2 * Copyright (C) 2014 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * This file started out by saying that if you have:
21 * struct foo one, two;
25 * That's equivalent to saying:
30 * Turning an assignment like that into a bunch of small fake assignments is
33 * The call to memcpy(&one, &two, sizeof(foo)); is the same as "one = two;" so
34 * we can re-use the code. And we may as well use it for memset() too.
35 * Assigning pointers is almost the same:
44 * The problem is that you can go a bit crazy with pointers to pointers.
46 * p1->x->y->z->one->two->three = p2->x->y->z->one->two->three;
48 * I don't have a proper solution for this problem right now. I just copy one
49 * level and don't nest. It should handle limitted nesting but intelligently.
51 * The other thing is that you end up with a lot of garbage assignments where
52 * we record "x could be anything. x->y could be anything. x->y->z->a->b->c
53 * could *also* be anything!". There should be a better way to filter this
54 * useless information.
60 #include "smatch_slist.h"
61 #include "smatch_extra.h"
69 static struct symbol
*get_struct_type(struct expression
*expr
)
73 type
= get_type(expr
);
76 if (type
->type
== SYM_PTR
)
77 type
= get_real_base_type(type
);
78 if (type
&& type
->type
== SYM_STRUCT
)
83 static struct expression
*get_right_base_expr(struct symbol
*left_type
, struct expression
*right
)
85 struct symbol
*struct_type
;
90 struct_type
= get_struct_type(right
);
93 if (struct_type
!= left_type
)
96 if (right
->type
== EXPR_PREOP
&& right
->op
== '&')
97 right
= strip_expr(right
->unop
);
99 if (right
->type
== EXPR_CALL
)
102 if (is_pointer(right
))
103 right
= deref_expression(right
);
108 static struct expression
*remove_addr(struct expression
*expr
)
110 expr
= strip_expr(expr
);
112 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
113 return strip_expr(expr
->unop
);
117 static struct expression
*faked_expression
;
118 struct expression
*get_faked_expression(void)
120 if (!__in_fake_assign
)
122 return faked_expression
;
125 static void split_fake_expr(struct expression
*expr
)
132 static void set_inner_struct_members(int mode
, struct expression
*faked
, struct expression
*left
, struct expression
*right
, struct symbol
*member
)
134 struct expression
*left_member
;
135 struct expression
*right_member
= NULL
; /* silence GCC */
136 struct expression
*assign
;
137 struct symbol
*base
= get_real_base_type(member
);
141 left
= member_expression(left
, '.', member
->ident
);
142 if (mode
!= COPY_MEMSET
&& right
)
143 right
= member_expression(right
, '.', member
->ident
);
146 FOR_EACH_PTR(base
->symbol_list
, tmp
) {
149 type
= get_real_base_type(tmp
);
153 if (type
->type
== SYM_ARRAY
)
155 if (type
->type
== SYM_UNION
|| type
->type
== SYM_STRUCT
) {
156 set_inner_struct_members(mode
, faked
, left
, right
, tmp
);
162 left_member
= member_expression(left
, '.', tmp
->ident
);
168 right_member
= member_expression(right
, '.', tmp
->ident
);
170 right_member
= unknown_value_expression(left_member
);
173 right_member
= right
;
177 assign
= assign_expression(left_member
, right_member
);
178 split_fake_expr(assign
);
179 } END_FOR_EACH_PTR(tmp
);
182 static void __struct_members_copy(int mode
, struct expression
*faked
,
183 struct expression
*left
,
184 struct expression
*right
)
186 struct symbol
*struct_type
, *tmp
, *type
;
187 struct expression
*left_member
;
188 struct expression
*right_member
;
189 struct expression
*assign
;
193 if (__in_fake_assign
)
195 faked_expression
= faked
;
197 left
= strip_expr(left
);
198 right
= strip_expr(right
);
200 struct_type
= get_struct_type(left
);
203 * This is not a struct assignment obviously. But this is where
204 * memcpy() is handled so it feels like a good place to add this
208 type
= get_type(left
);
209 if (!type
|| type
->type
!= SYM_BASETYPE
)
212 right
= strip_expr(right
);
213 if (right
&& right
->type
== EXPR_PREOP
&& right
->op
== '&')
214 right
= remove_addr(right
);
216 right
= unknown_value_expression(left
);
217 assign
= assign_expression(left
, right
);
218 split_fake_expr(assign
);
222 if (is_pointer(left
)) {
223 left
= deref_expression(left
);
226 if (mode
!= COPY_MEMSET
)
227 right
= get_right_base_expr(struct_type
, right
);
229 FOR_EACH_PTR(struct_type
->symbol_list
, tmp
) {
230 type
= get_real_base_type(tmp
);
233 if (type
->type
== SYM_ARRAY
)
236 if (type
->type
== SYM_UNION
|| type
->type
== SYM_STRUCT
) {
237 set_inner_struct_members(mode
, faked
, left
