smatch_buf_size.c

   1 /*
   2  * smatch/smatch_buf_size.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 #include <stdlib.h>
  11 #include <errno.h>
  12 #include "parse.h"
  13 #include "smatch.h"
  14 #include "smatch_slist.h"
  15 #include "smatch_extra.h"
  16
  17 /*
  18  * This check has two smatch IDs.
  19  * my_size_id - used to store the size of arrays.
  20  * my_strlen_id - track the strlen() of buffers.
  21  */
  22
  23 static int my_size_id;
  24 static int my_strlen_id;
  25
  26 struct limiter {
  27         int buf_arg;
  28         int limit_arg;
  29 };
  30 static struct limiter b0_l2 = {0, 2};
  31
  32 static _Bool params_set[32];
  33
  34 static int db_callback(void *unused, int argc, char **argv, char **azColName)
  35 {
  36         struct symbol *arg;
  37         unsigned int param;
  38         unsigned int size;
  39         int i;
  40         int dummy = 0;
  41
  42         errno = 0;
  43         param = strtoul(argv[0], NULL, 10);
  44         size = strtoul(argv[1], NULL, 10);
  45         if (errno)
  46                 return dummy;
  47
  48         if (param >= ARRAY_SIZE(params_set))
  49                 return dummy;
  50         if (params_set[param])
  51                 return dummy;
  52         params_set[param] = 1;
  53
  54         i = 0;
  55         FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
  56                 /*
  57                  * this is a temporary hack to work around a bug (I think in sparse?)
  58                  * 2.6.37-rc1:fs/reiserfs/journal.o
  59                  * If there is a function definition without parameter name found
  60                  * after a function implementation then it causes a crash.
  61                  * int foo() {}
  62                  * int bar(char *);
  63                  */
  64                 if (arg->ident->name < (char *)100)
  65                         continue;
  66                 if (i == param && arg->ident->name) {
  67                         set_state(my_size_id, arg->ident->name, arg, alloc_state_num(size));
  68                 }
  69                 i++;
  70         } END_FOR_EACH_PTR(arg);
  71
  72         return dummy;
  73 }
  74
  75 static void match_function_def(struct symbol *sym)
  76 {
  77         if (!sym || !sym->ident || !sym->ident->name)
  78                 return;
  79
  80         if (sym->ctype.modifiers & MOD_STATIC) {
  81                 run_sql(db_callback,
  82                         "select distinct parameter, size from buf_size "
  83                         "where file = '%s' and function = '%s' "
  84                         "order by size desc;",
  85                         get_filename(), sym->ident->name);
  86         } else {
  87                 run_sql(db_callback,
  88                         "select distinct parameter, size from buf_size "
  89                         "where function = '%s' "
  90                         "order by size desc;",
  91                         sym->ident->name);
  92         }
  93 }
  94
  95 static int get_initializer_size(struct expression *expr)
  96 {
  97         switch (expr->type) {
  98         case EXPR_STRING:
  99                 return expr->string->length;
 100         case EXPR_INITIALIZER: {
 101                 struct expression *tmp;
 102                 int i = 0;
 103                 int max = 0;
 104
 105                 FOR_EACH_PTR(expr->expr_list, tmp) {
 106                         if (tmp->type == EXPR_INDEX && tmp->idx_to > max)
 107                                 max = tmp->idx_to;
 108                         i++;
 109                 } END_FOR_EACH_PTR(tmp);
 110                 if (max)
 111                         return max + 1;
 112                 return i;
 113         }
 114         case EXPR_SYMBOL:
 115                 return get_array_size(expr);
 116         }
 117         return 0;
 118 }
 119
 120 static float get_cast_ratio(struct expression *unstripped)
 121 {
 122         struct expression *start_expr;
 123         struct symbol *start_type;
 124         struct symbol *end_type;
 125         int start_bytes = 0;
 126         int end_bytes = 0;
 127
 128         start_expr = strip_expr(unstripped);
 129         start_type  =  get_type(start_expr);
 130         end_type = get_type(unstripped);
 131         if (!start_type || !end_type)
 132                 return 1;
 133
 134         if (start_type->type == SYM_PTR)
 135                 start_bytes = (get_base_type(start_type))->ctype.alignment;
 136         if (start_type->type == SYM_ARRAY)
 137                 start_bytes = (get_base_type(start_type))->bit_size / 8;
