2 * Copyright (C) 2010 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * This is kernel specific stuff for smatch_extra.
24 #include "smatch_extra.h"
26 static int implied_err_cast_return(struct expression
*call
, void *unused
, struct range_list
**rl
)
28 struct expression
*arg
;
30 arg
= get_argument_from_call_expr(call
->args
, 0);
31 if (!get_implied_rl(arg
, rl
)) {
32 *rl
= alloc_rl(ll_to_sval(-4095), ll_to_sval(-1));
33 *rl
= cast_rl(get_type(arg
), *rl
);
38 static void hack_ERR_PTR(struct symbol
*sym
)
41 struct smatch_state
*estate
;
42 struct range_list
*after
;
56 if (!sym
|| !sym
->ident
)
58 if (strcmp(sym
->ident
->name
, "ERR_PTR") != 0)
61 arg
= first_ptr_list((struct ptr_list
*)sym
->ctype
.base_type
->arguments
);
62 if (!arg
|| !arg
->ident
)
65 estate
= get_state(SMATCH_EXTRA
, arg
->ident
->name
, arg
);
67 after
= alloc_rl(low_error
, minus_one
);
69 after
= rl_intersection(estate_rl(estate
), alloc_rl(low_error
, zero
));
70 if (rl_equiv(estate_rl(estate
), after
))
73 set_state(SMATCH_EXTRA
, arg
->ident
->name
, arg
, alloc_estate_rl(after
));
76 static void match_param_valid_ptr(const char *fn
, struct expression
*call_expr
,
77 struct expression
*assign_expr
, void *_param
)
79 int param
= PTR_INT(_param
);
80 struct expression
*arg
;
81 struct smatch_state
*pre_state
;
82 struct smatch_state
*end_state
;
83 struct range_list
*rl
;
85 arg
= get_argument_from_call_expr(call_expr
->args
, param
);
86 pre_state
= get_state_expr(SMATCH_EXTRA
, arg
);
87 if (estate_rl(pre_state
)) {
88 rl
= estate_rl(pre_state
);
89 rl
= remove_range(estate_rl(pre_state
), ll_to_sval(0), ll_to_sval(0));
90 rl
= remove_range(rl
, ll_to_sval(-4095), ll_to_sval(-1));
92 rl
= alloc_rl(valid_ptr_min_sval
, valid_ptr_max_sval
);
94 end_state
= alloc_estate_rl(rl
);
95 set_extra_expr_nomod(arg
, end_state
);
98 static void match_param_err_or_null(const char *fn
, struct expression
*call_expr
,
99 struct expression
*assign_expr
, void *_param
)
101 int param
= PTR_INT(_param
);
102 struct expression
*arg
;
103 struct range_list
*rl
;
104 struct smatch_state
*pre_state
;
105 struct smatch_state
*end_state
;
107 arg
= get_argument_from_call_expr(call_expr
->args
, param
);
108 pre_state
= get_state_expr(SMATCH_EXTRA
, arg
);
109 call_results_to_rl(call_expr
, &ptr_ctype
, "0,(-4095)-(-1)", &rl
);
110 rl
= rl_intersection(estate_rl(pre_state
), rl
);
111 rl
= cast_rl(estate_type(pre_state
), rl
);
112 end_state
= alloc_estate_rl(rl
);
113 set_extra_expr_nomod(arg
, end_state
);
116 static void match_not_err(const char *fn
, struct expression
*call_expr
,
117 struct expression
*assign_expr
, void *unused
)
119 struct expression
*arg
;
120 struct smatch_state
*pre_state
;
121 struct smatch_state
*new_state
;
123 arg
= get_argument_from_call_expr(call_expr
->args
, 0);
124 pre_state
= get_state_expr(SMATCH_EXTRA
, arg
);
125 new_state
= estate_filter_range(pre_state
, sval_type_min(&long_ctype
), ll_to_sval(-1));
126 set_extra_expr_nomod(arg
, new_state
);
129 static void match_err(const char *fn
, struct expression
*call_expr
,
130 struct expression
*assign_expr
, void *unused
)
132 struct expression
*arg
;
133 struct smatch_state
*pre_state
;
134 struct smatch_state
*new_state
;
136 arg
= get_argument_from_call_expr(call_expr
->args
, 0);
137 pre_state
= get_state_expr(SMATCH_EXTRA
, arg
);
138 new_state
= estate_filter_range(pre_state
, sval_type_min(&long_ctype
), ll_to_sval(-4096));
139 new_state
= estate_filter_range(new_state
, ll_to_sval(0), sval_type_max(&long_ctype
));
140 set_extra_expr_nomod(arg
, new_state
);
143 static void match_container_of_macro(const char *fn
, struct expression
*expr
, void *unused
)
145 set_extra_expr_mod(expr
->left
, alloc_estate_range(valid_ptr_min_sval
, valid_ptr_max_sval
));
148 static void match_container_of(struct expression
*expr
)
150 struct expression
*right
= expr
->right
;
154 * The problem here is that sometimes the container_of() macro is itself
155 * inside a macro and get_macro() only returns the name of the outside
160 * This actually an expression statement assignment but smatch_flow
161 * pre-mangles it for us so we only get the last chunk:
162 * sk = (typeof(sk))((char *)__mptr - offsetof(...))
