check_overflow: test copy_to/from_user as well.
[smatch.git] / smatch_slist.c
blob2fa200732254bde60ee86060322d8333826753b9
1 /*
2 * sparse/smatch_slist.c
4 * Copyright (C) 2008,2009 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
8 */
10 #include <stdlib.h>
11 #include <stdio.h>
12 #include "smatch.h"
13 #include "smatch_slist.h"
15 #undef CHECKORDER
16 #undef CHECKMYPOOLS
18 ALLOCATOR(sm_state, "smatch state");
19 ALLOCATOR(named_slist, "named slist");
21 void __print_slist(struct state_list *slist)
23 struct sm_state *state;
24 struct sm_state *poss;
25 int i;
27 printf("dumping slist at %d\n", get_lineno());
28 FOR_EACH_PTR(slist, state) {
29 printf("%d '%s'=%s (", state->owner, state->name,
30 show_state(state->state));
31 i = 0;
32 FOR_EACH_PTR(state->possible, poss) {
33 if (i++)
34 printf(", ");
35 printf("%s", show_state(poss->state));
36 } END_FOR_EACH_PTR(poss);
37 printf(")\n");
38 } END_FOR_EACH_PTR(state);
39 printf("---\n");
43 /* NULL states go at the end to simplify merge_slist */
44 int cmp_tracker(const struct sm_state *a, const struct sm_state *b)
46 int ret;
48 if (!a && !b)
49 return 0;
50 if (!b)
51 return -1;
52 if (!a)
53 return 1;
55 if (a->owner > b->owner)
56 return -1;
57 if (a->owner < b->owner)
58 return 1;
60 ret = strcmp(a->name, b->name);
61 if (ret)
62 return ret;
64 if (!b->sym && a->sym)
65 return -1;
66 if (!a->sym && b->sym)
67 return 1;
68 if (a->sym > b->sym)
69 return -1;
70 if (a->sym < b->sym)
71 return 1;
73 return 0;
76 static int cmp_sm_states(const struct sm_state *a, const struct sm_state *b)
78 int ret;
80 ret = cmp_tracker(a, b);
81 if (ret)
82 return ret;
84 /* todo: add hook for smatch_extra.c */
85 if (a->state > b->state)
86 return -1;
87 if (a->state < b->state)
88 return 1;
89 return 0;
92 void add_sm_state_slist(struct state_list **slist, struct sm_state *new)
94 struct sm_state *tmp;
96 FOR_EACH_PTR(*slist, tmp) {
97 if (cmp_sm_states(tmp, new) < 0)
98 continue;
99 else if (cmp_sm_states(tmp, new) == 0) {
100 return;
101 } else {
102 INSERT_CURRENT(new, tmp);
103 return;
105 } END_FOR_EACH_PTR(tmp);
106 add_ptr_list(slist, new);
109 static void add_possible(struct sm_state *sm, struct sm_state *new)
111 struct sm_state *tmp;
112 struct sm_state *tmp2;
114 if (!new) {
115 struct smatch_state *s;
117 s = merge_states(sm->name, sm->owner, sm->sym, sm->state, NULL);
118 tmp = alloc_state(sm->name, sm->owner, sm->sym, s);
119 add_sm_state_slist(&sm->possible, tmp);
120 return;
123 FOR_EACH_PTR(new->possible, tmp) {
124 tmp2 = alloc_state(tmp->name, tmp->owner, tmp->sym, tmp->state);
125 add_sm_state_slist(&sm->possible, tmp2);
126 } END_FOR_EACH_PTR(tmp);
129 struct sm_state *alloc_state(const char *name, int owner,
130 struct symbol *sym, struct smatch_state *state)
132 struct sm_state *sm_state = __alloc_sm_state(0);
134 sm_state->name = alloc_string(name);
135 sm_state->owner = owner;
136 sm_state->sym = sym;
137 sm_state->state = state;
138 sm_state->line = get_lineno();
139 sm_state->my_pools = NULL;
140 sm_state->all_pools = NULL;
141 sm_state->possible = NULL;
142 add_ptr_list(&sm_state->possible, sm_state);
143 return sm_state;
146 static void free_sm_state(struct sm_state *sm)
148 free_string(sm->name);
149 free_slist(&sm->possible);
150 free_stack(&sm->my_pools);
151 free_stack(&sm->all_pools);
153 * fixme. Free the actual state.
