check_kernel.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * This is kernel specific stuff for smatch_extra.
  20  */
  21
  22 #include "scope.h"
  23 #include "smatch.h"
  24 #include "smatch_extra.h"
  25
  26 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl)
  27 {
  28         struct expression *arg;
  29
  30         arg = get_argument_from_call_expr(call->args, 0);
  31         if (!get_implied_rl(arg, rl))
  32                 *rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(-1));
  33         return 1;
  34 }
  35
  36 static void match_param_valid_ptr(const char *fn, struct expression *call_expr,
  37                         struct expression *assign_expr, void *_param)
  38 {
  39         int param = PTR_INT(_param);
  40         struct expression *arg;
  41         struct smatch_state *pre_state;
  42         struct smatch_state *end_state;
  43
  44         arg = get_argument_from_call_expr(call_expr->args, param);
  45         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  46         end_state = estate_filter_range(pre_state, ll_to_sval(-4095), ll_to_sval(0));
  47         set_extra_expr_nomod(arg, end_state);
  48 }
  49
  50 static void match_param_err_or_null(const char *fn, struct expression *call_expr,
  51                         struct expression *assign_expr, void *_param)
  52 {
  53         int param = PTR_INT(_param);
  54         struct expression *arg;
  55         struct range_list *rl;
  56         struct smatch_state *pre_state;
  57         struct smatch_state *end_state;
  58
  59         arg = get_argument_from_call_expr(call_expr->args, param);
  60         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  61         rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(0));
  62         rl = rl_intersection(estate_rl(pre_state), rl);
  63         rl = cast_rl(estate_type(pre_state), rl);
  64         end_state = alloc_estate_rl(rl);
  65         set_extra_expr_nomod(arg, end_state);
  66 }
  67
  68 static void match_not_err(const char *fn, struct expression *call_expr,
  69                         struct expression *assign_expr, void *unused)
  70 {
  71         struct expression *arg;
  72         struct smatch_state *pre_state;
  73         struct smatch_state *new_state;
  74
  75         arg = get_argument_from_call_expr(call_expr->args, 0);
  76         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  77         new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-1));
  78         set_extra_expr_nomod(arg, new_state);
  79 }
  80
  81 static void match_err(const char *fn, struct expression *call_expr,
  82                         struct expression *assign_expr, void *unused)
  83 {
  84         struct expression *arg;
  85         struct smatch_state *pre_state;
  86         struct smatch_state *new_state;
  87
  88         arg = get_argument_from_call_expr(call_expr->args, 0);
  89         pre_state = get_state_expr(SMATCH_EXTRA, arg);
  90         new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-4096));
  91         new_state = estate_filter_range(new_state, ll_to_sval(0), sval_type_max(&long_ctype));
  92         set_extra_expr_nomod(arg, new_state);
  93 }
  94
  95 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused)
  96 {
  97         set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
  98 }
  99
 100 static void match_container_of(struct expression *expr)
 101 {
 102         struct expression *right = expr->right;
 103         char *macro;
 104
 105         /*
 106          * The problem here is that sometimes the container_of() macro is itself
 107          * inside a macro and get_macro() only returns the name of the outside
 108          * macro.
 109          */
 110
 111         /*
 112          * This actually an expression statement assignment but smatch_flow
 113          * pre-mangles it for us so we only get the last chunk:
 114          * sk = (typeof(sk))((char *)__mptr - offsetof(...))
 115          */
 116
 117         macro = get_macro_name(right->pos);
 118         if (!macro)
 119                 return;
 120         if (right->type != EXPR_CAST)
 121                 return;
 122         right = strip_expr(right);
 123         if (right->type != EXPR_BINOP || right->op != '-' ||
 124             right->left->type != EXPR_CAST)
 125                 return;
 126         right = strip_expr(right->left);
 127         if (right->type != EXPR_SYMBOL)
 128                 return;
 129         if (!right->symbol->ident ||
 130             strcmp(right->symbol->ident->name, "__mptr") != 0)
 131                 return;
 132         set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 133 }
 134
 135 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl)
 136 {
 137         struct expression *start_arg;
 138         struct expression *size_arg;
 139         struct symbol *type;
 140         sval_t min, max, tmp;
 141
 142         size_arg = get_argument_from_call_expr(call->args, 1);
 143         /* btw. there isn't a start_arg for find_first_bit() */
 144         start_arg = get_argument_from_call_expr(call->args, 2);
 145
 146         type = get_type(call);
 147         min = sval_type_val(type, 0);
 148         max = sval_type_val(type, sizeof(long long) * 8);
 149
 150         if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value)
 151                 max = tmp;
 152         if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp))
 153                 min = tmp;
 154         if (sval_cmp(min, max) > 0)
 155                 max = min;
 156         min = sval_cast(type, min);
 157         max = sval_cast(type, max);
 158         *rl = alloc_rl(min, max);
 159         return 1;
 160 }
 161
 162 static void find_module_init_exit(struct symbol_list *sym_list)
 163 {
 164         struct symbol *sym;
 165         struct symbol *fn;
 166         struct statement *stmt;
 167         char *name;
 168         int init;
 169         int count;
 170
 171         /*
 172          * This is more complicated because Sparse ignores the "alias"
 173          * attribute.  I search backwards because module_init() is normally at
 174          * the end of the file.
