2 * Copyright (C) 2020 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
20 #include "smatch_extra.h"
21 #include "smatch_slist.h"
25 static void undef(struct sm_state
*sm
, struct expression
*mod_expr
)
27 set_state(my_id
, sm
->name
, sm
->sym
, &undefined
);
30 char *swap_names(const char *orig
, const char *remove
, const char *add
)
42 while(orig
[offset
] == '*' || orig
[offset
] == '&' || orig
[offset
] == '(')
46 if (len
+ offset
> strlen(orig
))
48 if (orig
[offset
+ len
] != '-')
50 if (strncmp(orig
+ offset
, remove
, len
) != 0)
53 ret
= snprintf(buf
, sizeof(buf
), "%.*s%s%s%s", offset
, orig
,
54 add
, is_addr
? "." : "->", orig
+ offset
+ 2 + len
);
55 if (ret
>= sizeof(buf
))
57 return alloc_string(buf
);
60 static char *swap_with_param(const char *name
, struct symbol
*sym
, struct symbol
**sym_p
)
62 struct smatch_state
*state
;
63 struct var_sym
*var_sym
;
67 * Say you know that "foo = bar;" and you have a state "foo->baz" then
68 * we can just substitute "bar" for "foo" giving "bar->baz".
71 if (!sym
|| !sym
->ident
)
74 state
= get_state(my_id
, sym
->ident
->name
, sym
);
75 if (!state
|| !state
->data
)
77 var_sym
= state
->data
;
79 ret
= swap_names(name
, sym
->ident
->name
, var_sym
->var
);
83 *sym_p
= var_sym
->sym
;
87 struct expression
*map_container_of_to_simpler_expr_key(struct expression
*expr
, const char *orig_key
, char **new_key
)
90 char *p
= (char *)orig_key
;
95 expr
= strip_expr(expr
);
96 if (expr
->type
!= EXPR_DEREF
)
100 if (*p
== '(' && isdigit(*(p
+ 1))) {
102 offset
= strtoul(p
+ 1, &p
, 10);
103 if (!p
|| p
[0] != '<' || p
[1] != '~' || p
[2] != '$' ||
104 p
[3] != ')' || p
[4] != '-' || p
[5] != '>')
114 if (offset
!= get_member_offset_from_deref(expr
))
117 ret
= snprintf(buf
, sizeof(buf
), "%.*s$.%s", (int)(start
- orig_key
), orig_key
, end
);
118 if (ret
>= sizeof(buf
))
120 *new_key
= alloc_sname(buf
);
124 char *get_variable_from_key(struct expression
*arg
, const char *key
, struct symbol
**sym
)
129 bool address
= false;
131 bool add_dot
= false;
134 // FIXME: this function has been marked for being made static
135 // Use get_name_sym_from_param_key().
140 arg
= strip_expr(arg
);
142 if (strcmp(key
, "$") == 0)
143 return expr_to_var_sym(arg
, sym
);
145 if (strcmp(key
, "*$") == 0) {
146 if (arg
->type
== EXPR_PREOP
&& arg
->op
== '&') {
147 arg
= strip_expr(arg
->unop
);
148 return expr_to_var_sym(arg
, sym
);
150 tmp
= expr_to_var_sym(arg
, sym
);
153 ret
= snprintf(buf
, sizeof(buf
), "*%s", tmp
);
155 if (ret
>= sizeof(buf
))
157 return alloc_string(buf
);
161 if (strncmp(key
, "(*$)", 4) == 0) {
162 if (arg
->type
== EXPR_PREOP
&& arg
->op
== '&') {
163 arg
= strip_expr(arg
->unop
);
164 snprintf(buf
, sizeof(buf
), "$%s", key
+ 4);
165 return get_variable_from_key(arg
, buf
, sym
);
167 tmp
= expr_to_var_sym(arg
, sym
);
170 ret
= snprintf(buf
, sizeof(buf
), "(*%s)%s", tmp
, key
+ 4);
172 if (ret
>= sizeof(buf
))
174 return alloc_string(buf
);
178 if (strstr(key
, "<~$")) {
179 struct expression
*expr
;
182 expr
= map_container_of_to_simpler_expr_key(arg
, key
, &new_key
);
189 while (key
[0] == '*') {
200 * FIXME: This is a hack.
