smatch_flow.c

   1 /*
   2  * sparse/smatch_flow.c
   3  *
   4  * Copyright (C) 2006,2008 Dan Carpenter.
   5  *
   6  *  Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 #define _GNU_SOURCE 1
  11 #include <unistd.h>
  12 #include <stdio.h>
  13 #include "token.h"
  14 #include "smatch.h"
  15 #include "smatch_expression_stacks.h"
  16 #include "smatch_extra.h"
  17 #include "smatch_slist.h"
  18
  19 int final_pass;
  20
  21 static int __smatch_lineno = 0;
  22
  23 static const char *filename;
  24 static char *pathname;
  25 static char *full_filename;
  26 static char *cur_func;
  27 static int line_func_start;
  28 static int loop_count;
  29 static int expr_stmt_count;
  30 static struct expression_list *switch_expr_stack = NULL;
  31 static struct statement *next_stmt;
  32
  33 struct expression_list *big_expression_stack;
  34 struct statement_list *big_statement_stack;
  35 int __in_pre_condition = 0;
  36 int __bail_on_rest_of_function = 0;
  37 char *get_function(void) { return cur_func; }
  38 int get_lineno(void) { return __smatch_lineno; }
  39 int get_func_pos(void) { return __smatch_lineno - line_func_start; }
  40 int inside_loop(void) { return !!loop_count; }
  41 int in_expression_statement(void) { return !!expr_stmt_count; }
  42 struct statement *get_next_stmt(void) { return next_stmt; }
  43
  44 static void split_symlist(struct symbol_list *sym_list);
  45 static void split_declaration(struct symbol_list *sym_list);
  46 static void split_expr_list(struct expression_list *expr_list);
  47
  48 int option_assume_loops = 0;
  49 int option_known_conditions = 0;
  50 int option_two_passes = 0;
  51 struct symbol *cur_func_sym = NULL;
  52
  53 const char *get_filename(void)
  54 {
  55         if (option_full_path)
  56                 return full_filename;
  57         return filename;
  58 }
  59
  60 static void set_position(struct expression *expr)
  61 {
  62         int len;
  63         static int prev_stream = -1;
  64
  65         __smatch_lineno = expr->pos.line;
  66
  67         if (expr->pos.stream == prev_stream)
  68                 return;
  69
  70         filename = stream_name(expr->pos.stream);
  71
  72         free(full_filename);
  73         pathname = getcwd(NULL, 0);
  74         if (pathname) {
  75                 len = strlen(pathname) + 1 + strlen(filename) + 1;
  76                 full_filename = malloc(len);
  77                 snprintf(full_filename, len, "%s/%s", pathname, filename);
  78         } else {
  79                 full_filename = alloc_string(filename);
  80         }
  81         free(pathname);
  82 }
  83
  84 void __split_expr(struct expression *expr)
  85 {
  86         if (!expr)
  87                 return;
  88
  89         // sm_msg(" Debug expr_type %d %s", expr->type, show_special(expr->op));
  90
  91         push_expression(&big_expression_stack, expr);
  92         set_position(expr);
  93         __pass_to_client(expr, EXPR_HOOK);
  94
  95         switch (expr->type) {
  96         case EXPR_PREOP:
  97                 if (expr->op == '*')
  98                         __pass_to_client(expr, DEREF_HOOK);
  99         case EXPR_POSTOP:
 100                 __pass_to_client(expr, OP_HOOK);
 101                 __split_expr(expr->unop);
 102                 break;
 103         case EXPR_STATEMENT:
 104                 expr_stmt_count++;
 105                 __split_stmt(expr->statement);
 106                 expr_stmt_count--;
 107                 break;
 108         case EXPR_LOGICAL:
 109         case EXPR_COMPARE:
 110                 __handle_logic(expr);
 111                 break;
 112         case EXPR_BINOP:
 113                 __pass_to_client(expr, BINOP_HOOK);
