1 /* Warn on problematic uses of alloca and variable length arrays.
2 Copyright (C) 2016-2019 Free Software Foundation, Inc.
3 Contributed by Aldy Hernandez <aldyh@redhat.com>.
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
23 #include "coretypes.h"
27 #include "tree-pass.h"
29 #include "gimple-pretty-print.h"
30 #include "diagnostic-core.h"
31 #include "fold-const.h"
32 #include "gimple-iterator.h"
41 static unsigned HOST_WIDE_INT
adjusted_warn_limit (bool);
43 const pass_data pass_data_walloca
= {
48 PROP_cfg
, // properties_required
49 0, // properties_provided
50 0, // properties_destroyed
51 0, // properties_start
52 0, // properties_finish
55 class pass_walloca
: public gimple_opt_pass
58 pass_walloca (gcc::context
*ctxt
)
59 : gimple_opt_pass(pass_data_walloca
, ctxt
), first_time_p (false)
61 opt_pass
*clone () { return new pass_walloca (m_ctxt
); }
62 void set_pass_param (unsigned int n
, bool param
)
67 virtual bool gate (function
*);
68 virtual unsigned int execute (function
*);
71 // Set to TRUE the first time we run this pass on a function.
76 pass_walloca::gate (function
*fun ATTRIBUTE_UNUSED
)
78 // The first time this pass is called, it is called before
79 // optimizations have been run and range information is unavailable,
80 // so we can only perform strict alloca checking.
82 return warn_alloca
!= 0;
84 // Warning is disabled when its size limit is greater than PTRDIFF_MAX
85 // for the target maximum, which makes the limit negative since when
86 // represented in signed HOST_WIDE_INT.
87 unsigned HOST_WIDE_INT max
= tree_to_uhwi (TYPE_MAX_VALUE (ptrdiff_type_node
));
88 return (adjusted_warn_limit (false) <= max
89 || adjusted_warn_limit (true) <= max
);
92 // Possible problematic uses of alloca.
94 // Alloca argument is within known bounds that are appropriate.
97 // Alloca argument is KNOWN to have a value that is too large.
98 ALLOCA_BOUND_DEFINITELY_LARGE
,
100 // Alloca argument may be too large.
101 ALLOCA_BOUND_MAYBE_LARGE
,
103 // Alloca argument is bounded but of an indeterminate size.
104 ALLOCA_BOUND_UNKNOWN
,
106 // Alloca argument was casted from a signed integer.
107 ALLOCA_CAST_FROM_SIGNED
,
109 // Alloca appears in a loop.
112 // Alloca argument is 0.
115 // Alloca call is unbounded. That is, there is no controlling
116 // predicate for its argument.
120 // Type of an alloca call with its corresponding limit, if applicable.
121 class alloca_type_and_limit
{
123 enum alloca_type type
;
124 // For ALLOCA_BOUND_MAYBE_LARGE and ALLOCA_BOUND_DEFINITELY_LARGE
125 // types, this field indicates the assumed limit if known or
126 // integer_zero_node if unknown. For any other alloca types, this
127 // field is undefined.
129 alloca_type_and_limit ();
130 alloca_type_and_limit (enum alloca_type type
,
131 wide_int i
) : type(type
), limit(i
) { }
132 alloca_type_and_limit (enum alloca_type type
) : type(type
)
133 { if (type
== ALLOCA_BOUND_MAYBE_LARGE
134 || type
== ALLOCA_BOUND_DEFINITELY_LARGE
)
135 limit
= wi::to_wide (integer_zero_node
);
139 /* Return the value of the argument N to -Walloca-larger-than= or
140 -Wvla-larger-than= adjusted for the target data model so that
141 when N == HOST_WIDE_INT_MAX, the adjusted value is set to
142 PTRDIFF_MAX on the target. This is done to prevent warnings
143 for unknown/unbounded allocations in the "permissive mode"
144 while still diagnosing excessive and necessarily invalid
147 static unsigned HOST_WIDE_INT
148 adjusted_warn_limit (bool idx
)
150 static HOST_WIDE_INT limits
[2];
154 limits
[idx
] = idx
? warn_vla_limit
: warn_alloca_limit
;
155 if (limits
[idx
] != HOST_WIDE_INT_MAX
)
158 limits
[idx
] = tree_to_shwi (TYPE_MAX_VALUE (ptrdiff_type_node
));
163 // NOTE: When we get better range info, this entire function becomes
164 // irrelevant, as it should be possible to get range info for an SSA
165 // name at any point in the program.
