From patchwork Sat Jul 21 14:33:07 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luc Van Oostenryck X-Patchwork-Id: 10538903 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C77B460311 for ; Sat, 21 Jul 2018 14:33:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6650328C16 for ; Sat, 21 Jul 2018 14:33:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5B21328C27; Sat, 21 Jul 2018 14:33:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B48CD28C18 for ; Sat, 21 Jul 2018 14:33:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727631AbeGUP01 (ORCPT ); Sat, 21 Jul 2018 11:26:27 -0400 Received: from mail-ed1-f67.google.com ([209.85.208.67]:34958 "EHLO mail-ed1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727628AbeGUP00 (ORCPT ); Sat, 21 Jul 2018 11:26:26 -0400 Received: by mail-ed1-f67.google.com with SMTP id b10-v6so11985322edi.2 for ; Sat, 21 Jul 2018 07:33:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=s0BzNUBgeM6um9Mr66fNoSUyDZu7XtEVpWIhu+AtUNM=; b=gdh7jkomZk5r7xoiHGUpubg0F59Su3e9M89o5RlRXsY9lIEp4PyatZoBxgyah460dr y8I7wK/BLMl3jboov5ZroGQb6qaZEEsdoAX7tv4u2b4V6q7+o5uJv4lFQui3hFij5aag QfFXjyPwE0bcLXHhtNzd/1TA6TKlJGtUvgWPsuxnCqwEVPgwqyTRXbQj4tHure+zWG3U jmnU4DuzsrVk7oeakjbXhnZEhPEh1HMK2vRW4nDxajrm5HMldZjO8jr++zosE0xuTLRS 253kXTvbGxd2LQG3ukglnDU0ksXPLfMjYg+07M76HQA/4oBALeOFEDQgrAEC3FNSL3Kt p3BA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=s0BzNUBgeM6um9Mr66fNoSUyDZu7XtEVpWIhu+AtUNM=; b=kxn4xHL5OnaaTvII/+457qym4opjrOE2+IysnvnUyzDWO5LSLr9sPK3qOobMaT5kIh PYUc+xeqZFRi+UZRHB8Zn+LnFQ0IJ+myMbZ/XjdYGTVuluufo8cf+YLiAARyd1gED1o4 sh75gmP7KoAT4ZoyeKUu57W41PCQPVsQRccFHYbLrDRZ1QCQn1BssXpVVy2Fdw3wYIfb AkQB1XdzUPbbTxFHHEG9HDPiYQ1GxBxIYhm07EiCyJshRFczPXtqw6miiZQWq+86KDFj hWtGiQ1ClXyRRxEsccsdx//ynrNIuzvIV/HKPenEWK9XUHVayfbyLmvwlwjDARst0HRI IV6Q== X-Gm-Message-State: AOUpUlHvq3Fa8roTtFhP3iUfiMNupmpapd2wT9hMqIsTtRv+pP6U9JXw MaSaqutDWb5nuzbuGC7shWYn9o3d X-Google-Smtp-Source: AAOMgpeSc/P5FYJjbvqnRJ28hiGxA5j1h6zrmK+MkTozMM/u/Gw/cBLQjHwNt0xdYGM/ylTILcrP6Q== X-Received: by 2002:a50:ae04:: with SMTP id c4-v6mr6818815edd.137.1532183608364; Sat, 21 Jul 2018 07:33:28 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:4056:df00:e8d8:3f7a:508d:505d]) by smtp.gmail.com with ESMTPSA id j16-v6sm7450230edj.71.2018.07.21.07.33.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 21 Jul 2018 07:33:27 -0700 (PDT) From: Luc Van Oostenryck To: linux-sparse@vger.kernel.org Cc: Luc Van Oostenryck Subject: [PATCH 02/17] big-shift: mark out-of-range OP_{ASR, LSR, SHL} as tainted Date: Sat, 21 Jul 2018 16:33:07 +0200 Message-Id: <20180721143322.99163-3-luc.vanoostenryck@gmail.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20180721143322.99163-1-luc.vanoostenryck@gmail.com> References: <20180721143322.99163-1-luc.vanoostenryck@gmail.com> Sender: linux-sparse-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sparse@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Some undefined operations, like shifting by an amount bigger than the size, should not raise a warning during the optimization phase because the corresponding warning has already been issued during the expand phase. Mark the corresponding instructions as tainted and don't warn if already tainted. Signed-off-by: Luc Van Oostenryck --- linearize.c | 19 +++++++++++++++++++ simplify.c | 3 ++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/linearize.c b/linearize.c index 194afe664..938dbc07b 100644 --- a/linearize.c +++ b/linearize.c @@ -1002,6 +1002,23 @@ static pseudo_t linearize_store_gen(struct entrypoint *ep, return value; } +static void taint_undefined_behaviour(struct instruction *insn) +{ + pseudo_t src2; + + switch (insn->opcode) { + case OP_LSR: + case OP_ASR: + case OP_SHL: + src2 = insn->src2; + if (src2->type != PSEUDO_VAL) + break; + if ((unsigned long long)src2->value >= insn->size) + insn->tainted = 1; + break; + } +} + static pseudo_t add_binary_op(struct entrypoint *ep, struct symbol *ctype, int op, pseudo_t left, pseudo_t right) { struct instruction *insn = alloc_typed_instruction(op, ctype); @@ -1407,6 +1424,7 @@ static pseudo_t linearize_assignment(struct entrypoint *ep, struct expression *e oldvalue = cast_pseudo(ep, oldvalue, target->ctype, ctype); opcode = map_opcode(op_trans[expr->op - SPECIAL_BASE], ctype); dst = add_binary_op(ep, ctype, opcode, oldvalue, value); + taint_undefined_behaviour(dst->def); value = cast_pseudo(ep, dst, ctype, expr->ctype); } value = linearize_store_gen(ep, value, &ad); @@ -1512,6 +1530,7 @@ static pseudo_t linearize_binop(struct entrypoint *ep, struct expression *expr) src2 = linearize_expression(ep, expr->right); op = map_opcode(opcode[expr->op], expr->ctype); dst = add_binary_op(ep, expr->ctype, op, src1, src2); + taint_undefined_behaviour(dst->def); return dst; } diff --git a/simplify.c b/simplify.c index 741b1272c..d09ff40ec 100644 --- a/simplify.c +++ b/simplify.c @@ -538,8 +538,9 @@ static int simplify_asr(struct instruction *insn, pseudo_t pseudo, long long val { unsigned int size = operand_size(insn, pseudo); - if (value >= size) { + if (value >= size && !insn->tainted) { warning(insn->pos, "right shift by bigger than source value"); + insn->tainted = 1; return replace_with_pseudo(insn, value_pseudo(0)); } if (!value)