smatch_function_ptrs.c

   1 /*
   2  * Copyright (C) 2013 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * Track how functions are saved as various struct members or passed as
  20  * parameters.
  21  *
  22  */
  23
  24 #include "scope.h"
  25 #include "smatch.h"
  26 #include "smatch_slist.h"
  27
  28 static int my_id;
  29
  30 static char *get_from__symbol_get(struct expression *expr)
  31 {
  32         struct expression *arg;
  33
  34         /*
  35          * typeof(&dib0070_attach) __a =
  36          * ((((typeof(&dib0070_attach)) (__symbol_get("dib0070_attach")))) ?:
  37          *  (__request_module(true, "symbol:" "dib0070_attach"), (((typeof(&dib0070_attach))(__symbol_get("dib0070_attach"))))));
  38          */
  39
  40         expr = strip_expr(expr);
  41
  42         if (expr->type != EXPR_CALL)
  43                 return NULL;
  44         if (!sym_name_is("__symbol_get", expr->fn))
  45                 return NULL;
  46         arg = get_argument_from_call_expr(expr->args, 0);
  47         if (!arg || arg->type != EXPR_STRING)
  48                 return NULL;
  49
  50         return alloc_string(arg->string->data);
  51 }
  52
  53 static int xxx_is_array(struct expression *expr)
  54 {
  55         struct symbol *type;
  56
  57         expr = strip_expr(expr);
  58         if (!expr)
  59                 return 0;
  60
  61         if (expr->type == EXPR_PREOP && expr->op == '*') {
  62                 expr = strip_expr(expr->unop);
  63                 if (!expr)
  64                         return 0;
  65                 if (expr->type == EXPR_BINOP && expr->op == '+')
  66                         return 1;
  67         }
  68
  69         if (expr->type != EXPR_BINOP || expr->op != '+')
  70                 return 0;
  71
  72         type = get_type(expr->left);
  73         if (!type)
  74                 return 0;
  75         if (type->type != SYM_ARRAY && type->type != SYM_PTR)
  76                 return 0;
  77
  78         return 1;
  79 }
  80
  81 static struct expression *xxx_get_array_base(struct expression *expr)
  82 {
  83         if (!xxx_is_array(expr))
  84                 return NULL;
  85         expr = strip_expr(expr);
  86         if (expr->type == EXPR_PREOP && expr->op == '*')
  87                 expr = strip_expr(expr->unop);
  88         if (expr->type != EXPR_BINOP || expr->op != '+')
  89                 return NULL;
  90         return strip_parens(expr->left);
  91 }
  92
  93 static char *get_array_ptr(struct expression *expr)
  94 {
  95         struct expression *array;
  96         struct symbol *type;
  97         char *name;
  98         char buf[256];
  99
 100         array = xxx_get_array_base(expr);
 101
 102         if (array) {
 103                 name = get_member_name(array);
 104                 if (name)
 105                         return name;
 106         }
 107
 108         /* FIXME:  is_array() should probably be is_array_element() */
 109         type = get_type(expr);
 110         if (!array && type && type->type == SYM_ARRAY)
 111                 array = expr;
 112         if (array) {
 113                 name = expr_to_var(array);
 114                 if (!name)
 115                         return NULL;
 116                 snprintf(buf, sizeof(buf), "%s[]", name);
 117                 return alloc_string(buf);
 118         }
 119
 120         expr = get_assigned_expr(expr);
 121         array = xxx_get_array_base(expr);
 122         if (!array)
 123                 return NULL;
 124         name = expr_to_var(array);
 125         if (!name)
 126                 return NULL;
 127         snprintf(buf, sizeof(buf), "%s[]", name);
 128         free_string(name);
 129         return alloc_string(buf);
 130 }
 131
 132 static int is_local_symbol(struct symbol *sym)
 133 {
 134         if (!sym ||
 135             !(sym->ctype.modifiers & MOD_TOPLEVEL))
 136                 return 1;
 137         return 0;
 138 }
 139
 140 static char *ptr_prefix(struct symbol *sym)
 141 {
 142         static char buf[128];
 143
 144
 145         if (is_local_symbol(sym))
 146                 snprintf(buf, sizeof(buf), "%s ptr", get_function());
 147         else if (sym && toplevel(sym->scope))
 148                 snprintf(buf, sizeof(buf), "%s ptr", get_base_file());
 149         else
 150                 snprintf(buf, sizeof(buf), "ptr");
 151
 152         return buf;
 153 }
 154
 155 char *get_returned_ptr(struct expression *expr)
 156 {
 157         struct symbol *type;
 158         char *name;
 159         char buf[256];
 160
 161         if (expr->type != EXPR_CALL)
 162                 return NULL;
 163         if (!expr->fn || expr->fn->type != EXPR_SYMBOL)
 164                 return NULL;
 165
 166         type = get_type(expr);
 167         if (type && type->type == SYM_PTR)
 168                 type = get_real_base_type(type);
 169         if (!type || type->type != SYM_FN)
 170                 return NULL;
 171
 172         name = expr_to_var(expr->fn);
 173         if (!name)
 174                 return NULL;
 175         snprintf(buf, sizeof(buf), "r %s()", name);