167 // We have a few heuristics up our sleeve to determine if a call to
168 // alloca() is within bounds. Try them out and return the type of
169 // alloca call with its assumed limit (if applicable).
171 // Given a known argument (ARG) to alloca() and an EDGE (E)
172 // calculating said argument, verify that the last statement in the BB
173 // in E->SRC is a gate comparing ARG to an acceptable bound for
174 // alloca(). See examples below.
176 // If set, ARG_CASTED is the possible unsigned argument to which ARG
177 // was casted to. This is to handle cases where the controlling
178 // predicate is looking at a casted value, not the argument itself.
179 // arg_casted = (size_t) arg;
180 // if (arg_casted < N)
185 // MAX_SIZE is WARN_ALLOCA= adjusted for VLAs. It is the maximum size
186 // in bytes we allow for arg.
188 static class alloca_type_and_limit
189 alloca_call_type_by_arg (tree arg
, tree arg_casted
, edge e
,
190 unsigned HOST_WIDE_INT max_size
)
192 basic_block bb
= e
->src
;
193 gimple_stmt_iterator gsi
= gsi_last_bb (bb
);
194 gimple
*last
= gsi_stmt (gsi
);
196 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
198 /* When MAX_SIZE is greater than or equal to PTRDIFF_MAX treat
199 allocations that aren't visibly constrained as OK, otherwise
200 report them as (potentially) unbounded. */
201 alloca_type unbounded_result
= (max_size
< maxobjsize
.to_uhwi ()
202 ? ALLOCA_UNBOUNDED
: ALLOCA_OK
);
204 if (!last
|| gimple_code (last
) != GIMPLE_COND
)
206 return alloca_type_and_limit (unbounded_result
);
209 enum tree_code cond_code
= gimple_cond_code (last
);
210 if (e
->flags
& EDGE_TRUE_VALUE
)
212 else if (e
->flags
& EDGE_FALSE_VALUE
)
213 cond_code
= invert_tree_comparison (cond_code
, false);
215 return alloca_type_and_limit (unbounded_result
);
224 if ((cond_code
== LE_EXPR
225 || cond_code
== LT_EXPR
226 || cond_code
== GT_EXPR
227 || cond_code
== GE_EXPR
)
228 && (gimple_cond_lhs (last
) == arg
229 || gimple_cond_lhs (last
) == arg_casted
))
231 if (TREE_CODE (gimple_cond_rhs (last
)) == INTEGER_CST
)
233 tree rhs
= gimple_cond_rhs (last
);
234 int tst
= wi::cmpu (wi::to_widest (rhs
), max_size
);
235 if ((cond_code
== LT_EXPR
&& tst
== -1)
236 || (cond_code
== LE_EXPR
&& (tst
== -1 || tst
== 0)))
237 return alloca_type_and_limit (ALLOCA_OK
);
240 // Let's not get too specific as to how large the limit
241 // may be. Someone's clearly an idiot when things
242 // degrade into "if (N > Y) alloca(N)".
243 if (cond_code
== GT_EXPR
|| cond_code
== GE_EXPR
)
244 rhs
= integer_zero_node
;
245 return alloca_type_and_limit (ALLOCA_BOUND_MAYBE_LARGE
,
251 /* Analogous to ALLOCA_UNBOUNDED, when MAX_SIZE is greater
252 than or equal to PTRDIFF_MAX, treat allocations with
253 an unknown bound as OK. */
254 alloca_type unknown_result
255 = (max_size
< maxobjsize
.to_uhwi ()
256 ? ALLOCA_BOUND_UNKNOWN
: ALLOCA_OK
);
257 return alloca_type_and_limit (unknown_result
);
261 // Similarly, but check for a comparison with an unknown LIMIT.
262 // if (LIMIT .COND. ARG)
265 // Where LIMIT has a bound of unknown range.
