1 /* 2 * Copyright (C) 2010 Dan Carpenter. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 2 7 * of the License, or (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt 16 */ 17 18 /* 19 * This is kernel specific stuff for smatch_extra. 20 */ 21 22 #include "scope.h" 23 #include "smatch.h" 24 #include "smatch_extra.h" 25 26 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl) 27 { 28 struct expression *arg; 29 30 arg = get_argument_from_call_expr(call->args, 0); 31 if (!get_implied_rl(arg, rl)) 32 *rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(-1)); 33 return 1; 34 } 35 36 static void hack_ERR_PTR(struct symbol *sym) 37 { 38 struct symbol *arg; 39 struct smatch_state *estate; 40 struct range_list *after; 41 sval_t low_error; 42 sval_t minus_one; 43 sval_t zero; 44 45 low_error.type = &long_ctype; 46 low_error.value = -4095; 47 48 minus_one.type = &long_ctype; 49 minus_one.value = -1; 50 51 zero.type = &long_ctype; 52 zero.value = 0; 53 54 if (!sym || !sym->ident) 55 return; 56 if (strcmp(sym->ident->name, "ERR_PTR") != 0) 57 return; 58 59 arg = first_ptr_list((struct ptr_list *)sym->ctype.base_type->arguments); 60 if (!arg || !arg->ident) 61 return; 62 63 estate = get_state(SMATCH_EXTRA, arg->ident->name, arg); 64 if (!estate) { 65 after = alloc_rl(low_error, minus_one); 66 } else { 67 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero)); 68 if (rl_equiv(estate_rl(estate), after)) 69 return; 70 } 71 set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after)); 72 } 73 74 static void match_param_valid_ptr(const char *fn, struct expression *call_expr, 75 struct expression *assign_expr, void *_param) 76 { 77 int param = PTR_INT(_param); 78 struct expression *arg; 79 struct smatch_state *pre_state; 80 struct smatch_state *end_state; 81 82 arg = get_argument_from_call_expr(call_expr->args, param); 83 pre_state = get_state_expr(SMATCH_EXTRA, arg); 84 end_state = estate_filter_range(pre_state, ll_to_sval(-4095), ll_to_sval(0)); 85 set_extra_expr_nomod(arg, end_state); 86 } 87 88 static void match_param_err_or_null(const char *fn, struct expression *call_expr, 89 struct expression *assign_expr, void *_param) 90 { 91 int param = PTR_INT(_param); 92 struct expression *arg; 93 struct range_list *rl; 94 struct smatch_state *pre_state; 95 struct smatch_state *end_state; 96 97 arg = get_argument_from_call_expr(call_expr->args, param); 98 pre_state = get_state_expr(SMATCH_EXTRA, arg); 99 rl = alloc_rl(ll_to_sval(-4095), ll_to_sval(0)); 100 rl = rl_intersection(estate_rl(pre_state), rl); 101 rl = cast_rl(estate_type(pre_state), rl); 102 end_state = alloc_estate_rl(rl); 103 set_extra_expr_nomod(arg, end_state); 104 } 105 106 static void match_not_err(const char *fn, struct expression *call_expr, 107 struct expression *assign_expr, void *unused) 108 { 109 struct expression *arg; 110 struct smatch_state *pre_state; 111 struct smatch_state *new_state; 112 113 arg = get_argument_from_call_expr(call_expr->args, 0); 114 pre_state = get_state_expr(SMATCH_EXTRA, arg); 115 new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-1)); 116 set_extra_expr_nomod(arg, new_state); 117 } 118 119 static void match_err(const char *fn, struct expression *call_expr, 120 struct expression *assign_expr, void *unused) 121 { 122 struct expression *arg; 123 struct smatch_state *pre_state; 124 struct smatch_state *new_state; 125 126 arg = get_argument_from_call_expr(call_expr->args, 0); 127 pre_state = get_state_expr(SMATCH_EXTRA, arg); 128 new_state = estate_filter_range(pre_state, sval_type_min(&long_ctype), ll_to_sval(-4096)); 129 new_state = estate_filter_range(new_state, ll_to_sval(0), sval_type_max(&long_ctype)); 130 set_extra_expr_nomod(arg, new_state); 131 } 132 133 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused) 134 { 135 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval)); 136 } 137 138 static void match_container_of(struct expression *expr) 139 { 140 struct expression *right = expr->right; 141 char *macro; 142 143 /* 144 * The problem here is that sometimes the container_of() macro is itself 145 * inside a macro and get_macro() only returns the name of the outside 146 * macro. 