 175          */
 176         count = 0;
 177         FOR_EACH_PTR_REVERSE(sym_list, sym) {
 178                 if (sym->type != SYM_NODE)
 179                         continue;
 180                 if (!(sym->ctype.modifiers & MOD_STATIC))
 181                         continue;
 182                 fn = get_base_type(sym);
 183                 if (!fn)
 184                         continue;
 185                 if (fn->type != SYM_FN)
 186                         continue;
 187                 if (!sym->ident)
 188                         continue;
 189                 if (!fn->inline_stmt)
 190                         continue;
 191                 if (strcmp(sym->ident->name, "__inittest") == 0)
 192                         init = 1;
 193                 else if (strcmp(sym->ident->name, "__exittest") == 0)
 194                         init = 0;
 195                 else
 196                         continue;
 197
 198                 count++;
 199
 200                 stmt = first_ptr_list((struct ptr_list *)fn->inline_stmt->stmts);
 201                 if (!stmt || stmt->type != STMT_RETURN)
 202                         continue;
 203                 name = expr_to_var(stmt->ret_value);
 204                 if (!name)
 205                         continue;
 206                 if (init)
 207                         sql_insert_function_ptr(name, "(struct module)->init");
 208                 else
 209                         sql_insert_function_ptr(name, "(struct module)->exit");
 210                 free_string(name);
 211                 if (count >= 2)
 212                         return;
 213         } END_FOR_EACH_PTR_REVERSE(sym);
 214 }
 215
 216 static void match_end_file(struct symbol_list *sym_list)
 217 {
 218         struct symbol *sym;
 219
 220         /* find the last static symbol in the file */
 221         FOR_EACH_PTR_REVERSE(sym_list, sym) {
 222                 if (!(sym->ctype.modifiers & MOD_STATIC))
 223                         continue;
 224                 if (!sym->scope)
 225                         continue;
 226                 find_module_init_exit(sym->scope->symbols);
 227                 return;
 228         } END_FOR_EACH_PTR_REVERSE(sym);
 229 }
 230
 231 static struct expression *get_val_expr(struct expression *expr)
 232 {
 233         struct symbol *sym, *val;
 234
 235         if (expr->type != EXPR_DEREF)
 236                 return NULL;
 237         expr = expr->deref;
 238         if (expr->type != EXPR_SYMBOL)
 239                 return NULL;
 240         if (strcmp(expr->symbol_name->name, "__u") != 0)
 241                 return NULL;
 242         sym = get_base_type(expr->symbol);
 243         val = first_ptr_list((struct ptr_list *)sym->symbol_list);
 244         if (!val || strcmp(val->ident->name, "__val") != 0)
 245                 return NULL;
 246         return member_expression(expr, '.', val->ident);
 247 }
 248
 249 static void match__write_once_size(const char *fn, struct expression *call,
 250                                void *unused)
 251 {
 252         struct expression *dest, *data, *assign;
 253         struct range_list *rl;
 254
 255         dest = get_argument_from_call_expr(call->args, 0);
 256         if (dest->type != EXPR_PREOP || dest->op != '&')
 257                 return;
 258         dest = strip_expr(dest->unop);
 259
 260         data = get_argument_from_call_expr(call->args, 1);
 261         data = get_val_expr(data);
 262         if (!data)
 263                 return;
 264         get_absolute_rl(data, &rl);
 265         assign = assign_expression(dest, data);
 266
 267         __in_fake_assign++;
 268         __split_expr(assign);
 269         __in_fake_assign--;
 270 }
 271
 272 void check_kernel(int id)
 273 {
 274         if (option_project != PROJ_KERNEL)
 275                 return;
 276
 277         add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL);
 278         add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL);
 279         add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL);
 280         return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0);
 281         return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0);
 282         return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL);
 283         return_implies_state("IS_ERR", 1, 1, &match_err, NULL);
 284         return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0);
 285
 286         add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL);
 287         add_hook(match_container_of, ASSIGNMENT_HOOK);
 288
 289         add_implied_return_hook("find_next_bit", &match_next_bit, NULL);
 290         add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL);
 291         add_implied_return_hook("find_first_bit", &match_next_bit, NULL);
 292         add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL);
 293
 294         add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL);
 295         add_function_hook("__write_once_size", &match__write_once_size, NULL);
 296
 297         if (option_info)
 298                 add_hook(match_end_file, END_FILE_HOOK);
 299
 300 }