154 * Right now we leave it until the end of the function
155 * because we don't want to double free it.
156 * Use the freelist to not double free things
160 static void free_all_sm_states(struct allocation_blob *blob)
162 unsigned int size = sizeof(struct sm_state);
163 unsigned int offset = 0;
165 while (offset < blob->offset) {
166 free_sm_state((struct sm_state *)(blob->data + offset));
167 offset += size;
171 /* At the end of every function we free all the sm_states */
172 void free_every_single_sm_state(void)
174 struct allocator_struct *desc = &sm_state_allocator;
175 struct allocation_blob *blob = desc->blobs;
177 desc->blobs = NULL;
178 desc->allocations = 0;
179 desc->total_bytes = 0;
180 desc->useful_bytes = 0;
181 desc->freelist = NULL;
182 while (blob) {
183 struct allocation_blob *next = blob->next;
184 free_all_sm_states(blob);
185 blob_free(blob, desc->chunking);
186 blob = next;
190 struct sm_state *clone_state(struct sm_state *s)
192 struct sm_state *ret;
193 struct sm_state *poss;
195 ret = alloc_state(s->name, s->owner, s->sym, s->state);
196 ret->line = s->line;
197 ret->my_pools = clone_stack(s->my_pools);
198 ret->all_pools = clone_stack(s->all_pools);
199 FOR_EACH_PTR(s->possible, poss) {
200 add_sm_state_slist(&ret->possible, poss);
201 } END_FOR_EACH_PTR(poss);
202 return ret;
205 int slist_has_state(struct state_list *slist, struct smatch_state *state)
207 struct sm_state *tmp;
209 FOR_EACH_PTR(slist, tmp) {
210 if (tmp->state == state)
211 return 1;
212 } END_FOR_EACH_PTR(tmp);
213 return 0;
216 static void check_order(struct state_list *slist)
218 #ifdef CHECKORDER
219 struct sm_state *state;
220 struct sm_state *last = NULL;
221 int printed = 0;
223 FOR_EACH_PTR(slist, state) {
224 if (last && cmp_tracker(state, last) <= 0) {
225 printf("Error. Unsorted slist %d vs %d, %p vs %p, "
226 "%s vs %s\n", last->owner, state->owner,
227 last->sym, state->sym, last->name, state->name);
228 printed = 1;
230 last = state;
231 } END_FOR_EACH_PTR(state);
233 if (printed)
234 printf("======\n");
235 #endif
237 #ifdef CHECKMYPOOLS
238 static void check_my_pools(struct sm_state *sm)
240 struct sm_state *poss;
241 struct state_list *slist;
243 if (sm->state != &merged)
244 return;
246 FOR_EACH_PTR(sm->possible, poss) {
247 if (poss->state == &merged)
248 continue;
249 FOR_EACH_PTR(sm->my_pools, slist) {
250 if (get_state_slist(slist, sm->name, sm->owner, sm->sym)
251 == poss->state)
252 goto found;
253 } END_FOR_EACH_PTR(slist);
254 printf("%d pool not found for '%s' possible state \"%s\".\n",
255 get_lineno(), sm->name, show_state(poss->state));
256 return;
257 found:
258 continue;
259 } END_FOR_EACH_PTR(poss);
261 #endif
263 static void sanity_check_pools(struct state_list *slist)
265 #ifdef CHECKMYPOOLS
266 struct sm_state *tmp;
268 FOR_EACH_PTR(slist, tmp) {
269 check_my_pools(tmp);
270 } END_FOR_EACH_PTR(tmp);
271 #endif
274 struct state_list *clone_slist(struct state_list *from_slist)
276 struct sm_state *state;
277 struct sm_state *tmp;
278 struct state_list *to_slist = NULL;
280 FOR_EACH_PTR(from_slist, state) {
281 tmp = clone_state(state);
282 add_ptr_list(&to_slist, tmp);
283 } END_FOR_EACH_PTR(state);
284 check_order(to_slist);
285 return to_slist;
288 struct state_list_stack *clone_stack(struct state_list_stack *from_stack)
290 struct state_list *slist;
291 struct state_list_stack *to_stack = NULL;
293 FOR_EACH_PTR(from_stack, slist) {
294 push_slist(&to_stack, slist);
295 } END_FOR_EACH_PTR(slist);
296 return to_stack;
299 struct smatch_state *merge_states(const char *name, int owner,
300 struct symbol *sym,
301 struct smatch_state *state1,
302 struct smatch_state *state2)
304 struct smatch_state *ret;
306 if (state1 == state2)
307 ret = state1;
308 else if (__has_merge_function(owner))
309 ret = __client_merge_function(owner, name, sym, state1, state2);
310 else if (!state1 || !state2)
311 ret = &undefined;
312 else
313 ret = &merged;
314 return ret;
318 * add_pool() adds a slist to ->pools. If the slist has already been
319 * added earlier then it doesn't get added a second time.