, right
, tmp
);
244 left_member
= member_expression(left
, op
, tmp
->ident
);
251 right_member
= member_expression(right
, op
, tmp
->ident
);
253 right_member
= unknown_value_expression(left_member
);
256 right_member
= right
;
260 sm_msg("internal. No right member");
263 assign
= assign_expression(left_member
, right_member
);
264 split_fake_expr(assign
);
265 } END_FOR_EACH_PTR(tmp
);
268 faked_expression
= NULL
;
271 static int returns_zeroed_mem(struct expression
*expr
)
275 if (expr
->type
!= EXPR_CALL
|| expr
->fn
->type
!= EXPR_SYMBOL
)
277 fn
= expr_to_var(expr
->fn
);
280 if (strcmp(fn
, "kcalloc") == 0)
282 if (option_project
== PROJ_KERNEL
&& strstr(fn
, "zalloc"))
287 void __fake_struct_member_assignments(struct expression
*expr
)
289 struct symbol
*struct_type
;
290 struct symbol
*left_type
;
295 if (is_zero(expr
->right
))
298 left_type
= get_type(expr
->left
);
300 left_type
->type
!= SYM_PTR
&&
301 left_type
->type
!= SYM_STRUCT
&&
302 left_type
!= &ulong_ctype
)
305 struct_type
= get_struct_type(expr
->left
);
309 if (returns_zeroed_mem(expr
->right
))
310 __struct_members_copy(COPY_MEMSET
, expr
, expr
->left
, zero_expr());
312 __struct_members_copy(COPY_NORMAL
, expr
, expr
->left
, expr
->right
);
315 static void match_memset(const char *fn
, struct expression
*expr
, void *_size_arg
)
317 struct expression
*buf
;
318 struct expression
*val
;
320 buf
= get_argument_from_call_expr(expr
->args
, 0);
321 val
= get_argument_from_call_expr(expr
->args
, 1);
323 buf
= strip_expr(buf
);
324 __struct_members_copy(COPY_MEMSET
, expr
, remove_addr(buf
), val
);
327 static void match_memcpy(const char *fn
, struct expression
*expr
, void *_arg
)
329 struct expression
*dest
;
330 struct expression
*src
;
332 dest
= get_argument_from_call_expr(expr
->args
, 0);
333 src
= get_argument_from_call_expr(expr
->args
, 1);
335 __struct_members_copy(COPY_MEMCPY
, expr
, remove_addr(dest
), remove_addr(src
));
338 static void match_memcpy_unknown(const char *fn
, struct expression
*expr
, void *_arg
)
340 struct expression
*dest
;
342 dest
= get_argument_from_call_expr(expr
->args
, 0);
343 __struct_members_copy(COPY_MEMCPY
, expr
, remove_addr(dest
), NULL
);
346 static void match_sscanf(const char *fn
, struct expression
*expr
, void *unused
)
348 struct expression
*arg
;
352 FOR_EACH_PTR(expr
->args
, arg
) {
355 __struct_members_copy(COPY_MEMCPY
, expr
, remove_addr(arg
), NULL
);
356 } END_FOR_EACH_PTR(arg
);
359 static void unop_expr(struct expression
*expr
)
361 if (expr
->op
!= SPECIAL_INCREMENT
&&
362 expr
->op
!= SPECIAL_DECREMENT
)
365 if (!is_pointer(expr
))
367 __struct_members_copy(COPY_MEMCPY
, expr
, expr
->unop
, NULL
);
370 static void register_clears_param(void)
374 const char *function
;
377 if (option_project
== PROJ_NONE
)
380 snprintf(name
, 256, "%s.clears_argument", option_project_str
);
382 token
= get_tokens_file(name
);
385 if (token_type(token
) != TOKEN_STREAMBEGIN
)
388 while (token_type(token
) != TOKEN_STREAMEND
) {
389 if (token_type(token
) != TOKEN_IDENT
)
391 function
= show_ident(token
->ident
);
393 if (token_type(token
) != TOKEN_NUMBER
)
395 param
= atoi(token
->number
);
396 add_function_hook(function
, &match_memcpy_unknown
, INT_PTR(param
));
402 static void db_param_cleared(struct expression
*expr
, int param
, char *key
, char *value
)
404 struct expression
*arg
;
406 while (expr
->type
== EXPR_ASSIGNMENT
)
407 expr
= strip_expr(expr
->right
);
408 if (expr
->type
!= EXPR_CALL
)
412 * FIXME: __struct_members_copy() requires an expression but
413 * get_variable_from_key() returns a name/sym pair so that doesn't
416 if (strcmp(key
, "$") != 0)
419 arg
= get_argument_from_call_expr(expr
->args
, param
);
423 if (strcmp(value
, "0") == 0)
424 __struct_members_copy(COPY_MEMSET
, expr
, remove_addr(arg
), zero_expr());
426 __struct_members_copy(COPY_MEMCPY
, expr
, remove_addr(arg
), NULL
);
429 void register_struct_assignment(int id
)
431 add_function_hook("memset", &match_memset
, NULL
);
432 add_function_hook("__memset", &match_memset
, NULL
);
434 add_function_hook("memcpy", &match_memcpy
, INT_PTR(0));
435 add_function_hook("memmove", &match_memcpy
, INT_PTR(0));
436 add_function_hook("__memcpy", &match_memcpy
, INT_PTR(0));
437 add_function_hook("__memmove", &match_memcpy
, INT_PTR(0));
439 add_function_hook("sscanf", &match_sscanf
, NULL
);
441 add_hook(&unop_expr
, OP_HOOK
);
442 register_clears_param();
443 select_return_states_hook(PARAM_CLEARED
, &db_param_cleared
);