smatch_untracked_param.c

   1 /*
   2  * Copyright (C) 2014 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * Sometimes we aren't able to track a variable through a function call.  This
  20  * usually happens because a function changes too many variables so we give up.
  21  * Another reason this happens is because we call a function pointer and there
  22  * are too many functions which implement that function pointer so we give up.
  23  * Also maybe we don't have the database enabled.
  24  *
  25  * The goal here is to make a call back so what if we call:
  26  *
  27  *      frob(&foo);
  28  *
  29  * but we're not able to say what happens to "foo", then let's assume that we
  30  * don't know anything about "foo" if it's an untracked call.
  31  *
  32  */
  33
  34 #include "smatch.h"
  35 #include "smatch_slist.h"
  36 #include "smatch_extra.h"
  37
  38 static int my_id;
  39
  40 STATE(untracked);
  41 STATE(lost);
  42
  43 typedef void (untracked_hook)(struct expression *call, int param);
  44 DECLARE_PTR_LIST(untracked_hook_list, untracked_hook *);
  45 static struct untracked_hook_list *untracked_hooks;
  46 static struct untracked_hook_list *lost_hooks;
  47
  48 void add_untracked_param_hook(void (func)(struct expression *call, int param))
  49 {
  50         untracked_hook **p = malloc(sizeof(untracked_hook *));
  51         *p = func;
  52         add_ptr_list(&untracked_hooks, p);
  53 }
  54
  55 static void call_untracked_callbacks(struct expression *expr, int param)
  56 {
  57         untracked_hook **fn;
  58
  59         FOR_EACH_PTR(untracked_hooks, fn) {
  60                 (*fn)(expr, param);
  61         } END_FOR_EACH_PTR(fn);
  62 }
  63
  64 void add_lost_param_hook(void (func)(struct expression *call, int param))
  65 {
  66         untracked_hook **p = malloc(sizeof(untracked_hook *));
  67         *p = func;
  68         add_ptr_list(&lost_hooks, p);
  69 }
  70
  71 static void call_lost_callbacks(struct expression *expr, int param)
  72 {
  73         untracked_hook **fn;
  74
  75         FOR_EACH_PTR(lost_hooks, fn) {
  76                 (*fn)(expr, param);
  77         } END_FOR_EACH_PTR(fn);
  78 }
  79
  80 static char *get_array_from_key(struct expression *expr, int param, const char *key, struct symbol **sym)
  81 {
  82         struct expression *arg;
  83
  84         arg = get_argument_from_call_expr(expr->args, param);
  85         if (!arg)
  86                 return NULL;
  87         if (arg->type != EXPR_PREOP || arg->op != '&')
  88                 return NULL;
  89         arg = arg->unop;
  90         if (!is_array(arg))
  91                 return NULL;
  92         arg = get_array_base(arg);
  93
  94         return expr_to_var_sym(arg, sym);
  95 }
  96
  97 static void mark_untracked_lost(struct expression *expr, int param, const char *key, int type)
  98 {
  99         char *name;
 100         struct symbol *sym;
 101
 102         while (expr->type == EXPR_ASSIGNMENT)
 103                 expr = strip_expr(expr->right);
 104         if (expr->type != EXPR_CALL)
 105                 return;
 106
 107         name = get_name_sym_from_param_key(expr, param, key, &sym);
 108         if (!name || !sym) {
 109                 name = get_array_from_key(expr, param, key, &sym);
 110                 if (!name || !sym)
 111                         goto free;
 112         }
 113
 114         if (type == LOST_PARAM)
 115                 call_lost_callbacks(expr, param);
 116         call_untracked_callbacks(expr, param);
 117         set_state(my_id, name, sym, &untracked);
 118 free:
 119         free_string(name);
 120
 121 }
 122
 123 void mark_untracked(struct expression *expr, int param, const char *key, const char *value)
 124 {
 125         mark_untracked_lost(expr, param, key, UNTRACKED_PARAM);
 126 }
 127
 128 void mark_lost(struct expression *expr, int param, const char *key, const char *value)
 129 {
 130         mark_untracked_lost(expr, param, key, LOST_PARAM);
 131 }
 132
 133 static int lost_in_va_args(struct expression *expr)
 134 {
 135         struct symbol *fn;
 136         char *name;
 137         int is_lost;
 138
 139         fn = get_type(expr->fn);
 140         if (!fn || !fn->variadic)
 141                 return 0;
 142
 143         is_lost = 1;
 144         name = expr_to_var(expr->fn);
 145         if (name && strstr(name, "print"))
 146                 is_lost = 0;
 147         free_string(name);
 148
 149         return is_lost;
 150 }
 151
