1 /* Warn on problematic uses of alloca and variable length arrays.
2 Copyright (C) 2016-2020 Free Software Foundation, Inc.
3 Contributed by Aldy Hernandez <aldyh@redhat.com>.
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
23 #include "coretypes.h"
27 #include "tree-pass.h"
29 #include "gimple-pretty-print.h"
30 #include "diagnostic-core.h"
31 #include "fold-const.h"
32 #include "gimple-iterator.h"
39 #include "gimple-range.h"
41 static unsigned HOST_WIDE_INT
adjusted_warn_limit (bool);
43 const pass_data pass_data_walloca
= {
48 PROP_cfg
, // properties_required
49 0, // properties_provided
50 0, // properties_destroyed
51 0, // properties_start
52 0, // properties_finish
55 class pass_walloca
: public gimple_opt_pass
58 pass_walloca (gcc::context
*ctxt
)
59 : gimple_opt_pass(pass_data_walloca
, ctxt
), first_time_p (false)
61 opt_pass
*clone () { return new pass_walloca (m_ctxt
); }
62 void set_pass_param (unsigned int n
, bool param
)
67 virtual bool gate (function
*);
68 virtual unsigned int execute (function
*);
71 // Set to TRUE the first time we run this pass on a function.
76 pass_walloca::gate (function
*fun ATTRIBUTE_UNUSED
)
78 // The first time this pass is called, it is called before
79 // optimizations have been run and range information is unavailable,
80 // so we can only perform strict alloca checking.
82 return warn_alloca
!= 0;
84 // Warning is disabled when its size limit is greater than PTRDIFF_MAX
85 // for the target maximum, which makes the limit negative since when
86 // represented in signed HOST_WIDE_INT.
87 unsigned HOST_WIDE_INT max
= tree_to_uhwi (TYPE_MAX_VALUE (ptrdiff_type_node
));
88 return (adjusted_warn_limit (false) <= max
89 || adjusted_warn_limit (true) <= max
);
92 // Possible problematic uses of alloca.
94 // Alloca argument is within known bounds that are appropriate.
97 // Alloca argument is KNOWN to have a value that is too large.
98 ALLOCA_BOUND_DEFINITELY_LARGE
,
100 // Alloca argument may be too large.
101 ALLOCA_BOUND_MAYBE_LARGE
,
103 // Alloca appears in a loop.
106 // Alloca argument is 0.
109 // Alloca call is unbounded. That is, there is no controlling
110 // predicate for its argument.
114 // Type of an alloca call with its corresponding limit, if applicable.
115 class alloca_type_and_limit
{
117 enum alloca_type type
;
118 // For ALLOCA_BOUND_MAYBE_LARGE and ALLOCA_BOUND_DEFINITELY_LARGE
119 // types, this field indicates the assumed limit if known or
120 // integer_zero_node if unknown. For any other alloca types, this
121 // field is undefined.
123 alloca_type_and_limit ();
124 alloca_type_and_limit (enum alloca_type type
,
125 wide_int i
) : type(type
), limit(i
) { }
126 alloca_type_and_limit (enum alloca_type type
) : type(type
)
127 { if (type
== ALLOCA_BOUND_MAYBE_LARGE
128 || type
== ALLOCA_BOUND_DEFINITELY_LARGE
)
129 limit
= wi::to_wide (integer_zero_node
);
133 /* Return TRUE if the user specified a limit for either VLAs or ALLOCAs. */
136 warn_limit_specified_p (bool is_vla
)
138 unsigned HOST_WIDE_INT max
= is_vla
? warn_vla_limit
: warn_alloca_limit
;
139 return max
!= HOST_WIDE_INT_MAX
;
142 /* Return the value of the argument N to -Walloca-larger-than= or
143 -Wvla-larger-than= adjusted for the target data model so that
144 when N == HOST_WIDE_INT_MAX, the adjusted value is set to
145 PTRDIFF_MAX on the target. This is done to prevent warnings
146 for unknown/unbounded allocations in the "permissive mode"
147 while still diagnosing excessive and necessarily invalid
150 static unsigned HOST_WIDE_INT
151 adjusted_warn_limit (bool idx
)
153 static HOST_WIDE_INT limits
[2];
157 limits
[idx
] = idx
? warn_vla_limit
: warn_alloca_limit
;
158 if (limits
[idx
] != HOST_WIDE_INT_MAX
)
161 limits
[idx
] = tree_to_shwi (TYPE_MAX_VALUE (ptrdiff_type_node
));
165 // Analyze the alloca call in STMT and return the alloca type with its
166 // corresponding limit (if applicable). IS_VLA is set if the alloca
167 // call was created by the gimplifier for a VLA.
