check_return_efault.c

   1 /*
   2  * smatch/check_return_efault.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * This tries to find places which should probably return -EFAULT
  12  * but return the number of bytes to copy instead.
  13  */
  14
  15 #include "smatch.h"
  16 #include "smatch_slist.h"
  17 #include "smatch_extra.h"
  18
  19 static int my_id;
  20
  21 STATE(remaining);
  22 STATE(ok);
  23
  24 static void ok_to_use(const char *name, struct symbol *sym, struct expression *expr, void *unused)
  25 {
  26         set_state(my_id, name, sym, &ok);
  27 }
  28
  29 static void match_copy(const char *fn, struct expression *expr, void *unused)
  30 {
  31         struct expression *call;
  32         struct expression *arg;
  33         long long max;
  34
  35         if (expr->op == SPECIAL_SUB_ASSIGN)
  36                 return;
  37         set_state_expr(my_id, expr->left, &remaining);
  38
  39         call = strip_expr(expr->right);
  40         if (call->type != EXPR_CALL)
  41                 return;
  42         arg = get_argument_from_call_expr(call->args, 2);
  43         if (!get_absolute_max(arg, &max))
  44                 max = whole_range.max;
  45         set_extra_expr_mod(expr->left, alloc_extra_state_range(0, max));
  46
  47 }
  48
  49 static void match_condition(struct expression *expr)
  50 {
  51         if (!get_state_expr(my_id, expr))
  52                 return;
  53         /* If the variable is zero that's ok */
  54         set_true_false_states_expr(my_id, expr, NULL, &ok);
  55 }
  56
  57 /*
  58  * This function is biased in favour of print out errors.
  59  * The heuristic to print is:
  60  *    If we have a potentially positive return from copy_to_user
  61  *    and there is a possibility that we return negative as well
  62  *    then complain.
  63  */
  64 static void match_return(struct expression *ret_value)
  65 {
  66         struct smatch_state *state;
  67         struct sm_state *sm;
  68         long long min;
  69
  70         sm = get_sm_state_expr(my_id, ret_value);
  71         if (!sm)
  72                 return;
  73         if (!slist_has_state(sm->possible, &remaining))
  74                 return;
  75         state = get_state_expr(SMATCH_EXTRA, ret_value);
  76         if (!state)
  77                 return;
  78         if (!get_absolute_min(ret_value, &min))
  79                 return;
  80         if (min == 0)
  81                 return;
  82         sm_msg("warn: maybe return -EFAULT instead of the bytes remaining?");
  83 }
  84
  85 void check_return_efault(int id)
  86 {
  87         if (option_project != PROJ_KERNEL)
  88                 return;
  89
  90         my_id = id;
  91         add_function_assign_hook("copy_to_user", &match_copy, NULL);
  92         add_function_assign_hook("__copy_to_user", &match_copy, NULL);
  93         add_function_assign_hook("copy_from_user", &match_copy, NULL);
  94         add_function_assign_hook("__copy_from_user", &match_copy, NULL);
  95         add_function_assign_hook("clear_user", &match_copy, NULL);
  96         add_hook(&match_condition, CONDITION_HOOK);
  97         add_hook(&match_return, RETURN_HOOK);
  98         set_default_modification_hook(my_id, ok_to_use);
  99 }