 114         case EXPR_COMMA:
 115                 __split_expr(expr->left);
 116                 __split_expr(expr->right);
 117                 break;
 118         case EXPR_ASSIGNMENT: {
 119                 struct expression *tmp;
 120
 121                 /* foo = !bar() */
 122                 if (__handle_condition_assigns(expr))
 123                         break;
 124
 125                 /* foo = (x < 5 ? foo : 5); */
 126                 if (__handle_select_assigns(expr))
 127                         break;
 128
 129                 __split_expr(expr->right);
 130                 __pass_to_client(expr, ASSIGNMENT_HOOK);
 131                 tmp = strip_expr(expr->right);
 132                 if (tmp->type == EXPR_CALL)
 133                         __pass_to_client(expr, CALL_ASSIGNMENT_HOOK);
 134                 __split_expr(expr->left);
 135                 break;
 136         }
 137         case EXPR_DEREF:
 138                 __pass_to_client(expr, DEREF_HOOK);
 139                 __split_expr(expr->deref);
 140                 break;
 141         case EXPR_SLICE:
 142                 __split_expr(expr->base);
 143                 break;
 144         case EXPR_CAST:
 145         case EXPR_FORCE_CAST:
 146                 __split_expr(expr->cast_expression);
 147                 break;
 148         case EXPR_SIZEOF:
 149                 /* there isn't anything to pass a client from inside a sizeof() */
 150                 break;
 151         case EXPR_CONDITIONAL:
 152         case EXPR_SELECT:
 153                 __split_whole_condition(expr->conditional);
 154                 __split_expr(expr->cond_true);
 155                 __push_true_states();
 156                 __use_false_states();
 157                 __split_expr(expr->cond_false);
 158                 __merge_true_states();
 159                 break;
 160         case EXPR_CALL:
 161                 split_expr_list(expr->args);
 162                 __split_expr(expr->fn);
 163                 __pass_to_client(expr, FUNCTION_CALL_HOOK);
 164                 break;
 165         case EXPR_INITIALIZER:
 166                 split_expr_list(expr->expr_list);
 167                 break;
 168         case EXPR_IDENTIFIER:
 169                 __split_expr(expr->ident_expression);
 170                 break;
 171         case EXPR_INDEX:
 172                 __split_expr(expr->idx_expression);
 173                 break;
 174         case EXPR_POS:
 175                 __split_expr(expr->init_expr);
 176                 break;
 177         case EXPR_SYMBOL:
 178                 __pass_to_client(expr, SYM_HOOK);
 179                 break;
 180         case EXPR_STRING:
 181                 __pass_to_client(expr, STRING_HOOK);
 182                 break;
 183         default:
 184                 break;
 185         };
 186         pop_expression(&big_expression_stack);
 187 }
 188
 189 static int is_forever_loop(struct statement *stmt)
 190 {
 191
 192         struct expression *expr;
 193
 194         expr = strip_expr(stmt->iterator_pre_condition);
 195         if (!expr)
 196                 expr = stmt->iterator_post_condition;
 197         if (!expr) {
 198                 /* this is a for(;;) loop... */
 199                 return 1;
 200         }
 201
 202         if (expr->type == EXPR_VALUE && expr->value == 1) {
 203                 return 1;
 204         }
 205
 206         return 0;
 207 }
 208
 209 static int loop_num;
 210 static char *get_loop_name(int num)
 211 {
 212         char buf[256];
 213
 214         snprintf(buf, 255, "-loop%d", num);
 215         buf[255] = '\0';
 216         return alloc_sname(buf);;
 217 }
 218
 219 /*
 220  * Pre Loops are while and for loops.
