check_template.c

   1 /*
   2  * sparse/check_template.c
   3  *
   4  * Copyright (C) 20XX Your Name.
   5  *
   6  *  Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * First of all, it's best if you lower your expectations from finding
  12  * errors to just finding suspicious code.  There tends to be a lot
  13  * of false positives so having low expectations helps.
  14  *
  15  * For this test let's look for functions that return a negative value
  16  * with a semaphore held.
  17  *
  18  * This is just a template check.  It's designed for teaching
  19  * only and is deliberately less useful than it could be.
  20  *
  21  * This test could be a lot better if it handled the stuff like this:
  22  * ret = -ENOMEM;
  23  * return ret;
  24  * The correct way to handle that is to let smatch_extra store the
  25  * value of ret.  Then to use a *future* version of smatch that has
  26  * the get_possible_states(name, SMATCH_EXTRA, sym) function.  The
  27  * possible states will be saved in merge_slist() in that future version.
  28  *
  29  * Another short coming is that it assumes a function isn't supposed
  30  * to return negative with a lock held.  Perhaps the function was
  31  * called with the lock held.  A more complicated script could check that.
  32  *
  33  * Also it would be more effective to check for other types of locks
  34  * especially spinlocks.
  35  *
  36  */
  37
  38 #include "parse.h"
  39 #include "smatch.h"
  40 #include "smatch_slist.h"  // blast this was supposed to be internal only stuff
  41
  42 static int my_id;
  43
  44 STATE(lock);
  45 STATE(unlock);
  46
  47 /*
  48  * merge_func() can go away when we fix the core to just store all the possible
  49  * states.
  50  *
  51  * The parameters are passed in alphabetical order with NULL at the beginning
  52  * of the alphabet.  (s2 is never NULL).
  53  */
  54
  55 static struct smatch_state *merge_func(const char *name, struct symbol *sym,
  56                                        struct smatch_state *s1,
  57                                        struct smatch_state *s2)
  58 {
  59         if (s1 == NULL)
  60                 return s2;
  61         return &undefined;
  62
  63 }
  64
  65 static void match_call(struct expression *expr)
  66 {
  67         char *fn_name;
  68         struct expression *sem_expr;
  69         char *sem_name;
  70
  71         fn_name = get_variable_from_expr(expr->fn, NULL);
  72         if (!fn_name || (strcmp(fn_name, "down") && strcmp(fn_name, "up")))
  73                 return;
  74
  75         sem_expr = get_argument_from_call_expr(expr->args, 0);
  76         sem_name = get_variable_from_expr(sem_expr, NULL);
  77         if (!strcmp(fn_name, "down")) {
  78                 set_state(sem_name, my_id, NULL, &lock);
  79         } else {
  80                 set_state(sem_name, my_id, NULL, &unlock);
  81         }
  82         free_string(fn_name);
  83 }
  84
  85 static void match_return(struct statement *stmt)
  86 {
  87         int ret_val;
  88         struct state_list *slist;
  89         struct sm_state *tmp;
  90
  91         ret_val = get_value(stmt->ret_value);
  92         if (ret_val == UNDEFINED || ret_val >= 0)
  93                 return;
  94
  95         slist = get_all_states(my_id);
  96
  97         FOR_EACH_PTR(slist, tmp) {
  98                 if (tmp->state != &unlock)
  99                         smatch_msg("returned negative with %s semaphore held",
 100                                    tmp->name);
 101         } END_FOR_EACH_PTR(tmp);
 102 }
 103
 104 void register_template(int id)
 105 {
 106         my_id = id;
 107         add_merge_hook(my_id, &merge_func);
 108         add_hook(&match_call, FUNCTION_CALL_HOOK);
 109         add_hook(&match_return, RETURN_HOOK);
 110 }