2 * Copyright (C) 2012 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * This is almost the same as smatch_param_filter.c. The difference is that
20 * this only deals with values passed on the stack and param filter only deals
21 * with values changed so that the caller sees the new value. It other words
22 * the key for these should always be "$" and the key for param_filter should
23 * never be "$". Also smatch_param_set() should never use "$" as the key.
24 * Param set should work together with param_filter to determine the value that
25 * the caller sees at the end.
27 * This is for functions like this:
31 * if (a >= 0 && a < 10) {
38 * If we pass in 5, it returns 1.
40 * It's a bit complicated because we can't just consider the final value, we
41 * have to always consider the passed in value.
47 #include "smatch_extra.h"
48 #include "smatch_slist.h"
52 static struct stree
*limit_states
;
53 static struct stree
*ignore_states
;
57 static struct smatch_state
*unmatched_state(struct sm_state
*sm
)
59 struct smatch_state
*state
;
61 if (!param_was_set_var_sym(sm
->name
, sm
->sym
)) {
62 state
= __get_state(SMATCH_EXTRA
, sm
->name
, sm
->sym
);
66 return alloc_estate_whole(estate_type(sm
->state
));
69 struct smatch_state
*get_orig_estate(const char *name
, struct symbol
*sym
)
71 struct smatch_state
*state
;
73 state
= get_state(my_id
, name
, sym
);
77 state
= get_state(SMATCH_EXTRA
, name
, sym
);
80 return alloc_estate_rl(alloc_whole_rl(get_real_base_type(sym
)));
83 static struct range_list
*generify_mtag_range(struct smatch_state
*state
)
85 struct range_list
*rl
;
86 struct data_range
*drange
;
88 if (!estate_type(state
) || estate_type(state
)->type
!= SYM_PTR
)
89 return estate_rl(state
);
92 * The problem is that we get too specific on our param limits when we
93 * know exactly what pointers are passed to a function. It gets to the
94 * point where we say "pointer x will succeed, but everything else will
95 * fail." And then we introduce a new caller which passes a different
96 * pointer and it's like, "Sorry bro, that's not possible."
99 rl
= estate_rl(state
);
100 FOR_EACH_PTR(rl
, drange
) {
101 if (drange
->min
.value
!= drange
->max
.value
)
103 if (drange
->min
.value
== 0)
105 if (is_err_ptr(drange
->min
))
107 return rl_union(valid_ptr_rl
, rl
);
108 } END_FOR_EACH_PTR(drange
);
110 return estate_rl(state
);
113 static bool sm_was_set(struct sm_state
*sm
)
115 struct relation
*rel
;
117 if (!estate_related(sm
->state
))
118 return param_was_set_var_sym(sm
->name
, sm
->sym
);
120 FOR_EACH_PTR(estate_related(sm
->state
), rel
) {
121 if (param_was_set_var_sym(sm
->name
, sm
->sym
))
123 } END_FOR_EACH_PTR(rel
);
127 static bool is_boring_pointer_info(const char *name
, struct range_list
*rl
)
132 * One way that PARAM_LIMIT can be set is by dereferencing pointers.
133 * It's not necessarily very valuable to track that a pointer must
134 * be non-NULL. It's even less valuable to know that it's either NULL
135 * or valid. It can be nice to know that it's not an error pointer, I
136 * suppose. But let's not pass that data back to all the callers
141 if (strlen(name
) < 40)
144 rl_str
= show_rl(rl
);
148 if (strcmp(rl_str
, "4096-ptr_max") == 0 ||
149 strcmp(rl_str
, "0,4096-ptr_max") == 0)
155 static void print_return_value_param(int return_id
, char *return_ranges
, struct expression
*expr
)
157 struct smatch_state
*state
, *old
;
158 struct sm_state
*tmp
;
159 struct range_list
*rl
;
160 const char *param_name
;
163 FOR_EACH_MY_SM(SMATCH_EXTRA
, __get_cur_stree(), tmp
) {
164 if (tmp
->name
[0] == '&')
167 if (!get_state_stree(limit_states
, my_id
, tmp
->name
, tmp
->sym
) &&
168 get_state_stree(ignore_states
, my_id
, tmp
->name
, tmp
->sym
))
171 param
= get_param_num_from_sym(tmp
->sym
);
175 param_name
= get_param_name(tmp
);
179 state
= __get_state(my_id
, tmp
->name
, tmp
->sym
);
186 if (estate_is_whole(state
) || estate_is_empty(state
))
188 old
= get_state_stree(get_start_states(), SMATCH_EXTRA
, tmp
->name
, tmp
->sym
);
189 if (old
&& rl_equiv(estate_rl(old
), estate_rl(state
)))
192 if (is_ignored_kernel_data(param_name
))
195 rl
= generify_mtag_range(state
);
196 if (is_boring_pointer_info(param_name
, rl
))
199 sql_insert_return_states(return_id
, return_ranges
, PARAM_LIMIT
,
200 param
, param_name
, show_rl(rl
));
201 } END_FOR_EACH_SM(tmp
);
204 static void extra_mod_hook(const char *name
, struct symbol
*sym
, struct expression
*expr
, struct smatch_state
*state
)
206 struct smatch_state
*orig
;
207 struct symbol
*param_sym
;
210 if (expr
&& expr
->smatch_flags
& Fake
)
213 param_name
= get_param_var_sym_var_sym(name
, sym
, NULL
, ¶m_sym
);
214 if (!param_name
|| !param_sym
)
216 if (get_param_num_from_sym(param_sym
) < 0)
220 if (get_state(my_id
, param_name
, param_sym
))
223 orig
= get_state(SMATCH_EXTRA
, param_name
, param_sym
);
225 orig
= alloc_estate_whole(estate_type(state
));
227 set_state(my_id
, param_name
, param_sym
, orig
);
229 free_string(param_name
);
232 static void extra_nomod_hook(const char *name
, struct symbol
*sym
, struct expression
*expr
, struct smatch_state
*state
)
235 set_state_stree(&ignore_states
, my_id
, name
, sym
, &undefined
);
238 set_state_stree(&limit_states
, my_id
, name
, sym
, &undefined
);
241 static void match_end_func(struct symbol
*sym
)
243 free_stree(&ignore_states
);
244 free_stree(&limit_states
);
247 void register_param_limit(int id
)
251 add_function_data((unsigned long *)&limit_states
);
252 add_function_data((unsigned long *)&ignore_states
);
253 add_hook(&match_end_func
, END_FUNC_HOOK
);
255 db_ignore_states(my_id
);
256 set_dynamic_states(my_id
);
258 add_extra_mod_hook(&extra_mod_hook
);
259 add_extra_nomod_hook(&extra_nomod_hook
);
260 add_unmatched_state_hook(my_id
, &unmatched_state
);
261 add_merge_hook(my_id
, &merge_estates
);
263 add_split_return_callback(&print_return_value_param
);