2 * smatch/smatch_buf_size.c
4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
14 #include "smatch_slist.h"
15 #include "smatch_extra.h"
18 * This check has two smatch IDs.
19 * my_size_id - used to store the size of arrays.
20 * my_strlen_id - track the strlen() of buffers.
23 static int my_size_id
;
24 static int my_strlen_id
;
30 static struct limiter b0_l2
= {0, 2};
32 static _Bool params_set
[32];
34 static int db_callback(void *unused
, int argc
, char **argv
, char **azColName
)
43 param
= strtoul(argv
[0], NULL
, 10);
44 size
= strtoul(argv
[1], NULL
, 10);
48 if (param
>= ARRAY_SIZE(params_set
))
50 if (params_set
[param
])
52 params_set
[param
] = 1;
55 FOR_EACH_PTR(cur_func_sym
->ctype
.base_type
->arguments
, arg
) {
57 * this is a temporary hack to work around a bug (I think in sparse?)
58 * 2.6.37-rc1:fs/reiserfs/journal.o
59 * If there is a function definition without parameter name found
60 * after a function implementation then it causes a crash.
64 if (arg
->ident
->name
< (char *)100)
66 if (i
== param
&& arg
->ident
->name
) {
67 set_state(my_size_id
, arg
->ident
->name
, arg
, alloc_state_num(size
));
70 } END_FOR_EACH_PTR(arg
);
75 static void match_function_def(struct symbol
*sym
)
77 if (!sym
|| !sym
->ident
|| !sym
->ident
->name
)
80 if (sym
->ctype
.modifiers
& MOD_STATIC
) {
82 "select distinct parameter, size from buf_size "
83 "where file = '%s' and function = '%s' "
84 "order by size desc;",
85 get_filename(), sym
->ident
->name
);
88 "select distinct parameter, size from buf_size "
89 "where function = '%s' "
90 "order by size desc;",
95 static int get_initializer_size(struct expression
*expr
)
99 return expr
->string
->length
;
100 case EXPR_INITIALIZER
: {
101 struct expression
*tmp
;
105 FOR_EACH_PTR(expr
->expr_list
, tmp
) {
106 if (tmp
->type
== EXPR_INDEX
&& tmp
->idx_to
> max
)
109 } END_FOR_EACH_PTR(tmp
);
115 return get_array_size(expr
);
120 static float get_cast_ratio(struct expression
*unstripped
)
122 struct expression
*start_expr
;
123 struct symbol
*start_type
;
124 struct symbol
*end_type
;
128 start_expr
= strip_expr(unstripped
);
129 start_type
= get_type(start_expr
);
130 end_type
= get_type(unstripped
);
131 if (!start_type
|| !end_type
)
134 if (start_type
->type
== SYM_PTR
)
135 start_bytes
= (get_base_type(start_type
))->ctype
.alignment
;
136 if (start_type
->type
== SYM_ARRAY
)
137 start_bytes
= (get_base_type(start_type
))->bit_size
/ 8;
138 if (end_type
->type
== SYM_PTR
)
139 end_bytes
= (get_base_type(end_type
))->ctype
.alignment
;
140 if (end_type
->type
== SYM_ARRAY
)
141 end_bytes
= (get_base_type(end_type
))->bit_size
/ 8;
143 if (!start_bytes
|| !end_bytes
)
145 return start_bytes
/ end_bytes
;
148 int get_array_size(struct expression
*expr
)
151 struct smatch_state
*state
;
156 if (expr
->type
== EXPR_STRING
)
157 return expr
->string
->length
;
159 cast_ratio
= get_cast_ratio(expr
);
160 expr
= strip_expr(expr
);
161 tmp
= get_type(expr
);
165 if (tmp
->type
== SYM_ARRAY
) {
166 ret
= get_expression_value(tmp
->array_size
);
167 /* Dynamically sized array are -1 in sparse */
170 /* People put one element arrays on the end of structs */
174 return ret
* cast_ratio
;
177 state
= get_state_expr(my_size_id
, expr
);
178 if (state
== &merged
)
180 if (state
&& state
->data
) {
181 if (tmp
->type
== SYM_PTR
)
182 tmp
= get_base_type(tmp
);
183 if (!tmp
->ctype
.alignment
)
185 ret
= (int)state
->data
/ tmp
->ctype
.alignment
;
186 return ret
* cast_ratio
;
189 if (expr
->type
== EXPR_SYMBOL
&& expr
->symbol
->initializer
) {
190 if (expr
->symbol
->initializer
!= expr
) /* int a = a; */
191 return get_initializer_size(expr
->symbol
->initializer
) * cast_ratio
;
194 state
= get_state_expr(my_strlen_id
, expr
);
195 if (!state
|| !state
->data
)