 138         if (end_type->type == SYM_PTR)
 139                 end_bytes = (get_base_type(end_type))->ctype.alignment;
 140         if (end_type->type == SYM_ARRAY)
 141                 end_bytes = (get_base_type(end_type))->bit_size / 8;
 142
 143         if (!start_bytes || !end_bytes)
 144                 return 1;
 145         return start_bytes / end_bytes;
 146 }
 147
 148 int get_array_size(struct expression *expr)
 149 {
 150         struct symbol *tmp;
 151         struct smatch_state *state;
 152         int ret = 0;
 153         float cast_ratio;
 154         long long len;
 155
 156         if (expr->type == EXPR_STRING)
 157                 return expr->string->length;
 158
 159         cast_ratio = get_cast_ratio(expr);
 160         expr = strip_expr(expr);
 161         tmp = get_type(expr);
 162         if (!tmp)
 163                 return 0;
 164
 165         if (tmp->type == SYM_ARRAY) {
 166                 ret = get_expression_value(tmp->array_size);
 167                 /* Dynamically sized array are -1 in sparse */
 168                 if (ret < 0)
 169                         return 0;
 170                 /* People put one element arrays on the end of structs */
 171                 if (ret == 1)
 172                         return 0;
 173                 if (ret)
 174                         return ret * cast_ratio;
 175         }
 176
 177         state = get_state_expr(my_size_id, expr);
 178         if (state == &merged)
 179                 return 0;
 180         if (state && state->data) {
 181                 if (tmp->type == SYM_PTR)
 182                         tmp = get_base_type(tmp);
 183                 if (!tmp->ctype.alignment)
 184                         return 0;
 185                 ret = PTR_INT(state->data) / tmp->ctype.alignment;
 186                 return ret * cast_ratio;
 187         }
 188
 189         if (expr->type == EXPR_SYMBOL && expr->symbol->initializer) {
 190                 if (expr->symbol->initializer != expr) /* int a = a; */
 191                         return get_initializer_size(expr->symbol->initializer) * cast_ratio;
 192         }
 193
 194         state = get_state_expr(my_strlen_id, expr);
 195         if (!state || !state->data)
 196                 return 0;
 197         if (get_implied_max((struct expression *)state->data, &len))
 198                 return len + 1; /* add one because strlen doesn't include the NULL */
 199         return 0;
 200 }
 201
 202 int get_array_size_bytes(struct expression *expr)
 203 {
 204         struct symbol *tmp;
 205         int array_size;
 206         int element_size;
 207
 208         if (expr->type == EXPR_STRING)
 209                 return expr->string->length;
 210
 211         tmp = get_type(expr);
 212         if (!tmp)
 213                 return 0;
 214
 215         if (tmp->type == SYM_ARRAY) {
 216                 tmp = get_base_type(tmp);
 217                 element_size = tmp->bit_size / 8;
 218         } else if (tmp->type == SYM_PTR) {
 219                 tmp = get_base_type(tmp);
 220                 element_size = tmp->ctype.alignment;
 221         } else {
 222                 return 0;
 223         }
 224         array_size = get_array_size(expr);
 225         return array_size * element_size;
 226 }
 227
 228 static void match_strlen_condition(struct expression *expr)
 229 {
 230         struct expression *left;
 231         struct expression *right;
 232         struct expression *str = NULL;
 233         int strlen_left = 0;
 234         int strlen_right = 0;
 235         long long val;
 236         struct smatch_state *true_state = NULL;
 237         struct smatch_state *false_state = NULL;
 238
 239         if (expr->type != EXPR_COMPARE)
 240                 return;
 241         left = strip_expr(expr->left);
 242         right = strip_expr(expr->right);
 243
 244         if (left->type == EXPR_CALL && sym_name_is("strlen", left->fn)) {
 245                 str = get_argument_from_call_expr(left->args, 0);
 246                 strlen_left = 1;
 247         }
 248         if (right->type == EXPR_CALL && sym_name_is("strlen", right->fn)) {
 249                 str = get_argument_from_call_expr(right->args, 0);
 250                 strlen_right = 1;
 251         }
 252
 253         if (!strlen_left && !strlen_right)
 254                 return;
 255         if (strlen_left && strlen_right)
 256                 return;
 257
 258         if (strlen_left) {
 259                 if (!get_value(right, &val))
 260                         return;
 261         }
 262         if (strlen_right) {
