2 * Copyright (C) 2010 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
22 #include "smatch_slist.h"
23 #include "smatch_extra.h"
24 #include "smatch_function_hashtable.h"
26 #define UNKNOWN_SIZE (-1)
28 static int my_size_id
;
34 static struct limiter b0_l2
= {0, 2};
36 static DEFINE_HASHTABLE_INSERT(insert_func
, char, int);
37 static DEFINE_HASHTABLE_SEARCH(search_func
, char, int);
38 static struct hashtable
*allocation_funcs
;
40 static char *get_fn_name(struct expression
*expr
)
42 if (expr
->type
!= EXPR_CALL
)
44 if (expr
->fn
->type
!= EXPR_SYMBOL
)
46 return expr_to_var(expr
->fn
);
49 static int is_allocation_function(struct expression
*expr
)
54 func
= get_fn_name(expr
);
57 if (search_func(allocation_funcs
, func
))
63 static void add_allocation_function(const char *func
, void *call_back
, int param
)
65 insert_func(allocation_funcs
, (char *)func
, (int *)1);
66 add_function_assign_hook(func
, call_back
, INT_PTR(param
));
69 static int estate_to_size(struct smatch_state
*state
)
73 if (!state
|| !estate_rl(state
))
75 sval
= estate_max(state
);
79 static struct smatch_state
*size_to_estate(int size
)
83 sval
.type
= &int_ctype
;
86 return alloc_estate_sval(sval
);
89 static struct range_list
*size_to_rl(int size
)
93 sval
.type
= &int_ctype
;
96 return alloc_rl(sval
, sval
);
99 static struct smatch_state
*unmatched_size_state(struct sm_state
*sm
)
101 return size_to_estate(UNKNOWN_SIZE
);
104 static void set_size_undefined(struct sm_state
*sm
, struct expression
*mod_expr
)
106 set_state(sm
->owner
, sm
->name
, sm
->sym
, size_to_estate(UNKNOWN_SIZE
));
109 static struct smatch_state
*merge_size_func(struct smatch_state
*s1
, struct smatch_state
*s2
)
111 return merge_estates(s1
, s2
);
114 void set_param_buf_size(const char *name
, struct symbol
*sym
, char *key
, char *value
)
116 struct range_list
*rl
= NULL
;
117 struct smatch_state
*state
;
120 if (strncmp(key
, "$", 1) != 0)
123 snprintf(fullname
, 256, "%s%s", name
, key
+ 1);
125 str_to_rl(&int_ctype
, value
, &rl
);
126 if (!rl
|| is_whole_rl(rl
))
128 state
= alloc_estate_rl(rl
);
129 set_state(my_size_id
, fullname
, sym
, state
);
132 static int bytes_per_element(struct expression
*expr
)
138 if (expr
->type
== EXPR_STRING
)
140 type
= get_type(expr
);
144 if (type
->type
!= SYM_PTR
&& type
->type
!= SYM_ARRAY
)
147 type
= get_base_type(type
);
148 return type_bytes(type
);
151 static int bytes_to_elements(struct expression
*expr
, int bytes
)
155 bpe
= bytes_per_element(expr
);
161 static int elements_to_bytes(struct expression
*expr
, int elements
)
165 bpe
= bytes_per_element(expr
);
166 return elements
* bpe
;
169 static int get_initializer_size(struct expression
*expr
)
171 switch (expr
->type
) {
173 return expr
->string
->length
;
174 case EXPR_INITIALIZER
: {
175 struct expression
*tmp
;
178 FOR_EACH_PTR(expr
->expr_list
, tmp
) {
179 if (tmp
->type
== EXPR_INDEX
) {
180 if (tmp
->idx_to
>= i
)
187 } END_FOR_EACH_PTR(tmp
);
191 return get_array_size(expr
);
196 static struct range_list
*db_size_rl
;
197 static int db_size_callback(void *unused
, int argc
, char **argv
, char **azColName
)
199 struct range_list
*tmp
= NULL
;
202 str_to_rl(&int_ctype
, argv
[0], &db_size_rl
);
204 str_to_rl(&int_ctype
, argv
[0], &tmp
);
205 db_size_rl
= rl_union(db_size_rl
