Coverity model file update
Upon review, it was found that the model for malloc() was incorrect. In addition, several general purpose memory allocation functions were missing models: * kmem_vasprintf() * kmem_asprintf() * kmem_strdup() * kmem_strfree() * spl_vmem_alloc() * spl_vmem_zalloc() * spl_vmem_free() * calloc() As an experiment to try to find more bugs, some less than general purpose memory allocation functions were also given models: * zfsvfs_create() * zfsvfs_free() * nvlist_alloc() * nvlist_dup() * nvlist_free() * nvlist_pack() * nvlist_unpack() Finally, the models were improved using additional coverity primitives: * __coverity_negative_sink__() * __coverity_writeall0__() * __coverity_mark_as_uninitialized_buffer__() * __coverity_mark_as_afm_allocated__() In addition, an attempt to inform coverity that certain modelled functions read entire buffers was used by adding the following to certain models: int first = buf[0]; int last = buf[buflen-1]; It was inspired by the QEMU model file. No additional false positives were found by this, but it is believed that the more accurate model file will help to catch false positives in the future. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14048
This commit is contained in:
Richard Yao
GitHub
parent
27218a32fc
commit
d10bd7d288
|
|
@ -29,11 +29,20 @@
|
|||
|
||||
#define NULL (0)
|
||||
|
||||
typedef enum {
|
||||
B_FALSE = 0,
|
||||
B_TRUE = 1
|
||||
} boolean_t;
|
||||
|
||||
typedef unsigned int uint_t;
|
||||
|
||||
int condition0, condition1;
|
||||
|
||||
int
|
||||
ddi_copyin(const void *from, void *to, size_t len, int flags)
|
||||
{
|
||||
(void) flags;
|
||||
__coverity_negative_sink__(len);
|
||||
__coverity_tainted_data_argument__(from);
|
||||
__coverity_tainted_data_argument__(to);
|
||||
__coverity_writeall__(to);
|
||||
|
|
@ -42,6 +51,10 @@ ddi_copyin(const void *from, void *to, size_t len, int flags)
|
|||
void *
|
||||
memset(void *dst, int c, size_t len)
|
||||
{
|
||||
__coverity_negative_sink__(len);
|
||||
if (c == 0)
|
||||
__coverity_writeall0__(dst);
|
||||
else
|
||||
__coverity_writeall__(dst);
|
||||
return (dst);
|
||||
}
|
||||
|
|
@ -49,6 +62,10 @@ memset(void *dst, int c, size_t len)
|
|||
void *
|
||||
memmove(void *dst, void *src, size_t len)
|
||||
{
|
||||
int first = ((char *)src)[0];
|
||||
int last = ((char *)src)[len-1];
|
||||
|
||||
__coverity_negative_sink__(len);
|
||||
__coverity_writeall__(dst);
|
||||
return (dst);
|
||||
}
|
||||
|
|
@ -56,6 +73,10 @@ memmove(void *dst, void *src, size_t len)
|
|||
void *
|
||||
memcpy(void *dst, void *src, size_t len)
|
||||
{
|
||||
int first = ((char *)src)[0];
|
||||
int last = ((char *)src)[len-1];
|
||||
|
||||
__coverity_negative_sink__(len);
|
||||
__coverity_writeall__(dst);
|
||||
return (dst);
|
||||
}
|
||||
|
|
@ -63,43 +84,53 @@ memcpy(void *dst, void *src, size_t len)
|
|||
void *
|
||||
umem_alloc_aligned(size_t size, size_t align, int kmflags)
|
||||
{
|
||||
(void) align;
|
||||
__coverity_negative_sink__(size);
|
||||
__coverity_negative_sink__(align);
|
||||
|
||||
if (((UMEM_NOFAIL & kmflags) == UMEM_NOFAIL) || condition0) {
|
||||
void *buf = __coverity_alloc__(size);
|
||||
__coverity_mark_as_uninitialized_buffer__(buf);
|
||||
__coverity_mark_as_afm_allocated__(buf, "umem_free");
|
||||
return (buf);
|
||||
}
|
||||
|
||||
if ((UMEM_NOFAIL & kmflags) == UMEM_NOFAIL)
|
||||
return (__coverity_alloc__(size));
|
||||
else if (condition0)
|
||||
return (__coverity_alloc__(size));
|
||||
else
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
void *
|
||||
umem_alloc(size_t size, int kmflags)
|
||||
{
|
||||
if ((UMEM_NOFAIL & kmflags) == UMEM_NOFAIL)
|
||||
return (__coverity_alloc__(size));
|
||||
else if (condition0)