 176         free_string(name);
 177         return alloc_string(buf);
 178 }
 179
 180 char *get_fnptr_name(struct expression *expr)
 181 {
 182         char *name;
 183
 184         if (expr_is_zero(expr))
 185                 return NULL;
 186
 187         expr = strip_expr(expr);
 188
 189         /* (*ptrs[0])(a, b, c) is the same as ptrs[0](a, b, c); */
 190         if (expr->type == EXPR_PREOP && expr->op == '*')
 191                 expr = strip_expr(expr->unop);
 192
 193         name = get_from__symbol_get(expr);
 194         if (name)
 195                 return name;
 196
 197         name = get_array_ptr(expr);
 198         if (name)
 199                 return name;
 200
 201         name = get_returned_ptr(expr);
 202         if (name)
 203                 return name;
 204
 205         name = get_member_name(expr);
 206         if (name)
 207                 return name;
 208
 209         if (expr->type == EXPR_SYMBOL) {
 210                 int param;
 211                 char buf[256];
 212                 struct symbol *sym;
 213                 struct symbol *type;
 214
 215                 param = get_param_num_from_sym(expr->symbol);
 216                 if (param >= 0) {
 217                         snprintf(buf, sizeof(buf), "%s param %d", get_function(), param);
 218                         return alloc_string(buf);
 219                 }
 220
 221                 name = expr_to_var_sym(expr, &sym);
 222                 if (!name)
 223                         return NULL;
 224                 type = get_type(expr);
 225                 if (type && type->type == SYM_PTR) {
 226                         snprintf(buf, sizeof(buf), "%s %s", ptr_prefix(sym), name);
 227                         free_string(name);
 228                         return alloc_string(buf);
 229                 }
 230                 return name;
 231         }
 232         return expr_to_var(expr);
 233 }
 234
 235 static void match_passes_function_pointer(struct expression *expr)
 236 {
 237         struct expression *arg, *tmp;
 238         struct symbol *type;
 239         char *called_name;
 240         char *fn_name;
 241         char ptr_name[256];
 242         int i;
 243
 244
 245         i = -1;
 246         FOR_EACH_PTR(expr->args, arg) {
 247                 i++;
 248
 249                 tmp = strip_expr(arg);
 250                 if (tmp->type == EXPR_PREOP && tmp->op == '&')
 251                         tmp = strip_expr(tmp->unop);
 252
 253                 type = get_type(tmp);
 254                 if (type && type->type == SYM_PTR)
 255                         type = get_real_base_type(type);
 256                 if (!type || type->type != SYM_FN)
 257                         continue;
 258
 259                 called_name = expr_to_var(expr->fn);
 260                 if (!called_name)
 261                         return;
 262                 fn_name = get_fnptr_name(tmp);
 263                 if (!fn_name)
 264                         goto free;
 265
 266                 snprintf(ptr_name, sizeof(ptr_name), "%s param %d", called_name, i);
 267                 sql_insert_function_ptr(fn_name, ptr_name);
 268 free:
 269                 free_string(fn_name);
 270                 free_string(called_name);
 271         } END_FOR_EACH_PTR(arg);
 272
 273 }
 274
 275 static int get_row_count(void *_row_count, int argc, char **argv, char **azColName)
 276 {
 277         int *row_count = _row_count;
 278
 279         *row_count = 0;
 280         if (argc != 1)
 281                 return 0;
 282         *row_count = atoi(argv[0]);
 283         return 0;
 284 }
 285
 286 static int can_hold_function_ptr(struct expression *expr)
 287 {
 288         struct symbol *type;
 289
 290         type = get_type(expr);
 291         if (!type)
 292                 return 0;
 293         if (type->type == SYM_PTR || type->type == SYM_ARRAY) {
 294                 type = get_real_base_type(type);
 295                 if (!type)
 296                         return 0;
 297         }
 298         /* pointer to a pointer */
 299         if (type->type == SYM_PTR || type->type == SYM_ARRAY) {
 300                 type = get_real_base_type(type);
 301                 if (!type)
 302                         return 0;
 303         }
 304         if (type->type == SYM_FN)
 305                 return 1;
 306         if (type == &ulong_ctype && expr->type == EXPR_DEREF)
 307                 return 1;
 308         if (type == &void_ctype)
 309                 return 1;
 310         return 0;
 311 }
 312
 313 static void match_function_assign(struct expression *expr)
 314 {
 315         struct expression *right;
 316         struct symbol *type;
 317         char *fn_name;
 318         char *ptr_name;
 319
 320         if (__in_fake_assign)
 321                 return;
 322         if (__in_fake_var_assign)
 323                 return;
 324
 325         right = strip_expr(expr->right);
 326         if (right->type == EXPR_PREOP && right->op == '&')
 327                 right = strip_expr(right->unop);
 328
 329         if (right->type != EXPR_SYMBOL &&
 330             right->type != EXPR_DEREF &&
