1 /* 2 * Copyright (C) 2010 Dan Carpenter. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 2 7 * of the License, or (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt 16 */ 17 18 /* 19 * This is kernel specific stuff for smatch_extra. 20 */ 21 22 #include "scope.h" 23 #include "smatch.h" 24 #include "smatch_extra.h" 25 26 static sval_t err_ptr_min; 27 static sval_t err_ptr_max; 28 static sval_t null_ptr; 29 30 static int implied_err_cast_return(struct expression *call, void *unused, struct range_list **rl) 31 { 32 struct expression *arg; 33 34 arg = get_argument_from_call_expr(call->args, 0); 35 if (!get_implied_rl(arg, rl)) { 36 *rl = alloc_rl(err_ptr_min, err_ptr_max); 37 *rl = cast_rl(get_type(arg), *rl); 38 } 39 return 1; 40 } 41 42 static void hack_ERR_PTR(struct symbol *sym) 43 { 44 struct symbol *arg; 45 struct smatch_state *estate; 46 struct range_list *after; 47 sval_t low_error; 48 sval_t minus_one; 49 sval_t zero; 50 51 low_error.type = &long_ctype; 52 low_error.value = -4095; 53 54 minus_one.type = &long_ctype; 55 minus_one.value = -1; 56 57 zero.type = &long_ctype; 58 zero.value = 0; 59 60 if (!sym || !sym->ident) 61 return; 62 if (strcmp(sym->ident->name, "ERR_PTR") != 0) 63 return; 64 65 arg = first_ptr_list((struct ptr_list *)sym->ctype.base_type->arguments); 66 if (!arg || !arg->ident) 67 return; 68 69 estate = get_state(SMATCH_EXTRA, arg->ident->name, arg); 70 if (!estate) { 71 after = alloc_rl(low_error, minus_one); 72 } else { 73 after = rl_intersection(estate_rl(estate), alloc_rl(low_error, zero)); 74 if (rl_equiv(estate_rl(estate), after)) 75 return; 76 } 77 set_state(SMATCH_EXTRA, arg->ident->name, arg, alloc_estate_rl(after)); 78 } 79 80 static void match_param_valid_ptr(const char *fn, struct expression *call_expr, 81 struct expression *assign_expr, void *_param) 82 { 83 int param = PTR_INT(_param); 84 struct expression *arg; 85 struct smatch_state *pre_state; 86 struct smatch_state *end_state; 87 struct range_list *rl; 88 89 arg = get_argument_from_call_expr(call_expr->args, param); 90 pre_state = get_state_expr(SMATCH_EXTRA, arg); 91 if (estate_rl(pre_state)) { 92 rl = estate_rl(pre_state); 93 rl = remove_range(rl, null_ptr, null_ptr); 94 rl = remove_range(rl, err_ptr_min, err_ptr_max); 95 } else { 96 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval); 97 } 98 end_state = alloc_estate_rl(rl); 99 set_extra_expr_nomod(arg, end_state); 100 } 101 102 static void match_param_err_or_null(const char *fn, struct expression *call_expr, 103 struct expression *assign_expr, void *_param) 104 { 105 int param = PTR_INT(_param); 106 struct expression *arg; 107 struct range_list *rl; 108 struct smatch_state *pre_state; 109 struct smatch_state *end_state; 110 111 arg = get_argument_from_call_expr(call_expr->args, param); 112 pre_state = get_state_expr(SMATCH_EXTRA, arg); 113 call_results_to_rl(call_expr, &ptr_ctype, "0,(-4095)-(-1)", &rl); 114 rl = rl_intersection(estate_rl(pre_state), rl); 115 rl = cast_rl(get_type(arg), rl); 116 end_state = alloc_estate_rl(rl); 117 set_extra_expr_nomod(arg, end_state); 118 } 119 120 static void match_not_err(const char *fn, struct expression *call_expr, 121 struct expression *assign_expr, void *unused) 122 { 123 struct expression *arg; 124 struct smatch_state *pre_state; 125 struct range_list *rl; 126 127 arg = get_argument_from_call_expr(call_expr->args, 