check_kernel.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * This is kernel specific stuff for smatch_extra.
  20  */
  21
  22 #include "scope.h"
  23 #include "smatch.h"
  24 #include "smatch_slist.h"
  25 #include "smatch_extra.h"
  26
  27 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
  28 {
  29         struct expression *arg;
  30
  31         arg = get_argument_from_call_expr(call->args, 0);
  32         if (!get_implied_rl(arg, rl))
  33                 return false;
  34
  35         *rl = cast_rl(get_type(call), *rl);
  36         return !!*rl;
  37 }
  38
  39 static void hack_ERR_PTR(struct symbol *sym)
  40 {
  41         struct symbol *arg;
  42         struct smatch_state *estate;
  43         struct range_list *after;
  44         sval_t low_error = {
  45                 .type = &long_ctype,
  46                 .value = -4095,
  47         };
  48         sval_t minus_one = {
  49                 .type = &long_ctype,
  50                 .value = -1,
  51         };
  52         sval_t zero = {
  53                 .type = &long_ctype,
  54                 .value = 0,
  55         };
  56
  57         if (!sym || !sym->ident)
  58                 return;
  59         if (strcmp(sym->ident->name, "ERR_PTR") != 0)
  60                 return;
  61
  62         arg = first_ptr_list((struct ptr_list *)sym->ctype.base_type->arguments);
  63         if (!arg || !arg->ident)
  64                 return;
  65
  66         estate = get_state(SMATCH_EXTRA, arg->ident->name, arg);
  67         if (!estate) {
  68                 after = alloc_rl(low_error, minus_one);
  69         } else {
  70                 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero));
  71                 if (rl_equiv(estate_rl(estate), after))
  72                         return;
  73         }
  74         set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after));
  75 }
  76
  77 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
  78                         struct expression *assign_expr, void *_param)
  79 {
  80         int param = PTR_INT(_param);
  81         struct expression *arg;
  82         struct smatch_state *pre_state;
  83         struct smatch_state *end_state;
  84         struct range_list *rl;
  85
  86         arg = get_argument_from_call_expr(call_expr->args, param);
  87         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  88         if (estate_rl(pre_state)) {
  89                 rl = estate_rl(pre_state);
  90                 rl = remove_range(rl, ptr_null, ptr_null);
  91                 rl = remove_range(rl, ptr_err_min, ptr_err_max);
  92         } else {
  93                 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
  94         }
  95         end_state = alloc_estate_rl(rl);
  96         set_extra_expr_nomod(arg, end_state);
  97 }
  98
  99 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
 100                         struct expression *assign_expr, void *_param)
 101 {
 102         int param = PTR_INT(_param);
 103         struct expression *arg;
 104         struct range_list *pre, *rl;
 105         struct smatch_state *pre_state;
 106         struct smatch_state *end_state;
 107
 108         arg = get_argument_from_call_expr(call_expr->args, param);
 109         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 110         if (pre_state)
 111                 pre = estate_rl(pre_state);
 112         else
 113                 pre = alloc_whole_rl(&ptr_ctype);
 114         call_results_to_rl(call_expr, &ptr_ctype, "0,(-4095)-(-1)", &rl);
 115         rl = rl_intersection(pre, rl);
 116         rl = cast_rl(get_type(arg), rl);
 117         end_state = alloc_estate_rl(rl);
 118         set_extra_expr_nomod(arg, end_state);
 119 }
 120
 121 static void match_not_err(const char *fn, struct expression *call_expr,
 122                         struct expression *assign_expr, void *unused)
 123 {
 124         struct expression *arg;
 125         struct smatch_state *pre_state;
 126         struct range_list *rl;
 127
 128         arg = get_argument_from_call_expr(call_expr->args, 0);
 129         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 130         if (pre_state) {
 131                 rl = estate_rl(pre_state);
 132                 rl = remove_range(rl, ptr_err_min, ptr_err_max);
 133         } else {
 134                 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
 135         }
 136         rl = cast_rl(get_type(arg), rl);
 137         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 138 }
 139
 140 static void match_err(const char *fn, struct expression *call_expr,
 141                         struct expression *assign_expr, void *unused)
 142 {
 143         struct expression *arg;
 144         struct smatch_state *pre_state;
 145         struct range_list *rl;
 146
 147         arg = get_argument_from_call_expr(call_expr->args, 0);
 148         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 149         rl = estate_rl(pre_state);
 150         if (!rl)
 151                 rl = alloc_rl(ptr_err_min, ptr_err_max);
 152         rl = rl_intersection(rl, alloc_rl(ptr_err_min, ptr_err_max));
 153         rl = cast_rl(get_type(arg), rl);
 154         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 155 }
 156
 157 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
 158 {
 159         set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 160 }
 161
 162 static void match_container_of(struct expression *expr)
 163 {
 164         struct expression *right = expr->right;
 165         char *macro;
 166
 167         /*
 168          * The problem here is that sometimes the container_of() macro is itself
 169          * inside a macro and get_macro() only returns the name of the outside
 170          * macro.
