check_unchecked_allocation.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  * Copyright (C) 2021 Oracle.
   4  *
   5  * This program is free software; you can redistribute it and/or
   6  * modify it under the terms of the GNU General Public License
   7  * as published by the Free Software Foundation; either version 2
   8  * of the License, or (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  17  */
  18
  19 #include "smatch.h"
  20 #include "smatch_slist.h"
  21 #include "smatch_extra.h"
  22
  23 static int my_id;
  24
  25 #define __GFP_NOFAIL 0x8000u
  26
  27 STATE(null);
  28
  29 static unsigned long GFP_NOFAIL(void)
  30 {
  31         static unsigned long saved_flags = -1;
  32         struct symbol *macro_sym;
  33
  34         if (saved_flags != -1)
  35                 return saved_flags;
  36
  37         macro_sym = lookup_macro_symbol("___GFP_NOFAIL");
  38         if (!macro_sym)
  39                 macro_sym = lookup_macro_symbol("__GFP_NOFAIL");
  40         if (!macro_sym || !macro_sym->expansion)
  41                 return __GFP_NOFAIL;
  42         if (token_type(macro_sym->expansion) != TOKEN_NUMBER)
  43                 return __GFP_NOFAIL;
  44
  45         saved_flags = strtoul(macro_sym->expansion->number, NULL, 0);
  46         return saved_flags;
  47 }
  48
  49 static void pre_merge_hook(struct sm_state *cur, struct sm_state *other)
  50 {
  51         struct smatch_state *state;
  52
  53         if (is_impossible_path()) {
  54                 set_state(my_id, cur->name, cur->sym, &undefined);
  55                 return;
  56         }
  57
  58         state = get_state(SMATCH_EXTRA, cur->name, cur->sym);
  59         if (!state || !estate_rl(state))
  60                 return;
  61         if (!rl_has_sval(estate_rl(state), ptr_null))
  62                 set_state(my_id, cur->name, cur->sym, &undefined);
  63 }
  64
  65 static bool is_possibly_zero(const char *name, struct symbol *sym)
  66 {
  67         struct sm_state *sm, *tmp;
  68
  69         sm = get_sm_state(SMATCH_EXTRA, name, sym);
  70         if (!sm)
  71                 return false;
  72         FOR_EACH_PTR(sm->possible, tmp) {
  73                 if (!estate_rl(tmp->state))
  74                         continue;
  75                 if (rl_min(estate_rl(tmp->state)).value == 0 &&
  76                     rl_max(estate_rl(tmp->state)).value == 0)
  77                         return true;
  78         } END_FOR_EACH_PTR(tmp);
  79
  80         return false;
  81 }
  82
  83 static const char *get_allocation_fn_name(const char *name, struct symbol *sym)
  84 {
  85         struct expression *expr;
  86
  87         expr = get_assigned_expr_name_sym(name, sym);
  88         if (!expr)
  89                 return "<unknown>";
  90         if (expr->type == EXPR_CALL &&
  91             expr->fn->type == EXPR_SYMBOL &&
  92             expr->fn->symbol && expr->fn->symbol->ident)
  93                 return expr->fn->symbol->ident->name;
  94
  95         return "<unknown>";
  96 }
  97
  98 static void check_dereference_name_sym(char *name, struct symbol *sym)
  99 {
 100         struct sm_state *sm;
 101         const char *fn_name;
 102
 103         sm = get_sm_state(my_id, name, sym);
 104         if (!sm)
 105                 return;
 106         if (is_ignored(my_id, sm->name, sm->sym))
 107                 return;
 108         if (!is_possibly_zero(sm->name, sm->sym))
 109                 return;
 110         if (is_impossible_path())
 111                 return;
 112         if (!slist_has_state(sm->possible, &null))
 113                 return;
 114
 115         sm_msg("%s: sm='%s'", __func__, show_sm(sm));
 116         fn_name = get_allocation_fn_name(name, sym);
 117         sm_error("potential null dereference '%s'.  (%s returns null)",
 118                  sm->name, fn_name);
 119 }
 120