267 // Note: All conditions of the form (ARG .COND. XXXX) where covered
268 // by the previous check above, so we only need to look for (LIMIT
270 tree limit
= gimple_cond_lhs (last
);
271 if ((gimple_cond_rhs (last
) == arg
272 || gimple_cond_rhs (last
) == arg_casted
)
273 && TREE_CODE (limit
) == SSA_NAME
)
276 value_range_kind range_type
= get_range_info (limit
, &min
, &max
);
278 if (range_type
== VR_UNDEFINED
|| range_type
== VR_VARYING
)
279 return alloca_type_and_limit (ALLOCA_BOUND_UNKNOWN
);
281 // ?? It looks like the above `if' is unnecessary, as we never
282 // get any VR_RANGE or VR_ANTI_RANGE here. If we had a range
283 // for LIMIT, I suppose we would have taken care of it in
284 // alloca_call_type(), or handled above where we handle (ARG .COND. N).
286 // If this ever triggers, we should probably figure out why and
287 // handle it, though it is likely to be just an ALLOCA_UNBOUNDED.
288 return alloca_type_and_limit (unbounded_result
);
291 return alloca_type_and_limit (unbounded_result
);
294 // Return TRUE if SSA's definition is a cast from a signed type.
295 // If so, set *INVALID_CASTED_TYPE to the signed type.
298 cast_from_signed_p (tree ssa
, tree
*invalid_casted_type
)
300 gimple
*def
= SSA_NAME_DEF_STMT (ssa
);
302 && !gimple_nop_p (def
)
303 && gimple_assign_cast_p (def
)
304 && !TYPE_UNSIGNED (TREE_TYPE (gimple_assign_rhs1 (def
))))
306 *invalid_casted_type
= TREE_TYPE (gimple_assign_rhs1 (def
));
312 // Return TRUE if X has a maximum range of MAX, basically covering the
313 // entire domain, in which case it's no range at all.
316 is_max (tree x
, wide_int max
)
318 return wi::max_value (TREE_TYPE (x
)) == max
;
321 // Analyze the alloca call in STMT and return the alloca type with its
322 // corresponding limit (if applicable). IS_VLA is set if the alloca
323 // call was created by the gimplifier for a VLA.
325 // If the alloca call may be too large because of a cast from a signed
326 // type to an unsigned type, set *INVALID_CASTED_TYPE to the
327 // problematic signed type.
329 static class alloca_type_and_limit
330 alloca_call_type (gimple
*stmt
, bool is_vla
, tree
*invalid_casted_type
)
332 gcc_assert (gimple_alloca_call_p (stmt
));
333 bool tentative_cast_from_signed
= false;
334 tree len
= gimple_call_arg (stmt
, 0);
335 tree len_casted
= NULL
;
340 gcc_assert (!is_vla
|| warn_vla_limit
>= 0);
341 gcc_assert (is_vla
|| warn_alloca_limit
>= 0);
343 // Adjust warn_alloca_max_size for VLAs, by taking the underlying
344 // type into account.
345 unsigned HOST_WIDE_INT max_size
= adjusted_warn_limit (is_vla
);
347 // Check for the obviously bounded case.
348 if (TREE_CODE (len
) == INTEGER_CST
)
350 if (tree_to_uhwi (len
) > max_size
)
351 return alloca_type_and_limit (ALLOCA_BOUND_DEFINITELY_LARGE
,
353 if (integer_zerop (len
))
355 const offset_int maxobjsize
356 = wi::to_offset (max_object_size ());
357 alloca_type result
= (max_size
< maxobjsize
358 ? ALLOCA_ARG_IS_ZERO
: ALLOCA_OK
);
359 return alloca_type_and_limit (result
);
362 return alloca_type_and_limit (ALLOCA_OK
);
365 // Check the range info if available.
366 if (TREE_CODE (len
) == SSA_NAME
)
368 value_range_kind range_type
= get_range_info (len
, &min
, &max
);
369 if (range_type
== VR_RANGE
)
371 if (wi::leu_p (max
, max_size
))
372 return alloca_type_and_limit (ALLOCA_OK
);
375 // A cast may have created a range we don't care
376 // about. For instance, a cast from 16-bit to
377 // 32-bit creates a range of 0..65535, even if there
378 // is not really a determinable range in the
379 // underlying code. In this case, look through the
380 // cast at the original argument, and fall through
381 // to look at other alternatives.
