gcc/gimple-ssa-warn-alloca.c

   1 /* Warn on problematic uses of alloca and variable length arrays.
   2    Copyright (C) 2016-2021 Free Software Foundation, Inc.
   3    Contributed by Aldy Hernandez <aldyh@redhat.com>.
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it under
   8 the terms of the GNU General Public License as published by the Free
   9 Software Foundation; either version 3, or (at your option) any later
  10 version.
  11
  12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15 for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with GCC; see the file COPYING3.  If not see
  19 <http://www.gnu.org/licenses/>.  */
  20
  21 #include "config.h"
  22 #include "system.h"
  23 #include "coretypes.h"
  24 #include "backend.h"
  25 #include "tree.h"
  26 #include "gimple.h"
  27 #include "tree-pass.h"
  28 #include "ssa.h"
  29 #include "gimple-pretty-print.h"
  30 #include "diagnostic-core.h"
  31 #include "fold-const.h"
  32 #include "gimple-iterator.h"
  33 #include "tree-ssa.h"
  34 #include "tree-cfg.h"
  35 #include "builtins.h"
  36 #include "calls.h"
  37 #include "cfgloop.h"
  38 #include "intl.h"
  39 #include "gimple-range.h"
  40
  41 static unsigned HOST_WIDE_INT adjusted_warn_limit (bool);
  42
  43 const pass_data pass_data_walloca = {
  44   GIMPLE_PASS,
  45   "walloca",
  46   OPTGROUP_NONE,
  47   TV_NONE,
  48   PROP_cfg, // properties_required
  49   0,        // properties_provided
  50   0,        // properties_destroyed
  51   0,        // properties_start
  52   0,        // properties_finish
  53 };
  54
  55 class pass_walloca : public gimple_opt_pass
  56 {
  57 public:
  58   pass_walloca (gcc::context *ctxt)
  59     : gimple_opt_pass(pass_data_walloca, ctxt), first_time_p (false)
  60   {}
  61   opt_pass *clone () { return new pass_walloca (m_ctxt); }
  62   void set_pass_param (unsigned int n, bool param)
  63     {
  64       gcc_assert (n == 0);
  65       first_time_p = param;
  66     }
  67   virtual bool gate (function *);
  68   virtual unsigned int execute (function *);
  69
  70  private:
  71   // Set to TRUE the first time we run this pass on a function.
  72   bool first_time_p;
  73 };
  74
  75 bool
  76 pass_walloca::gate (function *fun ATTRIBUTE_UNUSED)
  77 {
  78   // The first time this pass is called, it is called before
  79   // optimizations have been run and range information is unavailable,
  80   // so we can only perform strict alloca checking.
  81   if (first_time_p)
  82     return warn_alloca != 0;
  83
  84   // Warning is disabled when its size limit is greater than PTRDIFF_MAX
  85   // for the target maximum, which makes the limit negative since when
  86   // represented in signed HOST_WIDE_INT.
  87   unsigned HOST_WIDE_INT max = tree_to_uhwi (TYPE_MAX_VALUE (ptrdiff_type_node));
  88   return (adjusted_warn_limit (false) <= max
  89           || adjusted_warn_limit (true) <= max);
  90 }
  91
  92 // Possible problematic uses of alloca.
  93 enum alloca_type {
  94   // Alloca argument is within known bounds that are appropriate.
  95   ALLOCA_OK,
  96
  97   // Alloca argument is KNOWN to have a value that is too large.
  98   ALLOCA_BOUND_DEFINITELY_LARGE,
  99
 100   // Alloca argument may be too large.
 101   ALLOCA_BOUND_MAYBE_LARGE,
 102
 103   // Alloca appears in a loop.
 104   ALLOCA_IN_LOOP,
 105
 106   // Alloca argument is 0.
 107   ALLOCA_ARG_IS_ZERO,
 108
 109   // Alloca call is unbounded.  That is, there is no controlling
 110   // predicate for its argument.