201 * We should be able to parse expressions like (*$)->foo and *$->foo.
203 type
= get_type(arg
);
204 if (is_struct_ptr(type
))
207 if (arg
->type
== EXPR_PREOP
&& arg
->op
== '&' && star_cnt
&& !add_dot
) {
208 arg
= strip_expr(arg
->unop
);
212 if (arg
->type
== EXPR_PREOP
&& arg
->op
== '&') {
213 arg
= strip_expr(arg
->unop
);
214 tmp
= expr_to_var_sym(arg
, sym
);
217 ret
= snprintf(buf
, sizeof(buf
), "%s%.*s%s.%s",
218 address
? "&" : "", star_cnt
, "**********",
220 if (ret
>= sizeof(buf
))
222 return alloc_string(buf
);
225 tmp
= expr_to_var_sym(arg
, sym
);
228 ret
= snprintf(buf
, sizeof(buf
), "%s%.*s%s%s",
229 address
? "&" : "", star_cnt
, "**********", tmp
, key
+ 1);
231 if (ret
>= sizeof(buf
))
233 return alloc_string(buf
);
236 static bool split_param_key(char *value
, int *param
, char *key
, int len
)
241 l
= snprintf(key
, len
, "%s", value
);
246 while (*p
&& *p
!= '$')
253 if (*param
< 0 || *param
> 99)
262 memmove(p
- skip
, p
, l
- (p
- key
) + 1);
267 bool get_implied_rl_from_call_str(struct expression
*expr
, const char *data
, struct range_list
**rl
)
269 struct smatch_state
*state
;
270 struct expression
*arg
;
276 while (expr
->type
== EXPR_ASSIGNMENT
)
278 if (expr
->type
!= EXPR_CALL
)
281 if (!split_param_key(data
, ¶m
, buf
, sizeof(buf
)))
284 if (strcmp(buf
, "$") == 0) {
285 arg
= get_argument_from_call_expr(expr
->args
, param
);
288 return get_implied_rl(arg
, rl
);
291 name
= get_name_sym_from_param_key(expr
, param
, buf
, &sym
);
295 state
= get_state(SMATCH_EXTRA
, name
, sym
);
296 if (!estate_rl(state
))
298 *rl
= estate_rl(state
);
302 char *get_chunk_from_key(struct expression
*arg
, char *key
, struct symbol
**sym
, struct var_sym_list
**vsl
)
306 if (strcmp("$", key
) == 0)
307 return expr_to_chunk_sym_vsl(arg
, sym
, vsl
);
308 return get_variable_from_key(arg
, key
, sym
);
311 static char *state_name_to_param_name(const char *state_name
, const char *param_name
)
313 bool address
= false;
320 * Normally what happens is that we map "*foo->bar" to "*param->bar"
321 * but with container_of() there is no notation for that in C and it's
322 * just a Smatch invention. So in that case, the state name is the
325 if (strstr(state_name
, "<~$"))
326 return (char *)state_name
;
328 name_len
= strlen(param_name
);
330 while (state_name
[0] == '*') {
335 if (state_name
[0] == '&') {
340 /* ten out of ten stars! */
344 if (strncmp(state_name
, "(*", 2) == 0 &&
345 strncmp(state_name
+ 2, param_name
, name_len
) == 0 &&
346 state_name
[name_len
+ 2] == ')') {
347 ret
= snprintf(buf
, sizeof(buf
), "%s%.*s(*$)%s",
349 star_cnt
, "**********",
350 state_name
+ name_len
+ 3);
351 if (ret
>= sizeof(buf
))
353 return alloc_sname(buf
);
356 if (strcmp(state_name
, param_name
) == 0) {
357 snprintf(buf
, sizeof(buf
), "%s%.*s$",
359 star_cnt
, "**********");
360 return alloc_sname(buf
);
363 /* check for '-' from "->" */
364 if (strncmp(state_name
, param_name
, name_len
) == 0 &&
365 state_name
[name_len
] == '-') {
366 ret
= snprintf(buf
, sizeof(buf
), "%s%.*s$%s",
368 star_cnt
, "**********",
369 state_name
+ name_len
);
370 if (ret
>= sizeof(buf
))
372 return alloc_sname(buf
);
377 char *get_param_name_var_sym(const char *name
, struct symbol
*sym
)
379 if (!sym
|| !sym
->ident
)
382 return state_name_to_param_name(name
, sym
->ident
->name
);
385 const char *get_mtag_name_var_sym(const char *state_name
, struct symbol
*sym
)
388 const char *sym_name
;
390 static char buf
[256];
393 * mtag_name is different from param_name because mtags can be a struct
394 * instead of a struct pointer. But we want to treat it like a pointer
395 * because really an mtag is a pointer. Or in other words, if you pass
396 * a struct foo then you want to talk about foo.bar but with an mtag
397 * you want to refer to it as foo->bar.
