modification_hooks: handle PARAM_SET earlier
[smatch.git] / smatch_struct_assignment.c
blob8fdcdbc4ae8d702ff982ff62738a3af9c11a2c1c
1 /*
2 * Copyright (C) 2014 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * This file started out by saying that if you have:
21 * struct foo one, two;
22 * ...
23 * one = two;
25 * That's equivalent to saying:
27 * one.x = two.x;
28 * one.y = two.y;
30 * Turning an assignment like that into a bunch of small fake assignments is
31 * really useful.
33 * The call to memcpy(&one, &two, sizeof(foo)); is the same as "one = two;" so
34 * we can re-use the code. And we may as well use it for memset() too.
35 * Assigning pointers is almost the same:
37 * p1 = p2;
39 * Is the same as:
41 * p1->x = p2->x;
42 * p1->y = p2->y;
44 * The problem is that you can go a bit crazy with pointers to pointers.
46 * p1->x->y->z->one->two->three = p2->x->y->z->one->two->three;
48 * I don't have a proper solution for this problem right now. I just copy one
49 * level and don't nest. It should handle limitted nesting but intelligently.
51 * The other thing is that you end up with a lot of garbage assignments where
52 * we record "x could be anything. x->y could be anything. x->y->z->a->b->c
53 * could *also* be anything!". There should be a better way to filter this
54 * useless information.
58 #include "scope.h"
59 #include "smatch.h"
60 #include "smatch_slist.h"
61 #include "smatch_extra.h"
63 enum {
64 COPY_NORMAL,
65 COPY_MEMCPY,
66 COPY_MEMSET,
69 static struct symbol *get_struct_type(struct expression *expr)
71 struct symbol *type;
73 type = get_type(expr);
74 if (!type)
75 return NULL;
76 if (type->type == SYM_PTR)
77 type = get_real_base_type(type);
78 if (type && type->type == SYM_STRUCT)
79 return type;
80 return NULL;
83 static struct expression *get_right_base_expr(struct symbol *left_type, struct expression *right)
85 struct symbol *struct_type;
87 if (!right)
88 return NULL;
90 struct_type = get_struct_type(right);
91 if (!struct_type)
92 return NULL;
93 if (struct_type != left_type)
94 return NULL;
96 if (right->type == EXPR_PREOP && right->op == '&')
97 right = strip_expr(right->unop);
99 if (right->type == EXPR_CALL)
100 return NULL;
102 if (is_pointer(right))
103 right = deref_expression(right);
105 return right;
108 static struct expression *remove_addr(struct expression *expr)
110 struct symbol *type;
112 expr = strip_expr(expr);
113 if (!expr)
114 return NULL;
116 if (expr->type == EXPR_PREOP && expr->op == '&')
117 return strip_expr(expr->unop);
118 type = get_type(expr);
119 if (!type || type->type != SYM_PTR)
120 return expr;
122 return deref_expression(expr);
125 static struct expression *faked_expression;
126 struct expression *get_faked_expression(void)
128 if (!__in_fake_assign)
129 return NULL;
130 return faked_expression;
133 static void split_fake_expr(struct expression *expr)
135 __in_fake_assign++;
136 __split_expr(expr);
137 __in_fake_assign--;
140 static void set_inner_struct_members(int mode, struct expression *faked, struct expression *left, struct expression *right, struct symbol *member)
142 struct expression *left_member;
143 struct expression *right_member = NULL; /* silence GCC */
144 struct expression *assign;
145 struct symbol *base = get_real_base_type(member);
146 struct symbol *tmp;
148 if (member->ident) {
149 left = member_expression(left, '.', member->ident);
150 if (mode != COPY_MEMSET && right)
151 right = member_expression(right, '.', member->ident);
154 FOR_EACH_PTR(base->symbol_list, tmp) {
155 struct symbol *type;
157 type = get_real_base_type(tmp);
158 if (!type)
159 continue;
161 if (type->type == SYM_ARRAY)
162 continue;
163 if (type->type == SYM_UNION || type->type == SYM_STRUCT) {
164 set_inner_struct_members(mode, faked, left, right, tmp);
165 continue;
167 if (!tmp->ident)
168 continue;
170 left_member = member_expression(left, '.', tmp->ident);
172 switch (mode) {
173 case COPY_NORMAL:
174 case COPY_MEMCPY:
175 if (right)
176 right_member = member_expression(right, '.', tmp->ident);
177 else
178 right_member = unknown_value_expression(left_member);
179 break;
180 case COPY_MEMSET:
181 right_member = right;
182 break;
185 assign = assign_expression(left_member, right_member);
186 split_fake_expr(assign);
187 } END_FOR_EACH_PTR(tmp);
190 static void __struct_members_copy(int mode, struct expression *faked,
191 struct expression *left,
192 struct expression *right)
194 struct symbol *struct_type, *tmp, *type;
195 struct expression *left_member;
196 struct expression *right_member;
197 struct expression *assign;
198 int op = '.';
201 if (__in_fake_assign)
202 return;
203 faked_expression = faked;
205 left = strip_expr(left);
206 right = strip_expr(right);
208 struct_type = get_struct_type(left);
209 if (!struct_type) {
211 * This is not a struct assignment obviously. But this is where
212 * memcpy() is handled so it feels like a good place to add this
213 * code.
