Print this page
11972 resync smatch


   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17 
  18 #include <stdlib.h>
  19 #include <errno.h>
  20 #include "parse.h"
  21 #include "smatch.h"
  22 #include "smatch_slist.h"
  23 #include "smatch_extra.h"
  24 #include "smatch_function_hashtable.h"
  25 
  26 #define UNKNOWN_SIZE (-1)
  27 
  28 static int my_size_id;
  29 
  30 static DEFINE_HASHTABLE_INSERT(insert_func, char, int);
  31 static DEFINE_HASHTABLE_SEARCH(search_func, char, int);
  32 static struct hashtable *allocation_funcs;
  33 
  34 static char *get_fn_name(struct expression *expr)
  35 {
  36         if (expr->type != EXPR_CALL)
  37                 return NULL;
  38         if (expr->fn->type != EXPR_SYMBOL)
  39                 return NULL;
  40         return expr_to_var(expr->fn);
  41 }
  42 
  43 static int is_allocation_function(struct expression *expr)
  44 {
  45         char *func;
  46         int ret = 0;


 257 
 258 static struct range_list *size_from_db(struct expression *expr)
 259 {
 260         struct range_list *rl;
 261 
 262         rl = size_from_db_symbol(expr);
 263         if (rl)
 264                 return rl;
 265         return size_from_db_type(expr);
 266 }
 267 
 268 static void db_returns_buf_size(struct expression *expr, int param, char *unused, char *math)
 269 {
 270         struct expression *call;
 271         struct range_list *rl;
 272 
 273         if (expr->type != EXPR_ASSIGNMENT)
 274                 return;
 275         call = strip_expr(expr->right);
 276 
 277         if (!parse_call_math_rl(call, math, &rl))
 278                 return;
 279         rl = cast_rl(&int_ctype, rl);
 280         set_state_expr(my_size_id, expr->left, alloc_estate_rl(rl));
 281 }
 282 
 283 static int get_real_array_size_from_type(struct symbol *type)
 284 {
 285         sval_t sval;
 286 
 287         if (!type)
 288                 return 0;
 289         if (!type || type->type != SYM_ARRAY)
 290                 return 0;
 291 
 292         if (!get_implied_value(type->array_size, &sval))
 293                 return 0;
 294 
 295         return sval.value;
 296 }
 297 
 298 int get_real_array_size(struct expression *expr)


 454         state = get_state(my_size_id, sym->ident->name, sym);
 455         if (!estate_to_size(state))
 456                 return 0;
 457 
 458         return estate_to_size(state) - type_bytes(base_sym) + type_bytes(get_type(expr));
 459 }
 460 
 461 static struct range_list *alloc_int_rl(int value)
 462 {
 463         sval_t sval = {
 464                 .type = &int_ctype,
 465                 {.value = value},
 466         };
 467 
 468         return alloc_rl(sval, sval);
 469 }
 470 
 471 struct range_list *get_array_size_bytes_rl(struct expression *expr)
 472 {
 473         struct range_list *ret = NULL;

 474         int size;
 475 
 476         expr = remove_addr_fluff(expr);
 477         if (!expr)
 478                 return NULL;
 479 
 480         /* "BAR" */
 481         if (expr->type == EXPR_STRING)
 482                 return alloc_int_rl(expr->string->length);
 483 
 484         if (expr->type == EXPR_BINOP && expr->op == '+') {
 485                 sval_t offset;
 486                 struct symbol *type;
 487                 int bytes;
 488 
 489                 if (!get_implied_value(expr->right, &offset))
 490                         return NULL;
 491                 type = get_type(expr->left);
 492                 if (!type)
 493                         return NULL;


