smatch_type_val.c

   1 /*
   2  * Copyright (C) 2013 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * The plan here is to save all the possible values store to a given struct
  20  * member.
  21  *
  22  * We will load all the values in to the function_type_val table first then
  23  * run a script on that and load all the resulting values into the type_val
  24  * table.
  25  *
  26  * So in this file we want to take the union of everything assigned to the
  27  * struct member and insert it into the function_type_val at the end.
  28  *
  29  * You would think that we could use smatch_modification_hooks.c or
  30  * extra_modification_hook() here to get the information here but in the end we
  31  * need to code everything again a third time.
  32  *
  33  */
  34
  35 #include "smatch.h"
  36 #include "smatch_slist.h"
  37 #include "smatch_extra.h"
  38
  39 static int my_id;
  40
  41 struct stree_stack *fn_type_val_stack;
  42 struct stree *fn_type_val;
  43 struct stree *global_type_val;
  44
  45 static char *db_vals;
  46 static int get_vals(void *unused, int argc, char **argv, char **azColName)
  47 {
  48         db_vals = alloc_string(argv[0]);
  49         return 0;
  50 }
  51
  52 static void match_inline_start(struct expression *expr)
  53 {
  54         push_stree(&fn_type_val_stack, fn_type_val);
  55         fn_type_val = NULL;
  56 }
  57
  58 static void match_inline_end(struct expression *expr)
  59 {
  60         free_stree(&fn_type_val);
  61         fn_type_val = pop_stree(&fn_type_val_stack);
  62 }
  63
  64 int get_db_type_rl(struct expression *expr, struct range_list **rl)
  65 {
  66         char *member;
  67         struct range_list *tmp;
  68         struct symbol *type;
  69
  70         member = get_member_name(expr);
  71         if (!member)
  72                 return 0;
  73
  74         db_vals = NULL;
  75         run_sql(get_vals, NULL,
  76                 "select value from type_value where type = '%s';", member);
  77         free_string(member);
  78         if (!db_vals)
  79                 return 0;
  80         type = get_type(expr);
  81         str_to_rl(type, db_vals, &tmp);
  82         free_string(db_vals);
  83         if (is_whole_rl(tmp))
  84                 return 0;
  85         *rl = tmp;
  86
  87         return 1;
  88 }
  89
  90 static void add_type_val(char *member, struct range_list *rl)
  91 {
  92         struct smatch_state *old, *add, *new;
  93
  94         member = alloc_string(member);
  95         old = get_state_stree(fn_type_val, my_id, member, NULL);
  96         add = alloc_estate_rl(rl);
  97         if (old)
  98                 new = merge_estates(old, add);
  99         else
 100                 new = add;
 101         set_state_stree(&fn_type_val, my_id, member, NULL, new);
 102 }
 103
 104 static void add_fake_type_val(char *member, struct range_list *rl, int ignore)
 105 {
 106         struct smatch_state *old, *add, *new;
 107
 108         member = alloc_string(member);
 109         old = get_state_stree(fn_type_val, my_id, member, NULL);
 110         if (old && strcmp(old->name, "min-max") == 0)
 111                 return;
 112         if (ignore && old && strcmp(old->name, "ignore") == 0)
 113                 return;
 114         add = alloc_estate_rl(rl);
 115         if (old) {
 116                 new = merge_estates(old, add);
 117         } else {
 118                 new = add;
 119                 if (ignore)
 120                         new->name = alloc_string("ignore");
 121                 else
 122                         new->name = alloc_string("min-max");
 123         }
 124         set_state_stree(&fn_type_val, my_id, member, NULL, new);
 125 }
 126
 127 static void add_global_type_val(char *member, struct range_list *rl)
 128 {
 129         struct smatch_state *old, *add, *new;
 130
 131         member = alloc_string(member);
 132         old = get_state_stree(global_type_val, my_id, member, NULL);
 133         add = alloc_estate_rl(rl);
 134         if (old)
 135                 new = merge_estates(old, add);
 136         else
 137                 new = add;
 138         new = clone_estate_perm(new);
 139         set_state_stree_perm(&global_type_val, my_id, member, NULL, new);
 140 }
 141
 142 static int has_link_cb(void *has_link, int argc, char **argv, char **azColName)
 143 {
 144         *(int *)has_link = 1;
 145         return 0;
 146 }
 147
 148 static int is_ignored_fake_assignment(void)
 149 {
 150         struct expression *expr;
 151         struct symbol *type;
 152         char *member_name;
 153         int has_link = 0;
 154
 155         expr = get_faked_expression();
 156         if (!expr || expr->type != EXPR_ASSIGNMENT)
 157                 return 0;
 158         if (!is_void_pointer(expr->right))
