2 * Copyright (C) 2017 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 #include "smatch_slist.h"
20 #include "smatch_extra.h"
25 static struct stree
*used_stree
;
26 static struct stree_stack
*saved_stack
;
30 int get_param_from_container_of(struct expression
*expr
)
32 struct expression
*param_expr
;
38 type
= get_type(expr
);
39 if (!type
|| type
->type
!= SYM_PTR
)
42 expr
= strip_expr(expr
);
43 if (expr
->type
!= EXPR_BINOP
|| expr
->op
!= '-')
46 if (!get_value(expr
->right
, &sval
))
48 if (sval
.value
< 0 || sval
.value
> 4096)
51 param_expr
= get_assigned_expr(expr
->left
);
54 param
= get_param_num(param_expr
);
61 int get_offset_from_container_of(struct expression
*expr
)
63 struct expression
*param_expr
;
67 type
= get_type(expr
);
68 if (!type
|| type
->type
!= SYM_PTR
)
71 expr
= strip_expr(expr
);
72 if (expr
->type
!= EXPR_BINOP
|| expr
->op
!= '-')
75 if (!get_value(expr
->right
, &sval
))
77 if (sval
.value
< 0 || sval
.value
> 4096)
80 param_expr
= get_assigned_expr(expr
->left
);
87 static int get_container_arg(struct symbol
*sym
)
89 struct expression
*__mptr
;
92 if (!sym
|| !sym
->ident
)
95 __mptr
= get_assigned_expr_name_sym(sym
->ident
->name
, sym
);
96 param
= get_param_from_container_of(__mptr
);
101 static int get_container_offset(struct symbol
*sym
)
103 struct expression
*__mptr
;
106 if (!sym
|| !sym
->ident
)
109 __mptr
= get_assigned_expr_name_sym(sym
->ident
->name
, sym
);
110 offset
= get_offset_from_container_of(__mptr
);
115 static char *get_container_name(struct sm_state
*sm
, int offset
)
117 static char buf
[256];
120 name
= get_param_name(sm
);
125 snprintf(buf
, sizeof(buf
), "$(-%d)%s", offset
, name
+ 1);
126 else if (name
[0] == '*' || name
[1] == '$')
127 snprintf(buf
, sizeof(buf
), "*$(-%d)%s", offset
, name
+ 2);
134 static void get_state_hook(int owner
, const char *name
, struct symbol
*sym
)
140 if (__in_fake_assign
)
143 arg
= get_container_arg(sym
);
145 set_state_stree(&used_stree
, my_id
, name
, sym
, &used
);
148 static void set_param_used(struct expression
*call
, struct expression
*arg
, char *key
, char *unused
)
154 name
= get_variable_from_key(arg
, key
, &sym
);
158 arg_nr
= get_container_arg(sym
);
160 set_state(my_id
, name
, sym
, &used
);
165 static void process_states(void)
167 struct sm_state
*tmp
;
171 FOR_EACH_SM(used_stree
, tmp
) {
172 arg
= get_container_arg(tmp
->sym
);
173 offset
= get_container_offset(tmp
->sym
);
174 if (arg
< 0 || offset
< 0)
176 name
= get_container_name(tmp
, offset
);
179 sql_insert_call_implies(CONTAINER
, arg
, name
, "");
180 } END_FOR_EACH_SM(tmp
);
182 free_stree(&used_stree
);
185 static void match_function_def(struct symbol
*sym
)
187 free_stree(&used_stree
);
190 static void match_save_states(struct expression
*expr
)
192 push_stree(&saved_stack
, used_stree
);
196 static void match_restore_states(struct expression
*expr
)
198 free_stree(&used_stree
);
199 used_stree
= pop_stree(&saved_stack
);
202 static void print_returns_container_of(int return_id
, char *return_ranges
, struct expression
*expr
)
209 param
= get_param_from_container_of(expr
);
212 offset
= get_offset_from_container_of(expr
);
216 snprintf(key
, sizeof(key
), "%d", param
);
217 snprintf(value
, sizeof(value
), "-%d", offset
);
219 /* no need to add it to call_implies because it's not really param_used */
220 sql_insert_return_states(return_id
, return_ranges
, CONTAINER
, -1,
224 static void returns_container_of(struct expression
*expr
, int param
, char *key
, char *value
)
226 struct expression
*call
, *arg
;
230 if (expr
->type
!= EXPR_ASSIGNMENT
|| expr
->op
!= '=')
232 call
= strip_expr(expr
->right
);
233 if (call
->type
!= EXPR_CALL
)
238 offset
= atoi(value
);
240 arg
= get_argument_from_call_expr(call
->args
, param
);
243 if (arg
->type
!= EXPR_SYMBOL
)
245 param
= get_param_num(arg
);
248 snprintf(buf
, sizeof(buf
), "$(%d)", offset
);
249 sql_insert_call_implies(CONTAINER
, param
, buf
, "");
252 static struct expression
*get_outer_struct(struct expression
*expr
)
254 expr
= strip_expr(expr
);
256 if (expr
->type
!= EXPR_DEREF
)
258 expr
= strip_expr(expr
->deref
);
259 if (expr
->type
== EXPR_SYMBOL
)
261 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '*')
262 return strip_expr(expr
->unop
);
266 static void match_call(struct expression
*call
)
268 struct expression
*fn_ptr
, *fn_parent
, *arg
, *arg_parent
;
269 struct symbol
*fn_sym
, *arg_sym
;
280 * We're trying to link the function with the parameter. There are a
281 * couple ways this can be passed:
282 * foo->func(foo, ...);
283 * foo->func(foo->x, ...);
284 * foo->bar.func(&foo->bar, ...);
285 * foo->bar->baz->func(foo, ...);
287 * So the method is basically to subtract the offsets until we get to
288 * the common bit, then the member offsets for the parameter.