|
||||
return (__coverity_alloc__(size));
|
||||
else
|
||||
__coverity_negative_sink__(size);
|
||||
|
||||
if (((UMEM_NOFAIL & kmflags) == UMEM_NOFAIL) || condition0) {
|
||||
void *buf = __coverity_alloc__(size);
|
||||
__coverity_mark_as_uninitialized_buffer__(buf);
|
||||
__coverity_mark_as_afm_allocated__(buf, "umem_free");
|
||||
return (buf);
|
||||
}
|
||||
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
void *
|
||||
umem_zalloc(size_t size, int kmflags)
|
||||
{
|
||||
if ((UMEM_NOFAIL & kmflags) == UMEM_NOFAIL)
|
||||
return (__coverity_alloc__(size));
|
||||
else if (condition0)
|
||||
return (__coverity_alloc__(size));
|
||||
else
|
||||
__coverity_negative_sink__(size);
|
||||
|
||||
if (((UMEM_NOFAIL & kmflags) == UMEM_NOFAIL) || condition0) {
|
||||
void *buf = __coverity_alloc__(size);
|
||||
__coverity_writeall0__(buf);
|
||||
__coverity_mark_as_afm_allocated__(buf, "umem_free");
|
||||
return (buf);
|
||||
}
|
||||
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
void
|
||||
umem_free(void *buf, size_t size)
|
||||
{
|
||||
(void) size;
|
||||
|
||||
__coverity_negative_sink__(size);
|
||||
__coverity_free__(buf);
|
||||
}
|
||||
|
||||
|
|
@ -113,11 +144,13 @@ umem_cache_alloc(umem_cache_t *skc, int flags)
|
|||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
if ((UMEM_NOFAIL & flags) == UMEM_NOFAIL)
|
||||
return (__coverity_alloc_nosize__());
|
||||
else if (condition0)
|
||||
return (__coverity_alloc_nosize__());
|
||||
else
|
||||
if (((UMEM_NOFAIL & flags) == UMEM_NOFAIL) || condition0) {
|
||||
void *buf = __coverity_alloc_nosize__();
|
||||
__coverity_mark_as_uninitialized_buffer__(buf);
|
||||
__coverity_mark_as_afm_allocated__(buf, "umem_cache_free");
|
||||
return (buf);
|
||||
}
|
||||
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
|
|
@ -135,14 +168,18 @@ spl_kmem_alloc(size_t sz, int fl, const char *func, int line)
|
|||
(void) func;
|
||||
(void) line;
|
||||
|
||||
__coverity_negative_sink__(sz);
|
||||
|
||||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
if (fl == 0) {
|
||||
return (__coverity_alloc__(sz));
|
||||
} else if (condition0)
|
||||
return (__coverity_alloc__(sz));
|
||||
else
|
||||
if ((fl == 0) || condition0) {
|
||||
void *buf = __coverity_alloc__(sz);
|
||||
__coverity_mark_as_uninitialized_buffer__(buf);
|
||||
__coverity_mark_as_afm_allocated__(buf, "spl_kmem_free");
|
||||
return (buf);
|
||||
}
|
||||
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
|
|
@ -152,22 +189,126 @@ spl_kmem_zalloc(size_t sz, int fl, const char *func, int line)
|
|||
(void) func;
|
||||
(void) line;
|
||||
|
||||
__coverity_negative_sink__(sz);
|
||||
|
||||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
if (fl == 0) {
|
||||
return (__coverity_alloc__(sz));
|
||||
} else if (condition0)
|
||||
return (__coverity_alloc__(sz));
|
||||
else
|
||||
if ((fl == 0) || condition0) {
|
||||
void *buf = __coverity_alloc__(sz);
|
||||
__coverity_writeall0__(buf);
|
||||
__coverity_mark_as_afm_allocated__(buf, "spl_kmem_free");
|
||||
return (buf);
|
||||
}
|
||||
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
void
|
||||
spl_kmem_free(const void *ptr, size_t sz)
|
||||
{
|
||||
(void) sz;
|
||||
__coverity_negative_sink__(sz);
|
||||
__coverity_free__(ptr);
|
||||
}
|
||||
|
||||
char *
|
||||
kmem_vasprintf(const char *fmt, va_list ap)
|
||||
{
|
||||
char *buf = __coverity_alloc_nosize__();
|
||||
(void) ap;
|
||||
|
||||
__coverity_string_null_sink__(fmt);
|
||||
__coverity_string_size_sink__(fmt);
|
||||
|
||||
__coverity_writeall__(buf);
|
||||
|
||||
__coverity_mark_as_afm_allocated__(buf, "kmem_strfree");
|
||||
|
||||
return (buf);
|
||||
}
|
||||
|
||||
char *
|
||||
kmem_asprintf(const char *fmt, ...)