 171          */
 172
 173         /*
 174          * This actually an expression statement assignment but smatch_flow
 175          * pre-mangles it for us so we only get the last chunk:
 176          * sk = (typeof(sk))((char *)__mptr - offsetof(...))
 177          */
 178
 179         macro = get_macro_name(right->pos);
 180         if (!macro)
 181                 return;
 182         if (right->type != EXPR_CAST)
 183                 return;
 184         right = strip_expr(right);
 185         if (right->type != EXPR_BINOP || right->op != '-' ||
 186             right->left->type != EXPR_CAST)
 187                 return;
 188         right = strip_expr(right->left);
 189         if (right->type != EXPR_SYMBOL)
 190                 return;
 191         if (!right->symbol->ident ||
 192             strcmp(right->symbol->ident->name, "__mptr") != 0)
 193                 return;
 194         set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 195 }
 196
 197 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl)
 198 {
 199         struct expression *start_arg;
 200         struct expression *size_arg;
 201         struct symbol *type;
 202         sval_t min, max, tmp;
 203
 204         size_arg = get_argument_from_call_expr(call->args, 1);
 205         /* btw. there isn't a start_arg for find_first_bit() */
 206         start_arg = get_argument_from_call_expr(call->args, 2);
 207
 208         type = get_type(call);
 209         min = sval_type_val(type, 0);
 210         max = sval_type_val(type, sizeof(long long) * 8);
 211
 212         if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value)
 213                 max = tmp;
 214         if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp))
 215                 min = tmp;
 216         if (sval_cmp(min, max) > 0)
 217                 max = min;
 218         min = sval_cast(type, min);
 219         max = sval_cast(type, max);
 220         *rl = alloc_rl(min, max);
 221         return 1;
 222 }
 223
 224 static struct expression *cast_to_ul(struct expression *expr)
 225 {
 226         struct symbol *type;
 227
 228         type = get_type(expr);
 229         if (!type)
 230                 return NULL;
 231         if (type_positive_bits(type) > type_positive_bits(&ulong_ctype))
 232                 return NULL;
 233         if (type_positive_bits(type) == type_positive_bits(&ulong_ctype))
 234                 return expr;
 235
 236         return cast_expression(expr, &ulong_ctype);
 237 }
 238
 239 static struct range_list *do_size_op(struct range_list *left, int op, struct range_list *right)
 240 {
 241         sval_t a_min, b_min, res_min;
 242
 243         /* no overflows */
 244         if (!sval_binop_overflows(rl_max(left), op, rl_max(right)))
 245                 return rl_binop(left, op, right);
 246
 247         /* only overflows */
 248         if (sval_binop_overflows(rl_min(left), op, rl_min(right)))
 249                 return alloc_rl(sval_type_max(&ulong_ctype),
 250                                 sval_type_max(&ulong_ctype));
 251
 252         a_min = rl_min(left);
 253         b_min = rl_min(right);
 254         res_min = sval_binop(a_min, op, b_min);
 255
 256         return alloc_rl(res_min, sval_type_max(&ulong_ctype));
 257 }
 258
 259 static bool match_size_op(struct expression *call, int op, struct range_list **rl)
 260 {
 261         struct expression *a, *b;
 262         struct range_list *a_rl, *b_rl;
 263
 264         a = get_argument_from_call_expr(call->args, 0);
