smatch_type_val.c

   1 /*
   2  * Copyright (C) 2013 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * The plan here is to save all the possible values store to a given struct
  20  * member.
  21  *
  22  * We will load all the values in to the function_type_val table first then
  23  * run a script on that and load all the resulting values into the type_val
  24  * table.
  25  *
  26  * So in this file we want to take the union of everything assigned to the
  27  * struct member and insert it into the function_type_val at the end.
  28  *
  29  * You would think that we could use smatch_modification_hooks.c or
  30  * extra_modification_hook() here to get the information here but in the end we
  31  * need to code everything again a third time.
  32  *
  33  */
  34
  35 #include "smatch.h"
  36 #include "smatch_slist.h"
  37 #include "smatch_extra.h"
  38
  39 static int my_id;
  40
  41 struct stree_stack *fn_type_val_stack;
  42 struct stree *fn_type_val;
  43 struct stree *global_type_val;
  44
  45 static int get_vals(void *_db_vals, int argc, char **argv, char **azColName)
  46 {
  47         char **db_vals = _db_vals;
  48
  49         *db_vals = alloc_string(argv[0]);
  50         return 0;
  51 }
  52
  53 static void match_inline_start(struct expression *expr)
  54 {
  55         push_stree(&fn_type_val_stack, fn_type_val);
  56         fn_type_val = NULL;
  57 }
  58
  59 static void match_inline_end(struct expression *expr)
  60 {
  61         free_stree(&fn_type_val);
  62         fn_type_val = pop_stree(&fn_type_val_stack);
  63 }
  64
  65 int get_db_type_rl(struct expression *expr, struct range_list **rl)
  66 {
  67         char *db_vals = NULL;
  68         char *member;
  69         struct range_list *tmp;
  70         struct symbol *type;
  71
  72         member = get_member_name(expr);
  73         if (!member)
  74                 return 0;
  75
  76         run_sql(get_vals, &db_vals,
  77                 "select value from type_value where type = '%s';", member);
  78         free_string(member);
  79         if (!db_vals)
  80                 return 0;
  81         type = get_type(expr);
  82         str_to_rl(type, db_vals, &tmp);
  83         free_string(db_vals);
  84         if (is_whole_rl(tmp))
  85                 return 0;
  86         *rl = tmp;
  87
  88         return 1;
  89 }
  90
  91 static void add_type_val(char *member, struct range_list *rl)
  92 {
  93         struct smatch_state *old, *add, *new;
  94
  95         member = alloc_string(member);
  96         old = get_state_stree(fn_type_val, my_id, member, NULL);
  97         add = alloc_estate_rl(rl);
  98         if (old)
  99                 new = merge_estates(old, add);
 100         else
 101                 new = add;
 102         set_state_stree(&fn_type_val, my_id, member, NULL, new);
 103 }
 104
 105 static void add_fake_type_val(char *member, struct range_list *rl, int ignore)
 106 {
 107         struct smatch_state *old, *add, *new;
 108
 109         member = alloc_string(member);
 110         old = get_state_stree(fn_type_val, my_id, member, NULL);
 111         if (old && strcmp(old->name, "min-max") == 0)
 112                 return;
 113         if (ignore && old && strcmp(old->name, "ignore") == 0)
 114                 return;
 115         add = alloc_estate_rl(rl);
 116         if (old) {
 117                 new = merge_estates(old, add);
 118         } else {
 119                 new = add;
 120                 if (ignore)
 121                         new->name = alloc_string("ignore");
 122                 else
 123                         new->name = alloc_string("min-max");
 124         }
 125         set_state_stree(&fn_type_val, my_id, member, NULL, new);
 126 }
 127
 128 static void add_global_type_val(char *member, struct range_list *rl)
 129 {
 130         struct smatch_state *old, *add, *new;
 131
 132         member = alloc_string(member);
 133         old = get_state_stree(global_type_val, my_id, member, NULL);
 134         add = alloc_estate_rl(rl);
 135         if (old)
 136                 new = merge_estates(old, add);
 137         else
 138                 new = add;
 139         new = clone_estate_perm(new);
 140         set_state_stree_perm(&global_type_val, my_id, member, NULL, new);
 141 }
 142
 143 static int has_link_cb(void *has_link, int argc, char **argv, char **azColName)
 144 {
 145         *(int *)has_link = 1;
 146         return 0;
 147 }
 148
 149 static int is_ignored_fake_assignment(void)
 150 {
 151         struct expression *expr;
 152         struct symbol *type;
 153         char *member_name;
 154         int has_link = 0;
 155
 156         expr = get_faked_expression();
 157         if (!expr || expr->type != EXPR_ASSIGNMENT)
 158                 return 0;
 159         if (!is_void_pointer(expr->right))