, tmp
);
210 static struct range_list
*size_from_db(struct expression
*expr
)
212 int this_file_only
= 0;
215 name
= get_member_name(expr
);
216 if (!name
&& is_static(expr
)) {
217 name
= expr_to_var(expr
);
223 if (this_file_only
) {
225 run_sql(db_size_callback
, NULL
,
226 "select size from function_type_size where type = '%s' and file = '%s';",
227 name
, get_filename());
234 run_sql(db_size_callback
, NULL
,
235 "select size from type_size where type = '%s';",
240 static void db_returns_buf_size(struct expression
*expr
, int param
, char *unused
, char *math
)
242 struct expression
*call
;
245 if (expr
->type
!= EXPR_ASSIGNMENT
)
247 call
= strip_expr(expr
->right
);
249 if (!parse_call_math(call
, math
, &sval
))
251 set_state_expr(my_size_id
, expr
->left
, size_to_estate(sval
.value
));
254 int get_real_array_size(struct expression
*expr
)
261 if (expr
->type
== EXPR_BINOP
) /* array elements foo[5] */
264 type
= get_type(expr
);
267 if (!type
|| type
->type
!= SYM_ARRAY
)
270 if (!get_implied_value(type
->array_size
, &sval
))
273 /* People put one element arrays on the end of structs */
280 static int get_size_from_initializer(struct expression
*expr
)
282 if (expr
->type
!= EXPR_SYMBOL
|| !expr
->symbol
|| !expr
->symbol
->initializer
)
284 if (expr
->symbol
->initializer
== expr
) /* int a = a; */
286 return get_initializer_size(expr
->symbol
->initializer
);
289 static struct range_list
*get_stored_size_bytes(struct expression
*expr
)
291 struct smatch_state
*state
;
293 state
= get_state_expr(my_size_id
, expr
);
296 return estate_rl(state
);
299 static int get_bytes_from_address(struct expression
*expr
)
306 if (expr
->type
!= EXPR_PREOP
|| expr
->op
!= '&')
308 type
= get_type(expr
);
312 if (type
->type
== SYM_PTR
)
313 type
= get_base_type(type
);
315 ret
= type_bytes(type
);
317 return 0; /* ignore char pointers */
322 static struct expression
*remove_addr_fluff(struct expression
*expr
)
324 struct expression
*tmp
;
327 expr
= strip_expr(expr
);
329 /* remove '&' and '*' operations that cancel */
330 while (expr
&& expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
331 tmp
= strip_expr(expr
->unop
);
332 if (tmp
->type
!= EXPR_PREOP
)
336 expr
= strip_expr(tmp
->unop
);
342 /* "foo + 0" is just "foo" */
343 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+' &&
344 get_value(expr
->right
, &sval
) && sval
.value
== 0)
350 static int is_last_member_of_struct(struct symbol
*sym
, struct ident
*member
)
356 FOR_EACH_PTR_REVERSE(sym
->symbol_list
, tmp
) {
357 if (i
++ || !tmp
->ident
)
359 if (tmp
->ident
== member
)
362 } END_FOR_EACH_PTR_REVERSE(tmp
);
367 static int last_member_is_resizable(struct symbol
*sym
)
369 struct symbol
*last_member
;
373 last_member
= last_ptr_list((struct ptr_list
*)sym
->symbol_list
);
374 if (!last_member
|| !last_member
->ident
)
377 type
= get_real_base_type(last_member
);
378 if (type
->type
== SYM_STRUCT
)
379 return last_member_is_resizable(type
);
380 if (type
->type
!= SYM_ARRAY
)
383 if (!get_implied_value(type
->array_size
, &sval
))
386 if (sval
.value
!= 0 && sval
.value
!= 1)
392 static int get_stored_size_end_struct_bytes(struct expression
*expr
)
395 struct symbol
*base_sym
;
396 struct smatch_state
*state
;
398 if (expr
->type
== EXPR_BINOP
) /* array elements foo[5] */
