check_checking_for_null_instead_of_err_ptr.c

   1 /*
   2  * Copyright (C) 2017 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include "smatch.h"
  19 #include "smatch_slist.h"
  20 #include "smatch_extra.h"
  21
  22 static int my_id;
  23
  24 STATE(err_ptr);
  25
  26 static void ok_to_use(struct sm_state *sm, struct expression *mod_expr)
  27 {
  28         set_state(my_id, sm->name, sm->sym, &undefined);
  29 }
  30
  31 static void match_returns_err_ptr(const char *fn, struct expression *expr,
  32                                 void *info)
  33 {
  34         set_state_expr(my_id, expr->left, &err_ptr);
  35 }
  36
  37 static void match_condition(struct expression *expr)
  38 {
  39         struct sm_state *sm;
  40         struct range_list *rl;
  41         sval_t zero = {
  42                 .type = NULL,
  43                 { .value = 0, }
  44         };
  45         char *name;
  46         struct range_list *err_rl;
  47
  48         while (expr->type == EXPR_ASSIGNMENT)
  49                 expr = strip_expr(expr->left);
  50
  51         sm = get_sm_state_expr(my_id, expr);
  52         if (!sm)
  53                 return;
  54         if (!slist_has_state(sm->possible, &err_ptr))
  55                 return;
  56         if (!get_implied_rl(expr, &rl))
  57                 return;
  58         zero.type = rl_type(rl);
  59         if (rl_has_sval(rl, zero))
  60                 return;
  61
  62         /*
  63          * At this point we already know that the condition is bogus because
  64          * it's non-NULL.  But let's do another filter to make sure it really is
  65          * a possible error pointer.
  66          *
  67          */
  68
  69         err_rl = alloc_rl(err_min, err_max);
  70         if (!possibly_true_rl(rl, SPECIAL_EQUAL, err_rl))
  71                 return;
  72
  73         name = expr_to_str(expr);
  74         sm_msg("warn: '%s' is an error pointer or valid", name);
  75         free_string(name);
  76 }
  77
  78 static void match_condition2(struct expression *expr)
  79 {
  80         struct range_list *rl;
  81         struct data_range *drange;
  82         char *name;
  83
  84         if (!is_pointer(expr))
  85                 return;
  86         if (!get_implied_rl(expr, &rl))
  87                 return;
  88
  89         FOR_EACH_PTR(rl, drange) {
  90                 if (sval_cmp(drange->min, drange->max) != 0)
  91                         continue;
  92                 if (drange->min.value >= -4095 && drange->min.value < 0)
  93                         goto warn;
  94         } END_FOR_EACH_PTR(drange);
  95
  96         return;
  97
  98 warn:
  99         name = expr_to_str(expr);
 100         if (option_spammy)
 101                 sm_warning("'%s' could be an error pointer", name);
 102         free_string(name);
 103 }
 104
 105 static void register_err_ptr_funcs(void)
 106 {
 107         struct token *token;
 108         const char *func;
 109
 110         token = get_tokens_file("kernel.returns_err_ptr");
 111         if (!token)
 112                 return;
 113         if (token_type(token) != TOKEN_STREAMBEGIN)
 114                 return;
 115         token = token->next;
 116         while (token_type(token) != TOKEN_STREAMEND) {
 117                 if (token_type(token) != TOKEN_IDENT)
 118                         return;
 119                 func = show_ident(token->ident);
 120                 add_function_assign_hook(func, &match_returns_err_ptr, NULL);
 121                 token = token->next;
 122         }
 123         clear_token_alloc();
 124 }
 125
 126 void check_checking_for_null_instead_of_err_ptr(int id)
 127 {
 128         if (option_project != PROJ_KERNEL)
 129                 return;
 130
 131         my_id = id;
 132         register_err_ptr_funcs();
 133         add_hook(&match_condition, CONDITION_HOOK);
 134         add_hook(&match_condition2, CONDITION_HOOK);
 135         add_modification_hook(my_id, &ok_to_use);
 136 }
 137