 511         /* buf[4] */
 512         size = get_real_array_size(expr);
 513         if (size)
 514                 return alloc_int_rl(elements_to_bytes(expr, size));
 515 
 516         /* buf = malloc(1024); */
 517         ret = get_stored_size_bytes(expr);
 518         if (ret)
 519                 return ret;
 520 
 521         /* char *foo = "BAR" */
 522         size = get_size_from_initializer(expr);
 523         if (size)
 524                 return alloc_int_rl(elements_to_bytes(expr, size));
 525 
 526         size = get_bytes_from_address(expr);
 527         if (size)
 528                 return alloc_int_rl(size);
 529 
 530         ret = size_from_db(expr);


 531         if (ret)
 532                 return ret;
 533 
 534         return NULL;
 535 }
 536 
 537 int get_array_size_bytes(struct expression *expr)
 538 {
 539         struct range_list *rl;
 540         sval_t sval;
 541 
 542         rl = get_array_size_bytes_rl(expr);
 543         if (!rl_to_sval(rl, &sval))
 544                 return 0;
 545         if (sval.uvalue >= INT_MAX)
 546                 return 0;
 547         return sval.value;
 548 }
 549 
 550 int get_array_size_bytes_max(struct expression *expr)


 615                 return;
 616 
 617         name = get_member_name(buffer);
 618         if (!name && is_static(buffer))
 619                 name = expr_to_var(buffer);
 620         if (!name)
 621                 return;
 622         if (rl && !is_whole_rl(rl))
 623                 sql_insert_function_type_size(name, show_rl(rl));
 624         else
 625                 sql_insert_function_type_size(name, "(-1)");
 626 
 627         free_string(name);
 628 }
 629 
 630 static void store_alloc(struct expression *expr, struct range_list *rl)
 631 {
 632         struct symbol *type;
 633 
 634         rl = clone_rl(rl); // FIXME!!!


 635         set_state_expr(my_size_id, expr, alloc_estate_rl(rl));
 636 
 637         type = get_type(expr);
 638         if (!type)
 639                 return;
 640         if (type->type != SYM_PTR)
 641                 return;
 642         type = get_real_base_type(type);
 643         if (!type)
 644                 return;
 645         if (type == &void_ctype)
 646                 return;
 647         if (type->type != SYM_BASETYPE && type->type != SYM_PTR)
 648                 return;
 649 
 650         info_record_alloction(expr, rl);
 651 }
 652 
 653 static void match_array_assignment(struct expression *expr)
 654 {


 702         right = strip_expr(expr->right);
 703         arg = get_argument_from_call_expr(right->args, size_arg);
 704         get_absolute_rl(arg, &rl);
 705         rl = cast_rl(&int_ctype, rl);
 706         store_alloc(expr->left, rl);
 707 }
 708 
 709 static void match_calloc(const char *fn, struct expression *expr, void *unused)
 710 {
 711         struct expression *right;
 712         struct expression *size, *nr, *mult;
 713         struct range_list *rl;
 714 
 715         right = strip_expr(expr->right);
 716         nr = get_argument_from_call_expr(right->args, 0);
 717         size = get_argument_from_call_expr(right->args, 1);
 718         mult = binop_expression(nr, '*', size);
 719         if (get_implied_rl(mult, &rl))
 720                 store_alloc(expr->left, rl);
 721         else
 722                 store_alloc(expr->left, size_to_rl(-1));
 723 }
 724 
 725 static void match_page(const char *fn, struct expression *expr, void *_unused)
 726 {
 727         sval_t page_size = {
 728                 .type = &int_ctype,
 729                 {.value = 4096},
 730         };
 731 
 732         store_alloc(expr->left, alloc_rl(page_size, page_size));
 733 }
 734 
 735 static void match_strndup(const char *fn, struct expression *expr, void *unused)
 736 {
 737         struct expression *fn_expr;
 738         struct expression *size_expr;
 739         sval_t size;
 740 
 741         fn_expr = strip_expr(expr->right);
 742         size_expr = get_argument_from_call_expr(fn_expr->args, 1);
 743         if (get_implied_max(size_expr, &size)) {
 744                 size.value++;
 745                 store_alloc(expr->left, size_to_rl(size.value));
 746         } else {
 747                 store_alloc(expr->left, size_to_rl(-1));
 748         }
 749 
 750 }
 751 
 752 static void match_alloc_pages(const char *fn, struct expression *expr, void *_order_arg)
 753 {
 754         int order_arg = PTR_INT(_order_arg);
 755         struct expression *right;
 756         struct expression *arg;
 757         sval_t sval;
 758 
 759         right = strip_expr(expr->right);
 760         arg = get_argument_from_call_expr(right->args, order_arg);
 761         if (!get_implied_value(arg, &sval))
 762                 return;
 763         if (sval.value < 0 || sval.value > 10)
 764                 return;
 765 
 766         sval.type = &int_ctype;
 767         sval.value = 1 << sval.value;