 121 static void check_dereference(struct expression *expr)
 122 {
 123         char *name;
 124         struct symbol *sym;
 125
 126         name = expr_to_var_sym(expr, &sym);
 127         if (!name)
 128                 return;
 129         check_dereference_name_sym(name, sym);
 130         free_string(name);
 131 }
 132
 133 static void match_dereferences(struct expression *expr)
 134 {
 135         if (expr->type != EXPR_PREOP)
 136                 return;
 137         check_dereference(expr->unop);
 138 }
 139
 140 static void match_pointer_as_array(struct expression *expr)
 141 {
 142         if (!is_array(expr))
 143                 return;
 144         check_dereference(get_array_base(expr));
 145 }
 146
 147 static void set_param_dereferenced(struct expression *call, struct expression *arg, char *key, char *unused)
 148 {
 149         struct symbol *sym;
 150         char *name;
 151
 152         name = get_variable_from_key(arg, key, &sym);
 153         if (!name || !sym)
 154                 goto free;
 155
 156         check_dereference_name_sym(name, sym);
 157 free:
 158         free_string(name);
 159 }
 160
 161 static int called_with_no_fail(struct expression *call, int param)
 162 {
 163         struct expression *arg;
 164         sval_t sval;
 165
 166         if (param == -1)
 167                 return 0;
 168         call = strip_expr(call);
 169         if (call->type != EXPR_CALL)
 170                 return 0;
 171         arg = get_argument_from_call_expr(call->args, param);
 172         if (get_value(arg, &sval) && (sval.uvalue & GFP_NOFAIL()))
 173                 return 1;
 174         return 0;
 175 }
 176
 177 static void match_assign_returns_null(const char *fn, struct expression *expr, void *_gfp)
 178 {
 179         int gfp_param = PTR_INT(_gfp);
 180
 181         if (called_with_no_fail(expr->right, gfp_param))
 182                 return;
 183         set_state_expr(my_id, expr->left, &null);
 184 }
 185
 186 static void register_allocation_funcs(void)
 187 {
 188         char filename[256];
 189         struct token *token;
 190         const char *func;
 191         int arg;
 192
 193         snprintf(filename, sizeof(filename), "%s.allocation_funcs_gfp", option_project_str);
 194         token = get_tokens_file(filename);
 195         if (!token)
 196                 return;
 197         if (token_type(token) != TOKEN_STREAMBEGIN)
 198                 return;
 199         token = token->next;
 200         while (token_type(token) != TOKEN_STREAMEND) {
 201                 if (token_type(token) != TOKEN_IDENT) {
 202                         printf("error parsing '%s' line %d\n", filename, token->pos.line);
 203                         return;
 204                 }
 205                 func = show_ident(token->ident);
 206                 token = token->next;
 207                 if (token_type(token) == TOKEN_IDENT)
 208                         arg = -1;
 209                 else if (token_type(token) == TOKEN_NUMBER)
 210                         arg = atoi(token->number);
 211                 else {
 212                         printf("error parsing '%s' line %d\n", filename, token->pos.line);
 213                         return;
 214                 }
 215                 add_function_assign_hook(func, &match_assign_returns_null, INT_PTR(arg));
 216                 token = token->next;
 217         }
 218         clear_token_alloc();
 219 }
 220
 221 void check_unchecked_allocation(int id)
 222 {
 223         my_id = id;
 224
 225         add_modification_hook(my_id, &set_undefined);
 226         add_pre_merge_hook(my_id, &pre_merge_hook);
 227         add_hook(&match_dereferences, DEREF_HOOK);
 228         add_hook(&match_pointer_as_array, OP_HOOK);
 229         select_return_implies_hook(DEREFERENCE, &set_param_dereferenced);
 230         register_allocation_funcs();
 231 }