check_checking_for_null_instead_of_err_ptr.c

   1 /*
   2  * Copyright (C) 2017 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include "smatch.h"
  19 #include "smatch_slist.h"
  20 #include "smatch_extra.h"
  21
  22 static int my_id;
  23
  24 static const char *untrusted_fn_ptrs[] = {
  25         "(struct target_core_fabric_ops)->fabric_make_np",
  26         "(struct target_core_fabric_ops)->fabric_make_tpg",
  27         "(struct configfs_group_operations)->make_item",
  28         "(cgroup_subsys_state)->css_alloc",
  29         /*
  30          * debugfs stuff should not be checked but checking for NULL is harmless
  31          * and some people see the error message and convert it to an IS_ERR()
  32          * check which is buggy.  So these warnings introduce a risk.
  33          *
  34          */
  35         "debugfs_create_dir",
  36         "debugfs_create_file",
  37 };
  38
  39 static bool from_untrusted_fn_ptr(struct expression *expr)
  40 {
  41         struct expression *prev;
  42         bool ret = false;
  43         char *fn;
  44         int i;
  45
  46         prev = get_assigned_expr(expr);
  47         if (!prev || prev->type != EXPR_CALL)
  48                 return false;
  49
  50         fn = get_fnptr_name(prev->fn);
  51         if (!fn)
  52                 return false;
  53
  54         for (i = 0; i < ARRAY_SIZE(untrusted_fn_ptrs); i++) {
  55                 if (strcmp(fn, untrusted_fn_ptrs[i]) == 0) {
  56                         ret = true;
  57                         break;
  58                 }
  59         }
  60         free_string(fn);
  61         return ret;
  62 }
  63
  64 static void match_condition(struct expression *expr)
  65 {
  66         char *name;
  67
  68         while (expr->type == EXPR_ASSIGNMENT)
  69                 expr = strip_expr(expr->left);
  70
  71         if (!is_pointer(expr))
  72                 return;
  73
  74         if (implied_not_equal(expr, 0) &&
  75             possible_err_ptr(expr) &&
  76             !from_untrusted_fn_ptr(expr)) {
  77                 name = expr_to_str(expr);
  78                 sm_msg("warn: '%s' is an error pointer or valid", name);
  79                 free_string(name);
  80         }
  81 }
  82
  83 static void match_condition2(struct expression *expr)
  84 {
  85         struct range_list *rl;
  86         struct data_range *drange;
  87         char *name;
  88
  89         if (!is_pointer(expr))
  90                 return;
  91         if (!get_implied_rl(expr, &rl))
  92                 return;
  93
  94         FOR_EACH_PTR(rl, drange) {
  95                 if (sval_cmp(drange->min, drange->max) != 0)
  96                         continue;
  97                 if (sval_cmp(drange->min, valid_ptr_max_sval) > 0)
  98                         goto warn;
  99         } END_FOR_EACH_PTR(drange);
 100
 101         return;
 102
 103 warn:
 104         if (from_untrusted_fn_ptr(expr))
 105                 return;
 106
 107         name = expr_to_str(expr);
 108         sm_warning("'%s' could be an error pointer", name);
 109         free_string(name);
 110 }
 111
 112 void check_checking_for_null_instead_of_err_ptr(int id)
 113 {
 114         if (option_project != PROJ_KERNEL)
 115                 return;
 116
 117         my_id = id;
 118         add_hook(&match_condition, CONDITION_HOOK);
 119         if (option_spammy)
 120                 add_hook(&match_condition2, CONDITION_HOOK);
 121 }
 122