 801 
 802         i = -1;
 803         FOR_EACH_PTR(expr->args, arg) {
 804                 i++;
 805                 type = get_type(arg);
 806                 if (!type || (type->type != SYM_PTR && type->type != SYM_ARRAY))
 807                         continue;
 808                 rl = get_array_size_bytes_rl(arg);
 809                 if (!rl)
 810                         continue;
 811                 if (is_whole_rl(rl))
 812                         continue;
 813                 if (is_type_bytes(rl, arg))
 814                         continue;
 815                 sql_insert_caller_info(expr, BUF_SIZE, i, "$", show_rl(rl));
 816         } END_FOR_EACH_PTR(arg);
 817 }
 818 
 819 static void struct_member_callback(struct expression *call, int param, char *printed_name, struct sm_state *sm)
 820 {
 821         if (sm->state == &merged ||
 822             strcmp(sm->state->name, "(-1)") == 0 ||
 823             strcmp(sm->state->name, "empty") == 0 ||
 824             strcmp(sm->state->name, "0") == 0)

 825                 return;

 826         sql_insert_caller_info(call, BUF_SIZE, param, printed_name, sm->state->name);
 827 }
 828 
 829 /*
 830  * This is slightly (very) weird because half of this stuff is handled in
 831  * smatch_parse_call_math.c which is poorly named.  But anyway, add some buf
 832  * sizes here.
 833  *
 834  */
 835 static void print_returned_allocations(int return_id, char *return_ranges, struct expression *expr)
 836 {
 837         char buf[16];
 838         int size;


 839 
 840         size = get_array_size_bytes(expr);
 841         if (!size)

 842                 return;
 843 
 844         snprintf(buf, sizeof(buf), "%d", size);











 845         sql_insert_return_states(return_id, return_ranges, BUF_SIZE, -1, "", buf);
 846 }
 847 
 848 static void record_global_size(struct symbol *sym)
 849 {
 850         int bytes;
 851         char buf[16];
 852 
 853         if (!sym->ident)
 854                 return;
 855 
 856         if (!(sym->ctype.modifiers & MOD_TOPLEVEL) ||
 857             sym->ctype.modifiers & MOD_STATIC)
 858                 return;
 859 
 860         bytes = get_array_size_bytes(symbol_expression(sym));
 861         if (bytes <= 1)
 862                 return;
 863 
 864         snprintf(buf, sizeof(buf), "%d", bytes);
 865         sql_insert_data_info_var_sym(sym->ident->name, sym, BUF_SIZE, buf);
 866 }
 867 
 868 void register_buf_size(int id)
 869 {
 870         my_size_id = id;
 871 
 872         set_dynamic_states(my_size_id);
 873 
 874         add_unmatched_state_hook(my_size_id, &unmatched_size_state);