290 * If the argument is not a pointer then we star it. This is perhaps
291 * not right. We should probably be treating addresses of a pointer
292 * different from the pointer value.
295 fn_ptr
= strip_expr(call
->fn
);
296 fn_parent
= get_outer_struct(fn_ptr
);
299 fn_sym
= expr_to_sym(fn_parent
);
303 type
= get_type(fn_parent
);
304 if (type
&& type
->type
== SYM_PTR
)
305 type
= get_real_base_type(type
);
306 offset
= get_member_offset(type
, fn_ptr
->member
->name
);
311 FOR_EACH_PTR(call
->args
, arg
) {
316 * This doesn't work because of things like:
318 * foo->func(foo, ...);
319 * We don't want to use "bar" here. But also perhaps I should
320 * be changing the short names to long names or something?
324 while ((tmp
= get_assigned_expr(arg
))) {
325 arg
= strip_expr(tmp
);
330 arg_sym
= expr_to_sym(arg
);
333 if (arg_sym
!= fn_sym
)
337 * We know these are related because arg_sym == fn_sym.
338 * If we don't record something in the DB, that is a failure.
342 if (arg
->type
== EXPR_PREOP
&& arg
->op
== '&')
343 arg
= strip_expr(arg
->unop
);
345 if (expr_equiv(arg
, fn_parent
)) {
346 snprintf(parent_str
, sizeof(parent_str
), "-%d", offset
);
351 while ((arg_parent
= get_outer_struct(arg
))) {
354 p
+= snprintf(p
, parent_str
+ sizeof(parent_str
) - p
, "-%d", offset
);
356 if (!expr_equiv(arg
, fn_parent
))
358 arg_offset
= get_member_offset_from_deref(arg
);
361 if (!is_pointer(arg
))
365 } END_FOR_EACH_PTR(arg
);
371 snprintf(offset_str
, sizeof(offset_str
), "*(%s+%d)", parent_str
, arg_offset
);
373 snprintf(offset_str
, sizeof(offset_str
), "%s+%d", parent_str
, arg_offset
);
374 snprintf(param_str
, sizeof(param_str
), "$%d", i
);
375 sql_insert_caller_info(call
, CONTAINER
, -1, offset_str
, param_str
);
378 static void db_passed_container(const char *name
, struct symbol
*sym
, char *key
, char *value
)
383 const char *arg_offset
;
398 if (val
< -4095 || val
>= 0)
401 arg_offset
= strchr(key
, '+');
404 val
= atoi(arg_offset
+ 1);
405 if (val
> 4095 || val
< 0)
407 offset
.value
|= val
<< 16;
409 offset
.value
|= 1ULL << 31;
414 param
= atoi(value
+ 1);
417 FOR_EACH_PTR(cur_func_sym
->ctype
.base_type
->arguments
, arg
) {
420 set_state(param_id
, arg
->ident
->name
, arg
, alloc_estate_sval(offset
));
421 } END_FOR_EACH_PTR(arg
);
425 struct symbol
*param_sym
;
427 struct range_list
*rl
;
430 static struct symbol
*get_member_from_offset(struct symbol
*sym
, int offset
)
432 struct symbol
*type
, *tmp
;
435 type
= get_real_base_type(sym
);
436 if (!type
|| type
->type
!= SYM_PTR
)
438 type
= get_real_base_type(type
);
439 if (!type
|| type
->type
!= SYM_STRUCT
)
443 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
444 cur
= ALIGN(cur
, tmp
->ctype
.alignment
);
447 cur
+= type_bytes(tmp
);
448 } END_FOR_EACH_PTR(tmp
);
452 static struct symbol
*get_member_type_from_offset(struct symbol
*sym
, int offset
)
454 struct symbol
*member
;
456 member
= get_member_from_offset(sym
, offset
);
459 return get_real_base_type(member
);
462 static void set_param_value(struct symbol
*sym
, int offset
, struct range_list
*rl
)
464 struct symbol
*member
;
468 if (!sym
|| !sym
->ident