216 type = get_type(left);
217 if (!type || type->type != SYM_BASETYPE)
218 goto done;
220 right = strip_expr(right);
221 if (right && right->type == EXPR_PREOP && right->op == '&')
222 right = remove_addr(right);
223 else
224 right = unknown_value_expression(left);
225 assign = assign_expression(left, right);
226 split_fake_expr(assign);
227 goto done;
230 if (is_pointer(left)) {
231 left = deref_expression(left);
232 op = '*';
234 if (mode != COPY_MEMSET)
235 right = get_right_base_expr(struct_type, right);
237 FOR_EACH_PTR(struct_type->symbol_list, tmp) {
238 type = get_real_base_type(tmp);
239 if (!type)
240 continue;
241 if (type->type == SYM_ARRAY)
242 continue;
244 if (type->type == SYM_UNION || type->type == SYM_STRUCT) {
245 set_inner_struct_members(mode, faked, left, right, tmp);
246 continue;
249 if (!tmp->ident)
250 continue;
252 left_member = member_expression(left, op, tmp->ident);
253 right_member = NULL;
255 switch (mode) {
256 case COPY_NORMAL:
257 case COPY_MEMCPY:
258 if (right)
259 right_member = member_expression(right, op, tmp->ident);
260 else
261 right_member = unknown_value_expression(left_member);
262 break;
263 case COPY_MEMSET:
264 right_member = right;
265 break;
267 if (!right_member) {
268 sm_msg("internal. No right member");
269 continue;
271 assign = assign_expression(left_member, right_member);
272 split_fake_expr(assign);
273 } END_FOR_EACH_PTR(tmp);
275 done:
276 faked_expression = NULL;
279 static int returns_zeroed_mem(struct expression *expr)
281 char *fn;
283 if (expr->type != EXPR_CALL || expr->fn->type != EXPR_SYMBOL)
284 return 0;
285 fn = expr_to_var(expr->fn);
286 if (!fn)
287 return 0;
288 if (strcmp(fn, "kcalloc") == 0)
289 return 1;
290 if (option_project == PROJ_KERNEL && strstr(fn, "zalloc"))
291 return 1;
292 return 0;
295 static int copy_containter_states(struct expression *left, struct expression *right, int offset)
297 char *left_name = NULL, *right_name = NULL;
298 struct symbol *left_sym, *right_sym;
299 struct sm_state *sm, *new_sm;
300 int ret = 0;
301 int len;
302 char buf[64];
303 char new_name[128];
305 right_name = expr_to_var_sym(right, &right_sym);
306 if (!right_name || !right_sym)
307 goto free;
308 left_name = expr_to_var_sym(left, &left_sym);
309 if (!left_name || !left_sym)
310 goto free;
312 len = snprintf(buf, sizeof(buf), "%s(-%d)", right_name, offset);
313 if (len >= sizeof(buf))
314 goto free;
316 FOR_EACH_SM(__get_cur_stree(), sm) {
317 if (sm->sym != right_sym)
318 continue;
319 if (strncmp(sm->name, buf, len) != 0)
320 continue;
321 snprintf(new_name, sizeof(new_name), "%s%s", left_name, sm->name + len);
322 new_sm = clone_sm(sm);
323 new_sm->name = alloc_sname(new_name);
324 new_sm->sym = left_sym;
325 __set_sm(new_sm);
326 ret = 1;
327 } END_FOR_EACH_SM(sm);
328 free:
329 free_string(left_name);
330 free_string(right_name);
331 return ret;
334 static int handle_param_offsets(struct expression *expr)
336 struct expression *right;
337 sval_t sval;
339 right = strip_expr(expr->right);
341 if (right->type != EXPR_BINOP || right->op != '-')
342 return 0;
344 if (!get_value(right->right, &sval))
345 return 0;
347 right = get_assigned_expr(right->left);
348 if (!right)
349 return 0;
350 return copy_containter_states(expr->left, right, sval.value);
353 static void returns_container_of(struct expression *expr, int param, char *key, char *value)
355 struct expression *call, *arg;
356 int offset;
358 if (expr->type != EXPR_ASSIGNMENT || expr->op != '=')
359 return;
360 call = strip_expr(expr->right);
361 if (call->type != EXPR_CALL)
362 return;
363 if (param != -1)
364 return;
365 param = atoi(key);
366 offset = atoi(value);
368 arg = get_argument_from_call_expr(call->args, param);
369 if (!arg)
370 return;
372 copy_containter_states(expr->left, arg, -offset);
375 void __fake_struct_member_assignments(struct expression *expr)
377 struct symbol *struct_type;
378 struct symbol *left_type;
380 if (expr->op != '=')
381 return;
383 if (is_zero(expr->right))
384 return;
386 left_type = get_type(expr->left);
