[PATCH smatch] Add safety checks in various modules

[PATCH smatch] Add safety checks in various modules

[Thomas Fourier]

When running Smatch on Linux, there were a number of crashes due to
segmentation faults, mostly because of null-pointer dereference.

Add safety checks to prevent the crashes.
---
 check_return.c      | 2 +-
 expression.h        | 1 +
 smatch_conditions.c | 2 ++
 smatch_helper.c     | 4 ++++
 smatch_math.c       | 5 +++++
 smatch_type.c       | 4 +++-
 symbol.h            | 3 +++
 7 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/check_return.c b/check_return.c
index babc452d..d9c11ee5 100644
--- a/check_return.c
+++ b/check_return.c
@@ -24,7 +24,7 @@ static void must_check(const char *fn, struct expression *expr, void *data)
 	struct statement *stmt;
 
 	stmt = last_ptr_list((struct ptr_list *)big_statement_stack);
-	if (stmt->type == STMT_EXPRESSION && stmt->expression == expr)
+	if (stmt && stmt->type == STMT_EXPRESSION && stmt->expression == expr)
 		sm_warning("unchecked '%s'", fn);
 }
 
diff --git a/expression.h b/expression.h
index 165d5a0c..53539f15 100644
--- a/expression.h
+++ b/expression.h
@@ -65,6 +65,7 @@ enum expression_type {
 	EXPR_SLICE,
 	EXPR_OFFSETOF,
 	EXPR_GENERIC,
+	NUM_EXPRESSION
 };
 
 
diff --git a/smatch_conditions.c b/smatch_conditions.c
index ad86a01a..3ed83f03 100644
--- a/smatch_conditions.c
+++ b/smatch_conditions.c
@@ -933,6 +933,8 @@ int __handle_expr_statement_assigns(struct expression *expr)
 	struct statement *stmt;
 
 	right = strip_expr_cast(expr->right, &cast);
+	if (!right)
+		return 0;
 	if (right->type == EXPR_PREOP && right->op == '(')
 		right = right->unop;
 	if (right->type != EXPR_STATEMENT)
diff --git a/smatch_helper.c b/smatch_helper.c
index ccea1bca..deb54d7e 100644
--- a/smatch_helper.c
+++ b/smatch_helper.c
@@ -1016,6 +1016,10 @@ struct expression *strip_expr_cast(struct expression *expr, struct expression **
 	ret = strip_no_cast(expr);
 	while (ret && (ret->type == EXPR_CAST || ret->type == EXPR_FORCE_CAST)) {
 		new = cast_expression(ret->cast_expression, ret->cast_type);
+
+		if (!new)
+			return ret;
+
 		new->cast_expression = NULL;
 		if (!last)
 			*cast = new;
diff --git a/smatch_math.c b/smatch_math.c
index ecb911a2..f5e88bdd 100644
--- a/smatch_math.c
+++ b/smatch_math.c
@@ -69,6 +69,8 @@ static bool last_stmt_rl(struct statement *stmt, int implied, int *recurse_cnt,
 		return false;
 
 	stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
+	if (!stmt)
+		return false;
 	if (stmt->type == STMT_LABEL) {
 		if (stmt->label_statement &&
 		    stmt->label_statement->type == STMT_EXPRESSION)
@@ -1979,6 +1981,9 @@ int get_value(struct expression *expr, sval_t *res_sval)
 	sval_t sval = {};
 	int i;
 
+	if (!expr || expr->type >= NUM_EXPRESSION)
+		return 0;
+
 	if (get_value_literal(expr, res_sval))
 		return 1;
 
diff --git a/smatch_type.c b/smatch_type.c
index f660081b..13271545 100644
--- a/smatch_type.c
+++ b/smatch_type.c
@@ -221,9 +221,11 @@ static struct symbol *get_return_type(struct expression *expr)
 
 static struct symbol *get_expr_stmt_type(struct statement *stmt)
 {
-	if (stmt->type != STMT_COMPOUND)
+	if (!stmt || stmt->type != STMT_COMPOUND)
 		return NULL;
 	stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
+	if (!stmt)
+		return NULL;
 	if (stmt->type == STMT_LABEL)
 		stmt = stmt->label_statement;
 	if (stmt->type != STMT_EXPRESSION)
diff --git a/symbol.h b/symbol.h
index 3c0ad0d7..937359bb 100644
--- a/symbol.h
+++ b/symbol.h
@@ -380,6 +380,9 @@ static inline int valid_type(const struct symbol *ctype)
 
 static inline struct symbol *get_base_type(const struct symbol *sym)
 {
+	if (!sym)
+		return NULL;
+
 	return examine_symbol_type(sym->ctype.base_type);
 }
 
-- 
2.43.0

Re: [PATCH smatch] Add safety checks in various modules

[Dan Carpenter]

On Tue, Oct 06, 2026 at 03:20:40PM +0200, Thomas Fourier wrote:
> diff --git a/smatch_math.c b/smatch_math.c
> index ecb911a2..f5e88bdd 100644
> --- a/smatch_math.c
> +++ b/smatch_math.c
> @@ -69,6 +69,8 @@ static bool last_stmt_rl(struct statement *stmt, int implied, int *recurse_cnt,
>  		return false;
>  
>  	stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
> +	if (!stmt)
> +		return false;
>  	if (stmt->type == STMT_LABEL) {
>  		if (stmt->label_statement &&
>  		    stmt->label_statement->type == STMT_EXPRESSION)
> @@ -1979,6 +1981,9 @@ int get_value(struct expression *expr, sval_t *res_sval)
>  	sval_t sval = {};
>  	int i;
>  
> +	if (!expr || expr->type >= NUM_EXPRESSION)

This could only happen if there is memory corruption so it's really just
a bandaid fix.

Anyway, applied.  Thanks!

regards,
dan carpenter