165 macro
= get_macro_name(right
->pos
);
168 if (right
->type
!= EXPR_CAST
)
170 right
= strip_expr(right
);
171 if (right
->type
!= EXPR_BINOP
|| right
->op
!= '-' ||
172 right
->left
->type
!= EXPR_CAST
)
174 right
= strip_expr(right
->left
);
175 if (right
->type
!= EXPR_SYMBOL
)
177 if (!right
->symbol
->ident
||
178 strcmp(right
->symbol
->ident
->name
, "__mptr") != 0)
180 set_extra_expr_mod(expr
->left
, alloc_estate_range(valid_ptr_min_sval
, valid_ptr_max_sval
));
183 static int match_next_bit(struct expression
*call
, void *unused
, struct range_list
**rl
)
185 struct expression
*start_arg
;
186 struct expression
*size_arg
;
188 sval_t min
, max
, tmp
;
190 size_arg
= get_argument_from_call_expr(call
->args
, 1);
191 /* btw. there isn't a start_arg for find_first_bit() */
192 start_arg
= get_argument_from_call_expr(call
->args
, 2);
194 type
= get_type(call
);
195 min
= sval_type_val(type
, 0);
196 max
= sval_type_val(type
, sizeof(long long) * 8);
198 if (get_implied_max(size_arg
, &tmp
) && tmp
.uvalue
< max
.value
)
200 if (start_arg
&& get_implied_min(start_arg
, &tmp
) && !sval_is_negative(tmp
))
202 if (sval_cmp(min
, max
) > 0)
204 min
= sval_cast(type
, min
);
205 max
= sval_cast(type
, max
);
206 *rl
= alloc_rl(min
, max
);
210 static int match_fls(struct expression
*call
, void *unused
, struct range_list
**rl
)
212 struct expression
*arg
;
213 struct range_list
*arg_rl
;
225 arg
= get_argument_from_call_expr(call
->args
, 0);
226 if (!get_implied_rl(arg
, &arg_rl
))
228 if (rl_to_sval(arg_rl
, &sval
)) {
231 for (i
= 63; i
>= 0; i
--) {
232 if (sval
.uvalue
& 1ULL << i
)
236 *rl
= alloc_rl(sval
, sval
);
239 zero
.type
= rl_type(arg_rl
);
240 if (!rl_has_sval(arg_rl
, zero
))
242 *rl
= alloc_rl(start
, end
);
248 static void find_module_init_exit(struct symbol_list
*sym_list
)
252 struct statement
*stmt
;
258 * This is more complicated because Sparse ignores the "alias"
259 * attribute. I search backwards because module_init() is normally at
260 * the end of the file.
