1 /* 2 * Copyright (C) 2010 Dan Carpenter. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 2 7 * of the License, or (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt 16 */ 17 18 /* 19 * This is kernel specific stuff for smatch_extra. 20 */ 21 22 #include "scope.h" 23 #include "smatch.h" 24 #include "smatch_extra.h" 25 26 static sval_t err_ptr_min; 27 static sval_t err_ptr_max; 28 static sval_t null_ptr; 29 30 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl) 31 { 32 struct expression *arg; 33 34 arg = get_argument_from_call_expr(call->args, 0); 35 if (!get_implied_rl(arg, rl)) { 36 *rl = alloc_rl(err_ptr_min, err_ptr_max); 37 *rl = cast_rl(get_type(arg), *rl); 38 } 39 return 1; 40 } 41 42 static void hack_ERR_PTR(struct symbol *sym) 43 { 44 struct symbol *arg; 45 struct smatch_state *estate; 46 struct range_list *after; 47 sval_t low_error; 48 sval_t minus_one; 49 sval_t zero; 50 51 low_error.type = &long_ctype; 52 low_error.value = -4095; 53 54 minus_one.type = &long_ctype; 55 minus_one.value = -1; 56 57 zero.type = &long_ctype; 58 zero.value = 0; 59 60 if (!sym || !sym->ident) 61 return; 62 if (strcmp(sym->ident->name, "ERR_PTR") != 0) 63 return; 64 65 arg = first_ptr_list((struct ptr_list *)sym->ctype.base_type->arguments); 66 if (!arg || !arg->ident) 67 return; 68 69 estate = get_state(SMATCH_EXTRA, arg->ident->name, arg); 70 if (!estate) { 71 after = alloc_rl(low_error, minus_one); 72 } else { 73 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero)); 74 if (rl_equiv(estate_rl(estate), after)) 75 return; 76 } 77 set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after)); 78 } 79 80 static void match_param_valid_ptr(const char *fn, struct expression *call_expr, 81 struct expression *assign_expr, void *_param) 82 { 83 int param = PTR_INT(_param); 84 struct expression *arg; 85 struct smatch_state *pre_state; 86 struct smatch_state *end_state; 87 struct range_list *rl; 88 89 arg = get_argument_from_call_expr(call_expr->args, param); 90 pre_state = get_state_expr(SMATCH_EXTRA, arg); 91 if (estate_rl(pre_state)) { 92 rl = estate_rl(pre_state); 93 rl = remove_range(rl, null_ptr, null_ptr); 94 rl = remove_range(rl, err_ptr_min, err_ptr_max); 95 } else { 96 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval); 97 } 98 end_state = alloc_estate_rl(rl); 99 set_extra_expr_nomod(arg, end_state); 100 } 101 102 static void match_param_err_or_null(const char *fn, struct expression *call_expr, 103 struct expression *assign_expr, void *_param) 104 { 105 int param = PTR_INT(_param); 106 struct expression *arg; 107 struct range_list *pre, *rl; 108 struct smatch_state *pre_state; 109 struct smatch_state *end_state; 110 111 arg = get_argument_from_call_expr(call_expr->args, param); 112 pre_state = get_state_expr(SMATCH_EXTRA, arg); 113 if (pre_state) 114 pre = estate_rl(pre_state); 115 else 116 pre = alloc_whole_rl(&ptr_ctype); 117 call_results_to_rl(call_expr, &ptr_ctype, "0,(-4095)-(-1)", &rl); 118 rl = rl_intersection(pre, rl); 119 rl = cast_rl(get_type(arg), rl); 120 end_state = alloc_estate_rl(rl); 121 set_extra_expr_nomod(arg, end_state); 122 } 123 124 static void match_not_err(const char *fn, struct expression *call_expr, 125 struct expression *assign_expr, void *unused) 126 { 127 struct expression *arg; 128 struct smatch_state *pre_state; 129 struct range_list *rl; 130 131 arg = get_argument_from_call_expr(call_expr->args, 0); 132 pre_state = get_state_expr(SMATCH_EXTRA, arg); 133 if (estate_rl(pre_state)) { 134 rl = estate_rl(pre_state); 135 rl = remove_range(rl, err_ptr_min, err_ptr_max); 136 } else { 137 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval); 138 } 139 rl = cast_rl(get_type(arg), rl); 140 set_extra_expr_nomod(arg, alloc_estate_rl(rl)); 141 } 142 143 static void match_err(const char *fn, struct expression *call_expr, 144 struct expression *assign_expr, void *unused) 145 { 146 struct expression *arg; 147 struct smatch_state *pre_state; 148 struct range_list *rl; 149 150 arg = get_argument_from_call_expr(call_expr->args, 0); 151 pre_state = get_state_expr(SMATCH_EXTRA, arg); 152 rl = estate_rl(pre_state); 153 if (!rl) 154 rl = alloc_rl(err_ptr_min, err_ptr_max); 155 rl = rl_intersection(rl, alloc_rl(err_ptr_min, err_ptr_max)); 156 rl = cast_rl(get_type(arg), rl); 157 set_extra_expr_nomod(arg, alloc_estate_rl(rl)); 158 } 159 160 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused) 161 { 162 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval)); 163 } 164 165 static void match_container_of(struct expression *expr) 166 { 167 struct expression *right = expr->right; 168 char *macro; 169 170 /* 171 * The problem here is that sometimes the container_of() macro is itself 172 * inside a macro and get_macro() only returns the name of the outside 173 * macro. 