From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr2-f34.google.com (mail-wr2-f34.google.com [74.125.225.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 53A1C43DA50 for ; Tue, 6 Oct 2026 13:22:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.225.98 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791292979; cv=none; b=RViTOp63S2qF0rcBdoApbj/SNMjNqAHqNmmp1EPtu9S9jsh47d+znA2mUSAxOBD8A1B5ISVYb7JikXGV634SErpNfuiHt5ej2krO+Jlx+RWVpGfs+n6P1NiZwfju0jcxv5BLQmatOZJgGs+Hp+Lm7B33AK+Ljo5KFkUJZNycfMo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791292979; c=relaxed/simple; bh=bo5ISG72U9gbzN8i6ia7uQNTwXEsOnmIwzkNo0ntpI4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pm0BZ4hyCf+aavRjjVBD5sBw3LAxTUFOb8RjtkNyA2W7v+F6KHktSB15vPwX/Sjp077bEvMAUYBzLAV7kQVz7ifcdTDchDf0eW1cMskNTU/E7hR6UBjl4wZZzJgNmGYyzftlH18puVWGOOYG55Dp+bMXHu/T8Xa8XIvZ6c1SyjE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Eml1AyC0; arc=none smtp.client-ip=74.125.225.98 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Eml1AyC0" Received: by mail-wr2-f34.google.com with SMTP id ffacd0b85a97d-48afbfe4247so360956f8f.0 for ; Tue, 06 Oct 2026 06:22:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791292976; x=1791897776; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=GCi1CmVxNYWZoFpIDBZzJZa/i/6eWGSqFH8rAM3x21U=; b=Eml1AyC0Hy79fotany2giUn0HPy81hxFmDHu8Dghwa71pLChKmCcDBhzoWje/y67S1 c5vJZRRneRnQdoDje7MzS3hNuusAfKGfsUjqeJVQNKnk0XwGI60ldpELNq3fQQTp6H4O 1RoN+Ts/3xoQW4xugzZR9537hhkoVrbMWMsZZEemPDd+0UiB0Gmh9VqMznjaKWNHHw9V Sdj7l33bvGAN9G15bzJtqowpSRvml/4WXgXorGAHzk38iQLkkAFDteYIMfNM+LqZGijP RhI4Z95KF0XiuVEXScfsnYGC3Jbl5GUo50+UQG6MlCrIWnz7F+nLTPUWc1yLP2vq3GMo TTyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791292976; x=1791897776; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=GCi1CmVxNYWZoFpIDBZzJZa/i/6eWGSqFH8rAM3x21U=; b=GyyTPzABgvBOy3YBI8hZXX0f3yCGKkYXeIE1NPXcRuXMHIXIN2pSxLacofqPcAN6N2 ybABH8SlCRmCADxdG9tmBg+cBTSl7biMJX9dYjcCeD4+wQCpDH8OrGEWuOdLWifNE4Am cipaPJtfnoCULx+PFFS5/k+BWcQ/4CNF10b9S3YzjhZOStxgkLsR3spEdn67CGKAPd2L 2K4rAxMiib6a8pcnDTXHZKLhEqRTZZMwk1fqIo8RCxqdjDq1tYsPDjxHwUd3wTfDxPx4 XBel2rnHLpq8A47neBicRN69wlAl95mvEjU3/E5M+Efwe7NFlSnJ/8IPQRqfGqUzmJLC T4rg== X-Gm-Message-State: AFuF++kyc9wgfq3i0DspGdYK9FBORiv3EVwpAIStJwZ+e8zjslxJwQ1n kZTYvwd23Fhrvaq+ignAIcmbI+RPW87EY5aL1jQtRkTojj0A3tKRp4uE8zzcAAud X-Gm-Gg: AYBFou2EA+6q9dmcIe+iSKea/h2kRbfB+bF2ljT3AzBThpTALjt2y1lKLmPBhuyJ6dV yny9Kxl5mT456fWL082AESBM0+bk7PS4tm1AIvZdjX+VmXMfdjjGmA/vPA4d8QpHGsU5xDqmfz0 O0OFTGJaz6RSR4P56jIolXbz6ldO1PxfStaD+1Ie3CuKwLIG1BkqKGmBeKX8s5d+B+rCiHL8byZ gXnsHpfRhnHzeIY9RiBcTX5nueeHK6aznPeFCba+dyC7TxCqRrRy2BDXtHuenEjKTExErxYDRNo vpXoLu/tXm8gMAjWYUlVmNWtW/9yO5zyivKI/jHLkA+uGK0PpGeybR/btcm1DKFtyC5W8uBVeUR bQnM63B6DpEP2OqH7+L4sGwiVxUl1LSDGYi/BF87UyQeQunbMTcgJL8n9d3/SvMfCGCjGpfPzE/ k1CY+VovKDKnmcTf/3K5WSUwmQe/lFHEbPtt2ZceStnVf9yFdSXjD1Bjf/M33rudcCCRKLJ0qz5 l4wGEimwO4/ybGT2OtDas3nlBOA7Ng4LlIVjzaD6V3ijtvR/NsN8mZrNOYqzPFhfgA= X-Received: by 2002:a05:600d:8496:10b0:4a1:7dcf:be1f with SMTP id 5b1f17b1804b1-4a17dcfbe6fmr3211295e9.1.1791292976157; Tue, 06 Oct 2026 06:22:56 -0700 (PDT) Received: from thomas-precision3591.paris.inria.fr (wifi-pro-83-149.paris.inria.fr. [128.93.83.149]) by smtp.googlemail.com with ESMTPSA id ffacd0b85a97d-48c622bb172sm22504751f8f.42.2026.10.06.06.22.