 265         b = get_argument_from_call_expr(call->args, 1);
 266         a = cast_to_ul(a);
 267         b = cast_to_ul(b);
 268
 269         get_absolute_rl(a, &a_rl);
 270         get_absolute_rl(b, &b_rl);
 271
 272         *rl = do_size_op(a_rl, op, b_rl);
 273
 274         return true;
 275 }
 276
 277 static int match_size_add(struct expression *call, void *unused, struct range_list **rl)
 278 {
 279         return match_size_op(call, '+', rl);
 280 }
 281
 282 static int match_size_mul(struct expression *call, void *unused, struct range_list **rl)
 283 {
 284         return match_size_op(call, '*', rl);
 285 }
 286
 287 static int match_ab_c_size(struct expression *call, void *unused, struct range_list **rl)
 288 {
 289         struct expression *a, *b, *c;
 290         struct range_list *a_rl, *b_rl, *c_rl, *ret;
 291
 292         a = get_argument_from_call_expr(call->args, 0);
 293         b = get_argument_from_call_expr(call->args, 1);
 294         c = get_argument_from_call_expr(call->args, 2);
 295
 296         a = cast_to_ul(a);
 297         b = cast_to_ul(b);
 298         c = cast_to_ul(c);
 299
 300         get_absolute_rl(a, &a_rl);
 301         get_absolute_rl(b, &b_rl);
 302         get_absolute_rl(c, &c_rl);
 303
 304         ret = do_size_op(a_rl, '*', b_rl);
 305         ret = do_size_op(ret, '+', c_rl);
 306
 307         *rl = ret;
 308
 309         return true;
 310 }
 311
 312 static int match_array_size(struct expression *call, void *unused, struct range_list **rl)
 313 {
 314         return match_size_mul(call, NULL, rl);
 315 }
 316
 317 static int match_ffs(struct expression *call, void *unused, struct range_list **rl)
 318 {
 319         if (get_implied_rl(call, rl))
 320                 return true;
 321         return false;
 322 }
 323
 324 static int match_fls(struct expression *call, void *unused, struct range_list **rl)
 325 {
 326         struct expression *arg;
 327         struct range_list *arg_rl;
 328         sval_t zero = {};
 329         sval_t start = {
 330                 .type = &int_ctype,
 331                 .value = 0,
 332         };
 333         sval_t end = {
 334                 .type = &int_ctype,
 335                 .value = 32,
 336         };
 337         sval_t sval;
 338
 339         arg = get_argument_from_call_expr(call->args, 0);
 340         if (!get_implied_rl(arg, &arg_rl))
 341                 return 0;
 342         if (rl_to_sval(arg_rl, &sval)) {
 343                 int i;
 344
 345                 for (i = 63; i >= 0; i--) {
 346                         if (sval.uvalue & 1ULL << i)
 347                                 break;
 348                 }
 349                 sval.value = i + 1;
 350                 *rl = alloc_rl(sval, sval);
 351                 return 1;
 352         }
 353         zero.type = rl_type(arg_rl);
 354         if (!rl_has_sval(arg_rl, zero))
 355                 start.value = 1;
 356         *rl = alloc_rl(start, end);
 357         return 1;
 358 }
 359
 360 static void find_module_init_exit(struct symbol_list *sym_list)
 361 {
 362         struct symbol *sym;
 363         struct symbol *fn;
 364         struct statement *stmt;
 365         char *name;
 366         int init;
 367         int count;
 368
 369         /*
 370          * This is more complicated because Sparse ignores the "alias"
 371          * attribute.  I search backwards because module_init() is normally at
 372          * the end of the file.