 159                 return 0;
 160         member_name = get_member_name(expr->right);
 161         if (!member_name)
 162                 return 0;
 163
 164         type = get_type(expr->left);
 165         if (!type || type->type != SYM_PTR)
 166                 return 0;
 167         type = get_real_base_type(type);
 168         if (!type || type->type != SYM_STRUCT)
 169                 return 0;
 170
 171         run_sql(has_link_cb, &has_link,
 172                 "select * from data_info where type = %d and data = '%s' and value = '%s';",
 173                 TYPE_LINK, member_name, type_to_str(type));
 174         return has_link;
 175 }
 176
 177 static int is_ignored_macro(void)
 178 {
 179         struct expression *expr;
 180         char *name;
 181
 182         expr = get_faked_expression();
 183         if (!expr || expr->type != EXPR_ASSIGNMENT)
 184                 return 0;
 185         name = get_macro_name(expr->right->pos);
 186         if (!name)
 187                 return 0;
 188         if (strcmp(name, "container_of") == 0)
 189                 return 1;
 190         if (strcmp(name, "rb_entry") == 0)
 191                 return 1;
 192         if (strcmp(name, "list_entry") == 0)
 193                 return 1;
 194         if (strcmp(name, "list_first_entry") == 0)
 195                 return 1;
 196         if (strcmp(name, "hlist_entry") == 0)
 197                 return 1;
 198         if (strstr(name, "for_each"))
 199                 return 1;
 200         return 0;
 201 }
 202
 203 static int is_ignored_function(void)
 204 {
 205         struct expression *expr;
 206
 207         expr = get_faked_expression();
 208         if (!expr || expr->type != EXPR_ASSIGNMENT)
 209                 return 0;
 210         expr = strip_expr(expr->right);
 211         if (!expr || expr->type != EXPR_CALL || expr->fn->type != EXPR_SYMBOL)
 212                 return 0;
 213
 214         if (sym_name_is("kmalloc", expr->fn))
 215                 return 1;
 216         if (sym_name_is("netdev_priv", expr->fn))
 217                 return 1;
 218
 219         return 0;
 220 }
 221
 222 static int is_uncasted_function(void)
 223 {
 224         struct expression *expr;
 225         struct symbol *left_type, *right_type;
 226
 227         expr = get_faked_expression();
 228         if (!expr || expr->type != EXPR_ASSIGNMENT)
 229                 return 0;
 230         if (expr->right->type != EXPR_CALL)
 231                 return 0;
 232         left_type = get_type(expr->left);
 233         right_type = get_type(expr->right);
 234
 235         if (!left_type || !right_type)
 236                 return 0;
 237         if (left_type->type != SYM_PTR || right_type->type != SYM_PTR)
 238                 return 0;
 239         left_type = get_real_base_type(left_type);
 240         right_type = get_real_base_type(right_type);
 241
 242         if (left_type == right_type)
 243                 return 1;
 244         return 0;
 245 }
 246
 247 static void match_assign_value(struct expression *expr)
 248 {
 249         char *member, *right_member;
 250         struct range_list *rl;
 251         struct symbol *type;
 252
 253         type = get_type(expr->left);
 254         if (type && type->type == SYM_STRUCT)
 255                 return;
 256
 257         member = get_member_name(expr->left);
 258         if (!member)
 259                 return;
 260
 261         /* if we're saying foo->mtu = bar->mtu then that doesn't add information */
 262         right_member = get_member_name(expr->right);
 263         if (right_member && strcmp(right_member, member) == 0)
 264                 goto free;
 265
 266         if (is_fake_call(expr->right)) {
 267                 if (is_ignored_macro())
 268                         goto free;
 269                 if (is_ignored_function())
 270                         goto free;
 271                 if (is_uncasted_function())
 272                         goto free;
 273                 add_fake_type_val(member, alloc_whole_rl(get_type(expr->left)), is_ignored_fake_assignment());
 274                 goto free;
 275         }
 276
 277         if (expr->op == '=') {
 278                 get_absolute_rl(expr->right, &rl);
 279                 rl = cast_rl(type, rl);
 280         } else {
 281                 /*
 282                  * This is a bit cheating.  We order it so this will already be set
 283                  * by smatch_extra.c and we just look up the value.
 284                  */
 285                 get_absolute_rl(expr->left, &rl);
 286         }
 287         add_type_val(member, rl);
 288 free:
 289         free_string(right_member);
 290         free_string(member);
 291 }
 292
 293 /*
 294  * If we too:  int *p = &my_struct->member then abandon all hope of tracking
 295  * my_struct->member.
