smatch_buf_size.c

   1 /*
   2  * smatch/smatch_buf_size.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 #include <stdlib.h>
  11 #include <errno.h>
  12 #include "parse.h"
  13 #include "smatch.h"
  14 #include "smatch_slist.h"
  15 #include "smatch_extra.h"
  16
  17 /*
  18  * This check has two smatch IDs.
  19  * my_size_id - used to store the size of arrays.
  20  * my_strlen_id - track the strlen() of buffers.
  21  */
  22
  23 static int my_size_id;
  24 static int my_strlen_id;
  25
  26 struct limiter {
  27         int buf_arg;
  28         int limit_arg;
  29 };
  30 static struct limiter b0_l2 = {0, 2};
  31
  32 static _Bool params_set[32];
  33
  34 void set_param_buf_size(const char *name, struct symbol *sym, char *key, char *value)
  35 {
  36         char fullname[256];
  37         unsigned int size;
  38
  39         if (strncmp(key, "$$", 2))
  40                 return;
  41
  42         snprintf(fullname, 256, "%s%s", name, key + 2);
  43
  44         errno = 0;
  45         size = strtoul(value, NULL, 10);
  46         if (errno)
  47                 return;
  48
  49         set_state(my_size_id, fullname, sym, alloc_state_num(size));
  50 }
  51
  52 static int get_initializer_size(struct expression *expr)
  53 {
  54         switch (expr->type) {
  55         case EXPR_STRING:
  56                 return expr->string->length;
  57         case EXPR_INITIALIZER: {
  58                 struct expression *tmp;
  59                 int i = 0;
  60                 int max = 0;
  61
  62                 FOR_EACH_PTR(expr->expr_list, tmp) {
  63                         if (tmp->type == EXPR_INDEX && tmp->idx_to > max)
  64                                 max = tmp->idx_to;
  65                         i++;
  66                 } END_FOR_EACH_PTR(tmp);
  67                 if (max)
  68                         return max + 1;
  69                 return i;
  70         }
  71         case EXPR_SYMBOL:
  72                 return get_array_size(expr);
  73         }
  74         return 0;
  75 }
  76
  77 static float get_cast_ratio(struct expression *unstripped)
  78 {
  79         struct expression *start_expr;
  80         struct symbol *start_type;
  81         struct symbol *end_type;
  82         int start_bytes = 0;
  83         int end_bytes = 0;
  84
  85         start_expr = strip_expr(unstripped);
  86         start_type  =  get_type(start_expr);
  87         end_type = get_type(unstripped);
  88         if (!start_type || !end_type)
  89                 return 1;
  90
  91         if (start_type->type == SYM_PTR)
  92                 start_bytes = (get_base_type(start_type))->ctype.alignment;
  93         if (start_type->type == SYM_ARRAY)
  94                 start_bytes = (get_base_type(start_type))->bit_size / 8;
  95         if (end_type->type == SYM_PTR)
  96                 end_bytes = (get_base_type(end_type))->ctype.alignment;
  97         if (end_type->type == SYM_ARRAY)
  98                 end_bytes = (get_base_type(end_type))->bit_size / 8;
  99
 100         if (!start_bytes || !end_bytes)
 101                 return 1;
 102         return start_bytes / end_bytes;
 103 }
 104
 105 int get_array_size(struct expression *expr)
 106 {
 107         struct symbol *tmp;
 108         struct smatch_state *state;
 109         int ret = 0;
 110         float cast_ratio;
 111         long long len;
 112
 113         if (expr->type == EXPR_STRING)
 114                 return expr->string->length;
 115
 116         cast_ratio = get_cast_ratio(expr);
 117         expr = strip_expr(expr);
 118         tmp = get_type(expr);
 119         if (!tmp)
 120                 return 0;
 121
 122         if (tmp->type == SYM_ARRAY) {
 123                 ret = get_expression_value(tmp->array_size);
 124                 /* Dynamically sized array are -1 in sparse */
 125                 if (ret < 0)
 126                         return 0;
 127                 /* People put one element arrays on the end of structs */
 128                 if (ret == 1)
 129                         return 0;
 130                 if (ret)
 131                         return ret * cast_ratio;
 132         }
 133
 134         state = get_state_expr(my_size_id, expr);
 135         if (state == &merged)
 136                 return 0;
 137         if (state && state->data) {
 138                 if (tmp->type == SYM_PTR)
 139                         tmp = get_base_type(tmp);
 140                 if (!tmp->ctype.alignment)
 141                         return 0;
 142                 ret = PTR_INT(state->data) / tmp->ctype.alignment;
