1 /* 2 * Copyright (C) 2012 Oracle. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 2 7 * of the License, or (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt 16 */ 17 18 /* 19 * This is almost the same as smatch_param_filter.c. The difference is that 20 * this only deals with values passed on the stack and param filter only deals 21 * with values changed so that the caller sees the new value. It other words 22 * the key for these should always be "$" and the key for param_filter should 23 * never be "$". Also smatch_param_set() should never use "$" as the key. 24 * Param set should work together with param_filter to determine the value that 25 * the caller sees at the end. 26 * 27 * This is for functions like this: 28 * 29 * int foo(int a) 30 * { 31 * if (a >= 0 && a < 10) { 32 * a = 42; 33 * return 1; 34 * } 35 * return 0; 36 * } 37 * 38 * If we pass in 5, it returns 1. 39 * 40 * It's a bit complicated because we can't just consider the final value, we 41 * have to always consider the passed in value. 42 * 43 */ 44 45 #include "scope.h" 46 #include "smatch.h" 47 #include "smatch_extra.h" 48 #include "smatch_slist.h" 49 50 static int my_id; 51 52 static struct stree *start_states; 53 static struct stree_stack *saved_stack; 54 55 static void save_start_states(struct statement *stmt) 56 { 57 start_states = get_all_states_stree(SMATCH_EXTRA); 58 } 59 60 static void free_start_states(void) 61 { 62 free_stree(&start_states); 63 } 64 65 static struct smatch_state *unmatched_state(struct sm_state *sm) 66 { 67 struct smatch_state *state; 68 69 state = __get_state(SMATCH_EXTRA, sm->name, sm->sym); 70 if (state) 71 return state; 72 return alloc_estate_whole(estate_type(sm->state)); 73 } 74 75 struct smatch_state *get_orig_estate(const char *name, struct symbol *sym) 76 { 77 struct smatch_state *state; 78 79 state = get_state(my_id, name, sym); 80 if (state) 81 return state; 82 83 state = get_state(SMATCH_EXTRA, name, sym); 84 if (state) 85 return state; 86 return alloc_estate_rl(alloc_whole_rl(get_real_base_type(sym))); 87 } 88 89 struct smatch_state *get_orig_estate_type(const char *name, struct symbol *sym, struct symbol *type) 90 { 91 struct smatch_state *state; 92 93 state = get_state(my_id, name, sym); 94 if (state) 95 return state; 96 97 state = get_state(SMATCH_EXTRA, name, sym); 98 if (state) 99 return state; 100 return alloc_estate_rl(alloc_whole_rl(type)); 101 } 102 103 static struct range_list *generify_mtag_range(struct smatch_state *state) 104 { 105 struct range_list *rl; 106 struct data_range *drange; 107 108 if (!estate_type(state) || estate_type(state)->type != SYM_PTR) 109 return estate_rl(state); 110 111 /* 112 * The problem is that we get too specific on our param limits when we 113 * know exactly what pointers are passed to a function. It gets to the 114 * point where we say "pointer x will succeed, but everything else will 115 * fail." And then we introduce a new caller which passes a different 116 * pointer and it's like, "Sorry bro, that's not possible." 117 * 118 */ 119 rl = estate_rl(state); 120 FOR_EACH_PTR(rl, drange) { 121 if (drange->min.value != drange->max.value) 122 continue; 123 if (drange->min.value == 0) 124 continue; 125 if (is_err_ptr(drange->min)) 126 continue; 127 return rl_union(valid_ptr_rl, rl); 128 } END_FOR_EACH_PTR(drange); 129 130 return estate_rl(state); 131 } 132 133 static void print_return_value_param(int return_id, char *return_ranges, struct expression *expr) 134 { 135 struct smatch_state *state, *old; 136 struct sm_state *tmp; 137 struct range_list *rl; 138 const char *param_name; 139 int param; 140 141 FOR_EACH_MY_SM(SMATCH_EXTRA, __get_cur_stree(), tmp) { 142 param = get_param_num_from_sym(tmp->sym); 143 if (param < 0) 144 continue; 145 146 param_name = get_param_name(tmp); 147 if (!param_name) 148 continue; 149 150 state = __get_state(my_id, tmp->name, tmp->sym); 151 if (!state) 152 state = tmp->state; 153 154 if (estate_is_whole(state) || estate_is_empty(state)) 155 continue; 156 old = get_state_stree(start_states, SMATCH_EXTRA, tmp->name, tmp->sym); 157 if (old && rl_equiv(estate_rl(old), estate_rl(state))) 158 continue; 159 160 if (is_ignored_kernel_data(param_name)) 161 continue; 162 163 rl = generify_mtag_range(state); 164 sql_insert_return_states(return_id, return_ranges, PARAM_LIMIT, 165 param, param_name, show_rl(rl)); 166 } END_FOR_EACH_SM(tmp); 167 } 168 169 static void extra_mod_hook(const char *name, struct symbol *sym, struct expression *expr, struct smatch_state *state) 170 { 171 struct smatch_state *orig_vals; 172 int param; 173 174 param = get_param_num_from_sym(sym); 175 if (param < 0) 176 return; 177 178 orig_vals = get_orig_estate_type(name, sym, estate_type(state)); 179 set_state(my_id, name, sym, orig_vals); 180 } 181 182 static void match_save_states(struct expression *expr) 183 { 184 push_stree(&saved_stack, start_states); 185 start_states = NULL; 186 } 187 188 static void match_restore_states(struct expression *expr) 189 { 190 free_stree(&start_states); 191 start_states = pop_stree(&saved_stack); 192 } 193 194 void register_param_limit(int id) 195 { 196 my_id = id; 197 198 set_dynamic_states(my_id); 199 add_hook(&save_start_states, AFTER_DEF_HOOK); 200 add_hook(&free_start_states, AFTER_FUNC_HOOK); 201 202 add_extra_mod_hook(&extra_mod_hook); 203 add_unmatched_state_hook(my_id, &unmatched_state); 204 add_merge_hook(my_id, &merge_estates); 205 206 add_hook(&match_save_states, INLINE_FN_START); 207 add_hook(&match_restore_states, INLINE_FN_END); 208 209 add_split_return_callback(&print_return_value_param); 210 } 211 212