 111   ALLOCA_UNBOUNDED
 112 };
 113
 114 // Type of an alloca call with its corresponding limit, if applicable.
 115 class alloca_type_and_limit {
 116 public:
 117   enum alloca_type type;
 118   // For ALLOCA_BOUND_MAYBE_LARGE and ALLOCA_BOUND_DEFINITELY_LARGE
 119   // types, this field indicates the assumed limit if known or
 120   // integer_zero_node if unknown.  For any other alloca types, this
 121   // field is undefined.
 122   wide_int limit;
 123   alloca_type_and_limit ();
 124   alloca_type_and_limit (enum alloca_type type,
 125                          wide_int i) : type(type), limit(i) { }
 126   alloca_type_and_limit (enum alloca_type type) : type(type)
 127   { if (type == ALLOCA_BOUND_MAYBE_LARGE
 128         || type == ALLOCA_BOUND_DEFINITELY_LARGE)
 129       limit = wi::to_wide (integer_zero_node);
 130   }
 131 };
 132
 133 /* Return TRUE if the user specified a limit for either VLAs or ALLOCAs.  */
 134
 135 static bool
 136 warn_limit_specified_p (bool is_vla)
 137 {
 138   unsigned HOST_WIDE_INT max = is_vla ? warn_vla_limit : warn_alloca_limit;
 139   return max != HOST_WIDE_INT_MAX;
 140 }
 141
 142 /* Return the value of the argument N to -Walloca-larger-than= or
 143    -Wvla-larger-than= adjusted for the target data model so that
 144    when N == HOST_WIDE_INT_MAX, the adjusted value is set to
 145    PTRDIFF_MAX on the target.  This is done to prevent warnings
 146    for unknown/unbounded allocations in the "permissive mode"
 147    while still diagnosing excessive and necessarily invalid
 148    allocations.  */
 149
 150 static unsigned HOST_WIDE_INT
 151 adjusted_warn_limit (bool idx)
 152 {
 153   static HOST_WIDE_INT limits[2];
 154   if (limits[idx])
 155     return limits[idx];
 156
 157   limits[idx] = idx ? warn_vla_limit : warn_alloca_limit;
 158   if (limits[idx] != HOST_WIDE_INT_MAX)
 159     return limits[idx];
 160
 161   limits[idx] = tree_to_shwi (TYPE_MAX_VALUE (ptrdiff_type_node));
 162   return limits[idx];
 163 }
 164
 165 // Analyze the alloca call in STMT and return the alloca type with its
 166 // corresponding limit (if applicable).  IS_VLA is set if the alloca
 167 // call was created by the gimplifier for a VLA.
 168
 169 static class alloca_type_and_limit
 170 alloca_call_type (range_query &query, gimple *stmt, bool is_vla)
 171 {
 172   gcc_assert (gimple_alloca_call_p (stmt));
 173   tree len = gimple_call_arg (stmt, 0);
 174
 175   gcc_assert (!is_vla || warn_vla_limit >= 0);
 176   gcc_assert (is_vla || warn_alloca_limit >= 0);
 177
 178   // Adjust warn_alloca_max_size for VLAs, by taking the underlying
 179   // type into account.
 180   unsigned HOST_WIDE_INT max_size = adjusted_warn_limit (is_vla);
 181
 182   // Check for the obviously bounded case.
 183   if (TREE_CODE (len) == INTEGER_CST)
 184     {
 185       if (tree_to_uhwi (len) > max_size)
 186         return alloca_type_and_limit (ALLOCA_BOUND_DEFINITELY_LARGE,
 187                                       wi::to_wide (len));
 188       if (integer_zerop (len))
 189         {
 190           const offset_int maxobjsize
 191             = wi::to_offset (max_object_size ());
 192           alloca_type result = (max_size < maxobjsize
 193                                 ? ALLOCA_ARG_IS_ZERO : ALLOCA_OK);
 194           return alloca_type_and_limit (result);
 195         }
 196
 197       return alloca_type_and_limit (ALLOCA_OK);
 198     }
 199
 200   struct alloca_type_and_limit ret = alloca_type_and_limit (ALLOCA_OK);
 201   // If we have a declared maximum size, we can take it into account.