 373          */
 374         count = 0;
 375         FOR_EACH_PTR_REVERSE(sym_list, sym) {
 376                 if (sym->type != SYM_NODE)
 377                         continue;
 378                 if (!(sym->ctype.modifiers & MOD_STATIC))
 379                         continue;
 380                 fn = get_base_type(sym);
 381                 if (!fn)
 382                         continue;
 383                 if (fn->type != SYM_FN)
 384                         continue;
 385                 if (!sym->ident)
 386                         continue;
 387                 if (!fn->inline_stmt)
 388                         continue;
 389                 if (strcmp(sym->ident->name, "__inittest") == 0)
 390                         init = 1;
 391                 else if (strcmp(sym->ident->name, "__exittest") == 0)
 392                         init = 0;
 393                 else
 394                         continue;
 395
 396                 count++;
 397
 398                 stmt = first_ptr_list((struct ptr_list *)fn->inline_stmt->stmts);
 399                 if (!stmt || stmt->type != STMT_RETURN)
 400                         continue;
 401                 name = expr_to_var(stmt->ret_value);
 402                 if (!name)
 403                         continue;
 404                 if (init)
 405                         sql_insert_function_ptr(name, "(struct module)->init");
 406                 else
 407                         sql_insert_function_ptr(name, "(struct module)->exit");
 408                 free_string(name);
 409                 if (count >= 2)
 410                         return;
 411         } END_FOR_EACH_PTR_REVERSE(sym);
 412 }
 413
 414 static void match_end_file(struct symbol_list *sym_list)
 415 {
 416         struct symbol *sym;
 417
 418         /* find the last static symbol in the file */
 419         FOR_EACH_PTR_REVERSE(sym_list, sym) {
 420                 if (!(sym->ctype.modifiers & MOD_STATIC))
 421                         continue;
 422                 if (!sym->scope)
 423                         continue;
 424                 find_module_init_exit(sym->scope->symbols);
 425                 return;
 426         } END_FOR_EACH_PTR_REVERSE(sym);
 427 }
 428
 429 static struct expression *get_val_expr(struct expression *expr)
 430 {
 431         struct symbol *sym, *val;
 432
 433         if (expr->type != EXPR_DEREF)
 434                 return NULL;
 435         expr = expr->deref;
 436         if (expr->type != EXPR_SYMBOL)
 437                 return NULL;
 438         if (strcmp(expr->symbol_name->name, "__u") != 0)
 439                 return NULL;
 440         sym = get_base_type(expr->symbol);
 441         val = first_ptr_list((struct ptr_list *)sym->symbol_list);
 442         if (!val || strcmp(val->ident->name, "__val") != 0)
 443                 return NULL;
 444         return member_expression(expr, '.', val->ident);
 445 }
 446
 447 static void match__write_once_size(const char *fn, struct expression *call,
 448                                void *unused)
 449 {
 450         struct expression *dest, *data, *assign;
 451         struct range_list *rl;
 452
 453         dest = get_argument_from_call_expr(call->args, 0);
 454         if (dest->type != EXPR_PREOP || dest->op != '&')
 455                 return;
 456         dest = strip_expr(dest->unop);
 457
 458         data = get_argument_from_call_expr(call->args, 1);
 459         data = get_val_expr(data);
 460         if (!data)
 461                 return;
 462         get_absolute_rl(data, &rl);
 463         assign = assign_expression(dest, '=', data);
 464
 465         __in_fake_assign++;
 466         __split_expr(assign);
 467         __in_fake_assign--;
 468 }
 469
 470 static void match__read_once_size(const char *fn, struct expression *call,
 471                                void *unused)
 472 {
 473         struct expression *dest, *data, *assign;
 474         struct symbol *type, *val_sym;
 475
 476         /*
 477          * We want to change:
 478          *      __read_once_size_nocheck(&(x), __u.__c, sizeof(x));
 479          * into a fake assignment:
 480          *      __u.val = x;
 481          *
 482          */
 483
 484         data = get_argument_from_call_expr(call->args, 0);
 485         if (data->type != EXPR_PREOP || data->op != '&')
 486                 return;
 487         data = strip_parens(data->unop);
 488
 489         dest = get_argument_from_call_expr(call->args, 1);
 490         if (dest->type != EXPR_DEREF || dest->op != '.')