401 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
402 expr
= strip_parens(expr
->unop
);
404 sym
= expr_to_sym(expr
);
405 if (!sym
|| !sym
->ident
)
407 if (!type_bytes(sym
))
409 if (sym
->type
!= SYM_NODE
)
412 base_sym
= get_real_base_type(sym
);
413 if (!base_sym
|| base_sym
->type
!= SYM_PTR
)
415 base_sym
= get_real_base_type(base_sym
);
416 if (!base_sym
|| base_sym
->type
!= SYM_STRUCT
)
419 if (!is_last_member_of_struct(base_sym
, expr
->member
))
421 if (!last_member_is_resizable(base_sym
))
424 state
= get_state(my_size_id
, sym
->ident
->name
, sym
);
425 if (!estate_to_size(state
))
428 return estate_to_size(state
) - type_bytes(base_sym
) + type_bytes(get_type(expr
));
431 static struct range_list
*alloc_int_rl(int value
)
438 return alloc_rl(sval
, sval
);
441 struct range_list
*get_array_size_bytes_rl(struct expression
*expr
)
443 int declared_size
= 0;
444 struct range_list
*ret
= NULL
;
447 expr
= remove_addr_fluff(expr
);
452 if (expr
->type
== EXPR_STRING
)
453 return alloc_int_rl(expr
->string
->length
);
455 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+') {
458 if (!get_implied_value(expr
->right
, &offset
))
460 size
= get_array_size_bytes(expr
->left
);
463 return alloc_int_rl(size
- offset
.value
);
467 size
= get_real_array_size(expr
);
469 declared_size
= elements_to_bytes(expr
, size
);
471 /* buf = malloc(1024); */
472 ret
= get_stored_size_bytes(expr
);
475 return rl_union(ret
, alloc_int_rl(size
));
479 return alloc_int_rl(declared_size
);
481 size
= get_stored_size_end_struct_bytes(expr
);
483 return alloc_int_rl(size
);
485 /* char *foo = "BAR" */
486 size
= get_size_from_initializer(expr
);
488 return alloc_int_rl(elements_to_bytes(expr
, size
));
490 size
= get_bytes_from_address(expr
);
492 return alloc_int_rl(size
);
495 ret
= size_from_db(expr
);
502 int get_array_size_bytes(struct expression
*expr
)
504 struct range_list
*rl
;
507 rl
= get_array_size_bytes_rl(expr
);
508 if (!rl_to_sval(rl
, &sval
))
510 if (sval
.uvalue
>= INT_MAX
)
515 int get_array_size_bytes_max(struct expression
*expr
)
517 struct range_list
*rl
;
520 rl
= get_array_size_bytes_rl(expr
);
527 if (bytes
.uvalue
>= INT_MAX
)
532 int get_array_size_bytes_min(struct expression
*expr
)
534 struct range_list
*rl
;
535 struct data_range
*range
;
537 rl
= get_array_size_bytes_rl(expr
);
541 FOR_EACH_PTR(rl
, range
) {
542 if (range
->min
.value
<= 0)
544 if (range
->max
.value
<= 0)
546 if (range
->min
.uvalue
>= INT_MAX
)
548 return range
->min
.value
;
549 } END_FOR_EACH_PTR(range
);
554 int get_array_size(struct expression
*expr
)
558 return bytes_to_elements(expr
, get_array_size_bytes_max(expr
));
561 static struct expression
*strip_ampersands(struct expression
*expr
)
565 if (expr
->type
!= EXPR_PREOP
)
569 type
= get_type(expr
->unop
);
570 if (!type
|| type
->type
!= SYM_ARRAY
)
575 static void info_record_alloction(struct expression
*buffer
, struct range_list
*rl
)
582 name
= get_member_name(buffer
);
583 if (!name
&& is_static(buffer
))
584 name
= expr_to_var(buffer
);
587 if (rl
&& !is_whole_rl(rl
))
588 sql_insert_function_type_size(name
, show_rl(rl
));
590 sql_insert_function_type_size(name
, "(-1)");
595 static void store_alloc(struct expression
*expr
, struct range_list
*rl
)
599 rl
= clone_rl(rl
); // FIXME!!!