0); 128 pre_state = get_state_expr(SMATCH_EXTRA, arg); 129 if (estate_rl(pre_state)) { 130 rl = estate_rl(pre_state); 131 rl = remove_range(rl, err_ptr_min, err_ptr_max); 132 } else { 133 rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval); 134 } 135 rl = cast_rl(get_type(arg), rl); 136 set_extra_expr_nomod(arg, alloc_estate_rl(rl)); 137 } 138 139 static void match_err(const char *fn, struct expression *call_expr, 140 struct expression *assign_expr, void *unused) 141 { 142 struct expression *arg; 143 struct smatch_state *pre_state; 144 struct range_list *rl; 145 146 arg = get_argument_from_call_expr(call_expr->args, 0); 147 pre_state = get_state_expr(SMATCH_EXTRA, arg); 148 rl = estate_rl(pre_state); 149 if (!rl) 150 rl = alloc_rl(err_ptr_min, err_ptr_max); 151 rl = rl_intersection(rl, alloc_rl(err_ptr_min, err_ptr_max)); 152 rl = cast_rl(get_type(arg), rl); 153 set_extra_expr_nomod(arg, alloc_estate_rl(rl)); 154 } 155 156 static void match_container_of_macro(const char *fn, struct expression *expr, void *unused) 157 { 158 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval)); 159 } 160 161 static void match_container_of(struct expression *expr) 162 { 163 struct expression *right = expr->right; 164 char *macro; 165 166 /* 167 * The problem here is that sometimes the container_of() macro is itself 168 * inside a macro and get_macro() only returns the name of the outside 169 * macro. 170 */ 171 172 /* 173 * This actually an expression statement assignment but smatch_flow 174 * pre-mangles it for us so we only get the last chunk: 175 * sk = (typeof(sk))((char *)__mptr - offsetof(...)) 176 */ 177 178 macro = get_macro_name(right->pos); 179 if (!macro) 180 return; 181 if (right->type != EXPR_CAST) 182 return; 183 right = strip_expr(right); 184 if (right->type != EXPR_BINOP || right->op != '-' || 185 right->left->type != EXPR_CAST) 186 return; 187 right = strip_expr(right->left); 188 if (right->type != EXPR_SYMBOL) 189 return; 190 if (!right->symbol->ident || 191 strcmp(right->symbol->ident->name, "__mptr") != 0) 192 return; 193 set_extra_expr_mod(expr->left, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval)); 194 } 195 196 static int match_next_bit(struct expression *call, void *unused, struct range_list **rl) 197 { 198 struct expression *start_arg; 199 struct expression *size_arg; 200 struct symbol *type; 201 sval_t min, max, tmp; 202 203 size_arg = get_argument_from_call_expr(call->args, 1); 204 /* btw. there isn't a start_arg for find_first_bit() */ 205 start_arg = get_argument_from_call_expr(call->args, 2); 206 207 type = get_type(call); 208 min = sval_type_val(type, 0); 209 max = sval_type_val(type, sizeof(long long) * 8); 210 211 if (get_implied_max(size_arg, &tmp) && tmp.uvalue < max.value) 212 max = tmp; 213 if (start_arg && get_implied_min(start_arg, &tmp) && !sval_is_negative(tmp)) 214 min = tmp; 215 if (sval_cmp(min, max) > 0) 216 max = min; 217 min = sval_cast(type, min); 218 max = sval_cast(type, max); 219 *rl = alloc_rl(min, max); 220 return 1; 221 } 222 223 static int match_fls(struct expression *call, void *unused, struct range_list **rl) 224 { 225 struct expression *arg; 226 struct range_list *arg_rl; 227 sval_t zero = {}; 228 sval_t start, end, sval; 229 230 start.type = &int_ctype; 231 start.value = 0; 232 end.type = &int_ctype; 233 end.value = 32; 234 235 arg = get_argument_from_call_expr(call->args, 0); 236 if (!get_implied_rl(arg, &arg_rl)) 237 return 0; 238 if (rl_to_sval(arg_rl, &sval)) { 239 int i; 240 241 for (i = 63; i >= 0; i--) { 242 if (sval.uvalue & 1ULL << i) 243 break; 244 } 245 sval.value = i + 1; 246 *rl = alloc_rl(sval, sval); 247 return 1; 248 } 249 zero.type = rl_type(arg_rl); 250 if (!rl_has_sval(arg_rl, zero)) 251 start.value = 1; 252 *rl = alloc_rl(start, end); 253 return 1; 254 } 255 256 257 258 static void find_module_init_exit(struct symbol_list *sym_list) 259 { 260 struct symbol *sym; 261 struct symbol *fn; 262 struct statement *stmt; 263 char *name; 264 int init; 265 int count; 266 267 /* 268 * This is more complicated because Sparse ignores the "alias" 269 * attribute. I search backwards because module_init() is normally at 270 * the end of the file. 271 */ 272 count = 0; 273 FOR_EACH_PTR_REVERSE(sym_list, sym) { 274 if (sym->type != SYM_NODE) 275 continue; 276 if (!(sym->ctype.modifiers & MOD_STATIC)) 277 continue; 278 fn = get_base_type(sym); 279 if (!fn) 280 continue; 281 if (fn->type != SYM_FN) 282 continue; 283 if (!sym->ident) 284 continue; 285 if (!fn->inline_stmt) 286 continue; 287 if (strcmp(sym->ident->name, "__inittest") == 0) 288 init = 1; 289 else if (strcmp(sym->ident->name, "__exittest") == 0) 290 init = 0; 291 else 292 continue; 293 294 count++; 295 296 stmt = first_ptr_list((struct ptr_list *)fn->inline_stmt->stmts); 297 if (!stmt || stmt->type != STMT_RETURN) 298 continue; 299 name = expr_to_var(stmt->ret_value); 300 if (!name) 301 continue; 302 if (init) 303 sql_insert_function_ptr(name, "(struct module)->init"); 304 else 305 sql_insert_function_ptr(name, "(struct module)->exit"); 306 free_string(name); 307 if (count >= 2) 308 return; 309 } END_FOR_EACH_PTR_REVERSE(sym); 310 } 311 312 static void match_end_file(struct symbol_list *sym_list) 313 { 314 struct symbol *sym; 315 316 /* find the last static symbol in the file */ 317 FOR_EACH_PTR_REVERSE(sym_list, sym) { 318 if (!(sym->ctype.modifiers & MOD_STATIC)) 319 continue; 320 if (!sym->scope) 321 continue; 322 find_module_init_exit(sym->scope->symbols); 323 return; 324 } END_FOR_EACH_PTR_REVERSE(sym); 325 } 326 327 static struct expression *get_val_expr(struct expression *expr) 328 { 329 struct symbol *sym, *val; 330 331 if (expr->type != EXPR_DEREF) 332 return NULL; 333 expr = expr->deref; 334 if (expr->type != EXPR_SYMBOL) 335 return NULL; 336 if (strcmp(expr->symbol_name->name, "__u") != 0) 337 return NULL; 338 sym = get_base_type(expr->symbol); 339 val = first_ptr_list((struct ptr_list *)sym->symbol_list); 340 if (!val || strcmp(val->ident->name, "__val") != 0) 341 return NULL; 342 return member_expression(expr, '.', val->ident); 343 } 344 345 static void match__write_once_size(const char *fn, struct expression *call, 346 void *unused) 347 { 348 struct expression *dest, *data, *assign; 349 struct range_list *rl; 350 351 dest = get_argument_from_call_expr(call->args, 0); 352 if (dest->type != EXPR_PREOP || dest->op != '&') 353 return; 354 dest = strip_expr(dest->unop); 355 356 data = get_argument_from_call_expr(call->args, 1); 357 data = get_val_expr(data); 358 if (!data) 359 return; 360 get_absolute_rl(data, &rl); 361 assign = assign_expression(dest, '=', data); 362 363 __in_fake_assign++; 364 __split_expr(assign); 365 __in_fake_assign--; 366 } 367 368 static void match__read_once_size(const char *fn, struct expression *call, 369 void *unused) 370 { 371 struct expression *dest, *data, *assign; 372 struct symbol *type, *val_sym; 373 374 /* 375 * We want to change: 376 * __read_once_size_nocheck(&(x), __u.