 202   if (gimple_call_builtin_p (stmt, BUILT_IN_ALLOCA_WITH_ALIGN_AND_MAX))
 203     {
 204       tree arg = gimple_call_arg (stmt, 2);
 205       if (compare_tree_int (arg, max_size) <= 0)
 206         ret = alloca_type_and_limit (ALLOCA_OK);
 207       else
 208         {
 209           const offset_int maxobjsize
 210             = wi::to_offset (max_object_size ());
 211           alloca_type result = (max_size < maxobjsize
 212                                 ? ALLOCA_BOUND_MAYBE_LARGE : ALLOCA_OK);
 213           ret = alloca_type_and_limit (result, wi::to_wide (arg));
 214         }
 215       return ret;
 216     }
 217
 218   // If the user specified a limit, use it.
 219   int_range_max r;
 220   if (warn_limit_specified_p (is_vla)
 221       && TREE_CODE (len) == SSA_NAME
 222       && query.range_of_expr (r, len, stmt)
 223       && !r.varying_p ())
 224     {
 225       // The invalid bits are anything outside of [0, MAX_SIZE].
 226       static int_range<2> invalid_range (build_int_cst (size_type_node, 0),
 227                                          build_int_cst (size_type_node,
 228                                                         max_size),
 229                                          VR_ANTI_RANGE);
 230
 231       r.intersect (invalid_range);
 232       if (r.undefined_p ())
 233         return alloca_type_and_limit (ALLOCA_OK);
 234
 235       return alloca_type_and_limit (ALLOCA_BOUND_MAYBE_LARGE,
 236                                     wi::to_wide (integer_zero_node));
 237     }
 238
 239   const offset_int maxobjsize = tree_to_shwi (max_object_size ());
 240   /* When MAX_SIZE is greater than or equal to PTRDIFF_MAX treat
 241      allocations that aren't visibly constrained as OK, otherwise
 242      report them as (potentially) unbounded.  */
 243   alloca_type unbounded_result = (max_size < maxobjsize.to_uhwi ()
 244                                   ? ALLOCA_UNBOUNDED : ALLOCA_OK);
 245   return alloca_type_and_limit (unbounded_result);
 246 }
 247
 248 // Return TRUE if STMT is in a loop, otherwise return FALSE.
 249
 250 static bool
 251 in_loop_p (gimple *stmt)
 252 {
 253   basic_block bb = gimple_bb (stmt);
 254   return
 255     bb->loop_father && bb->loop_father->header != ENTRY_BLOCK_PTR_FOR_FN (cfun);
 256 }
 257
 258 unsigned int
 259 pass_walloca::execute (function *fun)
 260 {
 261   gimple_ranger ranger;
 262   basic_block bb;
 263   FOR_EACH_BB_FN (bb, fun)
 264     {
 265       for (gimple_stmt_iterator si = gsi_start_bb (bb); !gsi_end_p (si);
 266            gsi_next (&si))
 267         {
 268           gimple *stmt = gsi_stmt (si);
 269           if (!gimple_alloca_call_p (stmt))
 270             continue;
 271
 272           location_t loc = gimple_nonartificial_location (stmt);
 273           loc = expansion_point_location_if_in_system_header (loc);
 274
 275           const bool is_vla
 276             = gimple_call_alloca_for_var_p (as_a <gcall *> (stmt));
 277
 278           // Strict mode whining for VLAs is handled by the front-end,
 279           // so we can safely ignore this case.  Also, ignore VLAs if
 280           // the user doesn't care about them.