383 // We only look at through the cast when its from
384 // unsigned to unsigned, otherwise we may risk
385 // looking at SIGNED_INT < N, which is clearly not
386 // what we want. In this case, we'd be interested
387 // in a VR_RANGE of [0..N].
389 // Note: None of this is perfect, and should all go
390 // away with better range information. But it gets
391 // most of the cases.
392 gimple
*def
= SSA_NAME_DEF_STMT (len
);
393 if (gimple_assign_cast_p (def
))
395 tree rhs1
= gimple_assign_rhs1 (def
);
396 tree rhs1type
= TREE_TYPE (rhs1
);
398 // Bail if the argument type is not valid.
399 if (!INTEGRAL_TYPE_P (rhs1type
))
400 return alloca_type_and_limit (ALLOCA_OK
);
402 if (TYPE_UNSIGNED (rhs1type
))
405 range_type
= get_range_info (len_casted
, &min
, &max
);
408 // An unknown range or a range of the entire domain is
409 // really no range at all.
410 if (range_type
== VR_VARYING
411 || (!len_casted
&& is_max (len
, max
))
412 || (len_casted
&& is_max (len_casted
, max
)))
416 else if (range_type
== VR_ANTI_RANGE
)
417 return alloca_type_and_limit (ALLOCA_UNBOUNDED
);
419 if (range_type
!= VR_VARYING
)
421 const offset_int maxobjsize
422 = wi::to_offset (max_object_size ());
423 alloca_type result
= (max_size
< maxobjsize
424 ? ALLOCA_BOUND_MAYBE_LARGE
: ALLOCA_OK
);
425 return alloca_type_and_limit (result
, max
);
429 else if (range_type
== VR_ANTI_RANGE
)
431 // There may be some wrapping around going on. Catch it
432 // with this heuristic. Hopefully, this VR_ANTI_RANGE
433 // nonsense will go away, and we won't have to catch the
434 // sign conversion problems with this crap.
436 // This is here to catch things like:
437 // void foo(signed int n) {
442 if (cast_from_signed_p (len
, invalid_casted_type
))
444 // Unfortunately this also triggers:
446 // __SIZE_TYPE__ n = (__SIZE_TYPE__)blah;
450 // ...which is clearly bounded. So, double check that
451 // the paths leading up to the size definitely don't
453 tentative_cast_from_signed
= true;
456 // No easily determined range and try other things.
459 // If we couldn't find anything, try a few heuristics for things we
460 // can easily determine. Check these misc cases but only accept
461 // them if all predecessors have a known bound.
462 class alloca_type_and_limit ret
= alloca_type_and_limit (ALLOCA_OK
);
463 FOR_EACH_EDGE (e
, ei
, gimple_bb (stmt
)->preds
)
465 gcc_assert (!len_casted
|| TYPE_UNSIGNED (TREE_TYPE (len_casted
)));
466 ret
= alloca_call_type_by_arg (len
, len_casted
, e
, max_size
);
467 if (ret
.type
!= ALLOCA_OK
)
471 if (ret
.type
!= ALLOCA_OK
&& tentative_cast_from_signed
)
472 ret
= alloca_type_and_limit (ALLOCA_CAST_FROM_SIGNED
);
474 // If we have a declared maximum size, we can take it into account.
475 if (ret
.type
!= ALLOCA_OK
476 && gimple_call_builtin_p (stmt
, BUILT_IN_ALLOCA_WITH_ALIGN_AND_MAX
))
478 tree arg
= gimple_call_arg (stmt
, 2);
479 if (compare_tree_int (arg
, max_size
) <= 0)
480 ret
= alloca_type_and_limit (ALLOCA_OK
);
483 const offset_int maxobjsize
484 = wi::to_offset (max_object_size ());
485 alloca_type result
= (max_size
< maxobjsize
486 ? ALLOCA_BOUND_MAYBE_LARGE
: ALLOCA_OK
);
487 ret
= alloca_type_and_limit (result
, wi::to_wide (arg
));
494 // Return TRUE if STMT is in a loop, otherwise return FALSE.