174 */ 175 176 /* 177 * This actually an expression statement assignment but smatch_flow 178 * pre-mangles it for us so we only get the last chunk: 179 * sk = (typeof(sk))((char *)__mptr - offsetof(...)) 180 */ 181 182 macro = get_macro_name(right->pos); 183 if (!macro) 184 return; 185 if (right->type != EXPR_CAST) 186 return; 187 right = strip_expr(right); 188 if (right->type != EXPR_BINOP || right->op != '-' || 189 right->left->type != EXPR_CAST) 190 return; 191 right = strip_expr(right->left); 192 if (right->type != EXPR_SYMBOL) 193 return; 194 if (!right->symbol->ident || 195 strcmp(right->symbol->ident->name, "__mptr") != 0) 196 return; 197 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval)); 198 } 199 200 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl) 201 { 202 struct expression *start_arg; 203 struct expression *size_arg; 204 struct symbol *type; 205 sval_t min, max, tmp; 206 207 size_arg = get_argument_from_call_expr(call->args, 1); 208 /* btw. there isn't a start_arg for find_first_bit() */ 209 start_arg = get_argument_from_call_expr(call->args, 2); 210 211 type = get_type(call); 212 min = sval_type_val(type, 0); 213 max = sval_type_val(type, sizeof(long long) * 8); 214 215 if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value) 216 max = tmp; 217 if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp)) 218 min = tmp; 219 if (sval_cmp(min, max) > 0) 220 max = min; 221 min = sval_cast(type, min); 222 max = sval_cast(type, max); 223 *rl = alloc_rl(min, max); 224 return 1; 225 } 226 227 static int match_fls(struct expression *call, void *unused, struct range_list **rl) 228 { 229 struct expression *arg; 230 struct range_list *arg_rl; 231 sval_t zero = {}; 232 sval_t start, end, sval; 233 234 start.type = &int_ctype; 235 start.value = 0; 236 end.type = &int_ctype; 237 end.value = 32; 238 239 arg = get_argument_from_call_expr(call->args, 0); 240 if (!get_implied_rl(arg, &arg_rl)) 241 return 0; 242 if (rl_to_sval(arg_rl, &sval)) { 243 int i; 244 245 for (i = 63; i >= 0; i--) { 246 if (sval.uvalue & 1ULL << i) 247 break; 248 } 249 sval.value = i + 1; 250 *rl = alloc_rl(sval, sval); 251 return 1; 252 } 253 zero.type = rl_type(arg_rl); 254 if (!rl_has_sval(arg_rl, zero)) 255 start.value = 1; 256 *rl = alloc_rl(start, end); 257 return 1; 258 } 259 260 261 262 static void find_module_init_exit(struct symbol_list *sym_list) 263 { 264 struct symbol *sym; 265 struct symbol *fn; 266 struct statement *stmt; 267 char *name; 268 int init; 269 int count; 270 271 /* 272 * This is more complicated because Sparse ignores the "alias" 273 * attribute. I search backwards because module_init() is normally at 274 * the end of the file. 275 */ 276 count = 0; 277 FOR_EACH_PTR_REVERSE(sym_list, sym) { 278 if (sym->type != SYM_NODE) 279 continue; 280 if (!(sym->ctype.modifiers & MOD_STATIC)) 281 continue; 282 fn = get_base_type(sym); 283 if (!fn) 284 continue; 285 if (fn->type != SYM_FN) 286 continue; 287 if (!sym->ident) 288 continue; 289 if (!fn->inline_stmt) 290 continue; 291 if (strcmp(sym->ident->name, "__inittest") == 0) 292 init = 1; 293 else if (strcmp(sym->ident->name, "__exittest") == 0) 294 init = 0; 295 else 296 continue; 297 298 count++; 299 300 stmt = first_ptr_list((struct ptr_list *)fn->inline_stmt->stmts); 301 if (!stmt || stmt->type != STMT_RETURN) 302 continue; 303 name = expr_to_var(stmt->ret_value); 304 if (!name) 305 continue; 306 if (init) 307 sql_insert_function_ptr(name, "(struct module)->init"); 308 else 309 sql_insert_function_ptr(name, "(struct module)->exit"); 310 free_string(name); 311 if (count >= 2) 312 return; 313 } END_FOR_EACH_PTR_REVERSE(sym); 314 } 315 316 static void match_end_file(struct symbol_list *sym_list) 317 { 318 struct symbol *sym; 319 320 /* find the last static symbol in the file */ 321 FOR_EACH_PTR_REVERSE(sym_list, sym) { 322 if (!