 281           if (is_vla)
 282             {
 283               if (warn_vla > 0 || warn_vla_limit < 0)
 284                 continue;
 285             }
 286           else if (warn_alloca)
 287             {
 288               warning_at (loc, OPT_Walloca, "%Guse of %<alloca%>", stmt);
 289               continue;
 290             }
 291           else if (warn_alloca_limit < 0)
 292             continue;
 293
 294           class alloca_type_and_limit t
 295             = alloca_call_type (ranger, stmt, is_vla);
 296
 297           unsigned HOST_WIDE_INT adjusted_alloca_limit
 298             = adjusted_warn_limit (false);
 299           // Even if we think the alloca call is OK, make sure it's not in a
 300           // loop, except for a VLA, since VLAs are guaranteed to be cleaned
 301           // up when they go out of scope, including in a loop.
 302           if (t.type == ALLOCA_OK && !is_vla && in_loop_p (stmt))
 303             {
 304               /* As in other instances, only diagnose this when the limit
 305                  is less than the maximum valid object size.  */
 306               const offset_int maxobjsize
 307                 = wi::to_offset (max_object_size ());
 308               if (adjusted_alloca_limit < maxobjsize.to_uhwi ())
 309                 t = alloca_type_and_limit (ALLOCA_IN_LOOP);
 310             }
 311
 312           enum opt_code wcode
 313             = is_vla ? OPT_Wvla_larger_than_ : OPT_Walloca_larger_than_;
 314           char buff[WIDE_INT_MAX_PRECISION / 4 + 4];
 315           switch (t.type)
 316             {
 317             case ALLOCA_OK:
 318               break;
 319             case ALLOCA_BOUND_MAYBE_LARGE:
 320               {
 321                 auto_diagnostic_group d;
 322                 if (warning_at (loc, wcode,
 323                                 (is_vla
 324                                  ? G_("%Gargument to variable-length "
 325                                       "array may be too large")
 326                                  : G_("%Gargument to %<alloca%> may be too "
 327                                       "large")),
 328                                 stmt)
 329                     && t.limit != 0)
 330                   {
 331                     print_decu (t.limit, buff);
 332                     inform (loc, "limit is %wu bytes, but argument "
 333                                  "may be as large as %s",
 334                             is_vla ? warn_vla_limit : adjusted_alloca_limit,
 335                             buff);
 336                   }
 337               }
 338               break;
 339             case ALLOCA_BOUND_DEFINITELY_LARGE:
 340               {
 341                 auto_diagnostic_group d;
 342                 if (warning_at (loc, wcode,
 343                                 (is_vla
 344                                  ? G_("%Gargument to variable-length"
 345                                       " array is too large")
 346                                  : G_("%Gargument to %<alloca%> is too large")),
 347                                 stmt)
 348                     && t.limit != 0)
 349                   {
 350                     print_decu (t.limit, buff);
 351                     inform (loc, "limit is %wu bytes, but argument is %s",
 352                             is_vla ? warn_vla_limit : adjusted_alloca_limit,
 353                             buff);
 354                   }
 355               }
 356               break;
 357             case ALLOCA_UNBOUNDED:
 358               warning_at (loc, wcode,
 359                           (is_vla
 360                            ? G_("%Gunbounded use of variable-length array")
 361                            : G_("%Gunbounded use of %<alloca%>")),
 362                           stmt);
 363               break;
 364             case ALLOCA_IN_LOOP:
 365               gcc_assert (!is_vla);
 366               warning_at (loc, wcode,
 367                           "%Guse of %<alloca%> within a loop", stmt);
 368               break;
 369             case ALLOCA_ARG_IS_ZERO:
 370               warning_at (loc, wcode,
 371                           (is_vla
 372                            ? G_("%Gargument to variable-length array "
 373                                 "is zero")
 374                            : G_("%Gargument to %<alloca%> is zero")),
 375                           stmt);
 376               break;
 377             default:
 378               gcc_unreachable ();
 379             }
 380         }
 381     }
 382   return 0;
 383 }
 384
 385 gimple_opt_pass *
 386 make_pass_walloca (gcc::context *ctxt)
 387 {
 388   return new pass_walloca (ctxt);
 389 }