|
||||
{
|
||||
char *buf = __coverity_alloc_nosize__();
|
||||
|
||||
__coverity_string_null_sink__(fmt);
|
||||
__coverity_string_size_sink__(fmt);
|
||||
|
||||
__coverity_writeall__(buf);
|
||||
|
||||
__coverity_mark_as_afm_allocated__(buf, "kmem_strfree");
|
||||
|
||||
return (buf);
|
||||
}
|
||||
|
||||
char *
|
||||
kmem_strdup(const char *str)
|
||||
{
|
||||
char *buf = __coverity_alloc_nosize__();
|
||||
|
||||
__coverity_string_null_sink__(str);
|
||||
__coverity_string_size_sink__(str);
|
||||
|
||||
__coverity_writeall__(buf);
|
||||
|
||||
__coverity_mark_as_afm_allocated__(buf, "kmem_strfree");
|
||||
|
||||
return (buf);
|
||||
|
||||
|
||||
}
|
||||
|
||||
void
|
||||
kmem_strfree(char *str)
|
||||
{
|
||||
__coverity_free__(str);
|
||||
}
|
||||
|
||||
void *
|
||||
spl_vmem_alloc(size_t sz, int fl, const char *func, int line)
|
||||
{
|
||||
(void) func;
|
||||
(void) line;
|
||||
|
||||
__coverity_negative_sink__(sz);
|
||||
|
||||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
if ((fl == 0) || condition0) {
|
||||
void *buf = __coverity_alloc__(sz);
|
||||
__coverity_mark_as_uninitialized_buffer__(buf);
|
||||
__coverity_mark_as_afm_allocated__(buf, "spl_vmem_free");
|
||||
return (buf);
|
||||
}
|
||||
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
void *
|
||||
spl_vmem_zalloc(size_t sz, int fl, const char *func, int line)
|
||||
{
|
||||
(void) func;
|
||||
(void) line;
|
||||
|
||||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
if ((fl == 0) || condition0) {
|
||||
void *buf = __coverity_alloc__(sz);
|
||||
__coverity_writeall0__(buf);
|
||||
__coverity_mark_as_afm_allocated__(buf, "spl_vmem_free");
|
||||
return (buf);
|
||||
}
|
||||
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
void
|
||||
spl_vmem_free(const void *ptr, size_t sz)
|
||||
{
|
||||
__coverity_negative_sink__(sz);
|
||||
__coverity_free__(ptr);
|
||||
}
|
||||
|
||||
|
|
@ -181,12 +322,12 @@ spl_kmem_cache_alloc(spl_kmem_cache_t *skc, int flags)
|
|||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
if (flags == 0) {
|
||||
return (__coverity_alloc_nosize__());
|
||||
} else if (condition0)
|
||||
return (__coverity_alloc_nosize__());
|
||||
else
|
||||
return (NULL);
|
||||
if ((flags == 0) || condition0) {
|
||||
void *buf = __coverity_alloc_nosize__();
|
||||
__coverity_mark_as_uninitialized_buffer__(buf);
|
||||
__coverity_mark_as_afm_allocated__(buf, "spl_kmem_cache_free");
|
||||
return (buf);
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
|
|
@ -197,12 +338,164 @@ spl_kmem_cache_free(spl_kmem_cache_t *skc, void *obj)
|
|||
__coverity_free__(obj);
|
||||
}
|
||||
|
||||
void
|
||||
malloc(size_t size)
|
||||
typedef struct {} zfsvfs_t;
|
||||
|
||||
int
|
||||
zfsvfs_create(const char *osname, boolean_t readonly, zfsvfs_t **zfvp)
|
||||
{
|
||||
__coverity_alloc__(size);
|
||||
(void) osname;
|
||||
(void) readonly;
|
||||
|
||||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
if (condition0) {
|
||||
*zfvp = __coverity_alloc_nosize__();
|
||||
__coverity_writeall__(*zfvp);
|
||||
return (0);
|
||||
}
|
||||
|
||||
return (1);
|
||||
}
|
||||
|
||||
void
|
||||
zfsvfs_free(zfsvfs_t *zfsvfs)
|
||||
{
|
||||
__coverity_free__(zfsvfs);
|
||||
}
|
||||
|
||||