197 if (get_implied_max((struct expression
*)state
->data
, &len
))
198 return len
+ 1; /* add one because strlen doesn't include the NULL */
202 int get_array_size_bytes(struct expression
*expr
)
208 if (expr
->type
== EXPR_STRING
)
209 return expr
->string
->length
;
211 tmp
= get_type(expr
);
215 if (tmp
->type
== SYM_ARRAY
) {
216 tmp
= get_base_type(tmp
);
217 element_size
= tmp
->bit_size
/ 8;
218 } else if (tmp
->type
== SYM_PTR
) {
219 tmp
= get_base_type(tmp
);
220 element_size
= tmp
->ctype
.alignment
;
224 array_size
= get_array_size(expr
);
225 return array_size
* element_size
;
228 static void match_strlen_condition(struct expression
*expr
)
230 struct expression
*left
;
231 struct expression
*right
;
232 struct expression
*str
;
234 int strlen_right
= 0;
236 struct smatch_state
*true_state
= NULL
;
237 struct smatch_state
*false_state
= NULL
;
239 if (expr
->type
!= EXPR_COMPARE
)
241 left
= strip_expr(expr
->left
);
242 right
= strip_expr(expr
->right
);
244 if (left
->type
== EXPR_CALL
&& sym_name_is("strlen", left
->fn
)) {
245 str
= get_argument_from_call_expr(left
->args
, 0);
248 if (right
->type
== EXPR_CALL
&& sym_name_is("strlen", right
->fn
)) {
249 str
= get_argument_from_call_expr(right
->args
, 0);
253 if (!strlen_left
&& !strlen_right
)
255 if (strlen_left
&& strlen_right
)
259 if (!get_value(right
, &val
))
263 if (!get_value(left
, &val
))
267 if (expr
->op
== SPECIAL_EQUAL
) {
268 set_true_false_states_expr(my_size_id
, str
, alloc_state_num(val
+ 1), NULL
);
271 if (expr
->op
== SPECIAL_NOTEQUAL
) {
272 set_true_false_states_expr(my_size_id
, str
, NULL
, alloc_state_num(val
+ 1));
278 case SPECIAL_UNSIGNED_LT
:
280 true_state
= alloc_state_num(val
);
282 false_state
= alloc_state_num(val
+ 1);
285 case SPECIAL_UNSIGNED_LTE
:
287 true_state
= alloc_state_num(val
+ 1);
289 false_state
= alloc_state_num(val
);
292 case SPECIAL_UNSIGNED_GTE
:
294 false_state
= alloc_state_num(val
);
296 true_state
= alloc_state_num(val
+ 1);
299 case SPECIAL_UNSIGNED_GT
:
301 false_state
= alloc_state_num(val
+ 1);
303 true_state
= alloc_state_num(val
);
306 set_true_false_states_expr(my_size_id
, str
, true_state
, false_state
);
309 static struct expression
*strip_ampersands(struct expression
*expr
)
313 if (expr
->type
!= EXPR_PREOP
)
317 type
= get_type(expr
->unop
);
318 if (!type
|| type
->type
!= SYM_ARRAY
)
323 static void match_array_assignment(struct expression
*expr
)
325 struct expression
*left
;
326 struct expression
*right
;
331 left
= strip_expr(expr
->left
);
332 right
= strip_expr(expr
->right
);
333 right
= strip_ampersands(right
);
334 array_size
= get_array_size_bytes(right
);
336 set_state_expr(my_size_id
, left
, alloc_state_num(array_size
));
339 static void match_alloc(const char *fn
, struct expression
*expr
, void *_size_arg
)
341 int size_arg
= (int)_size_arg
;
342 struct expression
*right
;
343 struct expression
*arg
;
346 right
= strip_expr(expr
->right
);
347 arg
= get_argument_from_call_expr(right
->args
, size_arg
);
348 if (!get_implied_value(arg
, &bytes
))
350 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(bytes
));
353 static void match_calloc(const char *fn
, struct expression
*expr
, void *unused
)
355 struct expression
*right
;
356 struct expression
*arg
;
360 right
= strip_expr(expr
->right
);
361 arg
= get_argument_from_call_expr(right
->args
, 0);
362 if (!get_implied_value(arg
, &elements
))
364 arg
= get_argument_from_call_expr(right
->args
, 1);
365 if (!get_implied_value(arg
, &size
))
367 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(elements
* size
));
370 static void match_strlen(const char *fn
, struct expression
*expr
, void *unused
)
372 struct expression
*right
;
373 struct expression
*str
;
374 struct expression
*len_expr
;
376 struct smatch_state