 143                 return ret * cast_ratio;
 144         }
 145
 146         if (expr->type == EXPR_SYMBOL && expr->symbol->initializer) {
 147                 if (expr->symbol->initializer != expr) /* int a = a; */
 148                         return get_initializer_size(expr->symbol->initializer) * cast_ratio;
 149         }
 150
 151         state = get_state_expr(my_strlen_id, expr);
 152         if (!state || !state->data)
 153                 return 0;
 154         if (get_implied_max((struct expression *)state->data, &len))
 155                 return len + 1; /* add one because strlen doesn't include the NULL */
 156         return 0;
 157 }
 158
 159 static int db_size;
 160 static int db_size_callback(void *unused, int argc, char **argv, char **azColName)
 161 {
 162         db_size = atoi(argv[0]);
 163         return 0;
 164 }
 165
 166 static int size_from_db(struct expression *expr)
 167 {
 168         char *name;
 169
 170         if (!option_spammy)
 171                 return 0;
 172
 173         name = get_member_name(expr);
 174         if (!name)
 175                 return 0;
 176
 177         db_size = 0;
 178         run_sql(db_size_callback, "select size from type_size where type = '%s'",
 179                         name);
 180         return db_size;
 181 }
 182
 183 int get_array_size_bytes(struct expression *expr)
 184 {
 185         struct symbol *tmp;
 186         int array_size;
 187         int element_size;
 188
 189         if (!expr)
 190                 return 0;
 191
 192         if (expr->type == EXPR_STRING)
 193                 return expr->string->length;
 194
 195         tmp = get_type(expr);
 196         if (!tmp)
 197                 return 0;
 198
 199         if (tmp->type == SYM_ARRAY) {
 200                 tmp = get_base_type(tmp);
 201                 element_size = tmp->bit_size / 8;
 202         } else if (tmp->type == SYM_PTR) {
 203                 tmp = get_base_type(tmp);
 204                 element_size = tmp->ctype.alignment;
 205         } else {
 206                 return 0;
 207         }
 208         array_size = get_array_size(expr);
 209         if (array_size)
 210                 return array_size * element_size;
 211
 212         return size_from_db(expr);
 213 }
 214
 215 static void match_strlen_condition(struct expression *expr)
 216 {
 217         struct expression *left;
 218         struct expression *right;
 219         struct expression *str = NULL;
 220         int strlen_left = 0;
 221         int strlen_right = 0;
 222         long long val;
 223         struct smatch_state *true_state = NULL;
 224         struct smatch_state *false_state = NULL;
 225
 226         if (expr->type != EXPR_COMPARE)
 227                 return;
 228         left = strip_expr(expr->left);
 229         right = strip_expr(expr->right);
 230
 231         if (left->type == EXPR_CALL && sym_name_is("strlen", left->fn)) {
 232                 str = get_argument_from_call_expr(left->args, 0);
 233                 strlen_left = 1;
 234         }
 235         if (right->type == EXPR_CALL && sym_name_is("strlen", right->fn)) {
 236                 str = get_argument_from_call_expr(right->args, 0);
 237                 strlen_right = 1;
 238         }
 239
 240         if (!strlen_left && !strlen_right)
 241                 return;
 242         if (strlen_left && strlen_right)
 243                 return;
 244
 245         if (strlen_left) {
 246                 if (!get_value(right, &val))
 247                         return;
 248         }
 249         if (strlen_right) {
 250                 if (!get_value(left, &val))
 251                         return;
 252         }
 253
 254         if (expr->op == SPECIAL_EQUAL) {
 255                 set_true_false_states_expr(my_size_id, str, alloc_state_num(val + 1), NULL);
 256                 return;
 257         }
 258         if (expr->op == SPECIAL_NOTEQUAL) {
 259                 set_true_false_states_expr(my_size_id, str, NULL, alloc_state_num(val + 1));
 260                 return;
 261         }
 262
 263         switch (expr->op) {
 264         case '<':
 265         case SPECIAL_UNSIGNED_LT:
 266                 if (strlen_left)
 267                         true_state = alloc_state_num(val);
 268                 else
 269                         false_state = alloc_state_num(val + 1);
 270                 break;
 271         case SPECIAL_LTE:
 272         case SPECIAL_UNSIGNED_LTE:
 273                 if (strlen_left)
 274                         true_state = alloc_state_num(val + 1);