 221  */
 222
 223 static void handle_pre_loop(struct statement *stmt)
 224 {
 225         int once_through; /* we go through the loop at least once */
 226         struct sm_state *extra_sm = NULL;
 227         int unchanged = 0;
 228         char *loop_name;
 229         struct state_list *slist = NULL;
 230         struct sm_state *sm = NULL;
 231
 232         loop_name = get_loop_name(loop_num);
 233         loop_num++;
 234
 235         __split_stmt(stmt->iterator_pre_statement);
 236
 237         once_through = implied_condition_true(stmt->iterator_pre_condition);
 238
 239         loop_count++;
 240         __push_continues();
 241         __push_breaks();
 242
 243         __merge_gotos(loop_name);
 244
 245         extra_sm = __extra_handle_canonical_loops(stmt, &slist);
 246         __in_pre_condition++;
 247         __split_whole_condition(stmt->iterator_pre_condition);
 248         __in_pre_condition--;
 249         FOR_EACH_PTR(slist, sm) {
 250                 set_state(sm->owner, sm->name, sm->sym, sm->state);
 251         } END_FOR_EACH_PTR(sm);
 252         free_slist(&slist);
 253         if (extra_sm)
 254                 extra_sm = get_sm_state(extra_sm->owner, extra_sm->name, extra_sm->sym);
 255
 256         if (option_assume_loops)
 257                 once_through = 1;
 258
 259         __split_stmt(stmt->iterator_statement);
 260         __warn_on_silly_pre_loops();
 261         if (is_forever_loop(stmt)) {
 262                 __save_gotos(loop_name);
 263                 /* forever loops don't have an iterator_post_statement */
 264                 __discard_continues();
 265                 __discard_false_states();
 266                 __use_breaks();
 267         } else {
 268                 __merge_continues();
 269                 unchanged = __iterator_unchanged(extra_sm);
 270                 __split_stmt(stmt->iterator_post_statement);
 271                 __save_gotos(loop_name);
 272                 __split_whole_condition(stmt->iterator_pre_condition);
 273                 nullify_path();
 274                 __merge_false_states();
 275                 if (once_through) {
 276                         __discard_false_states();
 277                 } else {
 278                         __merge_false_states();
 279
 280                 }
 281                 if (extra_sm && unchanged)
 282                         __extra_pre_loop_hook_after(extra_sm,
 283                                                 stmt->iterator_post_statement,
 284                                                 stmt->iterator_pre_condition);
 285                 __merge_breaks();
 286         }
 287         loop_count--;
 288 }
 289
 290 /*
 291  * Post loops are do {} while();
 292  */
 293 static void handle_post_loop(struct statement *stmt)
 294 {
 295         char *loop_name;
 296
 297         loop_name = get_loop_name(loop_num);
 298         loop_num++;
 299         loop_count++;
 300
 301         __push_continues();
 302         __push_breaks();
 303         __merge_gotos(loop_name);
 304         __split_stmt(stmt->iterator_statement);
 305         __merge_continues();
 306         if (!is_zero(stmt->iterator_post_condition))
 307                 __save_gotos(loop_name);
 308
 309         if (is_forever_loop(stmt)) {
 310                 __use_breaks();
 311         } else {
 312                 __split_whole_condition(stmt->iterator_post_condition);
 313                 __use_false_states();
 314                 __merge_breaks();
 315         }
 316         loop_count--;
 317 }
 318
 319 static int empty_statement(struct statement *stmt)
 320 {
 321         if (!stmt)
 322                 return 0;
 323         if (stmt->type == STMT_EXPRESSION && !stmt->expression)
 324                 return 1;
 325         return 0;
 326 }
 327
 328 static struct statement *last_stmt;
 329 static int is_last_stmt(struct statement *stmt)
 330 {
 331         if (stmt == last_stmt)
 332                 return 1;
 333         return 0;
 334 }
 335
 336 static void print_unreached_initializers(struct symbol_list *sym_list)
 337 {
 338         struct symbol *sym;
 339
 340         FOR_EACH_PTR(sym_list, sym) {
 341                 if(sym->initializer)
 342                         sm_msg("info: '%s' is not actually initialized (unreached code).",
 343                                 (sym->ident ? sym->ident->name : "this variable"));
 344         } END_FOR_EACH_PTR(sym);
 345 }
 346
 347 static void print_unreached(struct statement *stmt)
 348 {
 349
 350         static int print = 1;
 351
 352         if (!__path_is_null()) {
 353                 print = 1;
 354                 return;
 355         }
 356         if (!print)
 357                 return;
 358
 359         switch (stmt->type) {
 360         case STMT_COMPOUND: /* after a switch before a case stmt */
