1 /* Warn on problematic uses of alloca and variable length arrays.
2 Copyright (C) 2016-2021 Free Software Foundation, Inc.
3 Contributed by Aldy Hernandez <aldyh@redhat.com>.
4
5 This file is part of GCC.
6
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
10 version.
11
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
20
21 #include "config.h"
22 #include "system.h"
23 #include "coretypes.h"
24 #include "backend.h"
25 #include "tree.h"
26 #include "gimple.h"
27 #include "tree-pass.h"
28 #include "ssa.h"
29 #include "gimple-pretty-print.h"
30 #include "diagnostic-core.h"
31 #include "fold-const.h"
32 #include "gimple-iterator.h"
33 #include "tree-ssa.h"
34 #include "tree-cfg.h"
35 #include "builtins.h"
36 #include "calls.h"
37 #include "cfgloop.h"
38 #include "intl.h"
39 #include "gimple-range.h"
40
41 static unsigned HOST_WIDE_INT adjusted_warn_limit (bool);
42
43 const pass_data pass_data_walloca = {
44 GIMPLE_PASS,
45 "walloca",
46 OPTGROUP_NONE,
47 TV_NONE,
48 PROP_cfg, // properties_required
49 0, // properties_provided
50 0, // properties_destroyed
51 0, // properties_start
52 0, // properties_finish
53 };
54
55 class pass_walloca : public gimple_opt_pass
56 {
57 public:
pass_walloca(gcc::context * ctxt)58 pass_walloca (gcc::context *ctxt)
59 : gimple_opt_pass(pass_data_walloca, ctxt), first_time_p (false)
60 {}
clone()61 opt_pass *clone () { return new pass_walloca (m_ctxt); }
set_pass_param(unsigned int n,bool param)62 void set_pass_param (unsigned int n, bool param)
63 {
64 gcc_assert (n == 0);
65 first_time_p = param;
66 }
67 virtual bool gate (function *);
68 virtual unsigned int execute (function *);
69
70 private:
71 // Set to TRUE the first time we run this pass on a function.
72 bool first_time_p;
73 };
74
75 bool
gate(function * fun ATTRIBUTE_UNUSED)76 pass_walloca::gate (function *fun ATTRIBUTE_UNUSED)
77 {
78 // The first time this pass is called, it is called before
79 // optimizations have been run and range information is unavailable,
80 // so we can only perform strict alloca checking.
81 if (first_time_p)
82 return warn_alloca != 0;
83
84 // Warning is disabled when its size limit is greater than PTRDIFF_MAX
85 // for the target maximum, which makes the limit negative since when
86 // represented in signed HOST_WIDE_INT.
87 unsigned HOST_WIDE_INT max = tree_to_uhwi (TYPE_MAX_VALUE (ptrdiff_type_node));
88 return (adjusted_warn_limit (false) <= max
89 || adjusted_warn_limit (true) <= max);
90 }
91
92 // Possible problematic uses of alloca.
93 enum alloca_type {
94 // Alloca argument is within known bounds that are appropriate.
95 ALLOCA_OK,
96
97 // Alloca argument is KNOWN to have a value that is too large.
98 ALLOCA_BOUND_DEFINITELY_LARGE,
99
100 // Alloca argument may be too large.
101 ALLOCA_BOUND_MAYBE_LARGE,
102
103 // Alloca appears in a loop.
104 ALLOCA_IN_LOOP,
105
106 // Alloca argument is 0.
107 ALLOCA_ARG_IS_ZERO,
108
109 // Alloca call is unbounded. That is, there is no controlling
110 // predicate for its argument.
111 ALLOCA_UNBOUNDED
112 };
113
114 // Type of an alloca call with its corresponding limit, if applicable.
115 class alloca_type_and_limit {
116 public:
117 enum alloca_type type;
118 // For ALLOCA_BOUND_MAYBE_LARGE and ALLOCA_BOUND_DEFINITELY_LARGE
119 // types, this field indicates the assumed limit if known or
120 // integer_zero_node if unknown. For any other alloca types, this
121 // field is undefined.