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Oct 2026 06:22:55 -0700 (PDT) From: Thomas Fourier To: Dan Carpenter Cc: smatch@vger.kernel.org, Thomas Fourier Subject: [PATCH smatch] Add safety checks in various modules Date: Tue, 6 Oct 2026 15:20:40 +0200 Message-ID: <20261006132038.42445-3-fourier.thomas@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: smatch@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When running Smatch on Linux, there were a number of crashes due to segmentation faults, mostly because of null-pointer dereference. Add safety checks to prevent the crashes. --- check_return.c | 2 +- expression.h | 1 + smatch_conditions.c | 2 ++ smatch_helper.c | 4 ++++ smatch_math.c | 5 +++++ smatch_type.c | 4 +++- symbol.h | 3 +++ 7 files changed, 19 insertions(+), 2 deletions(-) diff --git a/check_return.c b/check_return.c index babc452d..d9c11ee5 100644 --- a/check_return.c +++ b/check_return.c @@ -24,7 +24,7 @@ static void must_check(const char *fn, struct expression *expr, void *data) struct statement *stmt; stmt = last_ptr_list((struct ptr_list *)big_statement_stack); - if (stmt->type == STMT_EXPRESSION && stmt->expression == expr) + if (stmt && stmt->type == STMT_EXPRESSION && stmt->expression == expr) sm_warning("unchecked '%s'", fn); } diff --git a/expression.h b/expression.h index 165d5a0c..53539f15 100644 --- a/expression.h +++ b/expression.h @@ -65,6 +65,7 @@ enum expression_type { EXPR_SLICE, EXPR_OFFSETOF, EXPR_GENERIC, + NUM_EXPRESSION }; diff --git a/smatch_conditions.c b/smatch_conditions.c index ad86a01a..3ed83f03 100644 --- a/smatch_conditions.c +++ b/smatch_conditions.c @@ -933,6 +933,8 @@ int __handle_expr_statement_assigns(struct expression *expr) struct statement *stmt; right = strip_expr_cast(expr->right, &cast); + if (!right) + return 0; if (right->type == EXPR_PREOP && right->op == '(') right = right->unop; if (right->type != EXPR_STATEMENT) diff --git a/smatch_helper.c b/smatch_helper.c index ccea1bca..deb54d7e 100644 --- a/smatch_helper.c +++ b/smatch_helper.c @@ -1016,6 +1016,10 @@ struct expression *strip_expr_cast(struct expression *expr, struct expression ** ret = strip_no_cast(expr); while (ret && (ret->type == EXPR_CAST || ret->type == EXPR_FORCE_CAST)) { new = cast_expression(ret->cast_expression, ret->cast_type); + + if (!new) + return ret; + new->cast_expression = NULL; if (!last) *cast = new; diff --git a/smatch_math.c b/smatch_math.c index ecb911a2..f5e88bdd 100644 --- a/smatch_math.c +++ b/smatch_math.c @@ -69,6 +69,8 @@ static bool last_stmt_rl(struct statement *stmt, int implied, int *recurse_cnt, return false; stmt = last_ptr_list((struct ptr_list *)stmt->stmts); + if (!stmt) + return false; if (stmt->type == STMT_LABEL) { if (stmt->label_statement && stmt->label_statement->type == STMT_EXPRESSION) @@ -1979,6 +1981,9 @@ int get_value(struct expression *expr, sval_t *res_sval) sval_t sval = {}; int i; + if (!expr || expr->type >= NUM_EXPRESSION) + return 0; + if (get_value_literal(expr, res_sval)) return 1; diff --git a/smatch_type.c b/smatch_type.c index f660081b..13271545 100644 --- a/smatch_type.c +++ b/smatch_type.c @@ -221,9 +221,11 @@ static struct symbol *get_return_type(struct expression *expr) static struct symbol *get_expr_stmt_type(struct statement *stmt) { - if (stmt->type != STMT_COMPOUND) + if (!stmt || stmt->type != STMT_COMPOUND) return NULL; stmt = last_ptr_list((struct ptr_list *)stmt->stmts); + if (!stmt) + return NULL; if (stmt->type == STMT_LABEL) stmt = stmt->label_statement; if (stmt->type != STMT_EXPRESSION) diff --git a/symbol.h b/symbol.h index 3c0ad0d7..937359bb 100644 --- a/symbol.h +++ b/symbol.h @@ -380,6 +380,9 @@ static inline int valid_type(const struct symbol *ctype) static inline struct symbol *get_base_type(const struct symbol *sym) { + if (!sym) + return NULL; + return examine_symbol_type(sym->ctype.base_type); } -- 2.43.0