smatch_dereference.c

   1 /*
   2  * Copyright (C) 2021 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include "smatch.h"
  19 #include "smatch_extra.h"
  20
  21 static int my_id;
  22 static struct expr_fn_list *deref_hooks;
  23
  24 struct deref_info {
  25         const char *name;
  26         int param;
  27         const char *key;
  28         const sval_t *implies_start, *implies_end;
  29 };
  30 static struct deref_info fn_deref_table[] = {
  31         { "nla_data", 0, "$" },
  32         { "strlen", 0, "$" },
  33         { "__builtin_strlen", 0, "$" },
  34         { "__fortify_strlen", 0, "$" },
  35         { "spinlock_check", 0, "$" },
  36 };
  37
  38 void add_dereference_hook(expr_func *fn)
  39 {
  40         add_ptr_list(&deref_hooks, fn);
  41 }
  42
  43 static void call_deref_hooks(struct expression *expr)
  44 {
  45         if (__in_fake_assign || __in_fake_parameter_assign)
  46                 return;
  47         if (!expr)
  48                 return;
  49
  50         call_expr_fns(deref_hooks, expr);
  51 }
  52
  53 static bool is_array_pointer_math(struct expression *expr)
  54 {
  55         struct expression *p, *parent;
  56         struct symbol *type;
  57
  58         /* Ignore "&array[0]".  Fixme: wouldn't the & mean it was already ignored? */
  59         p = strip_expr(expr->unop);
  60         type = get_type(p);
  61         if (!type || type->type != SYM_PTR)
  62                 return true;
  63
  64         /* Ignore "p->array".  Here p is not actually dereferenced.  */
  65         parent = expr_get_parent_expr(expr);
  66         if (!parent)
  67                 return false;
  68
  69         type = get_type(parent);
  70         if (!type || type->type != SYM_ARRAY)
  71                 return false;
  72         while ((parent = expr_get_parent_expr(parent))) {
  73                 if (parent->type == EXPR_PREOP &&
  74                     parent->op == '*')
  75                         return false;
  76         }
  77
  78         return true;
  79 }
  80
  81 static void match_dereference(struct expression *expr)
  82 {
  83         struct expression *p, *tmp;
  84         struct symbol *type;
  85
  86         if (expr->type != EXPR_PREOP ||
  87             expr->op != '*')
  88                 return;
  89
  90         if (is_array_pointer_math(expr))
  91                 return;
  92
  93         p = strip_expr(expr->unop);
  94         call_deref_hooks(p);
  95
  96         tmp = get_assigned_expr(p);
  97         if (!tmp)
  98                 return;
  99         /*
 100          * Imagine we have:
 101          * p = &foo->bar;
 102          * x = p->whatever;
 103          *
 104          * Note that we only care about address assignments because other
 105          * dereferences would have been handled already.
 106          */
 107         if (tmp->type != EXPR_PREOP || tmp->op != '&')
 108                 return;
 109         p = strip_expr(tmp->unop);
 110         if (p->type != EXPR_DEREF)
 111                 return;
 112         p = strip_expr(p->deref);
 113         if (p->type != EXPR_PREOP || p->op != '*')
 114                 return;
 115         p = strip_expr(p->unop);
 116         type = get_type(p);
 117         if (!type || type->type != SYM_PTR)
 118                 return;
 119         call_deref_hooks(p);
 120 }
 121
 122 static void match_pointer_as_array(struct expression *expr)
 123 {
 124         struct expression *array;
 125         struct symbol *type;
 126
 127         if (!is_array(expr))
 128                 return;
 129         if (getting_address(expr))
 130                 return;
 131
 132         array = get_array_base(expr);
 133         type = get_type(array);
 134         if (!type || type->type != SYM_PTR)
 135                 return;
 136
 137         call_deref_hooks(array);
 138 }
 139
 140 static void dereference_inner_pointer(struct expression *expr)
 141 {
 142         if (expr->type != EXPR_PREOP ||
 143             expr->op != '&')
 144                 return;
 145         expr = strip_expr(expr->unop);
 146         if (!expr || expr->type != EXPR_DEREF)
 147                 return;
 148         expr = strip_expr(expr->unop);
 149         if (!expr || expr->type != EXPR_PREOP || expr->op != '*')
 150                 return;
 151         expr = strip_expr(expr->unop);
 152         if (!expr)
 153                 return;
 154
 155         call_deref_hooks(expr);
 156 }
 157
 158 static void set_param_dereferenced(struct expression *call, struct expression *arg, char *key, char *unused)
 159 {
 160         struct expression *deref;
 161
 162         deref = gen_expression_from_key(arg, key);
 163         if (!deref)
 164                 return;
 165
 166         call_deref_hooks(deref);
 167
 168         /*
 169          * Generally, this stuff should be handled by smatch_flow.c but
 170          * smatch_flow.c doesn't have the PARAM_DEREFERENCED information so
 171          * we go one level down to mark it as dereferenced.
 172          *
 173          */
 174         dereference_inner_pointer(deref);
 175 }
 176
 177 static void param_deref(struct expression *expr)
 178 {
 179         call_deref_hooks(expr);
 180 }
 181
 182 void register_dereferences(int id)
 183 {
 184         struct deref_info *info;
 185         int i;
 186
 187         my_id = id;
 188
 189         add_hook(&match_dereference, DEREF_HOOK);
 190         add_hook(&match_pointer_as_array, OP_HOOK);
 191         select_return_implies_hook_early(DEREFERENCE, &set_param_dereferenced);
 192
 193         for (i = 0; i < ARRAY_SIZE(fn_deref_table); i++) {
 194                 info = &fn_deref_table[i];
 195                 add_param_key_expr_hook(info->name, &param_deref, info->param, info->key, info);
 196         }
 197 }
 198