401 if (!sym
|| !sym
->ident
)
404 type
= get_real_base_type(sym
);
405 if (type
&& type
->type
== SYM_BASETYPE
)
408 sym_name
= sym
->ident
->name
;
409 name_len
= strlen(sym_name
);
411 if (state_name
[name_len
] == '.' && /* check for '-' from "->" */
412 strncmp(state_name
, sym_name
, name_len
) == 0) {
413 snprintf(buf
, sizeof(buf
), "$->%s", state_name
+ name_len
+ 1);
417 return state_name_to_param_name(state_name
, sym_name
);
420 const char *get_mtag_name_expr(struct expression
*expr
)
424 const char *ret
= NULL
;
426 name
= expr_to_var_sym(expr
, &sym
);
430 ret
= get_mtag_name_var_sym(name
, sym
);
436 char *get_param_name(struct sm_state
*sm
)
438 return get_param_name_var_sym(sm
->name
, sm
->sym
);
441 char *get_param_var_sym_var_sym(const char *name
, struct symbol
*sym
, struct expression
*ret_expr
, struct symbol
**sym_p
)
443 struct smatch_state
*state
;
444 struct var_sym
*var_sym
;
449 // FIXME was modified...
451 param
= get_param_num_from_sym(sym
);
454 return alloc_string(name
);
457 state
= get_state(my_id
, name
, sym
);
458 if (state
&& state
->data
) {
459 var_sym
= state
->data
;
463 *sym_p
= var_sym
->sym
;
464 return alloc_string(var_sym
->var
);
467 /* One would think that handling container_of() should be done here
468 * but it it's quite tricky because we only have a name and a sym
469 * and none of the assignments have been handled yet, either here or
470 * in smatch_assignments.c. On the other hand handling container_of()
471 * in the assignment hook has the advantage that it saves resources and
472 * it should work fine because of the fake assignments which we do.
475 return swap_with_param(name
, sym
, sym_p
);
478 char *get_param_name_sym(struct expression
*expr
, struct symbol
**sym_p
)
481 const char *ret
= NULL
;
484 name
= expr_to_var_sym(expr
, &sym
);
488 ret
= get_param_var_sym_var_sym(name
, sym
, NULL
, sym_p
);
491 return alloc_string(ret
);
494 int get_param_key_from_var_sym(const char *name
, struct symbol
*sym
,
495 struct expression
*ret_expr
,
498 const char *param_name
;
500 struct symbol
*other_sym
;
506 /* straight forward param match */
507 param
= get_param_num_from_sym(sym
);
509 param_name
= get_param_name_var_sym(name
, sym
);
517 /* it's the return value */
519 struct symbol
*ret_sym
;
522 ret_str
= expr_to_str_sym(ret_expr
, &ret_sym
);
523 if (ret_str
&& ret_sym
== sym
) {
524 param_name
= state_name_to_param_name(name
, ret_str
);
526 free_string(ret_str
);
532 free_string(ret_str
);
535 other_name
= get_param_var_sym_var_sym(name
, sym
, ret_expr
, &other_sym
);
536 if (!other_name
|| !other_sym
)
538 param
= get_param_num_from_sym(other_sym
);
540 sm_msg("internal: '%s' parameter not found", other_name
);
544 param_name
= get_param_name_var_sym(other_name
, other_sym
);
553 int get_param_key_from_sm(struct sm_state
*sm
, struct expression
*ret_expr
,
556 return get_param_key_from_var_sym(sm
->name
, sm
->sym
, ret_expr
, key
);
