2 * Copyright (C) 2017 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 #include "smatch_slist.h"
20 #include "smatch_extra.h"
25 static struct stree
*used_stree
;
26 static struct stree_stack
*saved_stack
;
30 int get_param_from_container_of(struct expression
*expr
)
32 struct expression
*param_expr
;
38 type
= get_type(expr
);
39 if (!type
|| type
->type
!= SYM_PTR
)
42 expr
= strip_expr(expr
);
43 if (expr
->type
!= EXPR_BINOP
|| expr
->op
!= '-')
46 if (!get_value(expr
->right
, &sval
))
48 if (sval
.value
< 0 || sval
.value
> 4096)
51 param_expr
= get_assigned_expr(expr
->left
);
54 param
= get_param_num(param_expr
);
61 int get_offset_from_container_of(struct expression
*expr
)
63 struct expression
*param_expr
;
67 type
= get_type(expr
);
68 if (!type
|| type
->type
!= SYM_PTR
)
71 expr
= strip_expr(expr
);
72 if (expr
->type
!= EXPR_BINOP
|| expr
->op
!= '-')
75 if (!get_value(expr
->right
, &sval
))
77 if (sval
.value
< 0 || sval
.value
> 4096)
80 param_expr
= get_assigned_expr(expr
->left
);
87 static int get_container_arg(struct symbol
*sym
)
89 struct expression
*__mptr
;
92 if (!sym
|| !sym
->ident
)
95 __mptr
= get_assigned_expr_name_sym(sym
->ident
->name
, sym
);
96 param
= get_param_from_container_of(__mptr
);
101 static int get_container_offset(struct symbol
*sym
)
103 struct expression
*__mptr
;
106 if (!sym
|| !sym
->ident
)
109 __mptr
= get_assigned_expr_name_sym(sym
->ident
->name
, sym
);
110 offset
= get_offset_from_container_of(__mptr
);
115 static char *get_container_name(struct sm_state
*sm
, int offset
)
117 static char buf
[256];
120 name
= get_param_name(sm
);
125 snprintf(buf
, sizeof(buf
), "$(-%d)%s", offset
, name
+ 1);
126 else if (name
[0] == '*' || name
[1] == '$')
127 snprintf(buf
, sizeof(buf
), "*$(-%d)%s", offset
, name
+ 2);
134 static void get_state_hook(int owner
, const char *name
, struct symbol
*sym
)
140 if (__in_fake_assign
)
143 arg
= get_container_arg(sym
);
145 set_state_stree(&used_stree
, my_id
, name
, sym
, &used
);
148 static void set_param_used(struct expression
*call
, struct expression
*arg
, char *key
, char *unused
)
154 name
= get_variable_from_key(arg
, key
, &sym
);
158 arg_nr
= get_container_arg(sym
);
160 set_state(my_id
, name
, sym
, &used
);
165 static void process_states(void)
167 struct sm_state
*tmp
;
171 FOR_EACH_SM(used_stree
, tmp
) {
172 arg
= get_container_arg(tmp
->sym
);
173 offset
= get_container_offset(tmp
->sym
);
174 if (arg
< 0 || offset
< 0)
176 name
= get_container_name(tmp
, offset
);
179 sql_insert_return_implies(CONTAINER
, arg
, name
, "");
180 } END_FOR_EACH_SM(tmp
);
182 free_stree(&used_stree
);
185 static void match_function_def(struct symbol
*sym
)
187 free_stree(&used_stree
);
190 static void match_save_states(struct expression
*expr
)
192 push_stree(&saved_stack
, used_stree
);
196 static void match_restore_states(struct expression
*expr
)
198 free_stree(&used_stree
);
199 used_stree
= pop_stree(&saved_stack
);
202 static void print_returns_container_of(int return_id
, char *return_ranges
, struct expression
*expr
)
209 param
= get_param_from_container_of(expr
);
212 offset
= get_offset_from_container_of(expr
);
216 snprintf(key
, sizeof(key
), "%d", param
);
217 snprintf(value
, sizeof(value
), "-%d", offset
);
219 /* no need to add it to return_implies because it's not really param_used */
220 sql_insert_return_states(return_id
, return_ranges
, CONTAINER
, -1,
224 static void returns_container_of(struct expression
*expr
, int param
, char *key
, char *value
)
226 struct expression
*call
, *arg
;
230 if (expr
->type
!= EXPR_ASSIGNMENT
|| expr
->op
!= '=')
232 call
= strip_expr(expr
->right
);
233 if (call
->type
!= EXPR_CALL
)
238 offset
= atoi(value
);
240 arg
= get_argument_from_call_expr(call
->args
, param
);
243 if (arg
->type
!= EXPR_SYMBOL
)
245 param
= get_param_num(arg
);
248 snprintf(buf
, sizeof(buf
), "$(%d)", offset
);
249 sql_insert_return_implies(CONTAINER
, param
, buf
, "");
252 static int get_shared_cnt(const char *one
, const char *two
)
258 if (!one
[i
] || !two
[i
])
260 if (one
[i
] != two
[i
])
267 while (i
> 0 && (one
[i
] == '>' || one
[i
] == '-' || one
[i
] == '.'))