__c, sizeof(x)); 377 * into a fake assignment: 378 * __u.val = x; 379 * 380 */ 381 382 data = get_argument_from_call_expr(call->args, 0); 383 if (data->type != EXPR_PREOP || data->op != '&') 384 return; 385 data = strip_parens(data->unop); 386 387 dest = get_argument_from_call_expr(call->args, 1); 388 if (dest->type != EXPR_DEREF || dest->op != '.') 389 return; 390 if (!dest->member || strcmp(dest->member->name, "__c") != 0) 391 return; 392 dest = dest->deref; 393 type = get_type(dest); 394 if (!type) 395 return; 396 val_sym = first_ptr_list((struct ptr_list *)type->symbol_list); 397 dest = member_expression(dest, '.', val_sym->ident); 398 399 assign = assign_expression(dest, '=', data); 400 __in_fake_assign++; 401 __split_expr(assign); 402 __in_fake_assign--; 403 } 404 405 bool is_ignored_kernel_data(const char *name) 406 { 407 if (option_project != PROJ_KERNEL) 408 return false; 409 410 /* 411 * On the file I was looking at lockdep was 25% of the DB. 412 */ 413 if (strstr(name, ".dep_map.")) 414 return true; 415 if (strstr(name, ".lockdep_map.")) 416 return true; 417 return false; 418 } 419 420 void check_kernel(int id) 421 { 422 if (option_project != PROJ_KERNEL) 423 return; 424 425 err_ptr_min.type = &ptr_ctype; 426 err_ptr_min.value = -4095; 427 err_ptr_max.type = &ptr_ctype; 428 err_ptr_max.value = -1l; 429 null_ptr.type = &ptr_ctype; 430 null_ptr.value = 0; 431 432 err_ptr_min = sval_cast(&ptr_ctype, err_ptr_min); 433 err_ptr_max = sval_cast(&ptr_ctype, err_ptr_max); 434 435 add_implied_return_hook("ERR_PTR", &implied_err_cast_return, NULL); 436 add_implied_return_hook("ERR_CAST", &implied_err_cast_return, NULL); 437 add_implied_return_hook("PTR_ERR", &implied_err_cast_return, NULL); 438 add_hook(hack_ERR_PTR, AFTER_DEF_HOOK); 439 return_implies_state("IS_ERR_OR_NULL", 0, 0, &match_param_valid_ptr, (void *)0); 440 return_implies_state("IS_ERR_OR_NULL", 1, 1, &match_param_err_or_null, (void *)0); 441 return_implies_state("IS_ERR", 0, 0, &match_not_err, NULL); 442 return_implies_state("IS_ERR", 1, 1, &match_err, NULL); 443 return_implies_state("tomoyo_memory_ok", 1, 1, &match_param_valid_ptr, (void *)0); 444 445 add_macro_assign_hook_extra("container_of", &match_container_of_macro, NULL); 446 add_hook(match_container_of, ASSIGNMENT_HOOK); 447 448 add_implied_return_hook("find_next_bit", &match_next_bit, NULL); 449 add_implied_return_hook("find_next_zero_bit", &match_next_bit, NULL); 450 add_implied_return_hook("find_first_bit", &match_next_bit, NULL); 451 add_implied_return_hook("find_first_zero_bit", &match_next_bit, NULL); 452 453 add_implied_return_hook("fls", &match_fls, NULL); 454 add_implied_return_hook("fls64", &match_fls, NULL); 455 456 add_function_hook("__ftrace_bad_type", &__match_nullify_path_hook, NULL); 457 add_function_hook("__write_once_size", &match__write_once_size, NULL); 458 459 add_function_hook("__read_once_size", &match__read_once_size, NULL); 460 add_function_hook("__read_once_size_nocheck", &match__read_once_size, NULL); 461 462 if (option_info) 463 add_hook(match_end_file, END_FILE_HOOK); 464 } 465