 275                 else
 276                         false_state = alloc_state_num(val);
 277                 break;
 278         case SPECIAL_GTE:
 279         case SPECIAL_UNSIGNED_GTE:
 280                 if (strlen_left)
 281                         false_state = alloc_state_num(val);
 282                 else
 283                         true_state = alloc_state_num(val + 1);
 284                 break;
 285         case '>':
 286         case SPECIAL_UNSIGNED_GT:
 287                 if (strlen_left)
 288                         false_state = alloc_state_num(val + 1);
 289                 else
 290                         true_state = alloc_state_num(val);
 291                 break;
 292         }
 293         set_true_false_states_expr(my_size_id, str, true_state, false_state);
 294 }
 295
 296 static struct expression *strip_ampersands(struct expression *expr)
 297 {
 298         struct symbol *type;
 299
 300         if (expr->type != EXPR_PREOP)
 301                 return expr;
 302         if (expr->op != '&')
 303                 return expr;
 304         type = get_type(expr->unop);
 305         if (!type || type->type != SYM_ARRAY)
 306                 return expr;
 307         return expr->unop;
 308 }
 309
 310 static void match_array_assignment(struct expression *expr)
 311 {
 312         struct expression *left;
 313         struct expression *right;
 314         int array_size;
 315
 316         if (expr->op != '=')
 317                 return;
 318         left = strip_expr(expr->left);
 319         right = strip_expr(expr->right);
 320         right = strip_ampersands(right);
 321         array_size = get_array_size_bytes(right);
 322         if (array_size)
 323                 set_state_expr(my_size_id, left, alloc_state_num(array_size));
 324 }
 325
 326 static void match_alloc(const char *fn, struct expression *expr, void *_size_arg)
 327 {
 328         int size_arg = PTR_INT(_size_arg);
 329         struct expression *right;
 330         struct expression *arg;
 331         long long bytes;
 332
 333         right = strip_expr(expr->right);
 334         arg = get_argument_from_call_expr(right->args, size_arg);
 335         if (!get_implied_value(arg, &bytes))
 336                 return;
 337
 338         set_state_expr(my_size_id, expr->left, alloc_state_num(bytes));
 339
 340         if (option_info) {
 341                 char *member = get_member_name(expr->left);
 342
 343                 if (member)
 344                         sm_msg("info: '%s' allocated_buf_size %lld",
 345                                         member, bytes);
 346                 free_string(member);
 347         }
 348 }
 349
 350 static void match_calloc(const char *fn, struct expression *expr, void *unused)
 351 {
 352         struct expression *right;
 353         struct expression *arg;
 354         long long elements;
 355         long long size;
 356
 357         right = strip_expr(expr->right);
 358         arg = get_argument_from_call_expr(right->args, 0);
 359         if (!get_implied_value(arg, &elements))
 360                 return;
 361         arg = get_argument_from_call_expr(right->args, 1);
 362         if (!get_implied_value(arg, &size))
 363                 return;
 364         set_state_expr(my_size_id, expr->left, alloc_state_num(elements * size));
 365 }
 366
 367 static void match_strlen(const char *fn, struct expression *expr, void *unused)
 368 {
 369         struct expression *right;
 370         struct expression *str;
 371         struct expression *len_expr;
 372         char *len_name;
 373         struct smatch_state *state;
 374
 375         right = strip_expr(expr->right);
 376         str = get_argument_from_call_expr(right->args, 0);
 377         len_expr = strip_expr(expr->left);
 378
 379         len_name = get_variable_from_expr(len_expr, NULL);
 380         if (!len_name)
 381                 return;
 382
 383         state = __alloc_smatch_state(0);
 384         state->name = len_name;
 385         state->data = len_expr;
 386         set_state_expr(my_strlen_id, str, state);
 387 }
 388
 389 static void match_limited(const char *fn, struct expression *expr, void *_limiter)
 390 {
 391         struct limiter *limiter = (struct limiter *)_limiter;
 392         struct expression *dest;
 393         struct expression *size_expr;
 394         long long size;
 395
 396         dest = get_argument_from_call_expr(expr->args, limiter->buf_arg);
 397         size_expr = get_argument_from_call_expr(expr->args, limiter->limit_arg);