 875 
 876         select_caller_info_hook(set_param_buf_size, BUF_SIZE);
 877         select_return_states_hook(BUF_SIZE, &db_returns_buf_size);
 878         add_split_return_callback(print_returned_allocations);
 879 
 880         allocation_funcs = create_function_hashtable(100);
 881         add_allocation_function("malloc", &match_alloc, 0);
 882         add_allocation_function("calloc", &match_calloc, 0);
 883         add_allocation_function("memdup", &match_alloc, 1);
 884         add_allocation_function("realloc", &match_alloc, 1);
 885         if (option_project == PROJ_KERNEL) {
 886                 add_allocation_function("kmalloc", &match_alloc, 0);
 887                 add_allocation_function("kmalloc_node", &match_alloc, 0);
 888                 add_allocation_function("kzalloc", &match_alloc, 0);
 889                 add_allocation_function("kzalloc_node", &match_alloc, 0);
 890                 add_allocation_function("vmalloc", &match_alloc, 0);
 891                 add_allocation_function("__vmalloc", &match_alloc, 0);
 892                 add_allocation_function("kcalloc", &match_calloc, 0);
 893                 add_allocation_function("kmalloc_array", &match_calloc, 0);
 894                 add_allocation_function("drm_malloc_ab", &match_calloc, 0);
 895                 add_allocation_function("drm_calloc_large", &match_calloc, 0);
 896                 add_allocation_function("sock_kmalloc", &match_alloc, 1);
 897                 add_allocation_function("kmemdup", &match_alloc, 1);
 898                 add_allocation_function("kmemdup_user", &match_alloc, 1);
 899                 add_allocation_function("dma_alloc_attrs", &match_alloc, 1);
 900                 add_allocation_function("pci_alloc_consistent", &match_alloc, 1);
 901                 add_allocation_function("pci_alloc_coherent", &match_alloc, 1);
 902                 add_allocation_function("devm_kmalloc", &match_alloc, 1);
 903                 add_allocation_function("devm_kzalloc", &match_alloc, 1);
 904                 add_allocation_function("krealloc", &match_alloc, 1);
 905                 add_allocation_function("__alloc_bootmem", &match_alloc, 0);
 906                 add_allocation_function("alloc_bootmem", &match_alloc, 0);
 907                 add_allocation_function("kmap", &match_page, 0);

 908                 add_allocation_function("get_zeroed_page", &match_page, 0);
 909                 add_allocation_function("alloc_page", &match_page, 0);
 910                 add_allocation_function("page_address", &match_page, 0);
 911                 add_allocation_function("lowmem_page_address", &match_page, 0);
 912                 add_allocation_function("alloc_pages", &match_alloc_pages, 1);
 913                 add_allocation_function("alloc_pages_current", &match_alloc_pages, 1);
 914                 add_allocation_function("__get_free_pages", &match_alloc_pages, 1);


 915         }
 916 
 917         add_allocation_function("strndup", match_strndup, 0);
 918         if (option_project == PROJ_KERNEL)
 919                 add_allocation_function("kstrndup", match_strndup, 0);
 920 
 921         add_modification_hook(my_size_id, &set_size_undefined);
 922 
 923         add_merge_hook(my_size_id, &merge_size_func);
 924 
 925         if (option_info)
 926                 add_hook(record_global_size, BASE_HOOK);
 927 }
 928 
 929 void register_buf_size_late(int id)
 930 {
 931         /* has to happen after match_alloc() */
 932         add_hook(&match_array_assignment, ASSIGNMENT_HOOK);
 933 
 934         add_hook(&match_call, FUNCTION_CALL_HOOK);