147 */ 148 149 /* 150 * This actually an expression statement assignment but smatch_flow 151 * pre-mangles it for us so we only get the last chunk: 152 * sk = (typeof(sk))((char *)__mptr - offsetof(...)) 153 */ 154 155 macro = get_macro_name(right->pos); 156 if (!macro) 157 return; 158 if (right->type != EXPR_CAST) 159 return; 160 right = strip_expr(right); 161 if (right->type != EXPR_BINOP || right->op != '-' || 162 right->left->type != EXPR_CAST) 163 return; 164 right = strip_expr(right->left); 165 if (right->type != EXPR_SYMBOL) 166 return; 167 if (!right->symbol->ident || 168 strcmp(right->symbol->ident->name, "__mptr") != 0) 169 return; 170 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval)); 171 } 172 173 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl) 174 { 175 struct expression *start_arg; 176 struct expression *size_arg; 177 struct symbol *type; 178 sval_t min, max, tmp; 179 180 size_arg = get_argument_from_call_expr(call->args, 1); 181 /* btw. there isn't a start_arg for find_first_bit() */ 182 start_arg = get_argument_from_call_expr(call->args, 2); 183 184 type = get_type(call); 185 min = sval_type_val(type, 0); 186 max = sval_type_val(type, sizeof(long long) * 8); 187 188 if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value) 189 max = tmp; 190 if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp)) 191 min = tmp; 192 if (sval_cmp(min, max) > 0) 193 max = min; 194 min = sval_cast(type, min); 195 max = sval_cast(type, max); 196 *rl = alloc_rl(min, max); 197 return 1; 198 } 199 200 static int match_fls(struct expression *call, void *unused, struct range_list **rl) 201 { 202 struct expression *arg; 203 struct range_list *arg_rl; 204 sval_t zero = {}; 205 sval_t start, end, sval; 206 207 start.type = &int_ctype; 208 start.value = 0; 209 end.type = &int_ctype; 210 end.value = 32; 211 212 arg = get_argument_from_call_expr(call->args, 0); 213 if (!get_implied_rl(arg, &arg_rl)) 214 return 0; 215 if (rl_to_sval(arg_rl, &sval)) { 216 int i; 217 218 for (i = 63; i >= 0; i--) { 219 if (sval.uvalue & 1ULL << i) 220 break; 221 } 222 sval.value = i + 1; 223 *rl = alloc_rl(sval, sval); 224 return 1; 225 } 226 zero.type = rl_type(arg_rl); 227 if (!rl_has_sval(arg_rl, zero)) 228 start.value = 1; 229 *rl = alloc_rl(start, end); 230 return 1; 231 } 232 233 234 235 static void find_module_init_exit(struct symbol_list *sym_list) 236 { 237 struct symbol *sym; 238 struct symbol *fn; 239 struct statement *stmt; 240 char *name; 241 int init; 242 int count; 243 244 /* 245 * This is more complicated because Sparse ignores the "alias" 246 * attribute. I search backwards because module_init() is normally at 247 * the end of the file. 248 */ 249 count = 0; 250 FOR_EACH_PTR_REVERSE(sym_list, sym) { 251 if (sym->type != SYM_NODE) 252 continue; 253 if (!(sym->ctype.modifiers & MOD_STATIC)) 254 continue; 255 fn = get_base_type(sym); 256 if (!fn) 257 continue; 258 if (fn->type != SYM_FN) 259 continue; 260 if (!sym->ident) 261 continue; 262 if (!fn->inline_stmt) 263 continue; 264 if (strcmp(sym->ident->name, "__inittest") == 0) 265 init = 1; 266 else if (strcmp(sym->ident->name, "__exittest") == 0) 267 init = 0; 268 else 269 continue; 270 271 count++; 272 273 stmt = first_ptr_list((struct ptr_list *)fn->inline_stmt->stmts); 274 if (!stmt || stmt->type != STMT_RETURN) 275 continue; 276 name = expr_to_var(stmt->ret_value); 277 if (!name) 278 continue; 279 if (init) 280 sql_insert_function_ptr(name, "(struct module)->init"); 281 else 282 sql_insert_function_ptr(name, "(struct module)->exit"); 283 free_string(name); 284 if (count >= 2) 285 return; 286 } END_FOR_EACH_PTR_REVERSE(sym); 287 } 288 289 static void match_end_file(struct symbol_list *sym_list) 290 { 291 struct symbol *sym; 292 293 /* find the last static symbol in the file */ 294 FOR_EACH_PTR_REVERSE(sym_list, sym) { 295 if (!