2 * Copyright (C) 2017 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 #include "smatch_slist.h"
20 #include "smatch_extra.h"
24 static const char *untrusted_fn_ptrs
[] = {
25 "(struct target_core_fabric_ops)->fabric_make_np",
26 "(struct target_core_fabric_ops)->fabric_make_tpg",
27 "(struct configfs_group_operations)->make_item",
28 "(cgroup_subsys_state)->css_alloc",
30 * debugfs stuff should not be checked but checking for NULL is harmless
31 * and some people see the error message and convert it to an IS_ERR()
32 * check which is buggy. So these warnings introduce a risk.
36 "debugfs_create_file",
39 static bool from_untrusted_fn_ptr(struct expression
*expr
)
41 struct expression
*prev
;
46 prev
= get_assigned_expr(expr
);
47 if (!prev
|| prev
->type
!= EXPR_CALL
)
50 fn
= get_fnptr_name(prev
->fn
);
54 for (i
= 0; i
< ARRAY_SIZE(untrusted_fn_ptrs
); i
++) {
55 if (strcmp(fn
, untrusted_fn_ptrs
[i
]) == 0) {
64 static void match_condition(struct expression
*expr
)
68 while (expr
->type
== EXPR_ASSIGNMENT
)
69 expr
= strip_expr(expr
->left
);
71 if (!is_pointer(expr
))
74 if (implied_not_equal(expr
, 0) &&
75 possible_err_ptr(expr
) &&
76 !from_untrusted_fn_ptr(expr
)) {
77 name
= expr_to_str(expr
);
78 sm_msg("warn: '%s' is an error pointer or valid", name
);
83 static void match_condition2(struct expression
*expr
)
85 struct range_list
*rl
;
86 struct data_range
*drange
;
89 if (!is_pointer(expr
))
91 if (!get_implied_rl(expr
, &rl
))
94 FOR_EACH_PTR(rl
, drange
) {
95 if (sval_cmp(drange
->min
, drange
->max
) != 0)
97 if (sval_cmp(drange
->min
, valid_ptr_max_sval
) > 0)
99 } END_FOR_EACH_PTR(drange
);
104 if (from_untrusted_fn_ptr(expr
))
107 name
= expr_to_str(expr
);
108 sm_warning("'%s' could be an error pointer", name
);
112 void check_checking_for_null_instead_of_err_ptr(int id
)
114 if (option_project
!= PROJ_KERNEL
)
118 add_hook(&match_condition
, CONDITION_HOOK
);
120 add_hook(&match_condition2
, CONDITION_HOOK
);