 361         case STMT_RANGE:
 362         case STMT_CASE:
 363         case STMT_LABEL:
 364                 return;
 365         case STMT_DECLARATION: /* switch (x) { int a; case foo: ... */
 366                 print_unreached_initializers(stmt->declaration);
 367                 return;
 368         case STMT_RETURN: /* gcc complains if you don't have a return statement */
 369                 if (is_last_stmt(stmt))
 370                         return;
 371                 break;
 372         case STMT_GOTO:
 373                 if (!option_spammy)
 374                         return;
 375                 break;
 376         default:
 377                 break;
 378         }
 379         if (!option_spammy && empty_statement(stmt))
 380                 return;
 381         sm_msg("info: ignoring unreachable code.");
 382         print = 0;
 383 }
 384
 385 void __split_stmt(struct statement *stmt)
 386 {
 387         if (!stmt)
 388                 return;
 389
 390         if (out_of_memory() || __bail_on_rest_of_function) {
 391                 static char *printed = NULL;
 392
 393                 if (printed != cur_func)
 394                         sm_msg("Function too hairy.  Giving up.");
 395                 printed = cur_func;
 396                 return;
 397         }
 398
 399         add_ptr_list(&big_statement_stack, stmt);
 400         free_expression_stack(&big_expression_stack);
 401         __smatch_lineno = stmt->pos.line;
 402         print_unreached(stmt);
 403         __pass_to_client(stmt, STMT_HOOK);
 404
 405         switch (stmt->type) {
 406         case STMT_DECLARATION:
 407                 split_declaration(stmt->declaration);
 408                 return;
 409         case STMT_RETURN:
 410                 __split_expr(stmt->ret_value);
 411                 __pass_to_client(stmt->ret_value, RETURN_HOOK);
 412                 nullify_path();
 413                 return;
 414         case STMT_EXPRESSION:
 415                 __split_expr(stmt->expression);
 416                 return;
 417         case STMT_COMPOUND: {
 418                 struct statement *tmp;
 419                 struct statement *prev = NULL;
 420
 421                 if (!last_stmt)
 422                         last_stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
 423                 __push_scope_hooks();
 424                 FOR_EACH_PTR(stmt->stmts, tmp) {
 425                         if (!prev) {
 426                                 next_stmt = tmp;
 427                                 prev = tmp;
 428                                 continue;
 429                         }
 430                         next_stmt = tmp;
 431                         __split_stmt(prev);
 432                         prev = tmp;
 433                 } END_FOR_EACH_PTR(tmp);
 434                 if (next_stmt == prev)
 435                         next_stmt = NULL;
 436                 __split_stmt(prev);
 437                 __call_scope_hooks();
 438                 return;
 439         }
 440         case STMT_IF:
 441                 if (known_condition_true(stmt->if_conditional)) {
 442                         __split_stmt(stmt->if_true);
 443                         return;
 444                 }
 445                 if (known_condition_false(stmt->if_conditional)) {
 446                         __split_stmt(stmt->if_false);
 447                         return;
 448                 }
 449                 if (option_known_conditions &&
 450                     implied_condition_true(stmt->if_conditional)) {
 451                         sm_info("this condition is true.");
 452                         __split_stmt(stmt->if_true);
 453                         return;
 454                 }
 455                 if (option_known_conditions &&
 456                     implied_condition_false(stmt->if_conditional)) {
 457                         sm_info("this condition is false.");
 458                         __split_stmt(stmt->if_false);
 459                         return;
 460                 }
 461                 __split_whole_condition(stmt->if_conditional);
 462                 __split_stmt(stmt->if_true);
 463                 if (empty_statement(stmt->if_true))
 464                         sm_msg("warn: if();");
 465                 __push_true_states();
 466                 __use_false_states();
 467                 __split_stmt(stmt->if_false);
 468                 __merge_true_states();
 469                 return;
 470         case STMT_ITERATOR:
 471                 if (stmt->iterator_pre_condition)
 472                         handle_pre_loop(stmt);
 473                 else if (stmt->iterator_post_condition)
 474                         handle_post_loop(stmt);
 475                 else {
 476                         // these are for(;;) type loops.