387 if (left_type &&
388 left_type->type != SYM_PTR &&
389 left_type->type != SYM_STRUCT &&
390 left_type != &ulong_ctype)
391 return;
393 struct_type = get_struct_type(expr->left);
394 if (!struct_type)
395 return;
397 if (handle_param_offsets(expr))
398 return;
400 if (returns_zeroed_mem(expr->right))
401 __struct_members_copy(COPY_MEMSET, expr, expr->left, zero_expr());
402 else
403 __struct_members_copy(COPY_NORMAL, expr, expr->left, expr->right);
406 static void match_memset(const char *fn, struct expression *expr, void *_size_arg)
408 struct expression *buf;
409 struct expression *val;
411 buf = get_argument_from_call_expr(expr->args, 0);
412 val = get_argument_from_call_expr(expr->args, 1);
414 buf = strip_expr(buf);
415 __struct_members_copy(COPY_MEMSET, expr, remove_addr(buf), val);
418 static void match_memcpy(const char *fn, struct expression *expr, void *_arg)
420 struct expression *dest;
421 struct expression *src;
423 dest = get_argument_from_call_expr(expr->args, 0);
424 src = get_argument_from_call_expr(expr->args, 1);
426 __struct_members_copy(COPY_MEMCPY, expr, remove_addr(dest), remove_addr(src));
429 static void match_memcpy_unknown(const char *fn, struct expression *expr, void *_arg)
431 struct expression *dest;
433 dest = get_argument_from_call_expr(expr->args, 0);
434 __struct_members_copy(COPY_MEMCPY, expr, remove_addr(dest), NULL);
437 static void match_sscanf(const char *fn, struct expression *expr, void *unused)
439 struct expression *arg;
440 int i;
442 i = -1;
443 FOR_EACH_PTR(expr->args, arg) {
444 if (++i < 2)
445 continue;
446 __struct_members_copy(COPY_MEMCPY, expr, remove_addr(arg), NULL);
447 } END_FOR_EACH_PTR(arg);
450 static void unop_expr(struct expression *expr)
452 if (expr->op != SPECIAL_INCREMENT &&
453 expr->op != SPECIAL_DECREMENT)
454 return;
456 if (!is_pointer(expr))
457 return;
458 __struct_members_copy(COPY_MEMCPY, expr, expr->unop, NULL);
461 static void register_clears_param(void)
463 struct token *token;
464 char name[256];
465 const char *function;
466 int param;
468 if (option_project == PROJ_NONE)
469 return;
471 snprintf(name, 256, "%s.clears_argument", option_project_str);
473 token = get_tokens_file(name);
474 if (!token)
475 return;
476 if (token_type(token) != TOKEN_STREAMBEGIN)
477 return;
478 token = token->next;
479 while (token_type(token) != TOKEN_STREAMEND) {
480 if (token_type(token) != TOKEN_IDENT)
481 return;
482 function = show_ident(token->ident);
483 token = token->next;
484 if (token_type(token) != TOKEN_NUMBER)
485 return;
486 param = atoi(token->number);
487 add_function_hook(function, &match_memcpy_unknown, INT_PTR(param));
488 token = token->next;
490 clear_token_alloc();
493 static void db_param_cleared(struct expression *expr, int param, char *key, char *value)
495 struct expression *arg;
497 while (expr->type == EXPR_ASSIGNMENT)
498 expr = strip_expr(expr->right);
499 if (expr->type != EXPR_CALL)
500 return;
503 * FIXME: __struct_members_copy() requires an expression but
504 * get_variable_from_key() returns a name/sym pair so that doesn't
505 * work here.
507 if (strcmp(key, "$") != 0)
508 return;
510 arg = get_argument_from_call_expr(expr->args, param);
511 if (!arg)
512 return;
514 if (strcmp(value, "0") == 0)
515 __struct_members_copy(COPY_MEMSET, expr, remove_addr(arg), zero_expr());
516 else
517 __struct_members_copy(COPY_MEMCPY, expr, remove_addr(arg), NULL);
520 void register_struct_assignment(int id)
522 add_function_hook("memset", &match_memset, NULL);
523 add_function_hook("__memset", &match_memset, NULL);
525 add_function_hook("memcpy", &match_memcpy, INT_PTR(0));
526 add_function_hook("memmove", &match_memcpy, INT_PTR(0));
527 add_function_hook("__memcpy", &match_memcpy, INT_PTR(0));
528 add_function_hook("__memmove", &match_memcpy, INT_PTR(0));
530 add_function_hook("sscanf", &match_sscanf, NULL);
532 add_hook(&unop_expr, OP_HOOK);
533 register_clears_param();
534 select_return_states_hook(PARAM_CLEARED, &db_param_cleared);
536 select_return_states_hook(CONTAINER, &returns_container_of);