check_kmalloc_wrong_size.c

   1 /*
   2  * Copyright (C) 2011 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include "smatch.h"
  19
  20 static int my_id;
  21
  22 static int get_data_size(struct expression *ptr)
  23 {
  24         struct symbol *type;
  25
  26         type = get_type(ptr);
  27         if (!type || type->type != SYM_PTR)
  28                 return 0;
  29         type = get_base_type(type);
  30         if (!type)
  31                 return 0;
  32         return type_bytes(type);
  33 }
  34
  35 static void check_size_matches(int data_size, struct expression *size_expr)
  36 {
  37         sval_t sval;
  38
  39         if (data_size == 1)  /* this is generic a buffer */
  40                 return;
  41
  42         if (!get_implied_value(size_expr, &sval))
  43                 return;
  44         if (sval_cmp_val(sval, data_size) != 0)
  45                 sm_warning("double check that we're allocating correct size: %d vs %s", data_size, sval_to_str(sval));
  46 }
  47
  48 static void match_alloc(const char *fn, struct expression *expr, void *_arg_nr)
  49 {
  50         int arg_nr = PTR_INT(_arg_nr);
  51         struct expression *call = strip_expr(expr->right);
  52         struct expression *arg;
  53         int ptr_size;
  54
  55         ptr_size = get_data_size(expr->left);
  56         if (!ptr_size)
  57                 return;
  58
  59         arg = get_argument_from_call_expr(call->args, arg_nr);
  60         arg = strip_expr(arg);
  61         if (!arg || arg->type != EXPR_BINOP || arg->op != '*')
  62                 return;
  63         if (expr->left->type == EXPR_SIZEOF)
  64                 check_size_matches(ptr_size, arg->left);
  65         if (expr->right->type == EXPR_SIZEOF)
  66                 check_size_matches(ptr_size, arg->right);
  67 }
  68
  69 static void match_calloc(const char *fn, struct expression *expr, void *_arg_nr)
  70 {
  71         int arg_nr = PTR_INT(_arg_nr);
  72         struct expression *call = strip_expr(expr->right);
  73         struct expression *arg;
  74         int ptr_size;
  75
  76         ptr_size = get_data_size(expr->left);
  77         if (!ptr_size)
  78                 return;
  79
  80         arg = get_argument_from_call_expr(call->args, arg_nr);
  81         check_size_matches(ptr_size, arg);
  82 }
  83
  84 void check_kmalloc_wrong_size(int id)
  85 {
  86         my_id = id;
  87
  88         if (option_project != PROJ_KERNEL) {
  89                 add_function_assign_hook("malloc", &match_alloc, NULL);
  90                 add_function_assign_hook("calloc", &match_calloc, INT_PTR(1));
  91                 return;
  92         }
  93
  94         add_function_assign_hook("kmalloc", &match_alloc, INT_PTR(0));
  95         add_function_assign_hook("kcalloc", &match_calloc, INT_PTR(1));
  96 }