typedef struct {} nvlist_t;
|
||||
|
||||
int
|
||||
nvlist_alloc(nvlist_t **nvlp, uint_t nvflag, int kmflag)
|
||||
{
|
||||
(void) nvflag;
|
||||
|
||||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
if ((kmflag == 0) || condition0) {
|
||||
*nvlp = __coverity_alloc_nosize__();
|
||||
__coverity_mark_as_afm_allocated__(*nvlp, "nvlist_free");
|
||||
__coverity_writeall__(*nvlp);
|
||||
return (0);
|
||||
}
|
||||
|
||||
return (-1);
|
||||
|
||||
}
|
||||
|
||||
int
|
||||
nvlist_dup(const nvlist_t *nvl, nvlist_t **nvlp, int kmflag)
|
||||
{
|
||||
nvlist_t read = *nvl;
|
||||
|
||||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
if ((kmflag == 0) || condition0) {
|
||||
nvlist_t *nvl = __coverity_alloc_nosize__();
|
||||
__coverity_mark_as_afm_allocated__(nvl, "nvlist_free");
|
||||
__coverity_writeall__(nvl);
|
||||
*nvlp = nvl;
|
||||
return (0);
|
||||
}
|
||||
|
||||
return (-1);
|
||||
}
|
||||
|
||||
void
|
||||
nvlist_free(nvlist_t *nvl)
|
||||
{
|
||||
__coverity_free__(nvl);
|
||||
}
|
||||
|
||||
int
|
||||
nvlist_pack(nvlist_t *nvl, char **bufp, size_t *buflen, int encoding,
|
||||
int kmflag)
|
||||
{
|
||||
(void) nvl;
|
||||
(void) encoding;
|
||||
|
||||
if (*bufp == NULL) {
|
||||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
if ((kmflag == 0) || condition0) {
|
||||
char *buf = __coverity_alloc_nosize__();
|
||||
__coverity_writeall__(buf);
|
||||
/*
|
||||
* We cannot use __coverity_mark_as_afm_allocated__()
|
||||
* because the free function varies between the kernel
|
||||
* and userspace.
|
||||
*/
|
||||
*bufp = buf;
|
||||
return (0);
|
||||
}
|
||||
|
||||
return (-1);
|
||||
}
|
||||
|
||||
/*
|
||||
* Unfortunately, errors from the buffer being too small are not
|
||||
* possible to model, so we assume success.
|
||||
*/
|
||||
__coverity_negative_sink__(*buflen);
|
||||
__coverity_writeall__(*bufp);
|
||||
return (0);
|
||||
}
|
||||
|
||||
|
||||
int
|
||||
nvlist_unpack(char *buf, size_t buflen, nvlist_t **nvlp, int kmflag)
|
||||
{
|
||||
__coverity_negative_sink__(buflen);
|
||||
|
||||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
if ((kmflag == 0) || condition0) {
|
||||
nvlist_t *nvl = __coverity_alloc_nosize__();
|
||||
__coverity_mark_as_afm_allocated__(nvl, "nvlist_free");
|
||||
__coverity_writeall__(nvl);
|
||||
*nvlp = nvl;
|
||||
int first = buf[0];
|
||||
int last = buf[buflen-1];
|
||||
return (0);
|
||||
}
|
||||
|
||||
return (-1);
|
||||
|
||||
}
|
||||
|
||||
void *
|
||||
malloc(size_t size)
|
||||
{
|
||||
void *buf = __coverity_alloc__(size);
|
||||
|
||||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
__coverity_negative_sink__(size);
|
||||
__coverity_mark_as_uninitialized_buffer__(buf);
|
||||
__coverity_mark_as_afm_allocated__(buf, "free");
|
||||
|
||||
return (buf);
|
||||
}
|
||||
|
||||
void *
|
||||
calloc(size_t nmemb, size_t size)
|
||||
{
|
||||
void *buf = __coverity_alloc__(size * nmemb);
|
||||
|
||||
if (condition1)
|
||||
__coverity_sleep__();
|
||||
|
||||
__coverity_negative_sink__(size);
|
||||
__coverity_writeall0__(buf);
|
||||
__coverity_mark_as_afm_allocated__(buf, "free");
|
||||
return (buf);
|
||||
}
|
||||
void
|
||||
free(void *buf)
|
||||
{
|
||||
|
|
|
|||
Loading…
Reference in New Issue