1*4882a593Smuzhiyun// SPDX-License-Identifier: GPL-2.0-only 2*4882a593Smuzhiyun/// Unsigned expressions cannot be lesser than zero. Presence of 3*4882a593Smuzhiyun/// comparisons 'unsigned (<|<=|>|>=) 0' often indicates a bug, 4*4882a593Smuzhiyun/// usually wrong type of variable. 5*4882a593Smuzhiyun/// 6*4882a593Smuzhiyun/// To reduce number of false positives following tests have been added: 7*4882a593Smuzhiyun/// - parts of range checks are skipped, eg. "if (u < 0 || u > 15) ...", 8*4882a593Smuzhiyun/// developers prefer to keep such code, 9*4882a593Smuzhiyun/// - comparisons "<= 0" and "> 0" are performed only on results of 10*4882a593Smuzhiyun/// signed functions/macros, 11*4882a593Smuzhiyun/// - hardcoded list of signed functions/macros with always non-negative 12*4882a593Smuzhiyun/// result is used to avoid false positives difficult to detect by other ways 13*4882a593Smuzhiyun/// 14*4882a593Smuzhiyun// Confidence: Average 15*4882a593Smuzhiyun// Copyright: (C) 2015 Andrzej Hajda, Samsung Electronics Co., Ltd. 16*4882a593Smuzhiyun// URL: http://coccinelle.lip6.fr/ 17*4882a593Smuzhiyun// Options: --all-includes 18*4882a593Smuzhiyun 19*4882a593Smuzhiyunvirtual context 20*4882a593Smuzhiyunvirtual org 21*4882a593Smuzhiyunvirtual report 22*4882a593Smuzhiyun 23*4882a593Smuzhiyun@r_cmp@ 24*4882a593Smuzhiyunposition p; 25*4882a593Smuzhiyuntypedef bool, u8, u16, u32, u64; 26*4882a593Smuzhiyun{unsigned char, unsigned short, unsigned int, unsigned long, unsigned long long, 27*4882a593Smuzhiyun size_t, bool, u8, u16, u32, u64} v; 28*4882a593Smuzhiyunexpression e; 29*4882a593Smuzhiyun@@ 30*4882a593Smuzhiyun 31*4882a593Smuzhiyun \( v = e \| &v \) 32*4882a593Smuzhiyun ... 33*4882a593Smuzhiyun (\( v@p < 0 \| v@p <= 0 \| v@p >= 0 \| v@p > 0 \)) 34*4882a593Smuzhiyun 35*4882a593Smuzhiyun@r@ 36*4882a593Smuzhiyunposition r_cmp.p; 37*4882a593Smuzhiyuntypedef s8, s16, s32, s64; 38*4882a593Smuzhiyun{char, short, int, long, long long, ssize_t, s8, s16, s32, s64} vs; 39*4882a593Smuzhiyunexpression c, e, v; 40*4882a593Smuzhiyunidentifier f !~ "^(ata_id_queue_depth|btrfs_copy_from_user|dma_map_sg|dma_map_sg_attrs|fls|fls64|gameport_time|get_write_extents|nla_len|ntoh24|of_flat_dt_match|of_get_child_count|uart_circ_chars_pending|[A-Z0-9_]+)$"; 41*4882a593Smuzhiyun@@ 42*4882a593Smuzhiyun 43*4882a593Smuzhiyun( 44*4882a593Smuzhiyun v = f(...)@vs; 45*4882a593Smuzhiyun ... when != v = e; 46*4882a593Smuzhiyun* (\( v@p <=@e 0 \| v@p >@e 0 \)) 47*4882a593Smuzhiyun ... when any 48*4882a593Smuzhiyun| 49*4882a593Smuzhiyun( 50*4882a593Smuzhiyun (\( v@p < 0 \| v@p <= 0 \)) || ... || (\( v >= c \| v > c \)) 51*4882a593Smuzhiyun| 52*4882a593Smuzhiyun (\( v >= c \| v > c \)) || ... || (\( v@p < 0 \| v@p <= 0 \)) 53*4882a593Smuzhiyun| 54*4882a593Smuzhiyun (\( v@p >= 0 \| v@p > 0 \)) && ... && (\( v < c \| v <= c \)) 55*4882a593Smuzhiyun| 56*4882a593Smuzhiyun ((\( v < c \| v <= c \) && ... && \( v@p >= 0 \| v@p > 0 \))) 57*4882a593Smuzhiyun| 58*4882a593Smuzhiyun* (\( v@p <@e 0 \| v@p >=@e 0 \)) 59*4882a593Smuzhiyun) 60*4882a593Smuzhiyun) 61*4882a593Smuzhiyun 62*4882a593Smuzhiyun@script:python depends on org@ 63*4882a593Smuzhiyunp << r_cmp.p; 64*4882a593Smuzhiyune << r.e; 65*4882a593Smuzhiyun@@ 66*4882a593Smuzhiyun 67*4882a593Smuzhiyunmsg = "WARNING: Unsigned expression compared with zero: %s" % (e) 68*4882a593Smuzhiyuncoccilib.org.print_todo(p[0], msg) 69*4882a593Smuzhiyun 70*4882a593Smuzhiyun@script:python depends on report@ 71*4882a593Smuzhiyunp << r_cmp.p; 72*4882a593Smuzhiyune << r.e; 73*4882a593Smuzhiyun@@ 74*4882a593Smuzhiyun 75*4882a593Smuzhiyunmsg = "WARNING: Unsigned expression compared with zero: %s" % (e) 76*4882a593Smuzhiyuncoccilib.report.print_report(p[0], msg) 77