validation/sm_rosenberg.c

   1 #include "check_debug.h"
   2
   3 void memset(void *ptr, char c, int size){}
   4
   5 int copy_to_user(void *dest, void *data, int size){}
   6 int some_func(struct foo *p){}
   7
   8 typedef struct zr364xx_pipeinfo {
   9         char x;
  10         int y;
  11 } aa_policy_t;
  12
  13 struct aa_policy {
  14         int x;
  15 };
  16
  17 struct foo {
  18         struct aa_policy a;
  19         int x;
  20         int y;
  21 };
  22
  23 struct foo *p;
  24 struct foo global_dec;
  25 void *ptr;
  26
  27 int main(void)
  28 {
  29         struct zr364xx_pipeinfo one;
  30         struct aa_policy two;
  31         aa_policy_t three;
  32         struct foo four;
  33         struct foo five;
  34         struct foo six;
  35         struct foo seven;
  36         struct foo eight;
  37         struct foo nine;
  38
  39         p->a.x = 0;
  40         global_dec.x = 0;
  41         memset(&two, 0, sizeof(two));
  42         four.x = 0;
  43         six = five;
  44         some_func(&seven);
  45         eight.x = (four.x < 5 ? four.x : 5);
  46         eight.y = !five.y;
  47         if (some_func()) {
  48                 nine.x = 1;
  49                 nine.y = 2;
  50         }
  51
  52         copy_to_user(ptr, &p->a, sizeof(struct aa_policy));
  53         copy_to_user(ptr, &global_dec, sizeof(struct global_dec));
  54         copy_to_user(ptr, &one, sizeof(one));
  55         copy_to_user(ptr, &two, sizeof(two));
  56         copy_to_user(ptr, &three, sizeof(three));
  57         copy_to_user(ptr, &four, sizeof(four));
  58         copy_to_user(ptr, &five, sizeof(five));
  59         copy_to_user(ptr, &six, sizeof(six));
  60         copy_to_user(ptr, &seven, sizeof(seven));
  61         copy_to_user(ptr, &eight, sizeof(eight));
  62         copy_to_user(ptr, &nine, sizeof(nine));
  63         return 0;
  64 }
  65 /*
  66  * check-name: Rosenberg Leaks
  67  * check-command: smatch -p=kernel -I.. sm_rosenberg.c
  68  *
  69  * check-output-start
  70 sm_rosenberg.c:54 main() warn: check that 'one' doesn't leak information (struct has a hole after 'x')
  71 sm_rosenberg.c:56 main() warn: check that 'three' doesn't leak information (struct has a hole after 'x')
  72 sm_rosenberg.c:57 main() warn: check that 'four.y' doesn't leak information
  73 sm_rosenberg.c:62 main() warn: check that 'nine.x' doesn't leak information
  74  * check-output-end
  75  */