 152 static void match_after_call(struct expression *expr)
 153 {
 154         struct expression *arg;
 155         struct symbol *type;
 156         int i;
 157
 158         if (!lost_in_va_args(expr))
 159                 return;
 160
 161         i = -1;
 162         FOR_EACH_PTR(expr->args, arg) {
 163                 i++;
 164
 165                 type = get_type(arg);
 166                 if (!type || type->type != SYM_PTR)
 167                         continue;
 168
 169                 call_untracked_callbacks(expr, i);
 170                 call_lost_callbacks(expr, i);
 171                 set_state_expr(my_id, arg, &untracked);
 172         } END_FOR_EACH_PTR(arg);
 173 }
 174
 175 static void mark_all_params(int return_id, char *return_ranges, int type)
 176 {
 177         struct symbol *arg;
 178         int param;
 179
 180         param = -1;
 181         FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
 182                 param++;
 183
 184                 if (!arg->ident)
 185                         continue;
 186                 sql_insert_return_states(return_id, return_ranges,
 187                                          type, param, "$", "");
 188         } END_FOR_EACH_PTR(arg);
 189 }
 190
 191
 192 void mark_all_params_untracked(int return_id, char *return_ranges, struct expression *expr)
 193 {
 194         mark_all_params(return_id, return_ranges, UNTRACKED_PARAM);
 195 }
 196
 197 void mark_all_params_lost(int return_id, char *return_ranges, struct expression *expr)
 198 {
 199         mark_all_params(return_id, return_ranges, LOST_PARAM);
 200 }
 201
 202 static void print_untracked_params(int return_id, char *return_ranges, struct expression *expr)
 203 {
 204         struct sm_state *sm;
 205         struct symbol *arg;
 206         int param;
 207         int type;
 208
 209         param = -1;
 210         FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
 211                 param++;
 212
 213                 if (!arg->ident)
 214                         continue;
 215
 216                 if (__bail_on_rest_of_function) {
 217                         /* hairy functions are lost */
 218                         type = LOST_PARAM;
 219                 } else if ((sm = get_sm_state(my_id, arg->ident->name, arg))) {
 220                         if (slist_has_state(sm->possible, &lost))
 221                                 type = LOST_PARAM;
 222                         else
 223                                 type = UNTRACKED_PARAM;
 224                 } else {
 225                         continue;
 226                 }
 227
 228                 sql_insert_return_states(return_id, return_ranges,
 229                                          type, param, "$", "");
 230         } END_FOR_EACH_PTR(arg);
 231 }
 232
 233 static void match_assign(struct expression *expr)
 234 {
 235         struct expression *right;
 236         int param;
 237
 238         if (is_fake_var_assign(expr))
 239                 return;
 240
 241         right = strip_expr(expr->right);
 242
 243         if (right->type != EXPR_SYMBOL)
 244                 return;
 245         if (!is_pointer(expr->right))
 246                 return;
 247         param = get_param_num(right);
 248         if (param < 0)
 249                 return;
 250
 251         set_state_expr(my_id, right, &untracked);
 252 }
 253
 254 static void match_param_assign_in_asm(struct statement *stmt)
 255 {
 256         struct expression *expr;
 257         struct asm_operand *op;
 258         struct symbol *type;
 259         int param;
 260
 261         FOR_EACH_PTR(stmt->asm_inputs, op) {
 262                 expr = strip_expr(op->expr);
 263                 type = get_type(expr);
 264                 if (!type || type->type != SYM_PTR)
 265                         continue;
 266                 param = get_param_num(expr);
 267                 if (param < 0)
 268                         continue;
 269                 set_state_expr(my_id, expr, &untracked);
 270         } END_FOR_EACH_PTR(op);
 271 }
 272
 273 void register_untracked_param(int id)
 274 {
 275         my_id = id;
 276
 277         select_return_states_hook(UNTRACKED_PARAM, &mark_untracked);
 278         select_return_states_hook(LOST_PARAM, &mark_lost);
 279         add_hook(&match_after_call, FUNCTION_CALL_HOOK_AFTER_DB);
 280
 281         add_split_return_callback(&print_untracked_params);
 282
 283         add_hook(&match_assign, ASSIGNMENT_HOOK);
 284         add_hook(&match_param_assign_in_asm, ASM_HOOK);
 285 }