600 set_state_expr(my_size_id
, expr
, alloc_estate_rl(rl
));
602 type
= get_type(expr
);
605 if (type
->type
!= SYM_PTR
)
607 type
= get_real_base_type(type
);
610 if (type
== &void_ctype
)
612 if (type
->type
!= SYM_BASETYPE
)
615 info_record_alloction(expr
, rl
);
618 static void match_array_assignment(struct expression
*expr
)
620 struct expression
*left
;
621 struct expression
*right
;
622 char *left_member
, *right_member
;
623 struct range_list
*rl
;
628 left
= strip_expr(expr
->left
);
629 right
= strip_expr(expr
->right
);
630 right
= strip_ampersands(right
);
632 if (!is_pointer(left
))
634 if (is_allocation_function(right
))
637 left_member
= get_member_name(left
);
638 right_member
= get_member_name(right
);
639 if (left_member
&& right_member
&& strcmp(left_member
, right_member
) == 0) {
640 free_string(left_member
);
641 free_string(right_member
);
644 free_string(left_member
);
645 free_string(right_member
);
647 if (get_implied_value(right
, &sval
) && sval
.value
== 0) {
648 rl
= alloc_int_rl(0);
652 rl
= get_array_size_bytes_rl(right
);
655 store_alloc(left
, rl
);
658 static void match_alloc(const char *fn
, struct expression
*expr
, void *_size_arg
)
660 int size_arg
= PTR_INT(_size_arg
);
661 struct expression
*right
;
662 struct expression
*arg
;
663 struct range_list
*rl
;
665 right
= strip_expr(expr
->right
);
666 arg
= get_argument_from_call_expr(right
->args
, size_arg
);
667 get_absolute_rl(arg
, &rl
);
668 rl
= cast_rl(&int_ctype
, rl
);
669 store_alloc(expr
->left
, rl
);
672 static void match_calloc(const char *fn
, struct expression
*expr
, void *unused
)
674 struct expression
*right
;
675 struct expression
*arg
;
679 right
= strip_expr(expr
->right
);
680 arg
= get_argument_from_call_expr(right
->args
, 0);
681 if (!get_implied_value(arg
, &elements
))
683 arg
= get_argument_from_call_expr(right
->args
, 1);
684 if (get_implied_value(arg
, &size
))
685 store_alloc(expr
->left
, size_to_rl(elements
.value
* size
.value
));
687 store_alloc(expr
->left
, size_to_rl(-1));
690 static void match_page(const char *fn
, struct expression
*expr
, void *_unused
)
697 store_alloc(expr
->left
, alloc_rl(page_size
, page_size
));
700 static void match_limited(const char *fn
, struct expression
*expr
, void *_limiter
)
702 struct limiter
*limiter
= (struct limiter
*)_limiter
;
703 struct expression
*dest
;
704 struct expression
*size_expr
;
707 dest
= get_argument_from_call_expr(expr
->args
, limiter
->buf_arg
);
708 size_expr
= get_argument_from_call_expr(expr
->args
, limiter
->limit_arg
);
709 if (!get_implied_max(size_expr
, &size
))
711 set_state_expr(my_size_id
, dest
, size_to_estate(size
.value
));
714 static void match_strcpy(const char *fn
, struct expression
*expr
, void *unused
)
716 struct expression fake_assign
;
718 fake_assign
.op
= '=';
719 fake_assign
.left
= get_argument_from_call_expr(expr
->args
, 0);
720 fake_assign
.right
= get_argument_from_call_expr(expr
->args
, 1);
721 match_array_assignment(&fake_assign
);
724 static void match_strndup(const char *fn
, struct expression
*expr
, void *unused
)
726 struct expression
*fn_expr
;
727 struct expression
*size_expr
;
730 fn_expr
= strip_expr(expr
->right
);
731 size_expr
= get_argument_from_call_expr(fn_expr
->args
, 1);
732 if (get_implied_max(size_expr
, &size
)) {
734 store_alloc(expr
->left
