xref: /illumos-gate/usr/src/tools/smatch/src/validation/sm_rosenberg.c (revision 1f5207b7604fb44407eb4342aff613f7c4508508)
1 #include "check_debug.h"
2 
memset(void * ptr,char c,int size)3 void memset(void *ptr, char c, int size){}
4 
copy_to_user(void * dest,void * data,int size)5 int copy_to_user(void *dest, void *data, int size){}
some_func(struct foo * p)6 int some_func(struct foo *p){}
7 
8 typedef struct zr364xx_pipeinfo {
9 	char x;
10 	int y;
11 } aa_policy_t;
12 
13 struct aa_policy {
14 	int x;
15 };
16 
17 struct foo {
18 	struct aa_policy a;
19 	int x;
20 	int y;
21 };
22 
23 struct foo *p;
24 struct foo global_dec;
25 void *ptr;
26 
main(void)27 int main(void)
28 {
29 	struct zr364xx_pipeinfo one;
30 	struct aa_policy two;
31 	aa_policy_t three;
32 	struct foo four;
33 	struct foo five;
34 	struct foo six;
35 	struct foo seven;
36 	struct foo eight;
37 	struct foo nine;
38 
39 	p->a.x = 0;
40 	global_dec.x = 0;
41 	memset(&two, 0, sizeof(two));
42 	four.x = 0;
43 	six = five;
44 	some_func(&seven);
45 	eight.x = (four.x < 5 ? four.x : 5);
46 	eight.y = !five.y;
47 	if (some_func()) {
48 		nine.x = 1;
49 		nine.y = 2;
50 	}
51 
52 	copy_to_user(ptr, &p->a, sizeof(struct aa_policy));
53 	copy_to_user(ptr, &global_dec, sizeof(global_dec));
54 	copy_to_user(ptr, &one, sizeof(one));
55 	copy_to_user(ptr, &two, sizeof(two));
56 	copy_to_user(ptr, &three, sizeof(three));
57 	copy_to_user(ptr, &four, sizeof(four));
58 	copy_to_user(ptr, &five, sizeof(five));
59 	copy_to_user(ptr, &six, sizeof(six));
60 	copy_to_user(ptr, &seven, sizeof(seven));
61 	copy_to_user(ptr, &eight, sizeof(eight));
62 	copy_to_user(ptr, &nine, sizeof(nine));
63 	return 0;
64 }
65 /*
66  * check-name: Rosenberg Leaks
67  * check-command: smatch -p=kernel -I.. sm_rosenberg.c
68  *
69  * check-output-start
70 sm_rosenberg.c:54 main() warn: check that 'one' doesn't leak information (struct has a hole after 'x')
71 sm_rosenberg.c:56 main() warn: check that 'three' doesn't leak information (struct has a hole after 'x')
72 sm_rosenberg.c:57 main() warn: check that 'four.y' doesn't leak information
73 sm_rosenberg.c:62 main() warn: check that 'nine.x' doesn't leak information
74  * check-output-end
75  */
76