321 static void add_pool(struct state_list_stack **pools, struct state_list *new)
323 struct state_list *tmp;
325 FOR_EACH_PTR(*pools, tmp) {
326 if (tmp < new)
327 continue;
328 else if (tmp == new) {
329 return;
330 } else {
331 INSERT_CURRENT(new, tmp);
332 return;
334 } END_FOR_EACH_PTR(tmp);
335 add_ptr_list(pools, new);
338 static void copy_pools(struct sm_state *to, struct sm_state *sm)
340 struct state_list *tmp;
342 if (!sm)
343 return;
345 FOR_EACH_PTR(sm->my_pools, tmp) {
346 add_pool(&to->my_pools, tmp);
347 } END_FOR_EACH_PTR(tmp);
349 FOR_EACH_PTR(sm->all_pools, tmp) {
350 add_pool(&to->all_pools, tmp);
351 } END_FOR_EACH_PTR(tmp);
354 struct sm_state *merge_sm_states(struct sm_state *one, struct sm_state *two)
356 struct smatch_state *s;
357 struct sm_state *result;
359 s = merge_states(one->name, one->owner, one->sym, one->state,
360 (two?two->state:NULL));
361 result = alloc_state(one->name, one->owner, one->sym, s);
362 if (two && one->line == two->line)
363 result->line = one->line;
364 add_possible(result, one);
365 add_possible(result, two);
366 copy_pools(result, one);
367 copy_pools(result, two);
369 if (debug_states) {
370 struct sm_state *tmp;
371 int i = 0;
373 printf("%d merge name='%s' owner=%d: %s + %s => %s (",
374 get_lineno(), one->name, one->owner,
375 show_state(one->state), show_state(two?two->state:NULL),
376 show_state(s));
378 FOR_EACH_PTR(result->possible, tmp) {
379 if (i++) {
380 printf(", ");
382 printf("%s", show_state(tmp->state));
383 } END_FOR_EACH_PTR(tmp);
384 printf(")\n");
387 return result;
390 struct sm_state *get_sm_state_slist(struct state_list *slist, const char *name,
391 int owner, struct symbol *sym)
393 struct sm_state *state;
395 if (!name)
396 return NULL;
398 FOR_EACH_PTR(slist, state) {
399 if (state->owner == owner && state->sym == sym
400 && !strcmp(state->name, name))
401 return state;
402 } END_FOR_EACH_PTR(state);
403 return NULL;
406 struct smatch_state *get_state_slist(struct state_list *slist,
407 const char *name, int owner,
408 struct symbol *sym)
410 struct sm_state *state;
412 state = get_sm_state_slist(slist, name, owner, sym);
413 if (state)
414 return state->state;
415 return NULL;
418 void overwrite_sm_state(struct state_list **slist, struct sm_state *new)
420 struct sm_state *tmp;
422 FOR_EACH_PTR(*slist, tmp) {
423 if (cmp_tracker(tmp, new) < 0)
424 continue;
425 else if (cmp_tracker(tmp, new) == 0) {
426 REPLACE_CURRENT_PTR(tmp, new);