263 FOR_EACH_PTR_REVERSE(sym_list
, sym
) {
264 if (sym
->type
!= SYM_NODE
)
266 if (!(sym
->ctype
.modifiers
& MOD_STATIC
))
268 fn
= get_base_type(sym
);
271 if (fn
->type
!= SYM_FN
)
275 if (!fn
->inline_stmt
)
277 if (strcmp(sym
->ident
->name
, "__inittest") == 0)
279 else if (strcmp(sym
->ident
->name
, "__exittest") == 0)
286 stmt
= first_ptr_list((struct ptr_list
*)fn
->inline_stmt
->stmts
);
287 if (!stmt
|| stmt
->type
!= STMT_RETURN
)
289 name
= expr_to_var(stmt
->ret_value
);
293 sql_insert_function_ptr(name
, "(struct module)->init");
295 sql_insert_function_ptr(name
, "(struct module)->exit");
299 } END_FOR_EACH_PTR_REVERSE(sym
);
302 static void match_end_file(struct symbol_list
*sym_list
)
306 /* find the last static symbol in the file */
307 FOR_EACH_PTR_REVERSE(sym_list
, sym
) {
308 if (!(sym
->ctype
.modifiers
& MOD_STATIC
))
312 find_module_init_exit(sym
->scope
->symbols
);
314 } END_FOR_EACH_PTR_REVERSE(sym
);
317 static struct expression
*get_val_expr(struct expression
*expr
)
319 struct symbol
*sym
, *val
;
321 if (expr
->type
!= EXPR_DEREF
)
324 if (expr
->type
!= EXPR_SYMBOL
)
326 if (strcmp(expr
->symbol_name
->name
, "__u") != 0)
328 sym
= get_base_type(expr
->symbol
);
329 val
= first_ptr_list((struct ptr_list
*)sym
->symbol_list
);
330 if (!val
|| strcmp(val
->ident
->name
, "__val") != 0)
332 return member_expression(expr
, '.', val
->ident
);
335 static void match__write_once_size(const char *fn
, struct expression
*call
,
338 struct expression
*dest
, *data
, *assign
;
339 struct range_list
*rl
;
341 dest
= get_argument_from_call_expr(call
->args
, 0);
342 if (dest
->type
!= EXPR_PREOP
|| dest
->op
!= '&')
344 dest
= strip_expr(dest
->unop
);
346 data
= get_argument_from_call_expr(call
->args
, 1);
347 data
= get_val_expr(data
);
350 get_absolute_rl(data
, &rl
);
351 assign
= assign_expression(dest
, '=', data
);
354 __split_expr(assign
);
358 static void match__read_once_size(const char *fn
, struct expression
*call
,
361 struct expression
*dest
, *data
, *assign
;
362 struct symbol
*type
, *val_sym
;
366 * __read_once_size_nocheck(&(x), __u.__c, sizeof(x));
367 * into a fake assignment:
372 data
= get_argument_from_call_expr(call
->args
, 0);
373 if (data
->type
!= EXPR_PREOP
|| data
->op
!= '&')
375 data
= strip_parens(data
->unop
);
377 dest
= get_argument_from_call_expr(call
->args
, 1);
378 if (dest
->type
!= EXPR_DEREF
|| dest
->op
!= '.')
380 if (!dest
->member
|| strcmp(dest
->member
->name
, "__c") != 0)
383 type
= get_type(dest
);
386 val_sym
= first_ptr_list((struct ptr_list
*)type
->symbol_list
);
387 dest
= member_expression(dest
, '.', val_sym
->ident
);
389 assign
= assign_expression(dest
, '=', data
);
391 __split_expr(assign
);
395 void check_kernel(int id
)
397 if (option_project
!= PROJ_KERNEL
)
400 add_implied_return_hook("ERR_PTR", &implied_err_cast_return
, NULL
);
401 add_implied_return_hook("ERR_CAST", &implied_err_cast_return
, NULL
);
402 add_implied_return_hook("PTR_ERR", &implied_err_cast_return
, NULL
);
403 add_hook(hack_ERR_PTR
, AFTER_DEF_HOOK
);
404 return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr
, (void *)0);
405 return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null
, (void *)0);
406 return_implies_state("IS_ERR", 0, 0, &match_not_err
, NULL
);
407 return_implies_state("IS_ERR", 1, 1, &match_err
, NULL
);
408 return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr
, (void *)0);
410 add_macro_assign_hook_extra("container_of", &match_container_of_macro
, NULL
);
411 add_hook(match_container_of
, ASSIGNMENT_HOOK
);
413 add_implied_return_hook("find_next_bit", &match_next_bit
, NULL
);
414 add_implied_return_hook("find_next_zero_bit", &match_next_bit
, NULL
);
415 add_implied_return_hook("find_first_bit", &match_next_bit
, NULL
);
416 add_implied_return_hook("find_first_zero_bit", &match_next_bit
, NULL
);
418 add_implied_return_hook("fls", &match_fls
, NULL
);
419 add_implied_return_hook("fls64", &match_fls
, NULL
);
421 add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook
, NULL
);
422 add_function_hook("__write_once_size", &match__write_once_size
, NULL
);
424 add_function_hook("__read_once_size", &match__read_once_size
, NULL
);
425 add_function_hook("__read_once_size_nocheck", &match__read_once_size
, NULL
);
428 add_hook(match_end_file
, END_FILE_HOOK
);