   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17 
  18 #include <stdlib.h>
  19 #include <errno.h>
  20 #include "parse.h"
  21 #include "smatch.h"
  22 #include "smatch_slist.h"
  23 #include "smatch_extra.h"
  24 #include "smatch_function_hashtable.h"
  25 
  26 #define UNKNOWN_SIZE -1
  27 
  28 static int my_size_id;
  29 
  30 static DEFINE_HASHTABLE_INSERT(insert_func, char, int);
  31 static DEFINE_HASHTABLE_SEARCH(search_func, char, int);
  32 static struct hashtable *allocation_funcs;
  33 
  34 static char *get_fn_name(struct expression *expr)
  35 {
  36         if (expr->type != EXPR_CALL)
  37                 return NULL;
  38         if (expr->fn->type != EXPR_SYMBOL)
  39                 return NULL;
  40         return expr_to_var(expr->fn);
  41 }
  42 
  43 static int is_allocation_function(struct expression *expr)
  44 {
  45         char *func;
  46         int ret = 0;


 257 
 258 static struct range_list *size_from_db(struct expression *expr)
 259 {
 260         struct range_list *rl;
 261 
 262         rl = size_from_db_symbol(expr);
 263         if (rl)
 264                 return rl;
 265         return size_from_db_type(expr);
 266 }
 267 
 268 static void db_returns_buf_size(struct expression *expr, int param, char *unused, char *math)
 269 {
 270         struct expression *call;
 271         struct range_list *rl;
 272 
 273         if (expr->type != EXPR_ASSIGNMENT)
 274                 return;
 275         call = strip_expr(expr->right);
 276 
 277         call_results_to_rl(call, &int_ctype, math, &rl);

 278         rl = cast_rl(&int_ctype, rl);
 279         set_state_expr(my_size_id, expr->left, alloc_estate_rl(rl));
 280 }
 281 
 282 static int get_real_array_size_from_type(struct symbol *type)
 283 {
 284         sval_t sval;
 285 
 286         if (!type)
 287                 return 0;
 288         if (!type || type->type != SYM_ARRAY)
 289                 return 0;
 290 
 291         if (!get_implied_value(type->array_size, &sval))
 292                 return 0;
 293 
 294         return sval.value;
 295 }
 296 
 297 int get_real_array_size(struct expression *expr)


 453         state = get_state(my_size_id, sym->ident->name, sym);
 454         if (!estate_to_size(state))
 455                 return 0;
 456 
 457         return estate_to_size(state) - type_bytes(base_sym) + type_bytes(get_type(expr));
 458 }
 459 
 460 static struct range_list *alloc_int_rl(int value)
 461 {
 462         sval_t sval = {
 463                 .type = &int_ctype,
 464                 {.value = value},
 465         };
 466 
 467         return alloc_rl(sval, sval);
 468 }
 469 
 470 struct range_list *get_array_size_bytes_rl(struct expression *expr)
 471 {
 472         struct range_list *ret = NULL;
 473         sval_t sval;
 474         int size;
 475 
 476         expr = remove_addr_fluff(expr);
 477         if (!expr)
 478                 return NULL;
 479 
 480         /* "BAR" */
 481         if (expr->type == EXPR_STRING)
 482                 return alloc_int_rl(expr->string->length);
 483 
 484         if (expr->type == EXPR_BINOP && expr->op == '+') {
 485                 sval_t offset;
 486                 struct symbol *type;
 487                 int bytes;
 488 
 489                 if (!get_implied_value(expr->right, &offset))
 490                         return NULL;
 491                 type = get_type(expr->left);
 492                 if (!type)
 493                         return NULL;


 511         /* buf[4] */
 512         size = get_real_array_size(expr);
 513         if (size)
 514                 return alloc_int_rl(elements_to_bytes(expr, size));
 515 
 516         /* buf = malloc(1024); */
 517         ret = get_stored_size_bytes(expr);
 518         if (ret)
 519                 return ret;
 520 
 521         /* char *foo = "BAR" */
 522         size = get_size_from_initializer(expr);
 523         if (size)
 524                 return alloc_int_rl(elements_to_bytes(expr, size));
 525 
 526         size = get_bytes_from_address(expr);
 527         if (size)
 528                 return alloc_int_rl(size);
 529 
 530         ret = size_from_db(expr);
 531         if (rl_to_sval(ret, &sval) && sval.value == -1)
 532                 return NULL;
 533         if (ret)
 534                 return ret;
 535 
 536         return NULL;
 537 }
 538 
 539 int get_array_size_bytes(struct expression *expr)
 540 {
 541         struct range_list *rl;
 542         sval_t sval;
 543 
 544         rl = get_array_size_bytes_rl(expr);
 545         if (!rl_to_sval(rl, &sval))
 546                 return 0;
 547         if (sval.uvalue >= INT_MAX)
 548                 return 0;
 549         return sval.value;
 550 }
 551 
 552 int get_array_size_bytes_max(struct expression *expr)