169 static class alloca_type_and_limit
170 alloca_call_type (range_query
&query
, gimple
*stmt
, bool is_vla
)
172 gcc_assert (gimple_alloca_call_p (stmt
));
173 tree len
= gimple_call_arg (stmt
, 0);
175 gcc_assert (!is_vla
|| warn_vla_limit
>= 0);
176 gcc_assert (is_vla
|| warn_alloca_limit
>= 0);
178 // Adjust warn_alloca_max_size for VLAs, by taking the underlying
179 // type into account.
180 unsigned HOST_WIDE_INT max_size
= adjusted_warn_limit (is_vla
);
182 // Check for the obviously bounded case.
183 if (TREE_CODE (len
) == INTEGER_CST
)
185 if (tree_to_uhwi (len
) > max_size
)
186 return alloca_type_and_limit (ALLOCA_BOUND_DEFINITELY_LARGE
,
188 if (integer_zerop (len
))
190 const offset_int maxobjsize
191 = wi::to_offset (max_object_size ());
192 alloca_type result
= (max_size
< maxobjsize
193 ? ALLOCA_ARG_IS_ZERO
: ALLOCA_OK
);
194 return alloca_type_and_limit (result
);
197 return alloca_type_and_limit (ALLOCA_OK
);
200 struct alloca_type_and_limit ret
= alloca_type_and_limit (ALLOCA_OK
);
201 // If we have a declared maximum size, we can take it into account.
202 if (gimple_call_builtin_p (stmt
, BUILT_IN_ALLOCA_WITH_ALIGN_AND_MAX
))
204 tree arg
= gimple_call_arg (stmt
, 2);
205 if (compare_tree_int (arg
, max_size
) <= 0)
206 ret
= alloca_type_and_limit (ALLOCA_OK
);
209 const offset_int maxobjsize
210 = wi::to_offset (max_object_size ());
211 alloca_type result
= (max_size
< maxobjsize
212 ? ALLOCA_BOUND_MAYBE_LARGE
: ALLOCA_OK
);
213 ret
= alloca_type_and_limit (result
, wi::to_wide (arg
));
218 // If the user specified a limit, use it.
220 if (warn_limit_specified_p (is_vla
)
221 && TREE_CODE (len
) == SSA_NAME
222 && query
.range_of_expr (r
, len
, stmt
)
225 // The invalid bits are anything outside of [0, MAX_SIZE].
226 static int_range
<2> invalid_range (build_int_cst (size_type_node
, 0),
227 build_int_cst (size_type_node
,
231 r
.intersect (invalid_range
);
232 if (r
.undefined_p ())
233 return alloca_type_and_limit (ALLOCA_OK
);
235 return alloca_type_and_limit (ALLOCA_BOUND_MAYBE_LARGE
,
236 wi::to_wide (integer_zero_node
));
239 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
240 /* When MAX_SIZE is greater than or equal to PTRDIFF_MAX treat
241 allocations that aren't visibly constrained as OK, otherwise
242 report them as (potentially) unbounded. */
243 alloca_type unbounded_result
= (max_size
< maxobjsize
.to_uhwi ()
244 ? ALLOCA_UNBOUNDED
: ALLOCA_OK
);
245 return alloca_type_and_limit (unbounded_result
);
248 // Return TRUE if STMT is in a loop, otherwise return FALSE.
