check_access_ok_math.c

   1 /*
   2  * smatch/check_access_ok_math.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 #include "smatch.h"
  11
  12 static int my_id;
  13
  14 static int can_overflow(struct expression *expr)
  15 {
  16         sval_t max;
  17         int uncapped = 0;
  18
  19         expr = strip_expr(expr);
  20
  21         if (expr->type == EXPR_BINOP) {
  22                 uncapped += can_overflow(expr->left);
  23                 uncapped += can_overflow(expr->right);
  24
  25                 if (uncapped &&
  26                         (expr->op == '+' || expr->op == '*' || expr->op == SPECIAL_LEFTSHIFT))
  27                         return 1;
  28
  29                 return 0;
  30         }
  31
  32         if (get_implied_max(expr, &max))
  33                 return 0;
  34         if (get_absolute_max(expr, &max) && sval_cmp_val(max, 4096) <= 0)
  35                 return 0;
  36         return 1;
  37 }
  38
  39 static void match_size(struct expression *size_expr)
  40 {
  41         char *name;
  42
  43         size_expr = strip_expr(size_expr);
  44         if (!size_expr)
  45                 return;
  46         if (size_expr->type != EXPR_BINOP) {
  47                 size_expr = get_assigned_expr(size_expr);
  48                 if (!size_expr || size_expr->type != EXPR_BINOP)
  49                         return;
  50         }
  51         if (!can_overflow(size_expr))
  52                 return;
  53
  54         name = expr_to_str(size_expr);
  55         sm_msg("warn: math in access_ok() is dangerous '%s'", name);
  56
  57         free_string(name);
  58 }
  59
  60 static void match_access_ok(const char *fn, struct expression *expr, void *data)
  61 {
  62         struct expression *size_expr;
  63
  64         size_expr = get_argument_from_call_expr(expr->args, 1);
  65         match_size(size_expr);
  66 }
  67
  68 static void split_asm_constraints(struct expression_list *expr_list)
  69 {
  70         struct expression *expr;
  71         int state = 0;
  72         int i;
  73
  74         i = 0;
  75         FOR_EACH_PTR(expr_list, expr) {
  76
  77                 switch (state) {
  78                 case 0: /* identifier */
  79                 case 1: /* constraint */
  80                         state++;
  81                         continue;
  82                 case 2: /* expression */
  83                         state = 0;
  84                         if (i == 1)
  85                                 match_size(expr);
  86                         i++;
  87                         continue;
  88                 }
  89         } END_FOR_EACH_PTR(expr);
  90 }
  91
  92 static void match_asm_stmt(struct statement *stmt)
  93 {
  94         char *name;
  95
  96         name = get_macro_name(stmt->pos);
  97         if (!name || strcmp(name, "access_ok") != 0)
  98                 return;
  99         split_asm_constraints(stmt->asm_inputs);
 100 }
 101
 102 void check_access_ok_math(int id)
 103 {
 104         my_id = id;
 105         if (option_project != PROJ_KERNEL)
 106                 return;
 107         if (!option_spammy)
 108                 return;
 109         add_function_hook("__access_ok", &match_access_ok, NULL);
 110         add_hook(&match_asm_stmt, ASM_HOOK);
 111 }