On Mon, Apr 17, 2023 at 01:42:21PM +0300, Dan Carpenter wrote:
> Btw, we should be thinking about how to detect these sorts of issues
> using static analysis. Unfortunately, it's not as simple as saying
> "We know this variable is NULL so don't dereference it." The problem
> with that is that many times Smatch sees where a pointer is set to NULL
> but not when it is assigned to a different value.
>
> What we could do instead is say:
> 1) If a pointer is dereferenced and we know it is NULL then:
> set_state_expr(my_id, expr, &suspicious);
> 2) If we set a pointer to non-NULL and it is marked as suspicious then
> print a warning.
I was thinking about this and it's not so simple. Normally after a
warning we return so the state never transitions from &suspicious to
non-NULL.
So what we could do is set the state to &suspicious. Then at the end of
the function we look at all the states at the return paths. If the
state is non-NULL on any return path then print a warning. This is easy
enough to do, but requires quite a bit of Smatch knowledge so I have
done it. Attached.
Unfortunately, it doesn't print a warning in this case because Smatch
doesn't track that _dev_warn() dereferences the "dev" pointer. The
__dev_printk() function only dereferences "dev" if it is non-NULL.
Smatch only counts it if it *always* dereferences it.
This could be fixed in two steps:
Step 1: track dereferences based on the return insead just yes/no.
Step 2: split _dev_warn() returns into two returns based on if dev is
NULL or non-NULL.
Step 1 is probably a good idea. Step 2 is a bad idea, because it makes
no sense to pass a NULL to dev_warn().
A better approach for this bug is to print a warning if people pass
the address of the offset from a NULL pointer. Combine that with the
same return states filter as earlier to eliminate false positives where
Smatch thinks a pointer is always NULL.
drivers/input/joystick/xpad.c:2053 xpad_probe() warn: address of NULL pointer 'xpad->dev'
drivers/media/i2c/ccs/ccs-data.c:524 ccs_data_parse_rules() warn: address of NULL pointer 'rules'
drivers/scsi/lpfc/lpfc_attr.c:1482 lpfc_reset_pci_bus() warn: address of NULL pointer 'phba->pcidev'
That check is attached too.
regards,
dan carpenter
/*
* Copyright 2023 Linaro Ltd.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
*/
#include "smatch.h"
#include "smatch_extra.h"
#include "smatch_slist.h"
static int my_id;
STATE(suspicious);
static void deref_hook(struct expression *expr)
{
sval_t sval;
if (!get_implied_value(expr, &sval) || sval.value != 0)
return;
set_state_expr(my_id, expr, &suspicious);
}
static void check_variable(struct sm_state *sm)
{
struct sm_state *extra_sm, *tmp;
extra_sm = get_sm_state(SMATCH_EXTRA, sm->name, sm->sym);
if (!extra_sm)
return;
FOR_EACH_PTR(extra_sm->possible, tmp) {
if (!estate_rl(tmp->state))
continue;
if (rl_min(estate_rl(tmp->state)).value != 0) {
sm_warning_line(sm->line,
"pointer dereferenced without being set '%s'",
sm->name);
return;
}
} END_FOR_EACH_PTR(tmp);
}
static void process_states(void)
{
struct sm_state *tmp;
FOR_EACH_MY_SM(my_id, __get_cur_stree(), tmp) {
check_variable(tmp);
} END_FOR_EACH_SM(tmp);
}
void check_deref_before_set(int id)
{
my_id = id;
add_dereference_hook(deref_hook);
all_return_states_hook(&process_states);
}
/*
* Copyright (C) 2019 Oracle.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
*/
#include "smatch.h"
#include "smatch_extra.h"
#include "smatch_slist.h"
static int my_id;
STATE(suspicious);
static void check_param(struct expression *expr)
{
struct expression *tmp;
sval_t sval;
tmp = get_assigned_expr(expr);
if (tmp)
expr = tmp;
expr = strip_expr(expr);
if (!expr || expr->type != EXPR_PREOP || expr->op != '&')
return;
if (!get_implied_value(expr, &sval) ||
sval.value == 0 || sval.uvalue > 4096)
return;
expr = strip_expr(expr->unop);
while (expr->type == EXPR_DEREF) {
expr = strip_expr(expr->deref);
if (expr->type == EXPR_PREOP && expr->op == '*')
expr = strip_expr(expr->unop);
if (local_debug) {
struct range_list *rl;
get_absolute_rl(expr, &rl);
sm_msg("%s: expr='%s' type=%d rl='%s'", __func__, expr_to_str(expr), expr->type, show_rl(rl));
}
if (get_implied_value(expr, &sval) && sval.value == 0) {
set_state_expr(my_id, expr, &suspicious);
return;
}
}
}
static void match_call(struct expression *expr)
{
struct expression *arg;
FOR_EACH_PTR(expr->args, arg) {
check_param(arg);
} END_FOR_EACH_PTR(arg);
}
static void check_variable(struct sm_state *sm)
{
struct sm_state *extra_sm, *tmp;
int line = sm->line;
extra_sm = get_sm_state(SMATCH_EXTRA, sm->name, sm->sym);
if (!extra_sm)
return;
FOR_EACH_PTR(sm->possible, tmp) {
if (tmp->state == &suspicious)
line = tmp->line;
} END_FOR_EACH_PTR(tmp);
FOR_EACH_PTR(extra_sm->possible, tmp) {
if (!estate_rl(tmp->state))
continue;
if (rl_min(estate_rl(tmp->state)).value != 0) {
sm_warning_line(line, "address of NULL pointer '%s'",
sm->name);
return;
}
} END_FOR_EACH_PTR(tmp);
}
static void process_states(void)
{
struct sm_state *tmp;
FOR_EACH_MY_SM(my_id, __get_cur_stree(), tmp) {
check_variable(tmp);
} END_FOR_EACH_SM(tmp);
}
void check_bogus_address_param(int id)
{
my_id = id;
add_hook(&match_call, FUNCTION_CALL_HOOK);
all_return_states_hook(&process_states);
}