 617                 return;
 618 
 619         name = get_member_name(buffer);
 620         if (!name && is_static(buffer))
 621                 name = expr_to_var(buffer);
 622         if (!name)
 623                 return;
 624         if (rl && !is_whole_rl(rl))
 625                 sql_insert_function_type_size(name, show_rl(rl));
 626         else
 627                 sql_insert_function_type_size(name, "(-1)");
 628 
 629         free_string(name);
 630 }
 631 
 632 static void store_alloc(struct expression *expr, struct range_list *rl)
 633 {
 634         struct symbol *type;
 635 
 636         rl = clone_rl(rl); // FIXME!!!
 637         if (!rl)
 638                 rl = size_to_rl(UNKNOWN_SIZE);
 639         set_state_expr(my_size_id, expr, alloc_estate_rl(rl));
 640 
 641         type = get_type(expr);
 642         if (!type)
 643                 return;
 644         if (type->type != SYM_PTR)
 645                 return;
 646         type = get_real_base_type(type);
 647         if (!type)
 648                 return;
 649         if (type == &void_ctype)
 650                 return;
 651         if (type->type != SYM_BASETYPE && type->type != SYM_PTR)
 652                 return;
 653 
 654         info_record_alloction(expr, rl);
 655 }
 656 
 657 static void match_array_assignment(struct expression *expr)
 658 {


 706         right = strip_expr(expr->right);
 707         arg = get_argument_from_call_expr(right->args, size_arg);
 708         get_absolute_rl(arg, &rl);
 709         rl = cast_rl(&int_ctype, rl);
 710         store_alloc(expr->left, rl);
 711 }
 712 
 713 static void match_calloc(const char *fn, struct expression *expr, void *unused)
 714 {
 715         struct expression *right;
 716         struct expression *size, *nr, *mult;
 717         struct range_list *rl;
 718 
 719         right = strip_expr(expr->right);
 720         nr = get_argument_from_call_expr(right->args, 0);
 721         size = get_argument_from_call_expr(right->args, 1);
 722         mult = binop_expression(nr, '*', size);
 723         if (get_implied_rl(mult, &rl))
 724                 store_alloc(expr->left, rl);
 725         else
 726                 store_alloc(expr->left, size_to_rl(UNKNOWN_SIZE));
 727 }
 728 
 729 static void match_page(const char *fn, struct expression *expr, void *_unused)
 730 {
 731         sval_t page_size = {
 732                 .type = &int_ctype,
 733                 {.value = 4096},
 734         };
 735 
 736         store_alloc(expr->left, alloc_rl(page_size, page_size));
 737 }
 738 
 739 static void match_strndup(const char *fn, struct expression *expr, void *unused)
 740 {
 741         struct expression *fn_expr;
 742         struct expression *size_expr;
 743         sval_t size;
 744 
 745         fn_expr = strip_expr(expr->right);
 746         size_expr = get_argument_from_call_expr(fn_expr->args, 1);
 747         if (get_implied_max(size_expr, &size)) {
 748                 size.value++;
 749                 store_alloc(expr->left, size_to_rl(size.value));
 750         } else {
 751                 store_alloc(expr->left, size_to_rl(UNKNOWN_SIZE));
 752         }
 753 
 754 }
 755 
 756 static void match_alloc_pages(const char *fn, struct expression *expr, void *_order_arg)
 757 {
 758         int order_arg = PTR_INT(_order_arg);
 759         struct expression *right;
 760         struct expression *arg;
 761         sval_t sval;
 762 
 763         right = strip_expr(expr->right);
 764         arg = get_argument_from_call_expr(right->args, order_arg);
 765         if (!get_implied_value(arg, &sval))
 766                 return;
 767         if (sval.value < 0 || sval.value > 10)
 768                 return;
 769 
 770         sval.type = &int_ctype;
 771         sval.value = 1 << sval.value;