 160                 return 0;
 161         member_name = get_member_name(expr->right);
 162         if (!member_name)
 163                 return 0;
 164
 165         type = get_type(expr->left);
 166         if (!type || type->type != SYM_PTR)
 167                 return 0;
 168         type = get_real_base_type(type);
 169         if (!type || type->type != SYM_STRUCT)
 170                 return 0;
 171
 172         run_sql(has_link_cb, &has_link,
 173                 "select * from data_info where type = %d and data = '%s' and value = '%s';",
 174                 TYPE_LINK, member_name, type_to_str(type));
 175         return has_link;
 176 }
 177
 178 static int is_ignored_macro(void)
 179 {
 180         struct expression *expr;
 181         char *name;
 182
 183         expr = get_faked_expression();
 184         if (!expr || expr->type != EXPR_ASSIGNMENT)
 185                 return 0;
 186         name = get_macro_name(expr->right->pos);
 187         if (!name)
 188                 return 0;
 189         if (strcmp(name, "container_of") == 0)
 190                 return 1;
 191         if (strcmp(name, "rb_entry") == 0)
 192                 return 1;
 193         if (strcmp(name, "list_entry") == 0)
 194                 return 1;
 195         if (strcmp(name, "list_first_entry") == 0)
 196                 return 1;
 197         if (strcmp(name, "hlist_entry") == 0)
 198                 return 1;
 199         if (strstr(name, "for_each"))
 200                 return 1;
 201         return 0;
 202 }
 203
 204 static int is_ignored_function(void)
 205 {
 206         struct expression *expr;
 207
 208         expr = get_faked_expression();
 209         if (!expr || expr->type != EXPR_ASSIGNMENT)
 210                 return 0;
 211         expr = strip_expr(expr->right);
 212         if (!expr || expr->type != EXPR_CALL || expr->fn->type != EXPR_SYMBOL)
 213                 return 0;
 214
 215         if (sym_name_is("kmalloc", expr->fn))
 216                 return 1;
 217         if (sym_name_is("netdev_priv", expr->fn))
 218                 return 1;
 219
 220         return 0;
 221 }
 222
 223 static int is_uncasted_function(void)
 224 {
 225         struct expression *expr;
 226         struct symbol *left_type, *right_type;
 227
 228         expr = get_faked_expression();
 229         if (!expr || expr->type != EXPR_ASSIGNMENT)
 230                 return 0;
 231         if (expr->right->type != EXPR_CALL)
 232                 return 0;
 233         left_type = get_type(expr->left);
 234         right_type = get_type(expr->right);
 235
 236         if (!left_type || !right_type)
 237                 return 0;
 238         if (left_type->type != SYM_PTR || right_type->type != SYM_PTR)
 239                 return 0;
 240         left_type = get_real_base_type(left_type);
 241         right_type = get_real_base_type(right_type);
 242
 243         if (left_type == right_type)
 244                 return 1;
 245         return 0;
 246 }
 247
 248 static void match_assign_value(struct expression *expr)
 249 {
 250         char *member, *right_member;
 251         struct range_list *rl;
 252         struct symbol *type;
 253
 254         type = get_type(expr->left);
 255         if (type && type->type == SYM_STRUCT)
 256                 return;
 257
 258         member = get_member_name(expr->left);
 259         if (!member)
 260                 return;
 261
 262         /* if we're saying foo->mtu = bar->mtu then that doesn't add information */
 263         right_member = get_member_name(expr->right);
 264         if (right_member && strcmp(right_member, member) == 0)
 265                 goto free;
 266
 267         if (is_fake_call(expr->right)) {
 268                 if (is_ignored_macro())
 269                         goto free;
 270                 if (is_ignored_function())
 271                         goto free;
 272                 if (is_uncasted_function())
 273                         goto free;
 274                 add_fake_type_val(member, alloc_whole_rl(get_type(expr->left)), is_ignored_fake_assignment());
 275                 goto free;
 276         }
 277
 278         if (expr->op == '=') {
 279                 get_absolute_rl(expr->right, &rl);
 280                 rl = cast_rl(type, rl);
 281         } else {
 282                 /*
 283                  * This is a bit cheating.  We order it so this will already be set
 284                  * by smatch_extra.c and we just look up the value.
 285                  */
 286                 get_absolute_rl(expr->left, &rl);
 287         }
 288         add_type_val(member, rl);
 289 free:
 290         free_string(right_member);
 291         free_string(member);
 292 }
 293
 294 /*
 295  * If we too:  int *p = &my_struct->member then abandon all hope of tracking
 296  * my_struct->member.