122 wide_int limit;
123 alloca_type_and_limit ();
alloca_type_and_limit(enum alloca_type type,wide_int i)124 alloca_type_and_limit (enum alloca_type type,
125 wide_int i) : type(type), limit(i) { }
alloca_type_and_limit(enum alloca_type type)126 alloca_type_and_limit (enum alloca_type type) : type(type)
127 {
128 limit = wi::to_wide (integer_zero_node);
129 }
130 };
131
132 /* Return TRUE if the user specified a limit for either VLAs or ALLOCAs. */
133
134 static bool
warn_limit_specified_p(bool is_vla)135 warn_limit_specified_p (bool is_vla)
136 {
137 unsigned HOST_WIDE_INT max = is_vla ? warn_vla_limit : warn_alloca_limit;
138 return max != HOST_WIDE_INT_MAX;
139 }
140
141 /* Return the value of the argument N to -Walloca-larger-than= or
142 -Wvla-larger-than= adjusted for the target data model so that
143 when N == HOST_WIDE_INT_MAX, the adjusted value is set to
144 PTRDIFF_MAX on the target. This is done to prevent warnings
145 for unknown/unbounded allocations in the "permissive mode"
146 while still diagnosing excessive and necessarily invalid
147 allocations. */
148
149 static unsigned HOST_WIDE_INT
adjusted_warn_limit(bool idx)150 adjusted_warn_limit (bool idx)
151 {
152 static HOST_WIDE_INT limits[2];
153 if (limits[idx])
154 return limits[idx];
155
156 limits[idx] = idx ? warn_vla_limit : warn_alloca_limit;
157 if (limits[idx] != HOST_WIDE_INT_MAX)
158 return limits[idx];
159
160 limits[idx] = tree_to_shwi (TYPE_MAX_VALUE (ptrdiff_type_node));
161 return limits[idx];
162 }
163
164 // Analyze the alloca call in STMT and return the alloca type with its
165 // corresponding limit (if applicable). IS_VLA is set if the alloca
166 // call was created by the gimplifier for a VLA.
167
168 static class alloca_type_and_limit
alloca_call_type(range_query & query,gimple * stmt,bool is_vla)169 alloca_call_type (range_query &query, gimple *stmt, bool is_vla)
170 {
171 gcc_assert (gimple_alloca_call_p (stmt));
172 tree len = gimple_call_arg (stmt, 0);
173
174 gcc_assert (!is_vla || warn_vla_limit >= 0);
175 gcc_assert (is_vla || warn_alloca_limit >= 0);
176
177 // Adjust warn_alloca_max_size for VLAs, by taking the underlying
178 // type into account.
179 unsigned HOST_WIDE_INT max_size = adjusted_warn_limit (is_vla);
180
181 // Check for the obviously bounded case.
182 if (TREE_CODE (len) == INTEGER_CST)
183 {
184 if (tree_to_uhwi (len) > max_size)
185 return alloca_type_and_limit (ALLOCA_BOUND_DEFINITELY_LARGE,
186 wi::to_wide (len));
187 if (integer_zerop (len))
188 {
189 const offset_int maxobjsize
190 = wi::to_offset (max_object_size ());
191 alloca_type result = (max_size < maxobjsize
192 ? ALLOCA_ARG_IS_ZERO : ALLOCA_OK);
193 return alloca_type_and_limit (result);
194 }
195
196 return alloca_type_and_limit (ALLOCA_OK);
197 }
198
199 struct alloca_type_and_limit ret = alloca_type_and_limit (ALLOCA_OK);
200 // If we have a declared maximum size, we can take it into account.
201 if (gimple_call_builtin_p (stmt, BUILT_IN_ALLOCA_WITH_ALIGN_AND_MAX))
202 {
203 tree arg = gimple_call_arg (stmt, 2);
204 if (compare_tree_int (arg, max_size) <= 0)
205 ret = alloca_type_and_limit (ALLOCA_OK);
206 else
207 {
208 const offset_int maxobjsize
209 = wi::to_offset (max_object_size ());
210 alloca_type result = (max_size < maxobjsize
211 ? ALLOCA_BOUND_MAYBE_LARGE : ALLOCA_OK);
212 ret = alloca_type_and_limit (result, wi::to_wide (arg));
213 }
214 return ret;
215 }
216
217 // If the user specified a limit, use it.
218 int_range_max r;
219 if (warn_limit_specified_p (is_vla)
220 && TREE_CODE (len) == SSA_NAME
221 && query.range_of_expr (r, len, stmt)
222 && !r.varying_p ())
223 {
224 // The invalid bits are anything outside of [0, MAX_SIZE].
225 static int_range<2> invalid_range (build_int_cst (size_type_node, 0),
226 build_int_cst (size_type_node,
227 max_size),
228 VR_ANTI_RANGE);
229
230 r.intersect (invalid_range);
231 if (r.undefined_p ())
232 return alloca_type_and_limit (ALLOCA_OK);
233
234 return alloca_type_and_limit (ALLOCA_BOUND_MAYBE_LARGE,
235 wi::to_wide (integer_zero_node));
236 }
237
238 const offset_int maxobjsize = tree_to_shwi (max_object_size ());
239 /* When MAX_SIZE is greater than or equal to PTRDIFF_MAX treat
240 allocations that aren't visibly constrained as OK, otherwise
241 report them as (potentially) unbounded. */
242 alloca_type unbounded_result = (max_size < maxobjsize.to_uhwi ()
243 ? ALLOCA_UNBOUNDED : ALLOCA_OK);
244 return alloca_type_and_limit (unbounded_result);
245 }
246
247 // Return TRUE if STMT is in a loop, otherwise return FALSE.
