forked from Minki/linux
3f984cb399
Unsigned expressions cannot be lesser than zero. Presence of comparisons 'unsigned (<|<=|>|>=) 0' often indicates a bug, usually wrong type of variable. The patch beside finding such comparisons tries to eliminate false positives, mainly by bypassing range checks. gcc can detect such comparisons also using -Wtype-limits switch, but it warns also in correct cases, making too much noise. Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Acked-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Michal Marek <mmarek@suse.com>
76 lines
2.1 KiB
Plaintext
76 lines
2.1 KiB
Plaintext
/// Unsigned expressions cannot be lesser than zero. Presence of
|
|
/// comparisons 'unsigned (<|<=|>|>=) 0' often indicates a bug,
|
|
/// usually wrong type of variable.
|
|
///
|
|
/// To reduce number of false positives following tests have been added:
|
|
/// - parts of range checks are skipped, eg. "if (u < 0 || u > 15) ...",
|
|
/// developers prefer to keep such code,
|
|
/// - comparisons "<= 0" and "> 0" are performed only on results of
|
|
/// signed functions/macros,
|
|
/// - hardcoded list of signed functions/macros with always non-negative
|
|
/// result is used to avoid false positives difficult to detect by other ways
|
|
///
|
|
// Confidence: Average
|
|
// Copyright: (C) 2015 Andrzej Hajda, Samsung Electronics Co., Ltd. GPLv2.
|
|
// URL: http://coccinelle.lip6.fr/
|
|
// Options: --all-includes
|
|
|
|
virtual context
|
|
virtual org
|
|
virtual report
|
|
|
|
@r_cmp@
|
|
position p;
|
|
typedef bool, u8, u16, u32, u64;
|
|
{unsigned char, unsigned short, unsigned int, unsigned long, unsigned long long,
|
|
size_t, bool, u8, u16, u32, u64} v;
|
|
expression e;
|
|
@@
|
|
|
|
\( v = e \| &v \)
|
|
...
|
|
(\( v@p < 0 \| v@p <= 0 \| v@p >= 0 \| v@p > 0 \))
|
|
|
|
@r@
|
|
position r_cmp.p;
|
|
typedef s8, s16, s32, s64;
|
|
{char, short, int, long, long long, ssize_t, s8, s16, s32, s64} vs;
|
|
expression c, e, v;
|
|
identifier f !~ "^(ata_id_queue_depth|btrfs_copy_from_user|dma_map_sg|dma_map_sg_attrs|fls|fls64|gameport_time|get_write_extents|nla_len|ntoh24|of_flat_dt_match|of_get_child_count|uart_circ_chars_pending|[A-Z0-9_]+)$";
|
|
@@
|
|
|
|
(
|
|
v = f(...)@vs;
|
|
... when != v = e;
|
|
* (\( v@p <=@e 0 \| v@p >@e 0 \))
|
|
... when any
|
|
|
|
|
(
|
|
(\( v@p < 0 \| v@p <= 0 \)) || ... || (\( v >= c \| v > c \))
|
|
|
|
|
(\( v >= c \| v > c \)) || ... || (\( v@p < 0 \| v@p <= 0 \))
|
|
|
|
|
(\( v@p >= 0 \| v@p > 0 \)) && ... && (\( v < c \| v <= c \))
|
|
|
|
|
((\( v < c \| v <= c \) && ... && \( v@p >= 0 \| v@p > 0 \)))
|
|
|
|
|
* (\( v@p <@e 0 \| v@p >=@e 0 \))
|
|
)
|
|
)
|
|
|
|
@script:python depends on org@
|
|
p << r_cmp.p;
|
|
e << r.e;
|
|
@@
|
|
|
|
msg = "WARNING: Unsigned expression compared with zero: %s" % (e)
|
|
coccilib.org.print_todo(p[0], msg)
|
|
|
|
@script:python depends on report@
|
|
p << r_cmp.p;
|
|
e << r.e;
|
|
@@
|
|
|
|
msg = "WARNING: Unsigned expression compared with zero: %s" % (e)
|
|
coccilib.report.print_report(p[0], msg)
|