559 int map_to_param(const char *name
, struct symbol
*sym
)
561 return get_param_key_from_var_sym(name
, sym
, NULL
, NULL
);
564 int get_param_num_from_sym(struct symbol
*sym
)
570 return UNKNOWN_SCOPE
;
572 if (sym
->ctype
.modifiers
& MOD_TOPLEVEL
) {
573 if (sym
->ctype
.modifiers
& MOD_STATIC
)
580 sm_msg("warn: internal. problem with scope: %s",
581 sym
->ident
? sym
->ident
->name
: "<anon var>");
588 FOR_EACH_PTR(cur_func_sym
->ctype
.base_type
->arguments
, tmp
) {
592 } END_FOR_EACH_PTR(tmp
);
596 int get_param_num(struct expression
*expr
)
602 return UNKNOWN_SCOPE
;
603 name
= expr_to_var_sym(expr
, &sym
);
606 return UNKNOWN_SCOPE
;
607 return get_param_num_from_sym(sym
);
610 struct symbol
*get_param_sym_from_num(int num
)
619 FOR_EACH_PTR(cur_func_sym
->ctype
.base_type
->arguments
, sym
) {
622 } END_FOR_EACH_PTR(sym
);
626 char *get_name_sym_from_param_key(struct expression
*expr
, int param
, const char *key
, struct symbol
**sym
)
628 struct expression
*call
, *arg
;
635 sm_msg("internal: null call_expr. param=%d key='%s'", param
, key
);
640 while (call
->type
== EXPR_ASSIGNMENT
)
641 call
= strip_expr(call
->right
);
643 if (call
->type
!= EXPR_CALL
)
647 expr
->type
== EXPR_ASSIGNMENT
&&
649 name
= get_variable_from_key(expr
->left
, key
, sym
);
650 if (!name
|| (sym
&& !*sym
))
652 } else if (param
>= 0) {
653 arg
= get_argument_from_call_expr(call
->args
, param
);
657 name
= get_variable_from_key(arg
, key
, sym
);
658 if (!name
|| (sym
&& !*sym
))
661 name
= alloc_string(key
);
670 char *handle_container_of_assign(struct expression
*expr
, struct symbol
**sym
)
672 struct expression
*right
, *orig
;
678 type
= get_type(expr
->left
);
679 if (!type
|| type
->type
!= SYM_PTR
)
682 right
= strip_expr(expr
->right
);
683 if (right
->type
!= EXPR_BINOP
|| right
->op
!= '-')
686 if (!get_value(right
->right
, &sval
) ||
687 sval
.value
< 0 || sval
.value
> MTAG_OFFSET_MASK
)
690 orig
= get_assigned_expr(right
->left
);
693 if (orig
->type
!= EXPR_SYMBOL
)
695 param
= get_param_num_from_sym(orig
->symbol
);
699 snprintf(buf
, sizeof(buf
), "(%lld<~$)", sval
.value
);
701 return alloc_string(buf
);
704 const char *get_container_of_str(struct expression
*expr
)
706 struct smatch_state
*state
;
708 state
= get_state_expr(my_id
, expr
);
714 static void match_assign(struct expression
*expr
)
716 struct symbol
*param_sym
;
722 /* __in_fake_parameter_assign is included deliberately */
723 if (is_fake_call(expr
->right
) ||
724 __in_fake_struct_assign
)
727 param_name
= get_param_name_sym(expr
->right
, ¶m_sym
);
728 if (param_name
&& param_sym
)
731 param_name
= handle_container_of_assign(expr
, ¶m_sym
);
732 if (param_name
&& param_sym
)
738 set_state_expr(my_id
, expr
->left
, alloc_var_sym_state(param_name
, param_sym
));
740 free_string(param_name
);
743 void register_param_key(int id
)
747 set_dynamic_states(my_id
);
748 add_hook(&match_assign
, ASSIGNMENT_HOOK_AFTER
);
749 add_modification_hook(my_id
, &undef
);