Re: [PATCH] mm: hugetlb: checking for IS_ERR() instead of NULL

[Dan Carpenter <dan.carpenter@oracle.com>]

Here is my next attempt at this check.

Back in 2009, I used to write Smatch checks which were too complicated.
Ideally, each Smatch check should only print one warning.  The state
engine should only have one custom state, and &undefined and &merged.
That check I sent violated all those rules.

The other thing which might be interesting is if you pass a NULL
to IS_ERR() and then dereference the NULL then print a warning about
that.  This has a lot of overlaps with some of my existing checks, but
it's still a new idea so it belongs in a separate check.  It's fine and
good even if one bug triggers a lot of different warnings.  I'll write
that, hang on, brb.

regards,
dan carpenter

/*
 * Copyright (C) 2021 Oracle.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
 */

#include "smatch.h"
#include "smatch_extra.h"

static int my_id;

static void match_is_err(const char *fn, struct expression *expr, void *unused)
{
	struct expression *arg, *call;
	struct range_list *rl;
	char *name;

	arg = get_argument_from_call_expr(expr->args, 0);
	/* ignore unknown values */
	if (!get_implied_rl(arg, &rl))
		return;
	/* error pointers are what we expect */
	if (rl_max(rl).uvalue >= (unsigned long long)-4095)
		return;
	/* ignore valid pointers */
	if (rl_min(rl).uvalue != 0)
		return;
	/*
	 * Don't warn if people are using IS_ERR() to sanity check their
	 * parameters.
	 */
	call = get_assigned_expr(arg);
	call = strip_expr(call);
	if (!call || call->type != EXPR_CALL)
		return;

	name = expr_to_str(arg);
	sm_warning("'%s' is not an error pointer", name);
	free_string(name);
}

void check_not_an_err_ptr(int id)
{
	my_id = id;

	if (option_project != PROJ_KERNEL)
		return;

	add_function_hook("IS_ERR", &match_is_err, NULL);
}