 805 
 806         i = -1;
 807         FOR_EACH_PTR(expr->args, arg) {
 808                 i++;
 809                 type = get_type(arg);
 810                 if (!type || (type->type != SYM_PTR && type->type != SYM_ARRAY))
 811                         continue;
 812                 rl = get_array_size_bytes_rl(arg);
 813                 if (!rl)
 814                         continue;
 815                 if (is_whole_rl(rl))
 816                         continue;
 817                 if (is_type_bytes(rl, arg))
 818                         continue;
 819                 sql_insert_caller_info(expr, BUF_SIZE, i, "$", show_rl(rl));
 820         } END_FOR_EACH_PTR(arg);
 821 }
 822 
 823 static void struct_member_callback(struct expression *call, int param, char *printed_name, struct sm_state *sm)
 824 {
 825         sval_t sval;
 826 
 827         if (!estate_rl(sm->state) ||
 828             (estate_get_single_value(sm->state, &sval) &&
 829              (sval.value == -1 || sval.value == 0)))
 830                 return;
 831 
 832         sql_insert_caller_info(call, BUF_SIZE, param, printed_name, sm->state->name);
 833 }
 834 
 835 /*
 836  * This is slightly (very) weird because half of this stuff is handled in
 837  * smatch_parse_call_math.c which is poorly named.  But anyway, add some buf
 838  * sizes here.
 839  *
 840  */
 841 static void print_returned_allocations(int return_id, char *return_ranges, struct expression *expr)
 842 {
 843         const char *param_math;
 844         struct range_list *rl;
 845         char buf[64];
 846         sval_t sval;
 847 
 848         rl = get_array_size_bytes_rl(expr);
 849         param_math = get_allocation_math(expr);
 850         if (!rl && !param_math)
 851                 return;
 852 
 853         if (!param_math &&
 854             rl_to_sval(rl, &sval) &&
 855             (sval.value == -1 || sval.value == 0))
 856                 return;
 857 
 858         if (param_math)
 859                 snprintf(buf, sizeof(buf), "%s[%s]", show_rl(rl), param_math);
 860         else
 861                 snprintf(buf, sizeof(buf), "%s", show_rl(rl));
 862 
 863         // FIXME: don't store if you can guess the size from the type
 864         // FIXME: return if we allocate a parameter $0->bar
 865         sql_insert_return_states(return_id, return_ranges, BUF_SIZE, -1, "", buf);
 866 }
 867 
 868 static void record_global_size(struct symbol *sym)
 869 {
 870         int bytes;
 871         char buf[16];
 872 
 873         if (!sym->ident)
 874                 return;
 875 
 876         if (!(sym->ctype.modifiers & MOD_TOPLEVEL) ||
 877             sym->ctype.modifiers & MOD_STATIC)
 878                 return;
 879 
 880         bytes = get_array_size_bytes(symbol_expression(sym));
 881         if (bytes <= 1)
 882                 return;
 883 
 884         snprintf(buf, sizeof(buf), "%d", bytes);
 885         sql_insert_data_info_var_sym(sym->ident->name, sym, BUF_SIZE, buf);
 886 }
 887 
 888 void register_buf_size(int id)
 889 {
 890         my_size_id = id;
 891 
 892         set_dynamic_states(my_size_id);
 893 
 894         add_unmatched_state_hook(my_size_id, &unmatched_size_state);
 895         add_merge_hook(my_size_id, &merge_estates);
 896 
 897         select_caller_info_hook(set_param_buf_size, BUF_SIZE);
 898         select_return_states_hook(BUF_SIZE, &db_returns_buf_size);
 899         add_split_return_callback(print_returned_allocations);