 263                 if (!get_value(left, &val))
 264                         return;
 265         }
 266
 267         if (expr->op == SPECIAL_EQUAL) {
 268                 set_true_false_states_expr(my_size_id, str, alloc_state_num(val + 1), NULL);
 269                 return;
 270         }
 271         if (expr->op == SPECIAL_NOTEQUAL) {
 272                 set_true_false_states_expr(my_size_id, str, NULL, alloc_state_num(val + 1));
 273                 return;
 274         }
 275
 276         switch (expr->op) {
 277         case '<':
 278         case SPECIAL_UNSIGNED_LT:
 279                 if (strlen_left)
 280                         true_state = alloc_state_num(val);
 281                 else
 282                         false_state = alloc_state_num(val + 1);
 283                 break;
 284         case SPECIAL_LTE:
 285         case SPECIAL_UNSIGNED_LTE:
 286                 if (strlen_left)
 287                         true_state = alloc_state_num(val + 1);
 288                 else
 289                         false_state = alloc_state_num(val);
 290                 break;
 291         case SPECIAL_GTE:
 292         case SPECIAL_UNSIGNED_GTE:
 293                 if (strlen_left)
 294                         false_state = alloc_state_num(val);
 295                 else
 296                         true_state = alloc_state_num(val + 1);
 297                 break;
 298         case '>':
 299         case SPECIAL_UNSIGNED_GT:
 300                 if (strlen_left)
 301                         false_state = alloc_state_num(val + 1);
 302                 else
 303                         true_state = alloc_state_num(val);
 304                 break;
 305         }
 306         set_true_false_states_expr(my_size_id, str, true_state, false_state);
 307 }
 308
 309 static struct expression *strip_ampersands(struct expression *expr)
 310 {
 311         struct symbol *type;
 312
 313         if (expr->type != EXPR_PREOP)
 314                 return expr;
 315         if (expr->op != '&')
 316                 return expr;
 317         type = get_type(expr->unop);
 318         if (!type || type->type != SYM_ARRAY)
 319                 return expr;
 320         return expr->unop;
 321 }
 322
 323 static void match_array_assignment(struct expression *expr)
 324 {
 325         struct expression *left;
 326         struct expression *right;
 327         int array_size;
 328
 329         if (expr->op != '=')
 330                 return;
 331         left = strip_expr(expr->left);
 332         right = strip_expr(expr->right);
 333         right = strip_ampersands(right);
 334         array_size = get_array_size_bytes(right);
 335         if (array_size)
 336                 set_state_expr(my_size_id, left, alloc_state_num(array_size));
 337 }
 338
 339 static void match_alloc(const char *fn, struct expression *expr, void *_size_arg)
 340 {
 341         int size_arg = PTR_INT(_size_arg);
 342         struct expression *right;
 343         struct expression *arg;
 344         long long bytes;
 345
 346         right = strip_expr(expr->right);
 347         arg = get_argument_from_call_expr(right->args, size_arg);
 348         if (!get_implied_value(arg, &bytes))
 349                 return;
 350         set_state_expr(my_size_id, expr->left, alloc_state_num(bytes));
 351 }
 352
 353 static void match_calloc(const char *fn, struct expression *expr, void *unused)
 354 {
 355         struct expression *right;
 356         struct expression *arg;
 357         long long elements;
 358         long long size;
 359
 360         right = strip_expr(expr->right);
 361         arg = get_argument_from_call_expr(right->args, 0);
 362         if (!get_implied_value(arg, &elements))
 363                 return;
 364         arg = get_argument_from_call_expr(right->args, 1);
 365         if (!get_implied_value(arg, &size))
 366                 return;
 367         set_state_expr(my_size_id, expr->left, alloc_state_num(elements * size));
 368 }
 369
 370 static void match_strlen(const char *fn, struct expression *expr, void *unused)
 371 {
 372         struct expression *right;
 373         struct expression *str;
 374         struct expression *len_expr;
 375         char *len_name;
 376         struct smatch_state *state;
 377
 378         right = strip_expr(expr->right);
 379         str = get_argument_from_call_expr(right->args, 0);
 380         len_expr = strip_expr(expr->left);
 381
 382         len_name = get_variable_from_expr(len_expr, NULL);
 383         if (!len_name)
 384                 return;
 385
 386         state = __alloc_smatch_state(0);
