check_kernel.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * This is kernel specific stuff for smatch_extra.
  20  */
  21
  22 #include "scope.h"
  23 #include "smatch.h"
  24 #include "smatch_extra.h"
  25
  26 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
  27 {
  28         struct expression *arg;
  29
  30         arg = get_argument_from_call_expr(call->args, 0);
  31         if (!get_implied_rl(arg, rl)) {
  32                 *rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(-1));
  33                 *rl = cast_rl(get_type(arg), *rl);
  34         }
  35         return 1;
  36 }
  37
  38 static void hack_ERR_PTR(struct symbol *sym)
  39 {
  40         struct symbol *arg;
  41         struct smatch_state *estate;
  42         struct range_list *after;
  43         sval_t low_error = {
  44                 .type = &long_ctype,
  45                 .value = -4095,
  46         };
  47         sval_t minus_one = {
  48                 .type = &long_ctype,
  49                 .value = -1,
  50         };
  51         sval_t zero = {
  52                 .type = &long_ctype,
  53                 .value = 0,
  54         };
  55
  56         if (!sym || !sym->ident)
  57                 return;
  58         if (strcmp(sym->ident->name, "ERR_PTR") != 0)
  59                 return;
  60
  61         arg = first_ptr_list((struct ptr_list *)sym->ctype.base_type->arguments);
  62         if (!arg || !arg->ident)
  63                 return;
  64
  65         estate = get_state(SMATCH_EXTRA, arg->ident->name, arg);
  66         if (!estate) {
  67                 after = alloc_rl(low_error, minus_one);
  68         } else {
  69                 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero));
  70                 if (rl_equiv(estate_rl(estate), after))
  71                         return;
  72         }
  73         set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after));
  74 }
  75
  76 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
  77                         struct expression *assign_expr, void *_param)
  78 {
  79         int param = PTR_INT(_param);
  80         struct expression *arg;
  81         struct smatch_state *pre_state;
  82         struct smatch_state *end_state;
  83         struct range_list *rl;
  84
  85         arg = get_argument_from_call_expr(call_expr->args, param);
  86         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  87         if (estate_rl(pre_state)) {
  88                 rl = estate_rl(pre_state);
  89                 rl = remove_range(estate_rl(pre_state), ll_to_sval(0), ll_to_sval(0));
  90                 rl = remove_range(rl, ll_to_sval(-4095), ll_to_sval(-1));
  91         } else {
  92                 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
  93         }
  94         end_state = alloc_estate_rl(rl);
  95         set_extra_expr_nomod(arg, end_state);
  96 }
  97
  98 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
  99                         struct expression *assign_expr, void *_param)
 100 {
 101         int param = PTR_INT(_param);
 102         struct expression *arg;
 103         struct range_list *rl;
 104         struct smatch_state *pre_state;
 105         struct smatch_state *end_state;
 106
 107         arg = get_argument_from_call_expr(call_expr->args, param);
 108         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 109         call_results_to_rl(call_expr, &ptr_ctype, "0,(-4095)-(-1)", &rl);
 110         rl = rl_intersection(estate_rl(pre_state), rl);
 111         rl = cast_rl(estate_type(pre_state), rl);
 112         end_state = alloc_estate_rl(rl);
 113         set_extra_expr_nomod(arg, end_state);
 114 }
 115
 116 static void match_not_err(const char *fn, struct expression *call_expr,
 117                         struct expression *assign_expr, void *unused)
 118 {
 119         struct expression *arg;
 120         struct smatch_state *pre_state;
 121         struct smatch_state *new_state;
 122
 123         arg = get_argument_from_call_expr(call_expr->args, 0);
 124         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 125         new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-1));
 126         set_extra_expr_nomod(arg, new_state);
 127 }
 128
 129 static void match_err(const char *fn, struct expression *call_expr,
 130                         struct expression *assign_expr, void *unused)
 131 {
 132         struct expression *arg;
 133         struct smatch_state *pre_state;
 134         struct smatch_state *new_state;
 135
 136         arg = get_argument_from_call_expr(call_expr->args, 0);
 137         pre_state = get_state_expr(SMATCH_EXTRA, arg);
 138         new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-4096));
 139         new_state = estate_filter_range(new_state, ll_to_sval(0), sval_type_max(&long_ctype));
 140         set_extra_expr_nomod(arg, new_state);
 141 }
 142
 143 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
 144 {
 145         set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 146 }
 147
 148 static void match_container_of(struct expression *expr)
 149 {
 150         struct expression *right = expr->right;
 151         char *macro;
 152
 153         /*
 154          * The problem here is that sometimes the container_of() macro is itself
 155          * inside a macro and get_macro() only returns the name of the outside
 156          * macro.