 477                         handle_pre_loop(stmt);
 478                 }
 479                 return;
 480         case STMT_SWITCH:
 481                 __split_expr(stmt->switch_expression);
 482                 push_expression(&switch_expr_stack, stmt->switch_expression);
 483                 __save_switch_states(top_expression(switch_expr_stack));
 484                 nullify_path();
 485                 __push_default();
 486                 __push_breaks();
 487                 __split_stmt(stmt->switch_statement);
 488                 if (!__pop_default())
 489                         __merge_switches(top_expression(switch_expr_stack),
 490                                       NULL);
 491                 __discard_switches();
 492                 __merge_breaks();
 493                 pop_expression(&switch_expr_stack);
 494                 return;
 495         case STMT_CASE:
 496                 __merge_switches(top_expression(switch_expr_stack),
 497                                       stmt->case_expression);
 498                 __pass_case_to_client(top_expression(switch_expr_stack),
 499                                       stmt->case_expression);
 500                 if (!stmt->case_expression)
 501                         __set_default();
 502                 __split_expr(stmt->case_expression);
 503                 __split_expr(stmt->case_to);
 504                 __split_stmt(stmt->case_statement);
 505                 return;
 506         case STMT_LABEL:
 507                 if (stmt->label &&
 508                     stmt->label->type == SYM_LABEL &&
 509                     stmt->label->ident) {
 510                         loop_count = 1000000;
 511                         __merge_gotos(stmt->label->ident->name);
 512                 }
 513                 __split_stmt(stmt->label_statement);
 514                 return;
 515         case STMT_GOTO:
 516                 __split_expr(stmt->goto_expression);
 517                 if (stmt->goto_label && stmt->goto_label->type == SYM_NODE) {
 518                         if (!strcmp(stmt->goto_label->ident->name, "break")) {
 519                                 __process_breaks();
 520                         } else if (!strcmp(stmt->goto_label->ident->name,
 521                                            "continue")) {
 522                                 __process_continues();
 523                         }
 524                 } else if (stmt->goto_label &&
 525                            stmt->goto_label->type == SYM_LABEL &&
 526                            stmt->goto_label->ident) {
 527                         __save_gotos(stmt->goto_label->ident->name);
 528                 }
 529                 nullify_path();
 530                 return;
 531         case STMT_NONE:
 532                 return;
 533         case STMT_ASM:
 534                 __split_expr(stmt->asm_string);
 535                 split_expr_list(stmt->asm_outputs);
 536                 split_expr_list(stmt->asm_inputs);
 537                 split_expr_list(stmt->asm_clobbers);
 538                 return;
 539         case STMT_CONTEXT:
 540                 return;
 541         case STMT_RANGE:
 542                 __split_expr(stmt->range_expression);
 543                 __split_expr(stmt->range_low);
 544                 __split_expr(stmt->range_high);
 545                 return;
 546         }
 547 }
 548
 549 static void split_expr_list(struct expression_list *expr_list)
 550 {
 551         struct expression *expr;
 552         FOR_EACH_PTR(expr_list, expr) {
 553                 __split_expr(expr);
 554         } END_FOR_EACH_PTR(expr);
 555 }
 556
 557
 558 static void split_sym(struct symbol *sym)
 559 {
 560         if (!sym)
 561                 return;
 562         if (!(sym->namespace & NS_SYMBOL))
 563                 return;
 564
 565         __split_stmt(sym->stmt);
 566         __split_expr(sym->array_size);
 567         split_symlist(sym->arguments);