273 static int build_offset_str(struct expression
*expr
, const char *name
,
274 int shared
, char *buf
, int size
, int op
)
282 if (name
[i
] == '.' || name
[i
] == '-')
287 // FIXME: Handle more chops
294 offset
= get_member_offset_from_deref(expr
);
299 snprintf(buf
, size
, "%c%d", (op
== '+') ? '+' : '-', offset
);
303 static void match_call(struct expression
*call
)
305 struct expression
*fn
, *arg
;
306 char *fn_name
, *arg_name
;
314 * We're trying to link the function with the parameter. There are a
315 * couple ways this can be passed:
316 * foo->func(foo, ...);
317 * foo->func(foo->x, ...);
318 * foo->bar.func(&foo->bar, ...);
319 * foo->bar->baz->func(foo, ...);
321 * So the method is basically to subtract the offsets until we get to
322 * the common bit, then add the member offsets to get the parameter.
324 * If we're taking an address then the offset math is not stared,
325 * otherwise it is. Starred means dereferenced.
327 fn
= strip_expr(call
->fn
);
328 fn_name
= expr_to_var(fn
);
333 FOR_EACH_PTR(call
->args
, arg
) {
336 arg
= strip_expr(arg
);
338 if (arg
->type
== EXPR_PREOP
&& arg
->op
== '&') {
339 arg
= strip_expr(arg
->unop
);
343 arg_name
= expr_to_var(arg
);
346 shared
= get_shared_cnt(fn_name
, arg_name
);
349 if (!build_offset_str(fn
, fn_name
, shared
, minus_str
, sizeof(minus_str
), '-'))
351 if (!build_offset_str(arg
, arg_name
, shared
, plus_str
, sizeof(plus_str
), '+'))
354 snprintf(offset_str
, sizeof(offset_str
), "*(%s%s)", minus_str
, plus_str
);
356 snprintf(offset_str
, sizeof(offset_str
), "%s%s", minus_str
, plus_str
);
357 sql_insert_caller_info(call
, CONTAINER
, param
, offset_str
, "$(-1)");
359 free_string(arg_name
);
360 } END_FOR_EACH_PTR(arg
);
362 free_string(fn_name
);
365 static void db_passed_container(const char *name
, struct symbol
*sym
, char *key
, char *value
)
370 const char *arg_offset
;
380 if (val
< -4095 || val
>= 0)
383 arg_offset
= strchr(key
, '+');
386 val
= atoi(arg_offset
+ 1);
387 if (val
> 4095 || val
< 0)
389 offset
.value
|= val
<< 16;
391 offset
.value
|= 1ULL << 31;
393 set_state(param_id
, name
, sym
, alloc_estate_sval(offset
));
399 struct range_list
*rl
;
404 static struct symbol
*get_member_from_offset(struct symbol
*sym
, int offset
)
406 struct symbol
*type
, *tmp
;
409 type
= get_real_base_type(sym
);
410 if (!type
|| type
->type
!= SYM_PTR
)
412 type
= get_real_base_type(type
);
413 if (!type
|| type
->type
!= SYM_STRUCT
)
417 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
418 cur
= ALIGN(cur
, tmp
->ctype
.alignment
);
421 cur
+= type_bytes(tmp
);
422 } END_FOR_EACH_PTR(tmp
);
426 static struct symbol
*get_member_type_from_offset(struct symbol
*sym
, int offset
)
428 struct symbol
*base_type
;
429 struct symbol
*member
;
431 base_type
= get_real_base_type(sym
);
432 if (base_type
&& base_type
->type
== SYM_PTR
)
433 base_type
= get_real_base_type(base_type
);
434 if (offset
== 0 && base_type
&& base_type
->type
== SYM_BASETYPE
)
437 member
= get_member_from_offset(sym
, offset
);
440 return get_real_base_type(member
);
443 static const char *get_name_from_offset(struct symbol
*arg
, int offset
)
445 struct symbol
*member
, *type
;
447 static char fullname
[256];
449 name
= arg
->ident
->name
;
451 type
= get_real_base_type(arg
);
452 if (!type
|| type
->type
!= SYM_PTR
)
455 type
= get_real_base_type(type
);
458 if (type
->type
!= SYM_STRUCT
) {
459 snprintf(fullname
, sizeof(fullname
), "*%s", name
);
463 member
= get_member_from_offset(arg
, offset
);
467 snprintf(fullname
, sizeof(fullname
), "%s->%s", name
, member
->ident
->name
);
471 static void set_param_value(struct stree
**stree
, struct symbol
*arg
, int offset
, struct range_list
*rl
)
475 name
= get_name_from_offset(arg
