1 // SPDX-License-Identifier: GPL-2.0-only
2 /// Unsigned expressions cannot be lesser than zero. Presence of
3 /// comparisons 'unsigned (<|<=|>|>=) 0' often indicates a bug,
4 /// usually wrong type of variable.
5 ///
6 /// To reduce number of false positives following tests have been added:
7 /// - parts of range checks are skipped, eg. "if (u < 0 || u > 15) ...",
8 /// developers prefer to keep such code,
9 /// - comparisons "<= 0" and "> 0" are performed only on results of
10 /// signed functions/macros,
11 /// - hardcoded list of signed functions/macros with always non-negative
12 /// result is used to avoid false positives difficult to detect by other ways
13 ///
14 // Confidence: Average
15 // Copyright: (C) 2015 Andrzej Hajda, Samsung Electronics Co., Ltd.
16 // URL: https://coccinelle.gitlabpages.inria.fr/website
17 // Options: --all-includes
18
19 virtual context
20 virtual org
21 virtual report
22
23 @r_cmp@
24 position p;
25 typedef bool, u8, u16, u32, u64;
26 {unsigned char, unsigned short, unsigned int, unsigned long, unsigned long long,
27 size_t, bool, u8, u16, u32, u64} v;
28 expression e;
29 @@
30
31 \( v = e \| &v \)
32 ...
33 (\( v@p < 0 \| v@p <= 0 \| v@p >= 0 \| v@p > 0 \))
34
35 @r@
36 position r_cmp.p;
37 typedef s8, s16, s32, s64;
38 {char, short, int, long, long long, ssize_t, s8, s16, s32, s64} vs;
39 expression c, e, v;
40 identifier f !~ "^(ata_id_queue_depth|btrfs_copy_from_user|dma_map_sg|dma_map_sg_attrs|fls|fls64|gameport_time|get_write_extents|nla_len|ntoh24|of_flat_dt_match|of_get_child_count|uart_circ_chars_pending|[A-Z0-9_]+)$";
41 @@
42
43 (
44 v = f(...)@vs;
45 ... when != v = e;
46 * (\( v@p <=@e 0 \| v@p >@e 0 \))
47 ... when any
48 |
49 (
50 (\( v@p < 0 \| v@p <= 0 \)) || ... || (\( v >= c \| v > c \))
51 |
52 (\( v >= c \| v > c \)) || ... || (\( v@p < 0 \| v@p <= 0 \))
53 |
54 (\( v@p >= 0 \| v@p > 0 \)) && ... && (\( v < c \| v <= c \))
55 |
56 ((\( v < c \| v <= c \) && ... && \( v@p >= 0 \| v@p > 0 \)))
57 |
58 * (\( v@p <@e 0 \| v@p >=@e 0 \))
59 )
60 )
61
62 @script:python depends on org@
63 p << r_cmp.p;
64 e << r.e;
65 @@
66
67 msg = "WARNING: Unsigned expression compared with zero: %s" % (e)
68 coccilib.org.print_todo(p[0], msg)
69
70 @script:python depends on report@
71 p << r_cmp.p;
72 e << r.e;
73 @@
74
75 msg = "WARNING: Unsigned expression compared with zero: %s" % (e)
76 coccilib.report.print_report(p[0], msg)
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.