 387         state->name = len_name;
 388         state->data = len_expr;
 389         set_state_expr(my_strlen_id, str, state);
 390 }
 391
 392 static void match_limited(const char *fn, struct expression *expr, void *_limiter)
 393 {
 394         struct limiter *limiter = (struct limiter *)_limiter;
 395         struct expression *dest;
 396         struct expression *size_expr;
 397         long long size;
 398
 399         dest = get_argument_from_call_expr(expr->args, limiter->buf_arg);
 400         size_expr = get_argument_from_call_expr(expr->args, limiter->limit_arg);
 401         if (!get_implied_max(size_expr, &size))
 402                 return;
 403         set_state_expr(my_size_id, dest, alloc_state_num(size));
 404 }
 405
 406 static void match_strcpy(const char *fn, struct expression *expr, void *unused)
 407 {
 408         struct expression fake_assign;
 409
 410         fake_assign.op = '=';
 411         fake_assign.left = get_argument_from_call_expr(expr->args, 0);
 412         fake_assign.right = get_argument_from_call_expr(expr->args, 1);
 413         match_array_assignment(&fake_assign);
 414 }
 415
 416 static void match_strndup(const char *fn, struct expression *expr, void *unused)
 417 {
 418         struct expression *fn_expr;
 419         struct expression *size_expr;
 420         long long size;
 421
 422         fn_expr = strip_expr(expr->right);
 423         size_expr = get_argument_from_call_expr(fn_expr->args, 1);
 424         if (!get_implied_max(size_expr, &size))
 425                 return;
 426
 427         /* It's easy to forget space for the NUL char */
 428         size++;
 429         set_state_expr(my_size_id, expr->left, alloc_state_num(size));
 430 }
 431
 432 static void match_call(struct expression *expr)
 433 {
 434         char *name;
 435         struct expression *arg;
 436         int bytes;
 437         int i;
 438
 439         name = get_variable_from_expr(expr->fn, NULL);
 440         if (!name)
 441                 return;
 442
 443         i = 0;
 444         FOR_EACH_PTR(expr->args, arg) {
 445                 bytes = get_array_size_bytes(arg);
 446                 if (bytes > 1)
 447                         sm_msg("info: passes_buffer '%s' %d %d", name, i, bytes);
 448                 i++;
 449         } END_FOR_EACH_PTR(arg);
 450
 451         free_string(name);
 452 }
 453
 454 static void match_func_end(struct symbol *sym)
 455 {
 456         memset(params_set, 0, sizeof(params_set));
 457 }
 458
 459 void register_buf_size(int id)
 460 {
 461         my_size_id = id;
 462
 463         add_hook(&match_function_def, FUNC_DEF_HOOK);
 464
 465         add_function_assign_hook("malloc", &match_alloc, INT_PTR(0));
 466         add_function_assign_hook("calloc", &match_calloc, NULL);
 467         add_function_assign_hook("memdup", &match_alloc, INT_PTR(1));
 468         if (option_project == PROJ_KERNEL) {
 469                 add_function_assign_hook("kmalloc", &match_alloc, INT_PTR(0));
 470                 add_function_assign_hook("kzalloc", &match_alloc, INT_PTR(0));
 471                 add_function_assign_hook("vmalloc", &match_alloc, INT_PTR(0));
 472                 add_function_assign_hook("__vmalloc", &match_alloc, INT_PTR(0));
 473                 add_function_assign_hook("kcalloc", &match_calloc, NULL);
 474                 add_function_assign_hook("drm_malloc_ab", &match_calloc, NULL);
 475                 add_function_assign_hook("drm_calloc_large", &match_calloc, NULL);
 476                 add_function_assign_hook("kmemdup", &match_alloc, INT_PTR(1));
 477                 add_function_assign_hook("kmemdup_user", &match_alloc, INT_PTR(1));
 478         }
 479         add_hook(&match_array_assignment, ASSIGNMENT_HOOK);
 480         add_hook(&match_strlen_condition, CONDITION_HOOK);
 481         add_function_assign_hook("strlen", &match_strlen, NULL);
 482
 483         add_function_hook("strlcpy", &match_limited, &b0_l2);
 484         add_function_hook("strlcat", &match_limited, &b0_l2);
 485         add_function_hook("memscan", &match_limited, &b0_l2);
 486
 487         add_function_hook("strcpy", &match_strcpy, NULL);
 488
 489         add_function_assign_hook("strndup", match_strndup, NULL);
 490         if (option_project == PROJ_KERNEL)
 491                 add_function_assign_hook("kstrndup", match_strndup, NULL);
 492
 493         if (option_info)
 494                 add_hook(&match_call, FUNCTION_CALL_HOOK);
 495
 496         add_hook(&match_func_end, END_FUNC_HOOK);
 497 }
 498
 499 void register_strlen(int id)
 500 {
 501         my_strlen_id = id;
 502 }