 491                 return;
 492         if (!dest->member || strcmp(dest->member->name, "__c") != 0)
 493                 return;
 494         dest = dest->deref;
 495         type = get_type(dest);
 496         if (!type)
 497                 return;
 498         val_sym = first_ptr_list((struct ptr_list *)type->symbol_list);
 499         dest = member_expression(dest, '.', val_sym->ident);
 500
 501         assign = assign_expression(dest, '=', data);
 502         __in_fake_assign++;
 503         __split_expr(assign);
 504         __in_fake_assign--;
 505 }
 506
 507 static void match_closure_call(const char *name, struct expression *call,
 508                                void *unused)
 509 {
 510         struct expression *cl, *fn, *fake_call;
 511         struct expression_list *args = NULL;
 512
 513         cl = get_argument_from_call_expr(call->args, 0);
 514         fn = get_argument_from_call_expr(call->args, 1);
 515         if (!fn || !cl)
 516                 return;
 517
 518         add_ptr_list(&args, cl);
 519         fake_call = call_expression(fn, args);
 520         __split_expr(fake_call);
 521 }
 522
 523 static void match_put_device(const char *name, struct expression *expr,
 524                              void *unused)
 525 {
 526         static int refcount_id;
 527         struct expression *data, *fn, *fake_call;
 528         struct expression_list *args = NULL;
 529         struct smatch_state *state;
 530         char *ref, *release;
 531         struct symbol *sym;
 532
 533         if (!refcount_id)
 534                 refcount_id = id_from_name("check_refcount_info");
 535
 536         if (expr->type != EXPR_CALL)
 537                 return;
 538
 539         data = get_argument_from_call_expr(expr->args, 0);
 540
 541         ref = get_name_sym_from_param_key(expr, 0, "$->kobj.kref.refcount.refs.counter", &sym);
 542         if (!ref)
 543                 return;
 544         state = get_state(refcount_id, ref, sym);
 545         if (state && strcmp(state->name, "inc") == 0)
 546                 return;
 547
 548         release = get_name_sym_from_param_key(expr, 0, "$->release", NULL);
 549         fn = get_assigned_expr_name_sym(release, sym);
 550         if (!fn)
 551                 return;
 552         if (fn->type == EXPR_PREOP && fn->op == '&')
 553                 fn = strip_expr(fn->unop);
 554
 555         add_ptr_list(&args, data);
 556         fake_call = call_expression(fn, args);
 557         __split_expr(fake_call);
 558 }
 559
 560 static void fix_msecs_to_jiffies(struct expression *expr)
 561 {
 562         struct expression *arg;
 563         sval_t sval, ret;
 564         unsigned long HZ;
 565
 566         if (is_fake_var_assign(expr) ||
 567             expr->op != '=' ||
 568             expr->right->type != EXPR_CALL)
 569                 return;
 570         if (!get_function() || strcmp(get_function(), "msecs_to_jiffies") != 0)
 571                 return;
 572         if (!__cur_stmt || __cur_stmt->type != STMT_RETURN)
 573                 return;
 574
 575         arg = get_argument_from_call_expr(expr->right->args, 0);
 576         if (!get_implied_value(arg, &sval))
 577                 return;
 578
 579         if (!macro_to_ul("HZ", &HZ))
 580                 HZ = 100;
 581
 582         ret.type = &ulong_ctype;
 583         ret.value = (sval.value + (1000 / HZ) - 1) / (1000 / HZ);
 584
 585         set_extra_expr_mod(expr->left, alloc_estate_sval(ret));
 586 }
 587
 588 static void match_kernel_param(struct symbol *sym)
 589 {
 590         struct expression *var;
 591         struct symbol *type;
 592
 593         /* This was designed to parse the module_param_named() macro */
 594
 595         if (!sym->ident ||
 596             !sym->initializer ||
 597             sym->initializer->type != EXPR_INITIALIZER)
 598                 return;
 599
 600         type = get_real_base_type(sym);
 601         if (!type || type->type != SYM_STRUCT || !type->ident)
 602                 return;
 603         if (strcmp(type->ident->name, "kernel_param") != 0)
 604                 return;
 605
 606         var = last_ptr_list((struct ptr_list *)sym->initializer->expr_list);
 607         if (!var || var->type != EXPR_INITIALIZER)
 608                 return;
 609         var = first_ptr_list((struct ptr_list *)var->expr_list);
 610         if (!var || var->type != EXPR_PREOP || var->op != '&')
 611                 return;
 612         var = strip_expr(var->unop);
 613
 614         type = get_type(var);
 615         update_mtag_data(var, alloc_estate_whole(type));
 616 }
 617
 618 bool is_ignored_kernel_data(const char *name)
 619 {
 620         char *p;
 621
 622         if (option_project != PROJ_KERNEL)
 623                 return false;
 624
 625         /*
 626          * On the file I was looking at lockdep was 25% of the DB.