 398         if (!get_implied_max(size_expr, &size))
 399                 return;
 400         set_state_expr(my_size_id, dest, alloc_state_num(size));
 401 }
 402
 403 static void match_strcpy(const char *fn, struct expression *expr, void *unused)
 404 {
 405         struct expression fake_assign;
 406
 407         fake_assign.op = '=';
 408         fake_assign.left = get_argument_from_call_expr(expr->args, 0);
 409         fake_assign.right = get_argument_from_call_expr(expr->args, 1);
 410         match_array_assignment(&fake_assign);
 411 }
 412
 413 static void match_strndup(const char *fn, struct expression *expr, void *unused)
 414 {
 415         struct expression *fn_expr;
 416         struct expression *size_expr;
 417         long long size;
 418
 419         fn_expr = strip_expr(expr->right);
 420         size_expr = get_argument_from_call_expr(fn_expr->args, 1);
 421         if (!get_implied_max(size_expr, &size))
 422                 return;
 423
 424         /* It's easy to forget space for the NUL char */
 425         size++;
 426         set_state_expr(my_size_id, expr->left, alloc_state_num(size));
 427 }
 428
 429 static void match_call(struct expression *expr)
 430 {
 431         char *name;
 432         struct expression *arg;
 433         int bytes;
 434         int i;
 435
 436         name = get_fnptr_name(expr->fn);
 437         if (!name)
 438                 return;
 439
 440         i = 0;
 441         FOR_EACH_PTR(expr->args, arg) {
 442                 bytes = get_array_size_bytes(arg);
 443                 if (bytes > 1)
 444                         sm_msg("info: passes_buffer '%s' %d '$$' %d %s",
 445                                 name, i, bytes,
 446                                 is_static(expr->fn) ? "static" : "global");
 447                 i++;
 448         } END_FOR_EACH_PTR(arg);
 449
 450         free_string(name);
 451 }
 452
 453 static void struct_member_callback(char *fn, char *global_static, int param, char *printed_name, struct smatch_state *state)
 454 {
 455         if (state == &merged)
 456                 return;
 457         sm_msg("info: passes_buffer '%s' %d '%s' %s %s", fn, param, printed_name, state->name, global_static);
 458 }
 459
 460 static void match_func_end(struct symbol *sym)
 461 {
 462         memset(params_set, 0, sizeof(params_set));
 463 }
 464
 465 void register_buf_size(int id)
 466 {
 467         my_size_id = id;
 468
 469         add_definition_db_callback(set_param_buf_size, BUF_SIZE);
 470
 471         add_function_assign_hook("malloc", &match_alloc, INT_PTR(0));
 472         add_function_assign_hook("calloc", &match_calloc, NULL);
 473         add_function_assign_hook("memdup", &match_alloc, INT_PTR(1));
 474         if (option_project == PROJ_KERNEL) {
 475                 add_function_assign_hook("kmalloc", &match_alloc, INT_PTR(0));
 476                 add_function_assign_hook("kzalloc", &match_alloc, INT_PTR(0));
 477                 add_function_assign_hook("vmalloc", &match_alloc, INT_PTR(0));
 478                 add_function_assign_hook("__vmalloc", &match_alloc, INT_PTR(0));
 479                 add_function_assign_hook("kcalloc", &match_calloc, NULL);
 480                 add_function_assign_hook("drm_malloc_ab", &match_calloc, NULL);
 481                 add_function_assign_hook("drm_calloc_large", &match_calloc, NULL);
 482                 add_function_assign_hook("kmemdup", &match_alloc, INT_PTR(1));
 483                 add_function_assign_hook("kmemdup_user", &match_alloc, INT_PTR(1));
 484         }
 485         add_hook(&match_array_assignment, ASSIGNMENT_HOOK);
 486         add_hook(&match_strlen_condition, CONDITION_HOOK);
 487         add_function_assign_hook("strlen", &match_strlen, NULL);
 488
 489         add_function_hook("strlcpy", &match_limited, &b0_l2);
 490         add_function_hook("strlcat", &match_limited, &b0_l2);
 491         add_function_hook("memscan", &match_limited, &b0_l2);
 492
 493         add_function_hook("strcpy", &match_strcpy, NULL);
 494
 495         add_function_assign_hook("strndup", match_strndup, NULL);
 496         if (option_project == PROJ_KERNEL)
 497                 add_function_assign_hook("kstrndup", match_strndup, NULL);
 498
 499         if (option_info) {
 500                 add_hook(&match_call, FUNCTION_CALL_HOOK);
 501                 add_member_info_callback(my_size_id, struct_member_callback);
 502         }
 503
 504         add_hook(&match_func_end, END_FUNC_HOOK);
 505 }
 506
 507 void register_strlen(int id)
 508 {
 509         my_strlen_id = id;
 510 }