smatch_untracked_param.c

   1 /*
   2  * Copyright (C) 2014 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * Sometimes we aren't able to track a variable through a function call.  This
  20  * usually happens because a function changes too many variables so we give up.
  21  * Another reason this happens is because we call a function pointer and there
  22  * are too many functions which implement that function pointer so we give up.
  23  * Also maybe we don't have the database enabled.
  24  *
  25  * The goal here is to make a call back so what if we call:
  26  *
  27  *      frob(&foo);
  28  *
  29  * but we're not able to say what happens to "foo", then let's assume that we
  30  * don't know anything about "foo" if it's an untracked call.
  31  *
  32  */
  33
  34 #include "smatch.h"
  35 #include "smatch_slist.h"
  36 #include "smatch_extra.h"
  37
  38 static int my_id;
  39 static unsigned long tracked;
  40
  41 STATE(untracked);
  42 STATE(lost);
  43
  44 typedef void (untracked_hook)(struct expression *call, int param);
  45 DECLARE_PTR_LIST(untracked_hook_list, untracked_hook *);
  46 static struct untracked_hook_list *untracked_hooks;
  47 static struct untracked_hook_list *lost_hooks;
  48
  49 void add_untracked_param_hook(void (func)(struct expression *call, int param))
  50 {
  51         untracked_hook **p = malloc(sizeof(untracked_hook *));
  52         *p = func;
  53         add_ptr_list(&untracked_hooks, p);
  54 }
  55
  56 static void call_untracked_callbacks(struct expression *expr, int param)
  57 {
  58         untracked_hook **fn;
  59
  60         FOR_EACH_PTR(untracked_hooks, fn) {
  61                 (*fn)(expr, param);
  62         } END_FOR_EACH_PTR(fn);
  63 }
  64
  65 void add_lost_param_hook(void (func)(struct expression *call, int param))
  66 {
  67         untracked_hook **p = malloc(sizeof(untracked_hook *));
  68         *p = func;
  69         add_ptr_list(&lost_hooks, p);
  70 }
  71
  72 static void call_lost_callbacks(struct expression *expr, int param)
  73 {
  74         untracked_hook **fn;
  75
  76         FOR_EACH_PTR(lost_hooks, fn) {
  77                 (*fn)(expr, param);
  78         } END_FOR_EACH_PTR(fn);
  79 }
  80
  81 static void assume_tracked(struct expression *call_expr, int param, char *key, char *value)
  82 {
  83         tracked = 1;
  84 }
  85
  86 static char *get_array_from_key(struct expression *expr, int param, const char *key, struct symbol **sym)
  87 {
  88         struct expression *arg;
  89
  90         arg = get_argument_from_call_expr(expr->args, param);
  91         if (!arg)
  92                 return NULL;
  93         if (arg->type != EXPR_PREOP || arg->op != '&')
  94                 return NULL;
  95         arg = arg->unop;
  96         if (!is_array(arg))
  97                 return NULL;
  98         arg = get_array_base(arg);
  99
 100         return expr_to_var_sym(arg, sym);
 101 }
 102
 103 static void mark_untracked_lost(struct expression *expr, int param, const char *key, int type)
 104 {
 105         char *name;
 106         struct symbol *sym;
 107
 108         while (expr->type == EXPR_ASSIGNMENT)
 109                 expr = strip_expr(expr->right);
 110         if (expr->type != EXPR_CALL)
 111                 return;
 112
 113         name = get_name_sym_from_key(expr, param, key, &sym);
 114         if (!name || !sym) {
 115                 name = get_array_from_key(expr, param, key, &sym);
 116                 if (!name || !sym)
 117                         goto free;
 118         }
 119
 120         if (type == LOST_PARAM)
 121                 call_lost_callbacks(expr, param);
 122         call_untracked_callbacks(expr, param);
 123         set_state(my_id, name, sym, &untracked);
 124 free:
 125         free_string(name);
 126
 127 }
 128
 129 void mark_untracked(struct expression *expr, int param, const char *key, const char *value)
 130 {
 131         mark_untracked_lost(expr, param, key, UNTRACKED_PARAM);
 132 }
 133
 134 void mark_lost(struct expression *expr, int param, const char *key, const char *value)
 135 {
 136         mark_untracked_lost(expr, param, key, LOST_PARAM);
 137 }
 138
 139 static int lost_in_va_args(struct expression *expr)
 140 {
 141         struct symbol *fn;
 142         char *name;
 143         int is_lost;
 144
 145         fn = get_type(expr->fn);
 146         if (!fn || !fn->variadic)
 147                 return 0;
 148
 149         is_lost = 1;
 150         name = expr_to_var(expr->fn);
 151         if (name && strstr(name, "print"))
 152                 is_lost = 0;
 153         free_string(name);
 154
 155         return is_lost;
 156 }
 157