 627          */
 628         if (strstr(name, ".dep_map."))
 629                 return true;
 630         if (strstr(name, "->dep_map."))
 631                 return true;
 632         if (strstr(name, ".lockdep_map."))
 633                 return true;
 634
 635         if (strstr(name, ".rwsem."))
 636                 return true;
 637         if (strstr(name, "->rwsem."))
 638                 return true;
 639
 640         if (strstr(name, "->mutex."))
 641                 return true;
 642         if (strstr(name, "->lockdep_mutex."))
 643                 return true;
 644
 645         if (strstr(name, ".completion.wait."))
 646                 return true;
 647
 648         if (strstr(name, "kobj.kset-"))
 649                 return true;
 650         if (strstr(name, "power.suspend_timer."))
 651                 return true;
 652         if (strstr(name, "power.work."))
 653                 return true;
 654         if (strstr(name, ".lock.rlock."))
 655                 return true;
 656         if (strstr(name, "lockdep_mutex."))
 657                 return true;
 658
 659         if (strstr(name, ">klist_devices."))
 660                 return true;
 661
 662         if (strstr(name, "->m_log->"))
 663                 return true;
 664
 665         if (strstr(name, ".wait_lock."))
 666                 return true;
 667         if (strstr(name, "regmap->lock_arg"))
 668                 return true;
 669         if (strstr(name, "kworker->task"))
 670                 return true;
 671         if (strstr(name, "->algo_data->"))
 672                 return true;
 673
 674         /* ignore mutex internals */
 675         if ((p = strstr(name, ".rlock.")) ||
 676             (p = strstr(name, ">rlock."))) {
 677                 p += 7;
 678                 if (strncmp(p, "raw_lock", 8) == 0 ||
 679                     strcmp(p, "owner") == 0 ||
 680                     strcmp(p, "owner_cpu") == 0 ||
 681                     strcmp(p, "magic") == 0 ||
 682                     strcmp(p, "dep_map") == 0)
 683                         return true;
 684         }
 685
 686         return false;
 687 }
 688
 689 int get_gfp_param(struct expression *expr)
 690 {
 691         struct symbol *type;
 692         struct symbol *arg, *arg_type;
 693         int param;
 694
 695         if (expr->type != EXPR_CALL)
 696                 return -1;
 697         type = get_type(expr->fn);
 698         if (!type)
 699                 return -1;
 700         if (type->type == SYM_PTR)
 701                 type = get_real_base_type(type);
 702         if (type->type != SYM_FN)
 703                 return -1;
 704
 705         param = 0;
 706         FOR_EACH_PTR(type->arguments, arg) {
 707                 arg_type = get_base_type(arg);
 708                 if (arg_type && arg_type->ident &&
 709                     strcmp(arg_type->ident->name, "gfp_t") == 0)
 710                         return param;
 711                 param++;
 712         } END_FOR_EACH_PTR(arg);
 713
 714         return -1;
 715 }
 716
 717 static void match_function_def(struct symbol *sym)
 718 {
 719         char *macro;
 720
 721         macro = get_macro_name(sym->pos);
 722         if (!macro)
 723                 return;
 724         if (strcmp(macro, "TRACE_EVENT") == 0)
 725                 set_function_skipped();
 726 }
 727
 728 static bool delete_pci_error_returns(struct expression *expr)
 729 {
 730         const char *macro;
 731         sval_t sval;
 732
 733         if (!get_value(expr, &sval))
 734                 return false;
 735         if (sval.value < 0x80 || sval.value > 0x90)
 736                 return false;
 737
 738         macro = get_macro_name(expr->pos);