 157          */
 158
 159         /*
 160          * This actually an expression statement assignment but smatch_flow
 161          * pre-mangles it for us so we only get the last chunk:
 162          * sk = (typeof(sk))((char *)__mptr - offsetof(...))
 163          */
 164
 165         macro = get_macro_name(right->pos);
 166         if (!macro)
 167                 return;
 168         if (right->type != EXPR_CAST)
 169                 return;
 170         right = strip_expr(right);
 171         if (right->type != EXPR_BINOP || right->op != '-' ||
 172             right->left->type != EXPR_CAST)
 173                 return;
 174         right = strip_expr(right->left);
 175         if (right->type != EXPR_SYMBOL)
 176                 return;
 177         if (!right->symbol->ident ||
 178             strcmp(right->symbol->ident->name, "__mptr") != 0)
 179                 return;
 180         set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 181 }
 182
 183 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl)
 184 {
 185         struct expression *start_arg;
 186         struct expression *size_arg;
 187         struct symbol *type;
 188         sval_t min, max, tmp;
 189
 190         size_arg = get_argument_from_call_expr(call->args, 1);
 191         /* btw. there isn't a start_arg for find_first_bit() */
 192         start_arg = get_argument_from_call_expr(call->args, 2);
 193
 194         type = get_type(call);
 195         min = sval_type_val(type, 0);
 196         max = sval_type_val(type, sizeof(long long) * 8);
 197
 198         if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value)
 199                 max = tmp;
 200         if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp))
 201                 min = tmp;
 202         if (sval_cmp(min, max) > 0)
 203                 max = min;
 204         min = sval_cast(type, min);
 205         max = sval_cast(type, max);
 206         *rl = alloc_rl(min, max);
 207         return 1;
 208 }
 209
 210 static int match_fls(struct expression *call, void *unused, struct range_list **rl)
 211 {
 212         struct expression *arg;
 213         struct range_list *arg_rl;
 214         sval_t zero = {};
 215         sval_t start = {
 216                 .type = &int_ctype,
 217                 .value = 0,
 218         };
 219         sval_t end = {
 220                 .type = &int_ctype,
 221                 .value = 32,
 222         };
 223         sval_t sval;
 224
 225         arg = get_argument_from_call_expr(call->args, 0);
 226         if (!get_implied_rl(arg, &arg_rl))
 227                 return 0;
 228         if (rl_to_sval(arg_rl, &sval)) {
 229                 int i;
 230
 231                 for (i = 63; i >= 0; i--) {
 232                         if (sval.uvalue & 1ULL << i)
 233                                 break;
 234                 }
 235                 sval.value = i + 1;
 236                 *rl = alloc_rl(sval, sval);
 237                 return 1;
 238         }
 239         zero.type = rl_type(arg_rl);
 240         if (!rl_has_sval(arg_rl, zero))
 241                 start.value = 1;
 242         *rl = alloc_rl(start, end);
 243         return 1;
 244 }
 245
 246
 247
 248 static void find_module_init_exit(struct symbol_list *sym_list)
 249 {
 250         struct symbol *sym;
 251         struct symbol *fn;
 252         struct statement *stmt;
 253         char *name;
 254         int init;
 255         int count;
 256
 257         /*
 258          * This is more complicated because Sparse ignores the "alias"
 259          * attribute.  I search backwards because module_init() is normally at
 260          * the end of the file.
