check_err_ptr_deref.c

   1 /*
   2  * Copyright 2023 Linaro Ltd.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include "smatch.h"
  19 #include "smatch_extra.h"
  20
  21 static int my_id;
  22
  23 /* These functions do not necessarily need to be checked */
  24 static const char *safe_fns[] = {
  25         "exynos_drm_crtc_get_by_type",
  26         "mdp5_crtc_get_mixer",
  27         "mdp5_crtc_get_pipeline",
  28         "mtk_vdec_h264_get_ctrl_ptr",
  29         "nand_get_sdr_timings",
  30         "tc358746_get_format_by_code",
  31         "to_caam_req",
  32         "uverbs_attr_get",
  33         "uverbs_attr_get_alloced_ptr",
  34         "uverbs_attr_get_obj",
  35         "uverbs_attr_get_uobject",
  36 };
  37
  38 static bool from_safe_fn(struct expression *expr)
  39 {
  40         struct expression *prev;
  41         int i;
  42
  43         prev = get_assigned_expr(expr);
  44         if (!prev)
  45                 return false;
  46         if (prev->type != EXPR_CALL)
  47                 return false;
  48
  49         for (i = 0; i < ARRAY_SIZE(safe_fns); i++) {
  50                 if (sym_name_is(safe_fns[i], prev->fn))
  51                         return true;
  52         }
  53         return false;
  54 }
  55
  56 static void deref_hook(struct expression *expr)
  57 {
  58         char *name;
  59
  60         if (!possible_err_ptr(expr))
  61                 return;
  62         if (from_safe_fn(expr))
  63                 return;
  64
  65         name = expr_to_str(expr);
  66         sm_error("'%s' dereferencing possible ERR_PTR()", name);
  67         free_string(name);
  68 }
  69
  70 void check_err_ptr_deref(int id)
  71 {
  72         my_id = id;
  73
  74         if (option_project != PROJ_KERNEL)
  75                 return;
  76
  77         add_dereference_hook(deref_hook);
  78 }