 900 
 901         allocation_funcs = create_function_hashtable(100);
 902         add_allocation_function("malloc", &match_alloc, 0);
 903         add_allocation_function("calloc", &match_calloc, 0);
 904         add_allocation_function("memdup", &match_alloc, 1);
 905         add_allocation_function("realloc", &match_alloc, 1);
 906         if (option_project == PROJ_KERNEL) {
 907                 add_allocation_function("kmalloc", &match_alloc, 0);
 908                 add_allocation_function("kmalloc_node", &match_alloc, 0);
 909                 add_allocation_function("kzalloc", &match_alloc, 0);
 910                 add_allocation_function("kzalloc_node", &match_alloc, 0);
 911                 add_allocation_function("vmalloc", &match_alloc, 0);
 912                 add_allocation_function("__vmalloc", &match_alloc, 0);
 913                 add_allocation_function("kcalloc", &match_calloc, 0);
 914                 add_allocation_function("kmalloc_array", &match_calloc, 0);
 915                 add_allocation_function("drm_malloc_ab", &match_calloc, 0);
 916                 add_allocation_function("drm_calloc_large", &match_calloc, 0);
 917                 add_allocation_function("sock_kmalloc", &match_alloc, 1);
 918                 add_allocation_function("kmemdup", &match_alloc, 1);
 919                 add_allocation_function("kmemdup_user", &match_alloc, 1);
 920                 add_allocation_function("dma_alloc_attrs", &match_alloc, 1);
 921                 add_allocation_function("pci_alloc_consistent", &match_alloc, 1);
 922                 add_allocation_function("pci_alloc_coherent", &match_alloc, 1);
 923                 add_allocation_function("devm_kmalloc", &match_alloc, 1);
 924                 add_allocation_function("devm_kzalloc", &match_alloc, 1);
 925                 add_allocation_function("krealloc", &match_alloc, 1);
 926                 add_allocation_function("__alloc_bootmem", &match_alloc, 0);
 927                 add_allocation_function("alloc_bootmem", &match_alloc, 0);
 928                 add_allocation_function("kmap", &match_page, 0);
 929                 add_allocation_function("kmap_atomic", &match_page, 0);
 930                 add_allocation_function("get_zeroed_page", &match_page, 0);
 931                 add_allocation_function("alloc_page", &match_page, 0);


 932                 add_allocation_function("alloc_pages", &match_alloc_pages, 1);
 933                 add_allocation_function("alloc_pages_current", &match_alloc_pages, 1);
 934                 add_allocation_function("__get_free_pages", &match_alloc_pages, 1);
 935                 add_allocation_function("dma_alloc_contiguous", &match_alloc, 1);
 936                 add_allocation_function("dma_alloc_coherent", &match_alloc, 1);
 937         }
 938 
 939         add_allocation_function("strndup", match_strndup, 0);
 940         if (option_project == PROJ_KERNEL)
 941                 add_allocation_function("kstrndup", match_strndup, 0);
 942 
 943         add_modification_hook(my_size_id, &set_size_undefined);
 944 
 945         add_merge_hook(my_size_id, &merge_size_func);
 946 
 947         if (option_info)
 948                 add_hook(record_global_size, BASE_HOOK);
 949 }
 950 
 951 void register_buf_size_late(int id)
 952 {
 953         /* has to happen after match_alloc() */
 954         add_hook(&match_array_assignment, ASSIGNMENT_HOOK);
 955 
 956         add_hook(&match_call, FUNCTION_CALL_HOOK);