 296  */
 297 static void match_assign_pointer(struct expression *expr)
 298 {
 299         struct expression *right;
 300         char *member;
 301         struct range_list *rl;
 302         struct symbol *type;
 303
 304         right = strip_expr(expr->right);
 305         if (right->type != EXPR_PREOP || right->op != '&')
 306                 return;
 307         right = strip_expr(right->unop);
 308
 309         member = get_member_name(right);
 310         if (!member)
 311                 return;
 312         type = get_type(right);
 313         rl = alloc_whole_rl(type);
 314         add_type_val(member, rl);
 315         free_string(member);
 316 }
 317
 318 static void match_global_assign(struct expression *expr)
 319 {
 320         char *member;
 321         struct range_list *rl;
 322         struct symbol *type;
 323
 324         type = get_type(expr->left);
 325         if (type && (type->type == SYM_ARRAY || type->type == SYM_STRUCT))
 326                 return;
 327         member = get_member_name(expr->left);
 328         if (!member)
 329                 return;
 330         get_absolute_rl(expr->right, &rl);
 331         add_global_type_val(member, rl);
 332         free_string(member);
 333 }
 334
 335 static void unop_expr(struct expression *expr)
 336 {
 337         struct range_list *rl;
 338         char *member;
 339
 340         if (expr->op != SPECIAL_DECREMENT && expr->op != SPECIAL_INCREMENT)
 341                 return;
 342
 343         expr = strip_expr(expr->unop);
 344         member = get_member_name(expr);
 345         if (!member)
 346                 return;
 347         rl = alloc_whole_rl(get_type(expr));
 348         add_type_val(member, rl);
 349         free_string(member);
 350 }
 351
 352 static void asm_expr(struct statement *stmt)
 353 {
 354         struct expression *expr;
 355         struct range_list *rl;
 356         char *member;
 357         int state = 0;
 358
 359         FOR_EACH_PTR(stmt->asm_outputs, expr) {
 360                 switch (state) {
 361                 case 0: /* identifier */
 362                 case 1: /* constraint */
 363                         state++;
 364                         continue;
 365                 case 2: /* expression */
 366                         state = 0;
 367                         member = get_member_name(expr);
 368                         if (!member)
 369                                 continue;
 370                         rl = alloc_whole_rl(get_type(expr));
 371                         add_type_val(member, rl);
 372                         free_string(member);
 373                         continue;
 374                 }
 375         } END_FOR_EACH_PTR(expr);
 376 }
 377
 378 static void db_param_add(struct expression *expr, int param, char *key, char *value)
 379 {
 380         struct expression *arg;
 381         struct symbol *type;
 382         struct range_list *rl;
 383         char *member;
 384
 385         if (strcmp(key, "*$") != 0)
 386                 return;
 387
 388         while (expr->type == EXPR_ASSIGNMENT)
 389                 expr = strip_expr(expr->right);
 390         if (expr->type != EXPR_CALL)
 391                 return;
 392
 393         arg = get_argument_from_call_expr(expr->args, param);
 394         arg = strip_expr(arg);
 395         if (!arg)
 396                 return;
 397         type = get_member_type_from_key(arg, key);
 398         if (arg->type != EXPR_PREOP || arg->op != '&')
 399                 return;
 400         arg = strip_expr(arg->unop);
 401
 402         member = get_member_name(arg);
 403         if (!member)
 404                 return;
 405         call_results_to_rl(expr, type, value, &rl);
 406         add_type_val(member, rl);
 407         free_string(member);
 408 }
 409
 410 static void match_end_func_info(struct symbol *sym)
 411 {
 412         struct sm_state *sm;
 413
 414         FOR_EACH_SM(fn_type_val, sm) {
 415                 sql_insert_function_type_value(sm->name, sm->state->name);
 416         } END_FOR_EACH_SM(sm);
 417 }
 418
 419 static void match_after_func(struct symbol *sym)
 420 {
 421         free_stree(&fn_type_val);
 422 }
 423
 424 static void match_end_file(struct symbol_list *sym_list)
 425 {
 426         struct sm_state *sm;
 427
 428         FOR_EACH_SM(global_type_val, sm) {
 429                 sql_insert_function_type_value(sm->name, sm->state->name);
 430         } END_FOR_EACH_SM(sm);
 431 }
 432
 433 void register_type_val(int id)
 434 {
 435         if (!option_info)
 436                 return;
 437
 438         my_id = id;
 439
 440         add_hook(&match_assign_value, ASSIGNMENT_HOOK_AFTER);
 441         add_hook(&match_assign_pointer, ASSIGNMENT_HOOK);
 442         add_hook(&unop_expr, OP_HOOK);
 443         add_hook(&asm_expr, ASM_HOOK);
 444         select_return_states_hook(PARAM_ADD, &db_param_add);
 445         select_return_states_hook(PARAM_SET, &db_param_add);
 446
 447
 448         add_hook(&match_inline_start, INLINE_FN_START);
 449         add_hook(&match_inline_end, INLINE_FN_END);
 450
 451         add_hook(&match_end_func_info, END_FUNC_HOOK);
 452         add_hook(&match_after_func, AFTER_FUNC_HOOK);
 453
 454         add_hook(&match_global_assign, GLOBAL_ASSIGNMENT_HOOK);
 455         add_hook(&match_end_file, END_FILE_HOOK);
 456 }