scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /// Unsigned expressions cannot be lesser than zero. Presence of
   3 /// comparisons 'unsigned (<|<=|>|>=) 0' often indicates a bug,
   4 /// usually wrong type of variable.
   5 ///
   6 /// To reduce number of false positives following tests have been added:
   7 /// - parts of range checks are skipped, eg. "if (u < 0 || u > 15) ...",
   8 ///   developers prefer to keep such code,
   9 /// - comparisons "<= 0" and "> 0" are performed only on results of
  10 ///   signed functions/macros,
  11 /// - hardcoded list of signed functions/macros with always non-negative
  12 ///   result is used to avoid false positives difficult to detect by other ways
  13 ///
  14 // Confidence: Average
  15 // Copyright: (C) 2015 Andrzej Hajda, Samsung Electronics Co., Ltd.
  16 // URL: http://coccinelle.lip6.fr/
  17 // Options: --all-includes
  18
  19 virtual context
  20 virtual org
  21 virtual report
  22
  23 @r_cmp@
  24 position p;
  25 typedef bool, u8, u16, u32, u64;
  26 {unsigned char, unsigned short, unsigned int, unsigned long, unsigned long long,
  27         size_t, bool, u8, u16, u32, u64} v;
  28 expression e;
  29 @@
  30
  31         \( v = e \| &v \)
  32         ...
  33         (\( v@p < 0 \| v@p <= 0 \| v@p >= 0 \| v@p > 0 \))
  34
  35 @r@
  36 position r_cmp.p;
  37 typedef s8, s16, s32, s64;
  38 {char, short, int, long, long long, ssize_t, s8, s16, s32, s64} vs;
  39 expression c, e, v;
  40 identifier f !~ "^(ata_id_queue_depth|btrfs_copy_from_user|dma_map_sg|dma_map_sg_attrs|fls|fls64|gameport_time|get_write_extents|nla_len|ntoh24|of_flat_dt_match|of_get_child_count|uart_circ_chars_pending|[A-Z0-9_]+)$";
  41 @@
  42
  43 (
  44         v = f(...)@vs;
  45         ... when != v = e;
  46 *       (\( v@p <=@e 0 \| v@p >@e 0 \))
  47         ... when any
  48 |
  49 (
  50         (\( v@p < 0 \| v@p <= 0 \)) || ... || (\( v >= c \| v > c \))
  51 |
  52         (\( v >= c \| v > c \)) || ... || (\( v@p < 0 \| v@p <= 0 \))
  53 |
  54         (\( v@p >= 0 \| v@p > 0 \)) && ... && (\( v < c \| v <= c \))
  55 |
  56         ((\( v < c \| v <= c \) && ... && \( v@p >= 0 \| v@p > 0 \)))
  57 |
  58 *       (\( v@p <@e 0 \| v@p >=@e 0 \))
  59 )
  60 )
  61
  62 @script:python depends on org@
  63 p << r_cmp.p;
  64 e << r.e;
  65 @@
  66
  67 msg = "WARNING: Unsigned expression compared with zero: %s" % (e)
  68 coccilib.org.print_todo(p[0], msg)
  69
  70 @script:python depends on report@
  71 p << r_cmp.p;
  72 e << r.e;
  73 @@
  74
  75 msg = "WARNING: Unsigned expression compared with zero: %s" % (e)
  76 coccilib.report.print_report(p[0], msg)