 739         if (!macro)
 740                 return false;
 741
 742         if (strncmp(macro, "PCIBIOS_", 8) != 0)
 743                 return false;
 744
 745         if (strcmp(macro, "PCIBIOS_FUNC_NOT_SUPPORTED") == 0  ||
 746             strcmp(macro, "PCIBIOS_BAD_VENDOR_ID") == 0       ||
 747             strcmp(macro, "PCIBIOS_DEVICE_NOT_FOUND") == 0    ||
 748             strcmp(macro, "PCIBIOS_BAD_REGISTER_NUMBER") == 0 ||
 749             strcmp(macro, "PCIBIOS_SET_FAILED") == 0          ||
 750             strcmp(macro, "PCIBIOS_BUFFER_TOO_SMALL") == 0)
 751                 return true;
 752
 753         return false;
 754 }
 755
 756 static bool match_with_intel_runtime(struct statement *stmt)
 757 {
 758         char *macro;
 759
 760         macro = get_macro_name(stmt->pos);
 761         if (!macro)
 762                 return false;
 763         if (strncmp(macro, "with_intel_runtime", 18) == 0 ||
 764             strncmp(macro, "with_intel_display", 18) == 0)
 765                 return true;
 766         return false;
 767 }
 768
 769 void check_kernel(int id)
 770 {
 771         if (option_project != PROJ_KERNEL)
 772                 return;
 773
 774         add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
 775         add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
 776         add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
 777         add_hook(hack_ERR_PTR, AFTER_DEF_HOOK);
 778         return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
 779         return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
 780         return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
 781         return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
 782         return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
 783
 784         add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
 785         add_hook(match_container_of, ASSIGNMENT_HOOK);
 786
 787         add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
 788         add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
 789         add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
 790         add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
 791
 792         add_implied_return_hook("size_add", &match_size_add, NULL);
 793         add_implied_return_hook("size_mul", &match_size_mul, NULL);
 794         add_implied_return_hook("__ab_c_size", &match_ab_c_size, NULL);
 795         add_implied_return_hook("array_size", &match_array_size, NULL);
 796
 797         add_implied_return_hook("__ffs", &match_ffs, NULL);
 798         add_implied_return_hook("fls", &match_fls, NULL);
 799         add_implied_return_hook("__fls", &match_fls, NULL);
 800         add_implied_return_hook("fls64", &match_fls, NULL);
 801
 802         add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL);
 803         add_function_hook("__write_once_size", &match__write_once_size, NULL);
 804
 805         add_function_hook("__read_once_size", &match__read_once_size, NULL);
 806         add_function_hook("__read_once_size_nocheck", &match__read_once_size, NULL);
 807
 808         add_function_hook("closure_call", &match_closure_call, NULL);
 809         add_function_hook("put_device", &match_put_device, NULL);
 810
 811         add_once_through_hook(&match_with_intel_runtime);
 812
 813         add_hook(fix_msecs_to_jiffies, ASSIGNMENT_HOOK_AFTER);
 814         add_hook(&match_kernel_param, BASE_HOOK);
 815         add_hook(&match_function_def, FUNC_DEF_HOOK);
 816
 817         if (option_info)
 818                 add_hook(match_end_file, END_FILE_HOOK);
 819
 820         add_delete_return_hook(&delete_pci_error_returns);
 821 }