427 return;
428 } else {
429 INSERT_CURRENT(new, tmp);
430 return;
432 } END_FOR_EACH_PTR(tmp);
433 add_ptr_list(slist, new);
436 void overwrite_sm_state_stack(struct state_list_stack **stack,
437 struct sm_state *state)
439 struct state_list *slist;
441 slist = pop_slist(stack);
442 overwrite_sm_state(&slist, state);
443 push_slist(stack, slist);
446 void set_state_slist(struct state_list **slist, const char *name, int owner,
447 struct symbol *sym, struct smatch_state *state)
449 struct sm_state *tmp;
450 struct sm_state *new = alloc_state(name, owner, sym, state);
452 FOR_EACH_PTR(*slist, tmp) {
453 if (cmp_tracker(tmp, new) < 0)
454 continue;
455 else if (cmp_tracker(tmp, new) == 0) {
456 REPLACE_CURRENT_PTR(tmp, new);
457 return;
458 } else {
459 INSERT_CURRENT(new, tmp);
460 return;
462 } END_FOR_EACH_PTR(tmp);
463 add_ptr_list(slist, new);
466 void delete_state_slist(struct state_list **slist, const char *name, int owner,
467 struct symbol *sym)
469 struct sm_state *state;
471 FOR_EACH_PTR(*slist, state) {
472 if (state->owner == owner && state->sym == sym
473 && !strcmp(state->name, name)){
474 delete_ptr_list_entry((struct ptr_list **)slist,
475 state, 1);
476 return;
478 } END_FOR_EACH_PTR(state);
482 void push_slist(struct state_list_stack **list_stack, struct state_list *slist)
484 add_ptr_list(list_stack, slist);
487 struct state_list *pop_slist(struct state_list_stack **list_stack)
489 struct state_list *slist;
491 slist = last_ptr_list((struct ptr_list *)*list_stack);
492 delete_ptr_list_last((struct ptr_list **)list_stack);
493 return slist;
496 void free_slist(struct state_list **slist)
498 __free_ptr_list((struct ptr_list **)slist);
501 void free_stack(struct state_list_stack **stack)
503 __free_ptr_list((struct ptr_list **)stack);
506 void free_stack_and_slists(struct state_list_stack **slist_stack)
508 struct state_list *slist;
510 FOR_EACH_PTR(*slist_stack, slist) {
511 free_slist(&slist);
512 } END_FOR_EACH_PTR(slist);
513 free_stack(slist_stack);
517 * set_state_stack() sets the state for the top slist on the stack.
519 void set_state_stack(struct state_list_stack **stack, const char *name,
520 int owner, struct symbol *sym, struct smatch_state *state)
522 struct state_list *slist;
524 slist = pop_slist(stack);
525 set_state_slist(&slist, name, owner, sym, state);
526 push_slist(stack, slist);
530 * get_sm_state_stack() gets the state for the top slist on the stack.