 568         split_symlist(sym->symbol_list);
 569         __split_stmt(sym->inline_stmt);
 570         split_symlist(sym->inline_symbol_list);
 571 }
 572
 573 static void split_symlist(struct symbol_list *sym_list)
 574 {
 575         struct symbol *sym;
 576
 577         FOR_EACH_PTR(sym_list, sym) {
 578                 split_sym(sym);
 579         } END_FOR_EACH_PTR(sym);
 580 }
 581
 582 static struct expression *fake_assign_expr(struct symbol *sym)
 583 {
 584         struct expression *e_assign, *e_symbol;
 585
 586         e_assign = alloc_expression(sym->initializer->pos, EXPR_ASSIGNMENT);
 587         e_symbol = alloc_expression(sym->initializer->pos, EXPR_SYMBOL);
 588         e_assign->op = (int)'=';
 589         e_symbol->symbol = sym;
 590         e_symbol->symbol_name = sym->ident;
 591         e_assign->left = e_symbol;
 592         e_assign->right = sym->initializer;
 593         return e_assign;
 594 }
 595
 596 static void do_initializer_stuff(struct symbol *sym)
 597 {
 598         struct expression *assign;
 599
 600         if(!sym->initializer)
 601                 return;
 602         assign = fake_assign_expr(sym);
 603         __split_expr(assign);
 604 }
 605
 606 static void split_declaration(struct symbol_list *sym_list)
 607 {
 608         struct symbol *sym;
 609
 610         FOR_EACH_PTR(sym_list, sym) {
 611                 __pass_to_client(sym, DECLARATION_HOOK);
 612                 do_initializer_stuff(sym);
 613                 split_sym(sym);
 614         } END_FOR_EACH_PTR(sym);
 615 }
 616
 617 static void split_function(struct symbol *sym)
 618 {
 619         struct symbol *base_type = get_base_type(sym);
 620
 621         cur_func_sym = sym;
 622         if (base_type->stmt)
 623                 line_func_start = base_type->stmt->pos.line;
 624         if (sym->ident)
 625                 cur_func = sym->ident->name;
 626         __smatch_lineno = sym->pos.line;
 627         last_stmt = NULL;
 628         loop_count = 0;
 629         sm_debug("new function:  %s\n", cur_func);
 630         if (option_two_passes) {
 631                 __unnullify_path();
 632                 loop_num = 0;
 633                 final_pass = 0;
 634                 __pass_to_client(sym, FUNC_DEF_HOOK);
 635                 __split_stmt(base_type->stmt);
 636                 nullify_path();
 637         }
 638         __unnullify_path();
 639         loop_num = 0;
 640         final_pass = 1;
 641         __pass_to_client(sym, FUNC_DEF_HOOK);
 642         __split_stmt(base_type->stmt);
 643         __pass_to_client(sym, END_FUNC_HOOK);
 644         cur_func = NULL;
 645         line_func_start = 0;
 646         clear_all_states();
 647         free_data_info_allocs();
 648         free_expression_stack(&switch_expr_stack);
 649         __free_ptr_list((struct ptr_list **)&big_statement_stack);
 650         __bail_on_rest_of_function = 0;
 651 }
 652
 653 static void split_functions(struct symbol_list *sym_list)
 654 {
 655         struct symbol *sym;
 656
 657         FOR_EACH_PTR(sym_list, sym) {
 658                 if (sym->type == SYM_NODE && get_base_type(sym)->type == SYM_FN) {
 659                         split_function(sym);
 660                 } else {
 661                         __pass_to_client(sym, BASE_HOOK);
 662                 }
 663         } END_FOR_EACH_PTR(sym);
 664         __pass_to_client_no_data(END_FILE_HOOK);
 665 }
 666
 667 void smatch (int argc, char **argv)
 668 {
 669
 670         struct string_list *filelist = NULL;
 671         struct symbol_list *sym_list;
 672         char *file;
 673
 674         if (argc < 2) {
 675                 printf("Usage:  smatch [--debug] <filename.c>\n");
 676                 exit(1);
 677         }
 678         sparse_initialize(argc, argv, &filelist);
 679         FOR_EACH_PTR_NOTAG(filelist, file) {
 680                 sym_list = sparse_keep_tokens(file);
 681                 split_functions(sym_list);
 682         } END_FOR_EACH_PTR_NOTAG(file);
 683 }