2 * Copyright (C) 2017 Oracle. All rights reserved.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * One problem that I have is that it's really hard to track how pointers are
20 * passed around. For example, it would be nice to know that the probe() and
21 * remove() functions get the same pci_dev pointer. It would be good to know
22 * what pointers we're passing to the open() and close() functions. But that
23 * information gets lost in a call tree full of function pointer calls.
25 * I think the first step is to start naming specific pointers. So when a
26 * pointer is allocated, then it gets a tag. So calls to kmalloc() generate a
27 * tag. But we might not use that, because there might be a better name like
28 * framebuffer_alloc(). The framebuffer_alloc() is interesting because there is
29 * one per driver and it's passed around to all the file operations.
31 * Perhaps we could make a list of functions like framebuffer_alloc() which take
32 * a size and say that those are the interesting alloc functions.
34 * Another place where we would maybe name the pointer is when they are passed
35 * to the probe(). Because that's an important pointer, since there is one
36 * per driver (sort of).
38 * My vision is that you could take a pointer and trace it back to a global. So
39 * I'm going to track that pointer_tag - 28 bytes takes you to another pointer
40 * tag. You could follow that one back and so on. Also when we pass a pointer
41 * to a function that would be recorded as sort of a link or path or something.
46 #include "smatch_slist.h"
47 #include "smatch_extra.h"
49 #include <openssl/md5.h>
53 static struct smatch_state
*alloc_tag_state(mtag_t tag
)
55 struct smatch_state
*state
;
58 state
= __alloc_smatch_state(0);
59 snprintf(buf
, sizeof(buf
), "%lld", tag
);
60 state
->name
= alloc_sname(buf
);
61 state
->data
= malloc(sizeof(mtag_t
));
62 *(mtag_t
*)state
->data
= tag
;
67 static mtag_t
str_to_tag(const char *str
)
69 unsigned char c
[MD5_DIGEST_LENGTH
];
70 unsigned long long *tag
= (unsigned long long *)&c
;
76 MD5_Update(&mdContext
, str
, len
);
77 MD5_Final(c
, &mdContext
);
79 *tag
&= ~(1ULL << 63);
84 static void alloc_assign(const char *fn
, struct expression
*expr
, void *unused
)
86 struct expression
*left
, *right
;
87 char *left_name
, *right_name
;
88 struct symbol
*left_sym
;
92 if (expr
->type
!= EXPR_ASSIGNMENT
|| expr
->op
!= '=')
94 left
= strip_expr(expr
->left
);
95 right
= strip_expr(expr
->right
);
96 if (right
->type
!= EXPR_CALL
|| right
->fn
->type
!= EXPR_SYMBOL
)
99 left_name
= expr_to_str_sym(left
, &left_sym
);
100 right_name
= expr_to_str(right
);
102 snprintf(buf
, sizeof(buf
), "%s %s %s %s", get_filename(), get_function(),
103 left_name
, right_name
);
104 tag
= str_to_tag(buf
);
106 sql_insert_mtag_about(tag
, left_name
, right_name
);
108 if (left_name
&& left_sym
)
109 set_state(my_id
, left_name
, left_sym
, alloc_tag_state(tag
));
111 free_string(left_name
);
112 free_string(right_name
);
115 int get_toplevel_mtag(struct symbol
*sym
, mtag_t
*tag
)
123 !(sym
->ctype
.modifiers
& MOD_TOPLEVEL
))
126 snprintf(buf
, sizeof(buf
), "%s %s",
127 (sym
->ctype
.modifiers
& MOD_STATIC
) ? get_filename() : "extern",
129 *tag
= str_to_tag(buf
);
133 int get_deref_mtag(struct expression
*expr
, mtag_t
*tag
)
135 mtag_t container_tag
, member_tag
;
139 * I'm not totally sure what I'm doing...
141 * This is supposed to get something like "global_var->ptr", but I don't
142 * feel like it's complete at all.