*state
;
378 right
= strip_expr(expr
->right
);
379 str
= get_argument_from_call_expr(right
->args
, 0);
380 len_expr
= strip_expr(expr
->left
);
382 len_name
= get_variable_from_expr(len_expr
, NULL
);
386 state
= __alloc_smatch_state(0);
387 state
->name
= len_name
;
388 state
->data
= len_expr
;
389 set_state_expr(my_strlen_id
, str
, state
);
392 static void match_limited(const char *fn
, struct expression
*expr
, void *_limiter
)
394 struct limiter
*limiter
= (struct limiter
*)_limiter
;
395 struct expression
*dest
;
396 struct expression
*size_expr
;
399 dest
= get_argument_from_call_expr(expr
->args
, limiter
->buf_arg
);
400 size_expr
= get_argument_from_call_expr(expr
->args
, limiter
->limit_arg
);
401 if (!get_implied_max(size_expr
, &size
))
403 set_state_expr(my_size_id
, dest
, alloc_state_num(size
));
406 static void match_strcpy(const char *fn
, struct expression
*expr
, void *unused
)
408 struct expression fake_assign
;
410 fake_assign
.op
= '=';
411 fake_assign
.left
= get_argument_from_call_expr(expr
->args
, 0);
412 fake_assign
.right
= get_argument_from_call_expr(expr
->args
, 1);
413 match_array_assignment(&fake_assign
);
416 static void match_strndup(const char *fn
, struct expression
*expr
, void *unused
)
418 struct expression
*fn_expr
;
419 struct expression
*size_expr
;
422 fn_expr
= strip_expr(expr
->right
);
423 size_expr
= get_argument_from_call_expr(fn_expr
->args
, 1);
424 if (!get_implied_max(size_expr
, &size
))
427 /* It's easy to forget space for the NUL char */
429 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(size
));
432 static void match_call(struct expression
*expr
)
435 struct expression
*arg
;
439 name
= get_variable_from_expr(expr
->fn
, NULL
);
444 FOR_EACH_PTR(expr
->args
, arg
) {
445 bytes
= get_array_size_bytes(arg
);
447 sm_msg("info: passes_buffer '%s' %d %d", name
, i
, bytes
);
449 } END_FOR_EACH_PTR(arg
);
454 static void match_func_end(struct symbol
*sym
)
456 memset(params_set
, 0, sizeof(params_set
));
459 void register_buf_size(int id
)
463 add_hook(&match_function_def
, FUNC_DEF_HOOK
);
465 add_function_assign_hook("malloc", &match_alloc
, INT_PTR(0));
466 add_function_assign_hook("calloc", &match_calloc
, NULL
);
467 add_function_assign_hook("memdup", &match_alloc
, INT_PTR(1));
468 if (option_project
== PROJ_KERNEL
) {
469 add_function_assign_hook("kmalloc", &match_alloc
, INT_PTR(0));
470 add_function_assign_hook("kzalloc", &match_alloc
, INT_PTR(0));
471 add_function_assign_hook("vmalloc", &match_alloc
, INT_PTR(0));
472 add_function_assign_hook("__vmalloc", &match_alloc
, INT_PTR(0));
473 add_function_assign_hook("kcalloc", &match_calloc
, NULL
);
474 add_function_assign_hook("drm_malloc_ab", &match_calloc
, NULL
);
475 add_function_assign_hook("drm_calloc_large", &match_calloc
, NULL
);
476 add_function_assign_hook("kmemdup", &match_alloc
, INT_PTR(1));
477 add_function_assign_hook("kmemdup_user", &match_alloc
, INT_PTR(1));
479 add_hook(&match_array_assignment
, ASSIGNMENT_HOOK
);
480 add_hook(&match_strlen_condition
, CONDITION_HOOK
);
481 add_function_assign_hook("strlen", &match_strlen
, NULL
);
484 add_function_hook("strncpy", &match_limited
, &b0_l2
);
485 add_function_hook("strlcpy", &match_limited
, &b0_l2
);
486 add_function_hook("strlcat", &match_limited
, &b0_l2
);
488 add_function_hook("memcpy", &match_limited
, &b0_l2
);
489 add_function_hook("memscan", &match_limited
, &b0_l2
);
491 add_function_hook("strcpy", &match_strcpy
, NULL
);
493 add_function_assign_hook("strndup", match_strndup
, NULL
);
494 if (option_project
== PROJ_KERNEL
)
495 add_function_assign_hook("kstrndup", match_strndup
, NULL
);
498 add_hook(&match_call
, FUNCTION_CALL_HOOK
);
500 add_hook(&match_func_end
, END_FUNC_HOOK
);
503 void register_strlen(int id
)