check_zero_to_err_ptr.c

   1 /*
   2  * Copyright (C) 2013 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include "smatch.h"
  19 #include "smatch_extra.h"
  20 #include "smatch_slist.h"
  21
  22 static int my_id;
  23
  24 static int is_comparison_call(struct expression *expr)
  25 {
  26         expr = expr_get_parent_expr(expr);
  27         if (!expr || expr->type != EXPR_COMPARE)
  28                 return 0;
  29         if (expr->op != SPECIAL_EQUAL && expr->op != SPECIAL_NOTEQUAL)
  30                 return 0;
  31         return 1;
  32 }
  33
  34 static int next_line_is_if(struct expression *expr)
  35 {
  36         struct expression *next;
  37
  38         if (!__next_stmt || __next_stmt->type != STMT_IF)
  39                 return 0;
  40
  41         next = strip_expr(__next_stmt->if_conditional);
  42         while (next->type == EXPR_PREOP && next->op == '!')
  43                 next = strip_expr(next->unop);
  44         if (expr_equiv(expr, next))
  45                 return 1;
  46         return 0;
  47 }
  48
  49 static int next_line_checks_IS_ERR(struct expression *call, struct expression *arg)
  50 {
  51         struct expression *next;
  52         struct expression *tmp;
  53
  54         tmp = expr_get_parent_expr(call);
  55         if (tmp && tmp->type == EXPR_ASSIGNMENT) {
  56                 if (next_line_checks_IS_ERR(NULL, tmp->left))
  57                         return 1;
  58         }
  59
  60         if (!__next_stmt || __next_stmt->type != STMT_IF)
  61                 return 0;
  62
  63         next = strip_expr(__next_stmt->if_conditional);
  64         while (next->type == EXPR_PREOP && next->op == '!')
  65                 next = strip_expr(next->unop);
  66         if (!next || next->type != EXPR_CALL)
  67                 return 0;
  68         if (next->fn->type != EXPR_SYMBOL || !next->fn->symbol ||
  69             !next->fn->symbol->ident ||
  70             (strcmp(next->fn->symbol->ident->name, "IS_ERR") != 0 &&
  71              strcmp(next->fn->symbol->ident->name, "IS_ERR_OR_NULL") != 0))
  72                 return 0;
  73         next = get_argument_from_call_expr(next->args, 0);
  74         return expr_equiv(next, arg);
  75 }
  76
  77 static int is_valid_ptr(sval_t sval)
  78 {
  79         if (sval.type == &int_ctype &&
  80             (sval.value == INT_MIN || sval.value == INT_MAX))
  81                 return 0;
  82
  83         if (sval_cmp(valid_ptr_min_sval, sval) <= 0 &&
  84             sval_cmp(valid_ptr_max_sval, sval) >= 0)
  85                 return 1;
  86         return 0;
  87 }
  88
  89 static void match_err_ptr(const char *fn, struct expression *expr, void *data)
  90 {
  91         struct expression *arg_expr;
  92         struct sm_state *sm, *tmp;
  93         sval_t sval;
  94
  95         arg_expr = get_argument_from_call_expr(expr->args, 0);
  96         sm = get_sm_state_expr(SMATCH_EXTRA, arg_expr);
  97         if (!sm)
  98                 return;
  99
 100         if (is_comparison_call(expr))
 101                 return;
 102
 103         if (next_line_checks_IS_ERR(expr, arg_expr))
 104                 return;
 105         if (strcmp(fn, "ERR_PTR") == 0 &&
 106             next_line_is_if(arg_expr))
 107                 return;
 108
 109         FOR_EACH_PTR(sm->possible, tmp) {
 110                 if (!estate_rl(tmp->state))
 111                         continue;
 112                 if (is_valid_ptr(estate_min(tmp->state)) &&
 113                     is_valid_ptr(estate_max(tmp->state))) {
 114                         sm_msg("warn: passing a valid pointer to '%s'", fn);
 115                         return;
 116                 }
 117                 if (!rl_to_sval(estate_rl(tmp->state), &sval))
 118                         continue;
 119                 if (sval.value != 0)
 120                         continue;
 121                 sm_msg("warn: passing zero to '%s'", fn);
 122                 return;
 123         } END_FOR_EACH_PTR(tmp);
 124 }
 125
 126 void check_zero_to_err_ptr(int id)
 127 {
 128         if (option_project != PROJ_KERNEL)
 129                 return;
 130
 131         my_id = id;
 132         add_function_hook("ERR_PTR", &match_err_ptr, NULL);
 133         add_function_hook("ERR_CAST", &match_err_ptr, NULL);
 134         add_function_hook("PTR_ERR", &match_err_ptr, NULL);
 135 }