)
470 name
= sym
->ident
->name
;
472 member
= get_member_from_offset(sym
, offset
);
475 snprintf(fullname
, sizeof(fullname
), "%s", name
);
479 snprintf(fullname
, sizeof(fullname
), "%s->%s", name
, member
->ident
->name
);
482 set_state(SMATCH_EXTRA
, fullname
, sym
, alloc_estate_rl(rl
));
485 static int save_vals(void *_db_info
, int argc
, char **argv
, char **azColName
)
487 struct db_info
*db_info
= _db_info
;
489 struct range_list
*rl
;
494 offset
= atoi(argv
[0]);
500 if (db_info
->prev_offset
!= -1 &&
501 db_info
->prev_offset
!= offset
) {
502 set_param_value(db_info
->param_sym
, db_info
->prev_offset
, db_info
->rl
);
506 db_info
->prev_offset
= offset
;
508 type
= get_member_type_from_offset(db_info
->param_sym
, offset
);
509 str_to_rl(type
, (char *)value
, &rl
);
511 db_info
->rl
= rl_union(db_info
->rl
, rl
);
518 static void load_tag_info_sym(mtag_t tag
, struct symbol
*sym
, int arg_offset
, int star
)
520 struct db_info db_info
= {
529 run_sql(save_vals
, &db_info
,
530 "select value from mtag_data where tag = %lld and offset = %d and type = %d;",
531 tag
, arg_offset
, DATA_VALUE
);
533 run_sql(save_vals
, &db_info
,
534 "select offset, value from mtag_data where tag = %lld and type = %d;",
538 if (db_info
.prev_offset
!= -1)
539 set_param_value(db_info
.param_sym
, db_info
.prev_offset
, db_info
.rl
);
542 static void handle_passed_container(struct symbol
*sym
)
545 struct smatch_state
*state
;
546 mtag_t fn_tag
, container_tag
, arg_tag
;
548 int container_offset
, arg_offset
;
551 FOR_EACH_PTR(cur_func_sym
->ctype
.base_type
->arguments
, arg
) {
552 state
= get_state(param_id
, arg
->ident
->name
, arg
);
555 } END_FOR_EACH_PTR(arg
);
559 if (!estate_get_single_value(state
, &offset
))
561 container_offset
= -(offset
.value
& 0xffff);
562 arg_offset
= -((offset
.value
& 0xfff0000) >> 16);
563 star
= !!(offset
.value
& (1ULL << 31));
565 if (!get_toplevel_mtag(cur_func_sym
, &fn_tag
))
567 if (!mtag_map_select_container(fn_tag
, container_offset
, &container_tag
))
569 if (!arg_offset
|| star
) {
570 arg_tag
= container_tag
;
572 if (!mtag_map_select_tag(container_tag
, arg_offset
, &arg_tag
))
576 load_tag_info_sym(arg_tag
, arg
, -arg_offset
, star
);
579 void register_container_of(int id
)
583 add_hook(&match_function_def
, FUNC_DEF_HOOK
);
585 add_get_state_hook(&get_state_hook
);
587 add_hook(&match_save_states
, INLINE_FN_START
);
588 add_hook(&match_restore_states
, INLINE_FN_END
);
590 select_call_implies_hook(CONTAINER
, &set_param_used
);
591 all_return_states_hook(&process_states
);
593 add_split_return_callback(&print_returns_container_of
);
594 select_return_states_hook(CONTAINER
, &returns_container_of
);
596 add_hook(&match_call
, FUNCTION_CALL_HOOK
);
599 static struct smatch_state
*unmatched_state(struct sm_state
*sm
)
601 return alloc_estate_whole(estate_type(sm
->state
));
604 void register_container_of2(int id
)
608 select_caller_info_hook(db_passed_container
, CONTAINER
);
609 add_hook(&handle_passed_container
, AFTER_DEF_HOOK
);
610 add_unmatched_state_hook(param_id
, &unmatched_state
);
611 add_merge_hook(param_id
, &merge_estates
);