smatch_function_ptrs.c

   1 /*
   2  * Copyright (C) 2013 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * Track how functions are saved as various struct members or passed as
  20  * parameters.
  21  *
  22  */
  23
  24 #include "scope.h"
  25 #include "smatch.h"
  26 #include "smatch_slist.h"
  27
  28 static int my_id;
  29
  30 static char *get_from__symbol_get(struct expression *expr)
  31 {
  32         struct expression *arg;
  33
  34         /*
  35          * typeof(&dib0070_attach) __a =
  36          * ((((typeof(&dib0070_attach)) (__symbol_get("dib0070_attach")))) ?:
  37          *  (__request_module(true, "symbol:" "dib0070_attach"), (((typeof(&dib0070_attach))(__symbol_get("dib0070_attach"))))));
  38          */
  39
  40         expr = strip_expr(expr);
  41
  42         if (expr->type != EXPR_CALL)
  43                 return NULL;
  44         if (!sym_name_is("__symbol_get", expr->fn))
  45                 return NULL;
  46         arg = get_argument_from_call_expr(expr->args, 0);
  47         if (!arg || arg->type != EXPR_STRING)
  48                 return NULL;
  49
  50         return alloc_string(arg->string->data);
  51 }
  52
  53 static int xxx_is_array(struct expression *expr)
  54 {
  55         struct symbol *type;
  56
  57         expr = strip_expr(expr);
  58         if (!expr)
  59                 return 0;
  60
  61         if (expr->type == EXPR_PREOP && expr->op == '*') {
  62                 expr = strip_expr(expr->unop);
  63                 if (!expr)
  64                         return 0;
  65                 if (expr->type == EXPR_BINOP && expr->op == '+')
  66                         return 1;
  67         }
  68
  69         if (expr->type != EXPR_BINOP || expr->op != '+')
  70                 return 0;
  71
  72         type = get_type(expr->left);
  73         if (!type)
  74                 return 0;
  75         if (type->type != SYM_ARRAY && type->type != SYM_PTR)
  76                 return 0;
  77
  78         return 1;
  79 }
  80
  81 static struct expression *xxx_get_array_base(struct expression *expr)
  82 {
  83         if (!xxx_is_array(expr))
  84                 return NULL;
  85         expr = strip_expr(expr);
  86         if (expr->type == EXPR_PREOP && expr->op == '*')
  87                 expr = strip_expr(expr->unop);
  88         if (expr->type != EXPR_BINOP || expr->op != '+')
  89                 return NULL;
  90         return strip_parens(expr->left);
  91 }
  92
  93 static char *get_array_ptr(struct expression *expr)
  94 {
  95         struct expression *array;
  96         struct symbol *type;
  97         char *name;
  98         char buf[256];
  99
 100         array = xxx_get_array_base(expr);
 101
 102         if (array) {
 103                 name = get_member_name(array);
 104                 if (name)
 105                         return alloc_string(name);
 106         }
 107
 108         /* FIXME:  is_array() should probably be is_array_element() */
 109         type = get_type(expr);
 110         if (!array && type && type->type == SYM_ARRAY)
 111                 array = expr;
 112         if (array) {
 113                 name = expr_to_var(array);
 114                 if (!name)
 115                         return NULL;
 116                 snprintf(buf, sizeof(buf), "%s[]", name);
 117                 return alloc_string(buf);
 118         }
 119
 120         expr = get_assigned_expr(expr);
 121         array = xxx_get_array_base(expr);
 122         if (!array)
 123                 return NULL;
 124         name = expr_to_var(array);
 125         if (!name)
 126                 return NULL;
 127         snprintf(buf, sizeof(buf), "%s[]", name);
 128         free_string(name);
 129         return alloc_string(buf);
 130 }
 131
 132 static int is_local_symbol(struct symbol *sym)
 133 {
 134         if (!sym ||
 135             !(sym->ctype.modifiers & MOD_TOPLEVEL))
 136                 return 1;
 137         return 0;
 138 }
 139
 140 static char *ptr_prefix(struct symbol *sym)
 141 {
 142         static char buf[128];
 143
 144         if (is_local_symbol(sym))
 145                 snprintf(buf, sizeof(buf), "%s ptr", get_function());
 146         else if (sym && toplevel(sym->scope))
 147                 snprintf(buf, sizeof(buf), "%s ptr", get_base_file());
 148         else
 149                 snprintf(buf, sizeof(buf), "ptr");
 150
 151         return buf;
 152 }
 153
 154 char *get_returned_ptr(struct expression *expr)
 155 {
 156         struct symbol *type;
 157         char *name;
 158         char buf[256];
 159
 160         if (expr->type != EXPR_CALL)
 161                 return NULL;
 162         if (!expr->fn || expr->fn->type != EXPR_SYMBOL)
 163                 return NULL;
 164
 165         type = get_type(expr);
 166         if (type && type->type == SYM_PTR)
 167                 type = get_real_base_type(type);
 168         if (!type || type->type != SYM_FN)
 169                 return NULL;
 170
 171         name = expr_to_var(expr->fn);
 172         if (!name)
 173                 return NULL;
 174         snprintf(buf, sizeof(buf), "r %s()", name);
 175         free_string(name);
 176         return alloc_string(buf);
 177 }
 178