, size_to_rl(size
.value
));
736 store_alloc(expr
->left
, size_to_rl(-1));
741 static void match_call(struct expression
*expr
)
743 struct expression
*arg
;
745 struct range_list
*rl
;
749 FOR_EACH_PTR(expr
->args
, arg
) {
751 type
= get_type(arg
);
752 if (!type
|| (type
->type
!= SYM_PTR
&& type
->type
!= SYM_ARRAY
))
754 rl
= get_array_size_bytes_rl(arg
);
759 sql_insert_caller_info(expr
, BUF_SIZE
, i
, "$", show_rl(rl
));
760 } END_FOR_EACH_PTR(arg
);
763 static void struct_member_callback(struct expression
*call
, int param
, char *printed_name
, struct sm_state
*sm
)
765 if (sm
->state
== &merged
||
766 strcmp(sm
->state
->name
, "(-1)") == 0 ||
767 strcmp(sm
->state
->name
, "empty") == 0 ||
768 strcmp(sm
->state
->name
, "0") == 0)
770 sql_insert_caller_info(call
, BUF_SIZE
, param
, printed_name
, sm
->state
->name
);
773 void register_buf_size(int id
)
777 add_unmatched_state_hook(my_size_id
, &unmatched_size_state
);
779 select_caller_info_hook(set_param_buf_size
, BUF_SIZE
);
780 select_return_states_hook(BUF_SIZE
, &db_returns_buf_size
);
782 allocation_funcs
= create_function_hashtable(100);
783 add_allocation_function("malloc", &match_alloc
, 0);
784 add_allocation_function("calloc", &match_calloc
, 0);
785 add_allocation_function("memdup", &match_alloc
, 1);
786 add_allocation_function("realloc", &match_alloc
, 1);
787 if (option_project
== PROJ_KERNEL
) {
788 add_allocation_function("kmalloc", &match_alloc
, 0);
789 add_allocation_function("kzalloc", &match_alloc
, 0);
790 add_allocation_function("vmalloc", &match_alloc
, 0);
791 add_allocation_function("__vmalloc", &match_alloc
, 0);
792 add_allocation_function("kcalloc", &match_calloc
, 0);
793 add_allocation_function("kmalloc_array", &match_calloc
, 0);
794 add_allocation_function("drm_malloc_ab", &match_calloc
, 0);
795 add_allocation_function("drm_calloc_large", &match_calloc
, 0);
796 add_allocation_function("sock_kmalloc", &match_alloc
, 1);
797 add_allocation_function("kmemdup", &match_alloc
, 1);
798 add_allocation_function("kmemdup_user", &match_alloc
, 1);
799 add_allocation_function("dma_alloc_attrs", &match_alloc
, 1);
800 add_allocation_function("pci_alloc_consistent", &match_alloc
, 1);
801 add_allocation_function("pci_alloc_coherent", &match_alloc
, 1);
802 add_allocation_function("devm_kmalloc", &match_alloc
, 1);
803 add_allocation_function("devm_kzalloc", &match_alloc
, 1);
804 add_allocation_function("krealloc", &match_alloc
, 1);
805 add_allocation_function("kmap", &match_page
, 0);
806 add_allocation_function("get_zeroed_page", &match_page
, 0);
809 add_allocation_function("strndup", match_strndup
, 0);
810 if (option_project
== PROJ_KERNEL
)
811 add_allocation_function("kstrndup", match_strndup
, 0);
813 add_modification_hook(my_size_id
, &set_size_undefined
);
815 add_merge_hook(my_size_id
, &merge_size_func
);
818 void register_buf_size_late(int id
)
820 /* has to happen after match_alloc() */
821 add_hook(&match_array_assignment
, ASSIGNMENT_HOOK
);
823 add_function_hook("strlcpy", &match_limited
, &b0_l2
);
824 add_function_hook("strlcat", &match_limited
, &b0_l2
);
825 add_function_hook("memscan", &match_limited
, &b0_l2
);
827 add_function_hook("strcpy", &match_strcpy
, NULL
);
829 add_hook(&match_call
, FUNCTION_CALL_HOOK
);
830 add_member_info_callback(my_size_id
, struct_member_callback
);