497 in_loop_p (gimple
*stmt
)
499 basic_block bb
= gimple_bb (stmt
);
501 bb
->loop_father
&& bb
->loop_father
->header
!= ENTRY_BLOCK_PTR_FOR_FN (cfun
);
505 pass_walloca::execute (function
*fun
)
508 FOR_EACH_BB_FN (bb
, fun
)
510 for (gimple_stmt_iterator si
= gsi_start_bb (bb
); !gsi_end_p (si
);
513 gimple
*stmt
= gsi_stmt (si
);
514 location_t loc
= gimple_location (stmt
);
516 if (!gimple_alloca_call_p (stmt
))
520 = gimple_call_alloca_for_var_p (as_a
<gcall
*> (stmt
));
522 // Strict mode whining for VLAs is handled by the front-end,
523 // so we can safely ignore this case. Also, ignore VLAs if
524 // the user doesn't care about them.
527 if (warn_vla
> 0 || warn_vla_limit
< 0)
530 else if (warn_alloca
)
532 warning_at (loc
, OPT_Walloca
, "use of %<alloca%>");
535 else if (warn_alloca_limit
< 0)
538 tree invalid_casted_type
= NULL
;
539 class alloca_type_and_limit t
540 = alloca_call_type (stmt
, is_vla
, &invalid_casted_type
);
542 unsigned HOST_WIDE_INT adjusted_alloca_limit
543 = adjusted_warn_limit (false);
544 // Even if we think the alloca call is OK, make sure it's not in a
545 // loop, except for a VLA, since VLAs are guaranteed to be cleaned
546 // up when they go out of scope, including in a loop.
547 if (t
.type
== ALLOCA_OK
&& !is_vla
&& in_loop_p (stmt
))
549 /* As in other instances, only diagnose this when the limit
550 is less than the maximum valid object size. */
551 const offset_int maxobjsize
552 = wi::to_offset (max_object_size ());
553 if (adjusted_alloca_limit
< maxobjsize
.to_uhwi ())
554 t
= alloca_type_and_limit (ALLOCA_IN_LOOP
);
558 = is_vla
? OPT_Wvla_larger_than_
: OPT_Walloca_larger_than_
;
559 char buff
[WIDE_INT_MAX_PRECISION
/ 4 + 4];
564 case ALLOCA_BOUND_MAYBE_LARGE
:
566 auto_diagnostic_group d
;
567 if (warning_at (loc
, wcode
,
568 is_vla
? G_("argument to variable-length "
569 "array may be too large")
570 : G_("argument to %<alloca%> may be too "
574 print_decu (t
.limit
, buff
);
575 inform (loc
, "limit is %wu bytes, but argument "
576 "may be as large as %s",
577 is_vla
? warn_vla_limit
: adjusted_alloca_limit
,
582 case ALLOCA_BOUND_DEFINITELY_LARGE
:
584 auto_diagnostic_group d
;
585 if (warning_at (loc
, wcode
,
586 is_vla
? G_("argument to variable-length"
587 " array is too large")
588 : G_("argument to %<alloca%> is too large"))
591 print_decu (t
.limit
, buff
);
592 inform (loc
, "limit is %wu bytes, but argument is %s",
593 is_vla
? warn_vla_limit
: adjusted_alloca_limit
,
598 case ALLOCA_BOUND_UNKNOWN
:
599 warning_at (loc
, wcode
,
600 is_vla
? G_("variable-length array bound is unknown")
601 : G_("%<alloca%> bound is unknown"));
603 case ALLOCA_UNBOUNDED
:
604 warning_at (loc
, wcode
,
605 is_vla
? G_("unbounded use of variable-length array")
606 : G_("unbounded use of %<alloca%>"));
609 gcc_assert (!is_vla
);
610 warning_at (loc
, wcode
, "use of %<alloca%> within a loop");
612 case ALLOCA_CAST_FROM_SIGNED
:
613 gcc_assert (invalid_casted_type
!= NULL_TREE
);
614 warning_at (loc
, wcode
,
615 is_vla
? G_("argument to variable-length array "
616 "may be too large due to "
617 "conversion from %qT to %qT")
618 : G_("argument to %<alloca%> may be too large "
619 "due to conversion from %qT to %qT"),
620 invalid_casted_type
, size_type_node
);
622 case ALLOCA_ARG_IS_ZERO
:
623 warning_at (loc
, wcode
,
624 is_vla
? G_("argument to variable-length array "
626 : G_("argument to %<alloca%> is zero"));
637 make_pass_walloca (gcc::context
*ctxt
)
639 return new pass_walloca (ctxt
);