532 struct sm_state *get_sm_state_stack(struct state_list_stack *stack,
533 const char *name, int owner,
534 struct symbol *sym)
536 struct state_list *slist;
537 struct sm_state *ret;
539 slist = pop_slist(&stack);
540 ret = get_sm_state_slist(slist, name, owner, sym);
541 push_slist(&stack, slist);
542 return ret;
546 struct smatch_state *get_state_stack(struct state_list_stack *stack,
547 const char *name, int owner,
548 struct symbol *sym)
550 struct sm_state *state;
552 state = get_sm_state_stack(stack, name, owner, sym);
553 if (state)
554 return state->state;
555 return NULL;
558 static void register_implied_pool(struct state_list *pool)
560 struct sm_state *sm;
562 FOR_EACH_PTR(pool, sm) {
563 if (sm->state != &merged)
564 free_stack(&sm->my_pools);
565 if (!sm->my_pools)
566 add_pool(&sm->my_pools, pool);
567 add_pool(&sm->all_pools, pool);
568 } END_FOR_EACH_PTR(sm);
570 push_slist(&implied_pools, pool);
573 static void match_states(struct state_list **one, struct state_list **two)
575 struct sm_state *one_state;
576 struct sm_state *two_state;
577 struct sm_state *tmp;
578 struct smatch_state *tmp_state;
579 struct state_list *add_to_one = NULL;
580 struct state_list *add_to_two = NULL;
582 PREPARE_PTR_LIST(*one, one_state);
583 PREPARE_PTR_LIST(*two, two_state);
584 for (;;) {
585 if (!one_state && !two_state)
586 break;
587 if (cmp_tracker(one_state, two_state) < 0) {
588 tmp_state = __client_unmatched_state_function(one_state);
589 tmp = alloc_state(one_state->name, one_state->owner,
590 one_state->sym, tmp_state);
591 add_ptr_list(&add_to_two, tmp);
592 NEXT_PTR_LIST(one_state);
593 } else if (cmp_tracker(one_state, two_state) == 0) {
594 NEXT_PTR_LIST(one_state);
595 NEXT_PTR_LIST(two_state);
596 } else {
597 tmp_state = __client_unmatched_state_function(two_state);
598 tmp = alloc_state(two_state->name, two_state->owner,
599 two_state->sym, tmp_state);
600 add_ptr_list(&add_to_one, tmp);
601 NEXT_PTR_LIST(two_state);
604 FINISH_PTR_LIST(two_state);
605 FINISH_PTR_LIST(one_state);
607 overwrite_slist(add_to_one, one);
608 overwrite_slist(add_to_two, two);
612 * merge_slist() is called whenever paths merge, such as after
613 * an if statement. It takes the two slists and creates one.
615 void merge_slist(struct state_list **to, struct state_list *slist)
617 struct sm_state *to_state, *state, *tmp;
618 struct state_list *results = NULL;
619 struct state_list *implied_to = NULL;
620 struct state_list *implied_from = NULL;
622 check_order(*to);
623 check_order(slist);
624 sanity_check_pools(*to);
625 sanity_check_pools(slist);
627 /* merging a null and nonnull path gives you only the nonnull path */
628 if (!slist) {
629 return;
631 if (!*to) {
632 *to = clone_slist(slist);
633 return;
636 implied_to = clone_slist(*to);
637 implied_from = clone_slist(slist);
639 match_states(&implied_to, &implied_from);
641 register_implied_pool(implied_to);
642 register_implied_pool(implied_from);
644 PREPARE_PTR_LIST(implied_to, to_state);
645 PREPARE_PTR_LIST(implied_from, state);
646 for (;;) {
647 if (!to_state && !state)
648 break;
649 if (cmp_tracker(to_state, state) < 0) {
650 smatch_msg("error: Internal smatch error.");
651 NEXT_PTR_LIST(to_state);
652 } else if (cmp_tracker(to_state, state) == 0) {
653 tmp = merge_sm_states(to_state, state);
654 add_ptr_list(&results, tmp);
655 NEXT_PTR_LIST(to_state);
656 NEXT_PTR_LIST(state);
657 } else {
658 smatch_msg("error: Internal smatch error.");
659 NEXT_PTR_LIST(state);
662 FINISH_PTR_LIST(state);
663 FINISH_PTR_LIST(to_state);
665 free_slist(to);
666 *to = results;
669 static struct sm_state *find_intersection(struct sm_state *one,
670 struct sm_state *two)
672 struct state_list *tmp1, *tmp2;
673 struct state_list_stack *stack = NULL;
674 struct sm_state *tmp_state;