248
249 static bool
in_loop_p(gimple * stmt)250 in_loop_p (gimple *stmt)
251 {
252 basic_block bb = gimple_bb (stmt);
253 return
254 bb->loop_father && bb->loop_father->header != ENTRY_BLOCK_PTR_FOR_FN (cfun);
255 }
256
257 unsigned int
execute(function * fun)258 pass_walloca::execute (function *fun)
259 {
260 gimple_ranger ranger;
261 basic_block bb;
262 FOR_EACH_BB_FN (bb, fun)
263 {
264 for (gimple_stmt_iterator si = gsi_start_bb (bb); !gsi_end_p (si);
265 gsi_next (&si))
266 {
267 gimple *stmt = gsi_stmt (si);
268 if (!gimple_alloca_call_p (stmt))
269 continue;
270
271 location_t loc = gimple_nonartificial_location (stmt);
272 loc = expansion_point_location_if_in_system_header (loc);
273
274 const bool is_vla
275 = gimple_call_alloca_for_var_p (as_a <gcall *> (stmt));
276
277 // Strict mode whining for VLAs is handled by the front-end,
278 // so we can safely ignore this case. Also, ignore VLAs if
279 // the user doesn't care about them.
280 if (is_vla)
281 {
282 if (warn_vla > 0 || warn_vla_limit < 0)
283 continue;
284 }
285 else if (warn_alloca)
286 {
287 warning_at (loc, OPT_Walloca, "%Guse of %<alloca%>", stmt);
288 continue;
289 }
290 else if (warn_alloca_limit < 0)
291 continue;
292
293 class alloca_type_and_limit t
294 = alloca_call_type (ranger, stmt, is_vla);
295
296 unsigned HOST_WIDE_INT adjusted_alloca_limit
297 = adjusted_warn_limit (false);
298 // Even if we think the alloca call is OK, make sure it's not in a
299 // loop, except for a VLA, since VLAs are guaranteed to be cleaned
300 // up when they go out of scope, including in a loop.
301 if (t.type == ALLOCA_OK && !is_vla && in_loop_p (stmt))
302 {
303 /* As in other instances, only diagnose this when the limit
304 is less than the maximum valid object size. */
305 const offset_int maxobjsize
306 = wi::to_offset (max_object_size ());
307 if (adjusted_alloca_limit < maxobjsize.to_uhwi ())
308 t = alloca_type_and_limit (ALLOCA_IN_LOOP);
309 }
310
311 enum opt_code wcode
312 = is_vla ? OPT_Wvla_larger_than_ : OPT_Walloca_larger_than_;
313 char buff[WIDE_INT_MAX_PRECISION / 4 + 4];
314 switch (t.type)
315 {
316 case ALLOCA_OK:
317 break;
318 case ALLOCA_BOUND_MAYBE_LARGE:
319 {
320 auto_diagnostic_group d;
321 if (warning_at (loc, wcode,
322 (is_vla
323 ? G_("%Gargument to variable-length "
324 "array may be too large")
325 : G_("%Gargument to %<alloca%> may be too "
326 "large")),
327 stmt)
328 && t.limit != 0)
329 {
330 print_decu (t.limit, buff);
331 inform (loc, "limit is %wu bytes, but argument "
332 "may be as large as %s",
333 is_vla ? warn_vla_limit : adjusted_alloca_limit,
334 buff);
335 }
336 }
337 break;
338 case ALLOCA_BOUND_DEFINITELY_LARGE:
339 {
340 auto_diagnostic_group d;
341 if (warning_at (loc, wcode,
342 (is_vla
343 ? G_("%Gargument to variable-length"
344 " array is too large")
345 : G_("%Gargument to %<alloca%> is too large")),
346 stmt)
347 && t.limit != 0)
348 {
349 print_decu (t.limit, buff);
350 inform (loc, "limit is %wu bytes, but argument is %s",
351 is_vla ? warn_vla_limit : adjusted_alloca_limit,
352 buff);
353 }
354 }
355 break;
356 case ALLOCA_UNBOUNDED:
357 warning_at (loc, wcode,
358 (is_vla
359 ? G_("%Gunbounded use of variable-length array")
360 : G_("%Gunbounded use of %<alloca%>")),
361 stmt);
362 break;
363 case ALLOCA_IN_LOOP:
364 gcc_assert (!is_vla);
365 warning_at (loc, wcode,
366 "%Guse of %<alloca%> within a loop", stmt);
367 break;
368 case ALLOCA_ARG_IS_ZERO:
369 warning_at (loc, wcode,
370 (is_vla
371 ? G_("%Gargument to variable-length array "
372 "is zero")
373 : G_("%Gargument to %<alloca%> is zero")),
374 stmt);
375 break;
376 default:
377 gcc_unreachable ();
378 }
379 }
380 }
381 return 0;
382 }
383
384 gimple_opt_pass *
make_pass_walloca(gcc::context * ctxt)385 make_pass_walloca (gcc::context *ctxt)
386 {
387 return new pass_walloca (ctxt);
388 }
389