251 in_loop_p (gimple
*stmt
)
253 basic_block bb
= gimple_bb (stmt
);
255 bb
->loop_father
&& bb
->loop_father
->header
!= ENTRY_BLOCK_PTR_FOR_FN (cfun
);
259 pass_walloca::execute (function
*fun
)
261 gimple_ranger ranger
;
263 FOR_EACH_BB_FN (bb
, fun
)
265 for (gimple_stmt_iterator si
= gsi_start_bb (bb
); !gsi_end_p (si
);
268 gimple
*stmt
= gsi_stmt (si
);
269 if (!gimple_alloca_call_p (stmt
))
272 location_t loc
= gimple_nonartificial_location (stmt
);
273 loc
= expansion_point_location_if_in_system_header (loc
);
276 = gimple_call_alloca_for_var_p (as_a
<gcall
*> (stmt
));
278 // Strict mode whining for VLAs is handled by the front-end,
279 // so we can safely ignore this case. Also, ignore VLAs if
280 // the user doesn't care about them.
283 if (warn_vla
> 0 || warn_vla_limit
< 0)
286 else if (warn_alloca
)
288 warning_at (loc
, OPT_Walloca
, "%Guse of %<alloca%>", stmt
);
291 else if (warn_alloca_limit
< 0)
294 class alloca_type_and_limit t
295 = alloca_call_type (ranger
, stmt
, is_vla
);
297 unsigned HOST_WIDE_INT adjusted_alloca_limit
298 = adjusted_warn_limit (false);
299 // Even if we think the alloca call is OK, make sure it's not in a
300 // loop, except for a VLA, since VLAs are guaranteed to be cleaned
301 // up when they go out of scope, including in a loop.
302 if (t
.type
== ALLOCA_OK
&& !is_vla
&& in_loop_p (stmt
))
304 /* As in other instances, only diagnose this when the limit
305 is less than the maximum valid object size. */
306 const offset_int maxobjsize
307 = wi::to_offset (max_object_size ());
308 if (adjusted_alloca_limit
< maxobjsize
.to_uhwi ())
309 t
= alloca_type_and_limit (ALLOCA_IN_LOOP
);
313 = is_vla
? OPT_Wvla_larger_than_
: OPT_Walloca_larger_than_
;
314 char buff
[WIDE_INT_MAX_PRECISION
/ 4 + 4];
319 case ALLOCA_BOUND_MAYBE_LARGE
:
321 auto_diagnostic_group d
;
322 if (warning_at (loc
, wcode
,
324 ? G_("%Gargument to variable-length "
325 "array may be too large")
326 : G_("%Gargument to %<alloca%> may be too "
331 print_decu (t
.limit
, buff
);
332 inform (loc
, "limit is %wu bytes, but argument "
333 "may be as large as %s",
334 is_vla
? warn_vla_limit
: adjusted_alloca_limit
,
339 case ALLOCA_BOUND_DEFINITELY_LARGE
:
341 auto_diagnostic_group d
;
342 if (warning_at (loc
, wcode
,
344 ? G_("%Gargument to variable-length"
345 " array is too large")
346 : G_("%Gargument to %<alloca%> is too large")),
350 print_decu (t
.limit
, buff
);
351 inform (loc
, "limit is %wu bytes, but argument is %s",
352 is_vla
? warn_vla_limit
: adjusted_alloca_limit
,
357 case ALLOCA_UNBOUNDED
:
358 warning_at (loc
, wcode
,
360 ? G_("%Gunbounded use of variable-length array")
361 : G_("%Gunbounded use of %<alloca%>")),
365 gcc_assert (!is_vla
);
366 warning_at (loc
, wcode
,
367 "%Guse of %<alloca%> within a loop", stmt
);
369 case ALLOCA_ARG_IS_ZERO
:
370 warning_at (loc
, wcode
,
372 ? G_("%Gargument to variable-length array "
374 : G_("%Gargument to %<alloca%> is zero")),
386 make_pass_walloca (gcc::context
*ctxt
)
388 return new pass_walloca (ctxt
);