146 if (!get_mtag(expr
->unop
, &container_tag
))
149 offset
= get_member_offset_from_deref(expr
);
153 if (!mtag_map_select_tag(container_tag
, -offset
, &member_tag
))
160 static void global_variable(struct symbol
*sym
)
164 if (!get_toplevel_mtag(sym
, &tag
))
167 sql_insert_mtag_about(tag
,
169 (sym
->ctype
.modifiers
& MOD_STATIC
) ? get_filename() : "extern");
172 static void db_returns_buf_size(struct expression
*expr
, int param
, char *unused
, char *math
)
174 struct expression
*call
;
175 struct range_list
*rl
;
177 if (expr
->type
!= EXPR_ASSIGNMENT
)
179 call
= strip_expr(expr
->right
);
181 if (!parse_call_math_rl(call
, math
, &rl
))
183 // rl = cast_rl(&int_ctype, rl);
184 // set_state_expr(my_size_id, expr->left, alloc_estate_rl(rl));
187 static void db_returns_memory_tag(struct expression
*expr
, int param
, char *key
, char *value
)
189 struct expression
*call
, *arg
;
194 call
= strip_expr(expr
);
195 while (call
->type
== EXPR_ASSIGNMENT
)
196 call
= strip_expr(call
->right
);
197 if (call
->type
!= EXPR_CALL
)
200 tag
= strtoul(value
, NULL
, 10);
202 if (!create_mtag_alias(tag
, call
, &alias
))
205 arg
= get_argument_from_call_expr(call
->args
, param
);
209 name
= get_variable_from_key(arg
, key
, &sym
);
213 set_state(my_id
, name
, sym
, alloc_tag_state(alias
));
218 static void match_call_info(struct expression
*expr
)
220 struct smatch_state
*state
;
221 struct expression
*arg
;
224 FOR_EACH_PTR(expr
->args
, arg
) {
226 state
= get_state_expr(my_id
, arg
);
227 if (!state
|| !state
->data
)
229 sql_insert_caller_info(expr
, MEMORY_TAG
, i
, "$", state
->name
);
230 } END_FOR_EACH_PTR(arg
);
233 static void save_caller_info(const char *name
, struct symbol
*sym
, char *key
, char *value
)
235 struct smatch_state
*state
;
239 if (strncmp(key
, "$", 1) != 0)
243 snprintf(fullname
, 256, "%s%s", name
, key
+ 1);
244 state
= alloc_tag_state(tag
);
245 set_state(my_id
, fullname
, sym
, state
);
248 static int get_array_mtag(struct expression
*expr
, mtag_t
*tag
)
250 struct expression
*base
, *offset
;
258 base
= get_array_base(expr
);
261 offset
= get_array_offset(expr
);
265 if (!get_implied_value(offset
, &sval
))
268 if (!get_mtag(base
, &base_tag
))
271 snprintf(buf
, sizeof(buf
), "%lld + %lld", base_tag
, sval
.value
);
272 *tag
= str_to_tag(buf
);
277 static int get_mtag_cnt
;
278 int get_mtag(struct expression
*expr
, mtag_t
*tag
)
280 struct smatch_state
*state
;
283 expr
= strip_expr(expr
);
287 if (get_mtag_cnt
> 0)
292 /* FIXME: This doesn't feel like the right thing at all */
293 if (expr
->type
== EXPR_PREOP
) {
295 expr
= strip_expr(expr
->unop
);
297 expr
= strip_expr(expr
->unop
);
300 switch (expr
->type
) {
302 if (get_toplevel_mtag(expr
->symbol
, tag
)) {
308 if (get_deref_mtag(expr
, tag
)) {
314 ret
= get_array_mtag(expr
, tag
);
318 state
= get_state_expr(my_id
, expr
);
322 *tag
= *(mtag_t
*)state
->data
;
332 int get_mtag_offset(struct expression
*expr
)
336 expr
= strip_expr(expr
);
337 if (expr
->type
== EXPR_SYMBOL
)
339 return get_member_offset_from_deref(expr
);
342 int create_mtag_alias(mtag_t tag
, struct expression
*expr
, mtag_t
*new)
345 int lines_from_start
;
349 * We need the alias to be unique. It's not totally required that it
350 * be the same from one DB build to then next, but it makes debugging
358 lines_from_start
= expr
->pos
.line
- cur_func_sym
->pos
.line
;
359 str
= expr_to_str(expr
);
360 snprintf(buf
, sizeof(buf
), "%lld %d %s", tag
, lines_from_start
, str
);
363 *new = str_to_tag(buf
);
364 sql_insert_mtag_alias(tag
, *new);
369 int expr_to_mtag_name_offset(struct expression
*expr
, mtag_t
*tag
, char **name
, int *offset
)
371 static char buf
[256];
376 expr
= strip_expr(expr
);
380 if (expr
->type
== EXPR_DEREF
) {
381 *offset
= get_member_offset_from_deref(expr
);
384 snprintf(buf
, sizeof(buf
), "$->%s", expr
->member
->name
);
386 return get_mtag(expr
->deref
, tag
);
389 snprintf(buf
, sizeof(buf
), "*$");
392 return get_mtag(expr
, tag
);
395 static void print_stored_to_mtag(int return_id
, char *return_ranges
, struct expression
*expr
)
399 const char *param_name
;
402 FOR_EACH_MY_SM(my_id
, __get_cur_stree(), sm
) {
403 if (!sm
->state
->data
)
406 param
= get_param_num_from_sym(sm
->sym
);
409 param_name
= get_param_name(sm
);
412 if (strcmp(param_name
, "$") == 0)
415 snprintf(buf
, sizeof(buf
), "%lld", *(mtag_t
*)sm
->state
->data
);
416 sql_insert_return_states(return_id
, return_ranges
, MEMORY_TAG
, param
, param_name
, buf
);
417 } END_FOR_EACH_SM(sm
);
420 void register_mtag(int id
)
424 add_hook(&global_variable
, BASE_HOOK
);
426 add_function_assign_hook("kmalloc", &alloc_assign
, NULL
);
427 add_function_assign_hook("kzalloc", &alloc_assign
, NULL
);
429 select_return_states_hook(BUF_SIZE
, &db_returns_buf_size
);
431 add_hook(&match_call_info
, FUNCTION_CALL_HOOK
);
432 select_caller_info_hook(save_caller_info
, MEMORY_TAG
);
433 add_split_return_callback(&print_stored_to_mtag
);
434 select_return_states_hook(MEMORY_TAG
, db_returns_memory_tag
);