 331             right->type != EXPR_CALL)
 332                 return;
 333
 334         if (!can_hold_function_ptr(right) ||
 335             !can_hold_function_ptr(expr->left))
 336                 return;
 337
 338         fn_name = get_fnptr_name(right);
 339         ptr_name = get_fnptr_name(expr->left);
 340         if (!fn_name || !ptr_name)
 341                 goto free;
 342         if (strcmp(fn_name, ptr_name) == 0)
 343                 goto free;
 344
 345
 346         type = get_type(right);
 347         if (!type)
 348                 return;
 349         if (type->type == SYM_PTR || type->type == SYM_ARRAY) {
 350                 type = get_real_base_type(type);
 351                 if (!type)
 352                         return;
 353         }
 354         if (type->type != SYM_FN) {
 355                 int count = 0;
 356
 357                 /* look it up in function_ptr */
 358                 run_sql(get_row_count, &count,
 359                         "select count(*) from function_ptr where ptr = '%s'",
 360                         fn_name);
 361                 if (count == 0)
 362                         goto free;
 363         }
 364
 365         sql_insert_function_ptr(fn_name, ptr_name);
 366 free:
 367         free_string(fn_name);
 368         free_string(ptr_name);
 369 }
 370
 371 static void match_returns_function_pointer(struct expression *expr)
 372 {
 373         struct symbol *type;
 374         char *fn_name;
 375         char ptr_name[256];
 376
 377         if (__inline_fn)
 378                 return;
 379
 380         type = get_real_base_type(cur_func_sym);
 381         if (!type || type->type != SYM_FN)
 382                 return;
 383         type = get_real_base_type(type);
 384         if (!type || type->type != SYM_PTR)
 385                 return;
 386         type = get_real_base_type(type);
 387         if (!type || type->type != SYM_FN)
 388                 return;
 389
 390         if (expr->type == EXPR_PREOP && expr->op == '&')
 391                 expr = strip_expr(expr->unop);
 392
 393         fn_name = get_fnptr_name(expr);
 394         if (!fn_name)
 395                 return;
 396         snprintf(ptr_name, sizeof(ptr_name), "r %s()", get_function());
 397         sql_insert_function_ptr(fn_name, ptr_name);
 398 }
 399
 400 static void print_initializer_list(struct expression_list *expr_list,
 401                 struct symbol *struct_type)
 402 {
 403         struct expression *expr;
 404         struct symbol *base_type;
 405         char struct_name[256];
 406
 407         FOR_EACH_PTR(expr_list, expr) {
 408                 if (expr->type == EXPR_INDEX && expr->idx_expression && expr->idx_expression->type == EXPR_INITIALIZER) {
 409                         print_initializer_list(expr->idx_expression->expr_list, struct_type);
 410                         continue;
 411                 }
 412                 if (expr->type != EXPR_IDENTIFIER)
 413                         continue;
 414                 if (!expr->expr_ident)
 415                         continue;
 416                 if (!expr->ident_expression ||
 417                     expr->ident_expression->type != EXPR_SYMBOL ||
 418                     !expr->ident_expression->symbol_name)
 419                         continue;
 420                 base_type = get_type(expr->ident_expression);
 421                 if (!base_type || base_type->type != SYM_FN)
 422                         continue;
 423                 snprintf(struct_name, sizeof(struct_name), "(struct %s)->%s",
 424                          struct_type->ident->name, expr->expr_ident->name);
 425                 sql_insert_function_ptr(expr->ident_expression->symbol_name->name,
 426                                         struct_name);
 427         } END_FOR_EACH_PTR(expr);
 428 }
 429
 430 static void global_variable(struct symbol *sym)
 431 {
 432         struct symbol *struct_type;
 433
 434         if (!sym->ident)
 435                 return;
 436         if (!sym->initializer || sym->initializer->type != EXPR_INITIALIZER)
 437                 return;
 438         struct_type = get_base_type(sym);
 439         if (!struct_type)
 440                 return;
 441         if (struct_type->type == SYM_ARRAY) {
 442                 struct_type = get_base_type(struct_type);
 443                 if (!struct_type)
 444                         return;
 445         }
 446         if (struct_type->type != SYM_STRUCT || !struct_type->ident)
 447                 return;
 448         print_initializer_list(sym->initializer->expr_list, struct_type);
 449 }
 450
 451 void register_function_ptrs(int id)
 452 {
 453         my_id = id;
 454
 455         if (!option_info)
 456                 return;
 457
 458         add_hook(&global_variable, BASE_HOOK);
 459         add_hook(&global_variable, DECLARATION_HOOK);
 460         add_hook(&match_passes_function_pointer, FUNCTION_CALL_HOOK);
 461         add_hook(&match_returns_function_pointer, RETURN_HOOK);
 462         add_hook(&match_function_assign, ASSIGNMENT_HOOK);
 463         add_hook(&match_function_assign, GLOBAL_ASSIGNMENT_HOOK);
 464 }