675 struct sm_state *ret;
677 if (!one)
678 return two;
679 if (one->state != &merged) {
680 if (one->state == two->state)
681 return one;
682 if (two->state != &merged) {
683 smatch_msg("mutually exclusive 'and' conditions states "
684 "'%s': %s + %s", one->name,
685 show_state(one->state),
686 show_state(two->state));
687 return two;
691 PREPARE_PTR_LIST(one->my_pools, tmp1);
692 PREPARE_PTR_LIST(two->my_pools, tmp2);
693 for (;;) {
694 if (!tmp1 && !tmp2)
695 break;
696 if (!tmp2 || (tmp1 && tmp1 < tmp2)) {
697 NEXT_PTR_LIST(tmp1);
698 } else if (tmp1 == tmp2) {
699 push_slist(&stack, tmp1);
700 NEXT_PTR_LIST(tmp1);
701 NEXT_PTR_LIST(tmp2);
702 } else {
703 NEXT_PTR_LIST(tmp2);
706 FINISH_PTR_LIST(tmp2);
707 FINISH_PTR_LIST(tmp1);
709 if (!stack) {
710 smatch_msg("mutually eXclusive 'and' conditions states "
711 "'%s': %s + %s", one->name, show_state(one->state),
712 show_state(two->state));
713 return two;
716 ret = alloc_state(one->name, one->owner, one->sym, &merged);
717 FOR_EACH_PTR(stack, tmp1) {
718 tmp_state = get_sm_state_slist(tmp1, one->name, one->owner,
719 one->sym);
720 add_possible(ret, tmp_state);
721 } END_FOR_EACH_PTR(tmp1);
722 ret->my_pools = stack;
723 ret->all_pools = clone_stack(stack);
724 return ret;
728 * and_slist_stack() is basically the same as popping the top two slists,
729 * overwriting the one with the other and pushing it back on the stack.
730 * The difference is that it checks to see that a mutually exclusive
731 * state isn't included in both stacks. If smatch sees something like
732 * "if (a && !a)" it prints a warning.
734 void and_slist_stack(struct state_list_stack **slist_stack)
736 struct sm_state *tmp;
737 struct sm_state *left_state;
738 struct sm_state *res;
739 struct state_list *right_slist = pop_slist(slist_stack);
741 FOR_EACH_PTR(right_slist, tmp) {
742 left_state = get_sm_state_stack(*slist_stack, tmp->name,
743 tmp->owner, tmp->sym);
744 res = find_intersection(left_state, tmp);
745 overwrite_sm_state_stack(slist_stack, res);
746 } END_FOR_EACH_PTR(tmp);
747 free_slist(&right_slist);
751 * or_slist_stack() is for if we have: if (foo || bar) { foo->baz;
752 * It pops the two slists from the top of the stack and merges them
753 * together in a way that preserves the things they have in common
754 * but creates a merged state for most of the rest.
755 * You could have code that had: if (foo || foo) { foo->baz;
756 * It's this function which ensures smatch does the right thing.
758 void or_slist_stack(struct state_list_stack **pre_conds,
759 struct state_list *cur_slist,
760 struct state_list_stack **slist_stack)
762 struct state_list *new;
763 struct state_list *old;
764 struct state_list *res = NULL;
765 struct state_list *tmp_slist;
767 new = pop_slist(slist_stack);
768 old = pop_slist(slist_stack);
770 tmp_slist = pop_slist(pre_conds);
771 res = clone_slist(tmp_slist);
772 push_slist(pre_conds, tmp_slist);
773 overwrite_slist(old, &res);
775 tmp_slist = clone_slist(cur_slist);
776 overwrite_slist(new, &tmp_slist);
778 merge_slist(&res, tmp_slist);
780 push_slist(slist_stack, res);
781 free_slist(&tmp_slist);
782 free_slist(&new);
783 free_slist(&old);
787 * get_slist_from_named_stack() is only used for gotos.
789 struct state_list **get_slist_from_named_stack(struct named_stack *stack,
790 const char *name)
792 struct named_slist *tmp;
794 FOR_EACH_PTR(stack, tmp) {
795 if (!strcmp(tmp->name, name))
796 return &tmp->slist;
797 } END_FOR_EACH_PTR(tmp);
798 return NULL;
801 void overwrite_slist(struct state_list *from, struct state_list **to)
803 struct sm_state *tmp;
805 FOR_EACH_PTR(from, tmp) {
806 overwrite_sm_state(to, tmp);
807 } END_FOR_EACH_PTR(tmp);
810 unsigned int __get_allocations()
812 return sm_state_allocator.allocations;