, offset
);
478 set_state_stree(stree
, SMATCH_EXTRA
, name
, arg
, alloc_estate_rl(rl
));
481 static int save_vals(void *_db_info
, int argc
, char **argv
, char **azColName
)
483 struct db_info
*db_info
= _db_info
;
485 struct range_list
*rl
;
490 offset
= atoi(argv
[0]);
496 if (db_info
->prev_offset
!= -1 &&
497 db_info
->prev_offset
!= offset
) {
498 set_param_value(&db_info
->stree
, db_info
->arg
, db_info
->prev_offset
, db_info
->rl
);
502 db_info
->prev_offset
= offset
;
504 type
= get_real_base_type(db_info
->arg
);
507 if (type
->type
!= SYM_PTR
)
509 type
= get_real_base_type(type
);
510 if (type
->type
== SYM_BASETYPE
)
512 type
= get_member_type_from_offset(db_info
->arg
, offset
);
514 str_to_rl(type
, (char *)value
, &rl
);
516 db_info
->rl
= rl_union(db_info
->rl
, rl
);
523 static struct stree
*load_tag_info_sym(mtag_t tag
, struct symbol
*arg
, int arg_offset
, int star
)
525 struct db_info db_info
= {
532 if (!tag
|| !arg
->ident
)
535 type
= get_real_base_type(arg
);
539 if (type
->type
!= SYM_PTR
)
541 type
= get_real_base_type(type
);
546 if (star
|| type
->type
== SYM_BASETYPE
) {
547 run_sql(save_vals
, &db_info
,
548 "select value from mtag_data where tag = %lld and offset = %d and type = %d;",
549 tag
, arg_offset
, DATA_VALUE
);
550 } else { /* presumably the parameter is a struct pointer */
551 run_sql(save_vals
, &db_info
,
552 "select offset, value from mtag_data where tag = %lld and type = %d;",
556 if (db_info
.prev_offset
!= -1)
557 set_param_value(&db_info
.stree
, arg
, db_info
.prev_offset
, db_info
.rl
);
559 // FIXME: handle an offset correctly
560 if (!star
&& !arg_offset
) {
563 sval
.type
= get_real_base_type(arg
);
565 set_state_stree(&db_info
.stree
, SMATCH_EXTRA
, arg
->ident
->name
, arg
, alloc_estate_sval(sval
));
567 return db_info
.stree
;
570 static void handle_passed_container(struct symbol
*sym
)
573 struct smatch_state
*state
;
576 mtag_t fn_tag
, container_tag
, arg_tag
;
578 int container_offset
, arg_offset
;
581 FOR_EACH_PTR(cur_func_sym
->ctype
.base_type
->arguments
, arg
) {
582 state
= get_state(param_id
, arg
->ident
->name
, arg
);
585 } END_FOR_EACH_PTR(arg
);
589 if (!estate_get_single_value(state
, &offset
))
591 container_offset
= -(offset
.value
& 0xffff);
592 arg_offset
= (offset
.value
& 0xfff0000) >> 16;
593 star
= !!(offset
.value
& (1ULL << 31));
595 if (!get_toplevel_mtag(cur_func_sym
, &fn_tag
))
597 if (!mtag_map_select_container(fn_tag
, container_offset
, &container_tag
))
599 if (!arg_offset
|| star
) {
600 arg_tag
= container_tag
;
602 if (!mtag_map_select_tag(container_tag
, -arg_offset
, &arg_tag
))
606 stree
= load_tag_info_sym(arg_tag
, arg
, arg_offset
, star
);
607 FOR_EACH_SM(stree
, sm
) {
608 set_state(sm
->owner
, sm
->name
, sm
->sym
, sm
->state
);
609 } END_FOR_EACH_SM(sm
);
613 void register_container_of(int id
)
617 add_hook(&match_function_def
, FUNC_DEF_HOOK
);
619 add_get_state_hook(&get_state_hook
);
621 add_hook(&match_save_states
, INLINE_FN_START
);
622 add_hook(&match_restore_states
, INLINE_FN_END
);
624 select_return_implies_hook(CONTAINER
, &set_param_used
);
625 all_return_states_hook(&process_states
);
627 add_split_return_callback(&print_returns_container_of
);
628 select_return_states_hook(CONTAINER
, &returns_container_of
);
630 add_hook(&match_call
, FUNCTION_CALL_HOOK
);
633 static struct smatch_state
*unmatched_state(struct sm_state
*sm
)
635 return alloc_estate_whole(estate_type(sm
->state
));
638 void register_container_of2(int id
)
642 select_caller_info_hook(db_passed_container
, CONTAINER
);
643 add_hook(&handle_passed_container
, AFTER_DEF_HOOK
);
644 add_unmatched_state_hook(param_id
, &unmatched_state
);
645 add_merge_hook(param_id
, &merge_estates
);