(sym->ctype.modifiers & MOD_STATIC)) 323 continue; 324 if (!sym->scope) 325 continue; 326 find_module_init_exit(sym->scope->symbols); 327 return; 328 } END_FOR_EACH_PTR_REVERSE(sym); 329 } 330 331 static struct expression *get_val_expr(struct expression *expr) 332 { 333 struct symbol *sym, *val; 334 335 if (expr->type != EXPR_DEREF) 336 return NULL; 337 expr = expr->deref; 338 if (expr->type != EXPR_SYMBOL) 339 return NULL; 340 if (strcmp(expr->symbol_name->name, "__u") != 0) 341 return NULL; 342 sym = get_base_type(expr->symbol); 343 val = first_ptr_list((struct ptr_list *)sym->symbol_list); 344 if (!val || strcmp(val->ident->name, "__val") != 0) 345 return NULL; 346 return member_expression(expr, '.', val->ident); 347 } 348 349 static void match__write_once_size(const char *fn, struct expression *call, 350 void *unused) 351 { 352 struct expression *dest, *data, *assign; 353 struct range_list *rl; 354 355 dest = get_argument_from_call_expr(call->args, 0); 356 if (dest->type != EXPR_PREOP || dest->op != '&') 357 return; 358 dest = strip_expr(dest->unop); 359 360 data = get_argument_from_call_expr(call->args, 1); 361 data = get_val_expr(data); 362 if (!data) 363 return; 364 get_absolute_rl(data, &rl); 365 assign = assign_expression(dest, '=', data); 366 367 __in_fake_assign++; 368 __split_expr(assign); 369 __in_fake_assign--; 370 } 371 372 static void match__read_once_size(const char *fn, struct expression *call, 373 void *unused) 374 { 375 struct expression *dest, *data, *assign; 376 struct symbol *type, *val_sym; 377 378 /* 379 * We want to change: 380 * __read_once_size_nocheck(&(x), __u.__c, sizeof(x)); 381 * into a fake assignment: 382 * __u.val = x; 383 * 384 */ 385 386 data = get_argument_from_call_expr(call->args, 0); 387 if (data->type != EXPR_PREOP || data->op != '&') 388 return; 389 data = strip_parens(data->unop); 390 391 dest = get_argument_from_call_expr(call->args, 1); 392 if (dest->type != EXPR_DEREF || dest->op != '.') 393 return; 394 if (!dest->member || strcmp(dest->member->name, "__c") != 0) 395 return; 396 dest = dest->deref; 397 type = get_type(dest); 398 if (!type) 399 return; 400 val_sym = first_ptr_list((struct ptr_list *)type->symbol_list); 401 dest = member_expression(dest, '.', val_sym->ident); 402 403 assign = assign_expression(dest, '=', data); 404 __in_fake_assign++; 405 __split_expr(assign); 406 __in_fake_assign--; 407 } 408 409 bool is_ignored_kernel_data(const char *name) 410 { 411 if (option_project != PROJ_KERNEL) 412 return false; 413 414 /* 415 * On the file I was looking at lockdep was 25% of the DB. 416 */ 417 if (strstr(name, ".dep_map.")) 418 return true; 419 if (strstr(name, ".lockdep_map.")) 420 return true; 421 return false; 422 } 423 424 void check_kernel(int id) 425 { 426 if (option_project != PROJ_KERNEL) 427 return; 428 429 err_ptr_min.type = &ptr_ctype; 430 err_ptr_min.value = -4095; 431 err_ptr_max.type = &ptr_ctype; 432 err_ptr_max.value = -1l; 433 null_ptr.type = &ptr_ctype; 434 null_ptr.value = 0; 435 436 err_ptr_min = sval_cast(&ptr_ctype, err_ptr_min); 437 err_ptr_max = sval_cast(&ptr_ctype, err_ptr_max); 438 439 add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL); 440 add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL); 441 add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL); 442 add_hook(hack_ERR_PTR, AFTER_DEF_HOOK); 443 return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0); 444 return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0); 445 return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL); 446 return_implies_state("IS_ERR", 1, 1, &match_err, NULL); 447 return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0); 448 449 add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL); 450 add_hook(match_container_of, ASSIGNMENT_HOOK); 451 452 add_implied_return_hook("find_next_bit", &match_next_bit, NULL); 453 add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL); 454 add_implied_return_hook("find_first_bit", &match_next_bit, NULL); 455 add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL); 456 457 add_implied_return_hook("fls", &match_fls, NULL); 458 add_implied_return_hook("fls64", &match_fls, NULL); 459 460 add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL); 461 add_function_hook("__write_once_size", &match__write_once_size, NULL); 462 463 add_function_hook("__read_once_size", &match__read_once_size, NULL); 464 add_function_hook("__read_once_size_nocheck", &match__read_once_size, NULL); 465 466 if (option_info) 467 add_hook(match_end_file, END_FILE_HOOK); 468 } 469