 297  */
 298 static void match_assign_pointer(struct expression *expr)
 299 {
 300         struct expression *right;
 301         char *member;
 302         struct range_list *rl;
 303         struct symbol *type;
 304
 305         right = strip_expr(expr->right);
 306         if (right->type != EXPR_PREOP || right->op != '&')
 307                 return;
 308         right = strip_expr(right->unop);
 309
 310         member = get_member_name(right);
 311         if (!member)
 312                 return;
 313         type = get_type(right);
 314         rl = alloc_whole_rl(type);
 315         add_type_val(member, rl);
 316         free_string(member);
 317 }
 318
 319 static void match_global_assign(struct expression *expr)
 320 {
 321         char *member;
 322         struct range_list *rl;
 323         struct symbol *type;
 324
 325         type = get_type(expr->left);
 326         if (type && (type->type == SYM_ARRAY || type->type == SYM_STRUCT))
 327                 return;
 328         member = get_member_name(expr->left);
 329         if (!member)
 330                 return;
 331         get_absolute_rl(expr->right, &rl);
 332         rl = cast_rl(type, rl);
 333         add_global_type_val(member, rl);
 334         free_string(member);
 335 }
 336
 337 static void unop_expr(struct expression *expr)
 338 {
 339         struct range_list *rl;
 340         char *member;
 341
 342         if (expr->op != SPECIAL_DECREMENT && expr->op != SPECIAL_INCREMENT)
 343                 return;
 344
 345         expr = strip_expr(expr->unop);
 346         member = get_member_name(expr);
 347         if (!member)
 348                 return;
 349         rl = alloc_whole_rl(get_type(expr));
 350         add_type_val(member, rl);
 351         free_string(member);
 352 }
 353
 354 static void asm_expr(struct statement *stmt)
 355 {
 356         struct expression *expr;
 357         struct range_list *rl;
 358         char *member;
 359         int state = 0;
 360
 361         FOR_EACH_PTR(stmt->asm_outputs, expr) {
 362                 switch (state) {
 363                 case 0: /* identifier */
 364                 case 1: /* constraint */
 365                         state++;
 366                         continue;
 367                 case 2: /* expression */
 368                         state = 0;
 369                         member = get_member_name(expr);
 370                         if (!member)
 371                                 continue;
 372                         rl = alloc_whole_rl(get_type(expr));
 373                         add_type_val(member, rl);
 374                         free_string(member);
 375                         continue;
 376                 }
 377         } END_FOR_EACH_PTR(expr);
 378 }
 379
 380 static void db_param_add(struct expression *expr, int param, char *key, char *value)
 381 {
 382         struct expression *arg;
 383         struct symbol *type;
 384         struct range_list *rl;
 385         char *member;
 386
 387         if (strcmp(key, "*$") != 0)
 388                 return;
 389
 390         while (expr->type == EXPR_ASSIGNMENT)
 391                 expr = strip_expr(expr->right);
 392         if (expr->type != EXPR_CALL)
 393                 return;
 394
 395         arg = get_argument_from_call_expr(expr->args, param);
 396         arg = strip_expr(arg);
 397         if (!arg)
 398                 return;
 399         type = get_member_type_from_key(arg, key);
 400         if (arg->type != EXPR_PREOP || arg->op != '&')
 401                 return;
 402         arg = strip_expr(arg->unop);
 403
 404         member = get_member_name(arg);
 405         if (!member)
 406                 return;
 407         call_results_to_rl(expr, type, value, &rl);
 408         add_type_val(member, rl);
 409         free_string(member);
 410 }
 411
 412 static void match_end_func_info(struct symbol *sym)
 413 {
 414         struct sm_state *sm;
 415
 416         FOR_EACH_SM(fn_type_val, sm) {
 417                 sql_insert_function_type_value(sm->name, sm->state->name);
 418         } END_FOR_EACH_SM(sm);
 419 }
 420
 421 static void match_after_func(struct symbol *sym)
 422 {
 423         free_stree(&fn_type_val);
 424 }
 425
 426 static void match_end_file(struct symbol_list *sym_list)
 427 {
 428         struct sm_state *sm;
 429
 430         FOR_EACH_SM(global_type_val, sm) {
 431                 sql_insert_function_type_value(sm->name, sm->state->name);
 432         } END_FOR_EACH_SM(sm);
 433 }
 434
 435 void register_type_val(int id)
 436 {
 437         if (!option_info)
 438                 return;
 439
 440         my_id = id;
 441
 442         add_hook(&match_assign_value, ASSIGNMENT_HOOK_AFTER);
 443         add_hook(&match_assign_pointer, ASSIGNMENT_HOOK);
 444         add_hook(&unop_expr, OP_HOOK);
 445         add_hook(&asm_expr, ASM_HOOK);
 446         select_return_states_hook(PARAM_ADD, &db_param_add);
 447         select_return_states_hook(PARAM_SET, &db_param_add);
 448
 449
 450         add_hook(&match_inline_start, INLINE_FN_START);
 451         add_hook(&match_inline_end, INLINE_FN_END);
 452
 453         add_hook(&match_end_func_info, END_FUNC_HOOK);
 454         add_hook(&match_after_func, AFTER_FUNC_HOOK);
 455
 456         add_hook(&match_global_assign, GLOBAL_ASSIGNMENT_HOOK);
 457         add_hook(&match_end_file, END_FILE_HOOK);
 458 }