 261          */
 262         count = 0;
 263         FOR_EACH_PTR_REVERSE(sym_list, sym) {
 264                 if (sym->type != SYM_NODE)
 265                         continue;
 266                 if (!(sym->ctype.modifiers & MOD_STATIC))
 267                         continue;
 268                 fn = get_base_type(sym);
 269                 if (!fn)
 270                         continue;
 271                 if (fn->type != SYM_FN)
 272                         continue;
 273                 if (!sym->ident)
 274                         continue;
 275                 if (!fn->inline_stmt)
 276                         continue;
 277                 if (strcmp(sym->ident->name, "__inittest") == 0)
 278                         init = 1;
 279                 else if (strcmp(sym->ident->name, "__exittest") == 0)
 280                         init = 0;
 281                 else
 282                         continue;
 283
 284                 count++;
 285
 286                 stmt = first_ptr_list((struct ptr_list *)fn->inline_stmt->stmts);
 287                 if (!stmt || stmt->type != STMT_RETURN)
 288                         continue;
 289                 name = expr_to_var(stmt->ret_value);
 290                 if (!name)
 291                         continue;
 292                 if (init)
 293                         sql_insert_function_ptr(name, "(struct module)->init");
 294                 else
 295                         sql_insert_function_ptr(name, "(struct module)->exit");
 296                 free_string(name);
 297                 if (count >= 2)
 298                         return;
 299         } END_FOR_EACH_PTR_REVERSE(sym);
 300 }
 301
 302 static void match_end_file(struct symbol_list *sym_list)
 303 {
 304         struct symbol *sym;
 305
 306         /* find the last static symbol in the file */
 307         FOR_EACH_PTR_REVERSE(sym_list, sym) {
 308                 if (!(sym->ctype.modifiers & MOD_STATIC))
 309                         continue;
 310                 if (!sym->scope)
 311                         continue;
 312                 find_module_init_exit(sym->scope->symbols);
 313                 return;
 314         } END_FOR_EACH_PTR_REVERSE(sym);
 315 }
 316
 317 static struct expression *get_val_expr(struct expression *expr)
 318 {
 319         struct symbol *sym, *val;
 320
 321         if (expr->type != EXPR_DEREF)
 322                 return NULL;
 323         expr = expr->deref;
 324         if (expr->type != EXPR_SYMBOL)
 325                 return NULL;
 326         if (strcmp(expr->symbol_name->name, "__u") != 0)
 327                 return NULL;
 328         sym = get_base_type(expr->symbol);
 329         val = first_ptr_list((struct ptr_list *)sym->symbol_list);
 330         if (!val || strcmp(val->ident->name, "__val") != 0)
 331                 return NULL;
 332         return member_expression(expr, '.', val->ident);
 333 }
 334
 335 static void match__write_once_size(const char *fn, struct expression *call,
 336                                void *unused)
 337 {
 338         struct expression *dest, *data, *assign;
 339         struct range_list *rl;
 340
 341         dest = get_argument_from_call_expr(call->args, 0);
 342         if (dest->type != EXPR_PREOP || dest->op != '&')
 343                 return;
 344         dest = strip_expr(dest->unop);
 345
 346         data = get_argument_from_call_expr(call->args, 1);
 347         data = get_val_expr(data);
 348         if (!data)
 349                 return;
 350         get_absolute_rl(data, &rl);
 351         assign = assign_expression(dest, '=', data);
 352
 353         __in_fake_assign++;
 354         __split_expr(assign);
 355         __in_fake_assign--;
 356 }
 357
 358 static void match__read_once_size(const char *fn, struct expression *call,
 359                                void *unused)
 360 {
 361         struct expression *dest, *data, *assign;
 362         struct symbol *type, *val_sym;
 363
 364         /*
 365          * We want to change:
 366          *      __read_once_size_nocheck(&(x), __u.__c, sizeof(x));
 367          * into a fake assignment:
 368          *      __u.val = x;
 369          *
 370          */
 371
 372         data = get_argument_from_call_expr(call->args, 0);
 373         if (data->type != EXPR_PREOP || data->op != '&')
 374                 return;
 375         data = strip_parens(data->unop);
 376
 377         dest = get_argument_from_call_expr(call->args, 1);
 378         if (dest->type != EXPR_DEREF || dest->op != '.')
 379                 return;
 380         if (!dest->member || strcmp(dest->member->name, "__c") != 0)
 381                 return;
 382         dest = dest->deref;
 383         type = get_type(dest);
 384         if (!type)
 385                 return;
 386         val_sym = first_ptr_list((struct ptr_list *)type->symbol_list);
 387         dest = member_expression(dest, '.', val_sym->ident);
 388
 389         assign = assign_expression(dest, '=', data);
 390         __in_fake_assign++;
 391         __split_expr(assign);
 392         __in_fake_assign--;
 393 }
 394
 395 void check_kernel(int id)
 396 {
 397         if (option_project != PROJ_KERNEL)
 398                 return;
 399
 400         add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
 401         add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
 402         add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
 403         add_hook(hack_ERR_PTR, AFTER_DEF_HOOK);
 404         return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
 405         return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
 406         return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
 407         return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
 408         return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
 409
 410         add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
 411         add_hook(match_container_of, ASSIGNMENT_HOOK);
 412
 413         add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
 414         add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
 415         add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
 416         add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
 417
 418         add_implied_return_hook("fls", &match_fls, NULL);
 419         add_implied_return_hook("fls64", &match_fls, NULL);
 420
 421         add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL);
 422         add_function_hook("__write_once_size", &match__write_once_size, NULL);
 423
 424         add_function_hook("__read_once_size", &match__read_once_size, NULL);
 425         add_function_hook("__read_once_size_nocheck", &match__read_once_size, NULL);
 426
 427         if (option_info)
 428                 add_hook(match_end_file, END_FILE_HOOK);
 429 }