(sym->ctype.modifiers & MOD_STATIC)) 296 continue; 297 if (!sym->scope) 298 continue; 299 find_module_init_exit(sym->scope->symbols); 300 return; 301 } END_FOR_EACH_PTR_REVERSE(sym); 302 } 303 304 static struct expression *get_val_expr(struct expression *expr) 305 { 306 struct symbol *sym, *val; 307 308 if (expr->type != EXPR_DEREF) 309 return NULL; 310 expr = expr->deref; 311 if (expr->type != EXPR_SYMBOL) 312 return NULL; 313 if (strcmp(expr->symbol_name->name, "__u") != 0) 314 return NULL; 315 sym = get_base_type(expr->symbol); 316 val = first_ptr_list((struct ptr_list *)sym->symbol_list); 317 if (!val || strcmp(val->ident->name, "__val") != 0) 318 return NULL; 319 return member_expression(expr, '.', val->ident); 320 } 321 322 static void match__write_once_size(const char *fn, struct expression *call, 323 void *unused) 324 { 325 struct expression *dest, *data, *assign; 326 struct range_list *rl; 327 328 dest = get_argument_from_call_expr(call->args, 0); 329 if (dest->type != EXPR_PREOP || dest->op != '&') 330 return; 331 dest = strip_expr(dest->unop); 332 333 data = get_argument_from_call_expr(call->args, 1); 334 data = get_val_expr(data); 335 if (!data) 336 return; 337 get_absolute_rl(data, &rl); 338 assign = assign_expression(dest, '=', data); 339 340 __in_fake_assign++; 341 __split_expr(assign); 342 __in_fake_assign--; 343 } 344 345 static void match__read_once_size(const char *fn, struct expression *call, 346 void *unused) 347 { 348 struct expression *dest, *data, *assign; 349 struct symbol *type, *val_sym; 350 351 /* 352 * We want to change: 353 * __read_once_size_nocheck(&(x), __u.__c, sizeof(x)); 354 * into a fake assignment: 355 * __u.val = x; 356 * 357 */ 358 359 data = get_argument_from_call_expr(call->args, 0); 360 if (data->type != EXPR_PREOP || data->op != '&') 361 return; 362 data = strip_parens(data->unop); 363 364 dest = get_argument_from_call_expr(call->args, 1); 365 if (dest->type != EXPR_DEREF || dest->op != '.') 366 return; 367 if (!dest->member || strcmp(dest->member->name, "__c") != 0) 368 return; 369 dest = dest->deref; 370 type = get_type(dest); 371 if (!type) 372 return; 373 val_sym = first_ptr_list((struct ptr_list *)type->symbol_list); 374 dest = member_expression(dest, '.', val_sym->ident); 375 376 assign = assign_expression(dest, '=', data); 377 __in_fake_assign++; 378 __split_expr(assign); 379 __in_fake_assign--; 380 } 381 382 void check_kernel(int id) 383 { 384 if (option_project != PROJ_KERNEL) 385 return; 386 387 add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL); 388 add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL); 389 add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL); 390 add_hook(hack_ERR_PTR, AFTER_DEF_HOOK); 391 return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0); 392 return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0); 393 return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL); 394 return_implies_state("IS_ERR", 1, 1, &match_err, NULL); 395 return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0); 396 397 add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL); 398 add_hook(match_container_of, ASSIGNMENT_HOOK); 399 400 add_implied_return_hook("find_next_bit", &match_next_bit, NULL); 401 add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL); 402 add_implied_return_hook("find_first_bit", &match_next_bit, NULL); 403 add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL); 404 405 add_implied_return_hook("fls", &match_fls, NULL); 406 add_implied_return_hook("fls64", &match_fls, NULL); 407 408 add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL); 409 add_function_hook("__write_once_size", &match__write_once_size, NULL); 410 411 add_function_hook("__read_once_size", &match__read_once_size, NULL); 412 add_function_hook("__read_once_size_nocheck", &match__read_once_size, NULL); 413 414 if (option_info) 415 add_hook(match_end_file, END_FILE_HOOK); 416 } 417