 179 char *get_fnptr_name(struct expression *expr)
 180 {
 181         char *name;
 182
 183         if (expr_is_zero(expr))
 184                 return NULL;
 185
 186         expr = strip_expr(expr);
 187
 188         /* (*ptrs[0])(a, b, c) is the same as ptrs[0](a, b, c); */
 189         if (expr->type == EXPR_PREOP && expr->op == '*')
 190                 expr = strip_expr(expr->unop);
 191
 192         name = get_from__symbol_get(expr);
 193         if (name)
 194                 return name;
 195
 196         name = get_array_ptr(expr);
 197         if (name)
 198                 return name;
 199
 200         name = get_returned_ptr(expr);
 201         if (name)
 202                 return name;
 203
 204         name = get_member_name(expr);
 205         if (name)
 206                 return alloc_string(name);
 207
 208         if (expr->type == EXPR_SYMBOL) {
 209                 int param;
 210                 char buf[256];
 211                 struct symbol *sym;
 212                 struct symbol *type;
 213
 214                 param = get_param_num_from_sym(expr->symbol);
 215                 if (param >= 0) {
 216                         snprintf(buf, sizeof(buf), "%s param %d", get_function(), param);
 217                         return alloc_string(buf);
 218                 }
 219
 220                 name = expr_to_var_sym(expr, &sym);
 221                 if (!name)
 222                         return NULL;
 223                 type = get_type(expr);
 224                 if (type && type->type == SYM_PTR) {
 225                         snprintf(buf, sizeof(buf), "%s %s", ptr_prefix(sym), name);
 226                         free_string(name);
 227                         return alloc_string(buf);
 228                 }
 229                 return name;
 230         }
 231         return expr_to_var(expr);
 232 }
 233
 234 static int get_arg_count(struct expression *fn)
 235 {
 236         struct symbol *fn_type;
 237
 238         fn_type = get_type(fn);
 239         if (!fn_type)
 240                 return INT_MAX;
 241         if (fn_type->type == SYM_PTR)
 242                 fn_type = get_real_base_type(fn_type);
 243         if (fn_type->type != SYM_FN)
 244                 return INT_MAX;
 245
 246         return ptr_list_size((struct ptr_list *)fn_type->arguments);
 247 }
 248
 249 static void match_passes_function_pointer(struct expression *expr)
 250 {
 251         struct expression *arg, *tmp;
 252         struct symbol *type;
 253         char *called_name;
 254         char *fn_name;
 255         char ptr_name[256];
 256         int cnt, i;
 257
 258         cnt = get_arg_count(expr->fn);
 259
 260         i = -1;
 261         FOR_EACH_PTR(expr->args, arg) {
 262                 i++;
 263
 264                 if (i >= cnt)
 265                         return;
 266
 267                 tmp = strip_expr(arg);
 268                 if (tmp->type == EXPR_PREOP && tmp->op == '&')
 269                         tmp = strip_expr(tmp->unop);
 270
 271                 type = get_type(tmp);
 272                 if (type && type->type == SYM_PTR)
 273                         type = get_real_base_type(type);
 274                 if (!type || type->type != SYM_FN)
 275                         continue;
 276
 277                 called_name = expr_to_var(expr->fn);
 278                 if (!called_name)
 279                         return;
 280                 fn_name = get_fnptr_name(tmp);
 281                 if (!fn_name)
 282                         goto free;
 283
 284                 snprintf(ptr_name, sizeof(ptr_name), "%s param %d", called_name, i);
 285                 sql_insert_function_ptr(fn_name, ptr_name);
 286 free:
 287                 free_string(fn_name);
 288                 free_string(called_name);
 289         } END_FOR_EACH_PTR(arg);
 290 }
 291
 292 static int can_hold_function_ptr(struct expression *expr)
 293 {
 294         struct symbol *type;
 295
 296         type = get_type(expr);
 297         if (!type)
 298                 return 0;
 299         if (type->type == SYM_PTR || type->type == SYM_ARRAY) {
 300                 type = get_real_base_type(type);
 301                 if (!type)
 302                         return 0;
 303         }
 304         /* pointer to a pointer */
 305         if (type->type == SYM_PTR || type->type == SYM_ARRAY) {
 306                 type = get_real_base_type(type);
 307                 if (!type)
 308                         return 0;
 309         }
 310         if (type->type == SYM_FN)
 311                 return 1;
 312         if (type == &ulong_ctype && expr->type == EXPR_DEREF)
 313                 return 1;
 314         if (type == &void_ctype)
 315                 return 1;
 316         return 0;
 317 }
 318
 319 static void match_function_assign(struct expression *expr)
 320 {
 321         struct expression *right;
 322         struct symbol *type;
 323         char *fn_name;
 324         char *ptr_name;
 325
 326         if (__in_fake_assign)
 327                 return;
 328         if (is_fake_var_assign(expr))
 329                 return;
 330
 331         right = strip_expr(expr->right);
 332         if (right->type == EXPR_PREOP && right->op == '&')
 333                 right = strip_expr(right->unop);