 158 static void match_after_call(struct expression *expr)
 159 {
 160         struct expression *arg;
 161         struct symbol *type;
 162         int i;
 163
 164         if (lost_in_va_args(expr))
 165                 tracked = 0;
 166
 167         if (tracked)
 168                 return;
 169
 170         i = -1;
 171         FOR_EACH_PTR(expr->args, arg) {
 172                 i++;
 173
 174                 type = get_type(arg);
 175                 if (!type || type->type != SYM_PTR)
 176                         continue;
 177
 178                 call_untracked_callbacks(expr, i);
 179                 set_state_expr(my_id, arg, &untracked);
 180         } END_FOR_EACH_PTR(arg);
 181 }
 182
 183
 184 static void mark_all_params(int return_id, char *return_ranges, int type)
 185 {
 186         struct symbol *arg;
 187         int param;
 188
 189         param = -1;
 190         FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
 191                 param++;
 192
 193                 if (!arg->ident)
 194                         continue;
 195                 sql_insert_return_states(return_id, return_ranges,
 196                                          type, param, "$", "");
 197         } END_FOR_EACH_PTR(arg);
 198 }
 199
 200
 201 void mark_all_params_untracked(int return_id, char *return_ranges, struct expression *expr)
 202 {
 203         mark_all_params(return_id, return_ranges, UNTRACKED_PARAM);
 204 }
 205
 206 void mark_all_params_lost(int return_id, char *return_ranges, struct expression *expr)
 207 {
 208         mark_all_params(return_id, return_ranges, LOST_PARAM);
 209 }
 210
 211 static void print_untracked_params(int return_id, char *return_ranges, struct expression *expr)
 212 {
 213         struct sm_state *sm;
 214         struct symbol *arg;
 215         int param;
 216         int type;
 217
 218         param = -1;
 219         FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
 220                 param++;
 221
 222                 if (!arg->ident)
 223                         continue;
 224
 225                 if (__bail_on_rest_of_function) {
 226                         /* hairy functions are lost */
 227                         type = LOST_PARAM;
 228                 } else if ((sm = get_sm_state(my_id, arg->ident->name, arg))) {
 229                         if (slist_has_state(sm->possible, &lost))
 230                                 type = LOST_PARAM;
 231                         else
 232                                 type = UNTRACKED_PARAM;
 233                 } else {
 234                         continue;
 235                 }
 236
 237                 sql_insert_return_states(return_id, return_ranges,
 238                                          type, param, "$", "");
 239         } END_FOR_EACH_PTR(arg);
 240 }
 241
 242 static void match_param_assign(struct expression *expr)
 243 {
 244         struct expression *right;
 245         struct symbol *type;
 246         int param;
 247
 248         if (__in_fake_assign)
 249                 return;
 250
 251         right = strip_expr(expr->right);
 252         type = get_type(right);
 253         if (!type || type->type != SYM_PTR)
 254                 return;
 255
 256         param = get_param_num(right);
 257         if (param < 0)
 258                 return;
 259
 260         set_state_expr(my_id, right, &untracked);
 261 }
 262
 263
 264 static void match_param_assign_in_asm(struct statement *stmt)
 265 {
 266         struct expression *expr;
 267         struct asm_operand *op;
 268         struct symbol *type;
 269         int param;
 270
 271         FOR_EACH_PTR(stmt->asm_inputs, op) {
 272                 expr = strip_expr(op->expr);
 273                 type = get_type(expr);
 274                 if (!type || type->type != SYM_PTR)
 275                         continue;
 276                 param = get_param_num(expr);
 277                 if (param < 0)
 278                         continue;
 279                 set_state_expr(my_id, expr, &untracked);
 280         } END_FOR_EACH_PTR(op);
 281 }
 282
 283 void register_untracked_param(int id)
 284 {
 285         my_id = id;
 286
 287         select_return_states_hook(INTERNAL, &assume_tracked);
 288         select_return_states_hook(UNTRACKED_PARAM, &mark_untracked);
 289         select_return_states_hook(LOST_PARAM, &mark_lost);
 290         add_hook(&match_after_call, FUNCTION_CALL_HOOK_AFTER_DB);
 291
 292         add_split_return_callback(&print_untracked_params);
 293
 294         add_hook(&match_param_assign, ASSIGNMENT_HOOK);
 295         add_hook(&match_param_assign_in_asm, ASM_HOOK);
 296
 297         add_function_data((unsigned long *)&tracked);
 298 }