
40 if (!macro_sym
|| !macro_sym
->expansion
)
42 if (token_type(macro_sym
->expansion
) != TOKEN_NUMBER
)
45 saved_flags
= strtoul(macro_sym
->expansion
->number
, NULL
, 0);
49 static void pre_merge_hook(struct sm_state
*cur
, struct sm_state
*other
)
51 struct smatch_state
*state
;
53 if (is_impossible_path()) {
54 set_state(my_id
, cur
->name
, cur
->sym
, &undefined
);
58 state
= get_state(SMATCH_EXTRA
, cur
->name
, cur
->sym
);
59 if (!state
|| !estate_rl(state
))
61 if (!rl_has_sval(estate_rl(state
), ptr_null
))
62 set_state(my_id
, cur
->name
, cur
->sym
, &undefined
);
65 static bool is_possibly_zero(const char *name
, struct symbol
*sym
)
67 struct sm_state
*sm
, *tmp
;
69 sm
= get_sm_state(SMATCH_EXTRA
, name
, sym
);
72 FOR_EACH_PTR(sm
->possible
, tmp
) {
73 if (!estate_rl(tmp
->state
))
75 if (rl_min(estate_rl(tmp
->state
)).value
== 0 &&
76 rl_max(estate_rl(tmp
->state
)).value
== 0)
78 } END_FOR_EACH_PTR(tmp
);
83 static const char *get_allocation_fn_name(const char *name
, struct symbol
*sym
)
85 struct expression
*expr
;
87 expr
= get_assigned_expr_name_sym(name
, sym
);
90 if (expr
->type
== EXPR_CALL
&&
91 expr
->fn
->type
== EXPR_SYMBOL
&&
92 expr
->fn
->symbol
&& expr
->fn
->symbol
->ident
)
93 return expr
->fn
->symbol
->ident
->name
;
98 static void check_dereference_name_sym(char *name
, struct symbol
*sym
)
103 sm
= get_sm_state(my_id
, name
, sym
);
106 if (is_ignored(my_id
, sm
->name
, sm
->sym
))
108 if (!is_possibly_zero(sm
->name
, sm
->sym
))
110 if (is_impossible_path())
112 if (!slist_has_state(sm
->possible
, &null
))
115 sm_msg("%s: sm='%s'", __func__
, show_sm(sm
));
116 fn_name
= get_allocation_fn_name(name
, sym
);
117 sm_error("potential null dereference '%s'. (%s returns null)",
121 static void check_dereference(struct expression
*expr
)
126 name
= expr_to_var_sym(expr
, &sym
);
129 check_dereference_name_sym(name
, sym
);
133 static void match_dereferences(struct expression
*expr
)
135 if (expr
->type
!= EXPR_PREOP
)
137 check_dereference(expr
->unop
);
140 static void match_pointer_as_array(struct expression
*expr
)
144 check_dereference(get_array_base(expr
));
147 static void set_param_dereferenced(struct expression
*call
, struct expression
*arg
, char *key
, char *unused
)
152 name
= get_variable_from_key(arg
, key
, &sym
);
156 check_dereference_name_sym(name
, sym
);
161 static int called_with_no_fail(struct expression
*call
, int param
)
163 struct expression
*arg
;
168 call
= strip_expr(call
);
169 if (call
->type
!= EXPR_CALL
)
171 arg
= get_argument_from_call_expr(call
->args
, param
);
172 if (get_value(arg
, &sval
) && (sval
.uvalue
& GFP_NOFAIL()))
177 static void match_assign_returns_null(const char *fn
, struct expression
*expr
, void *_gfp
)
179 int gfp_param
= PTR_INT(_gfp
);
181 if (called_with_no_fail(expr
->right
, gfp_param
))
183 set_state_expr(my_id
, expr
->left
, &null
);
186 static void register_allocation_funcs(void)
193 snprintf(filename
, sizeof(filename
), "%s.allocation_funcs_gfp", option_project_str
);
194 token
= get_tokens_file(filename
);
197 if (token_type(token
) != TOKEN_STREAMBEGIN
)
200 while (token_type(token
) != TOKEN_STREAMEND
) {
201 if (token_type(token
) != TOKEN_IDENT
) {
202 printf("error parsing '%s' line %d\n", filename
, token
->pos
.line
);
205 func
= show_ident(token
->ident
);
207 if (token_type(token
) == TOKEN_IDENT
)
209 else if (token_type(token
) == TOKEN_NUMBER
)
210 arg
= atoi(token
->number
);
212 printf("error parsing '%s' line %d\n", filename
, token
->pos
.line
);
215 add_function_assign_hook(func
, &match_assign_returns_null
, INT_PTR(arg
));
221 void check_unchecked_allocation(int id
)
225 add_modification_hook(my_id
, &set_undefined
);
226 add_pre_merge_hook(my_id
, &pre_merge_hook
);
227 add_hook(&match_dereferences
, DEREF_HOOK
);
228 add_hook(&match_pointer_as_array
, OP_HOOK
);
229 select_return_implies_hook(DEREFERENCE
, &set_param_dereferenced
);
230 register_allocation_funcs();