 334
 335         if (right->type != EXPR_SYMBOL &&
 336             right->type != EXPR_DEREF &&
 337             right->type != EXPR_CALL)
 338                 return;
 339
 340         if (!can_hold_function_ptr(right) ||
 341             !can_hold_function_ptr(expr->left))
 342                 return;
 343
 344         fn_name = get_fnptr_name(right);
 345         ptr_name = get_fnptr_name(expr->left);
 346         if (!fn_name || !ptr_name)
 347                 goto free;
 348         if (strcmp(fn_name, ptr_name) == 0)
 349                 goto free;
 350
 351
 352         type = get_type(right);
 353         if (!type)
 354                 return;
 355         if (type->type == SYM_PTR || type->type == SYM_ARRAY) {
 356                 type = get_real_base_type(type);
 357                 if (!type)
 358                         return;
 359         }
 360         if (type->type != SYM_FN) {
 361                 int count = 0;
 362
 363                 /* look it up in function_ptr */
 364                 run_sql(get_row_count, &count,
 365                         "select count(*) from function_ptr where ptr = '%s'",
 366                         fn_name);
 367                 if (count == 0)
 368                         goto free;
 369         }
 370
 371         sql_insert_function_ptr(fn_name, ptr_name);
 372 free:
 373         free_string(fn_name);
 374         free_string(ptr_name);
 375 }
 376
 377 static void match_returns_function_pointer(struct expression *expr)
 378 {
 379         struct symbol *type;
 380         char *fn_name;
 381         char ptr_name[256];
 382
 383         if (__inline_fn)
 384                 return;
 385
 386         type = get_real_base_type(cur_func_sym);
 387         if (!type || type->type != SYM_FN)
 388                 return;
 389         type = get_real_base_type(type);
 390         if (!type || type->type != SYM_PTR)
 391                 return;
 392         type = get_real_base_type(type);
 393         if (!type || type->type != SYM_FN)
 394                 return;
 395
 396         if (expr->type == EXPR_PREOP && expr->op == '&')
 397                 expr = strip_expr(expr->unop);
 398
 399         fn_name = get_fnptr_name(expr);
 400         if (!fn_name)
 401                 return;
 402         snprintf(ptr_name, sizeof(ptr_name), "r %s()", get_function());
 403         sql_insert_function_ptr(fn_name, ptr_name);
 404 }
 405
 406 static void print_initializer_list(struct expression_list *expr_list,
 407                 struct symbol *struct_type)
 408 {
 409         struct expression *expr;
 410         struct symbol *base_type;
 411         char struct_name[256];
 412
 413         FOR_EACH_PTR(expr_list, expr) {
 414                 if (expr->type == EXPR_INDEX && expr->idx_expression && expr->idx_expression->type == EXPR_INITIALIZER) {
 415                         print_initializer_list(expr->idx_expression->expr_list, struct_type);
 416                         continue;
 417                 }
 418                 if (expr->type != EXPR_IDENTIFIER)
 419                         continue;
 420                 if (!expr->expr_ident)
 421                         continue;
 422                 if (!expr->ident_expression ||
 423                     expr->ident_expression->type != EXPR_SYMBOL ||
 424                     !expr->ident_expression->symbol_name)
 425                         continue;
 426                 base_type = get_type(expr->ident_expression);
 427                 if (!base_type || base_type->type != SYM_FN)
 428                         continue;
 429                 snprintf(struct_name, sizeof(struct_name), "(struct %s)->%s",
 430                          struct_type->ident->name, expr->expr_ident->name);
 431                 sql_insert_function_ptr(expr->ident_expression->symbol_name->name,
 432                                         struct_name);
 433         } END_FOR_EACH_PTR(expr);
 434 }
 435
 436 static void global_variable(struct symbol *sym)
 437 {
 438         struct symbol *struct_type;
 439
 440         if (!sym->ident)
 441                 return;
 442         if (!sym->initializer || sym->initializer->type != EXPR_INITIALIZER)
 443                 return;
 444         struct_type = get_base_type(sym);
 445         if (!struct_type)
 446                 return;
 447         if (struct_type->type == SYM_ARRAY) {
 448                 struct_type = get_base_type(struct_type);
 449                 if (!struct_type)
 450                         return;
 451         }
 452         if (struct_type->type != SYM_STRUCT || !struct_type->ident)
 453                 return;
 454         print_initializer_list(sym->initializer->expr_list, struct_type);
 455 }
 456
 457 void register_function_ptrs(int id)
 458 {
 459         my_id = id;
 460
 461         if (!option_info)
 462                 return;
 463
 464         add_hook(&global_variable, BASE_HOOK);
 465         add_hook(&global_variable, DECLARATION_HOOK);
 466         add_hook(&match_passes_function_pointer, FUNCTION_CALL_HOOK);
 467         add_hook(&match_returns_function_pointer, RETURN_HOOK);
 468         add_hook(&match_function_assign, ASSIGNMENT_HOOK);
 469         add_hook(&match_function_assign, GLOBAL_ASSIGNMENT_HOOK);
 470 }