]>
Commit | Line | Data |
---|---|---|
adc577c5 | 1 | /* Warn on problematic uses of alloca and variable length arrays. |
a945c346 | 2 | Copyright (C) 2016-2024 Free Software Foundation, Inc. |
adc577c5 AH |
3 | Contributed by Aldy Hernandez <aldyh@redhat.com>. |
4 | ||
5 | This file is part of GCC. | |
6 | ||
7 | GCC is free software; you can redistribute it and/or modify it under | |
8 | the terms of the GNU General Public License as published by the Free | |
9 | Software Foundation; either version 3, or (at your option) any later | |
10 | version. | |
11 | ||
12 | GCC is distributed in the hope that it will be useful, but WITHOUT ANY | |
13 | WARRANTY; without even the implied warranty of MERCHANTABILITY or | |
14 | FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License | |
15 | for more details. | |
16 | ||
17 | You should have received a copy of the GNU General Public License | |
18 | along with GCC; see the file COPYING3. If not see | |
19 | <http://www.gnu.org/licenses/>. */ | |
20 | ||
21 | #include "config.h" | |
22 | #include "system.h" | |
23 | #include "coretypes.h" | |
24 | #include "backend.h" | |
25 | #include "tree.h" | |
26 | #include "gimple.h" | |
27 | #include "tree-pass.h" | |
28 | #include "ssa.h" | |
29 | #include "gimple-pretty-print.h" | |
30 | #include "diagnostic-core.h" | |
31 | #include "fold-const.h" | |
32 | #include "gimple-iterator.h" | |
33 | #include "tree-ssa.h" | |
adc577c5 | 34 | #include "tree-cfg.h" |
00abf86c | 35 | #include "builtins.h" |
adc577c5 AH |
36 | #include "calls.h" |
37 | #include "cfgloop.h" | |
38 | #include "intl.h" | |
495ec0b2 | 39 | #include "gimple-range.h" |
adc577c5 | 40 | |
0aaafa5e MS |
41 | static unsigned HOST_WIDE_INT adjusted_warn_limit (bool); |
42 | ||
adc577c5 AH |
43 | const pass_data pass_data_walloca = { |
44 | GIMPLE_PASS, | |
45 | "walloca", | |
46 | OPTGROUP_NONE, | |
47 | TV_NONE, | |
48 | PROP_cfg, // properties_required | |
49 | 0, // properties_provided | |
50 | 0, // properties_destroyed | |
51 | 0, // properties_start | |
52 | 0, // properties_finish | |
53 | }; | |
54 | ||
55 | class pass_walloca : public gimple_opt_pass | |
56 | { | |
57 | public: | |
58 | pass_walloca (gcc::context *ctxt) | |
f974b54b | 59 | : gimple_opt_pass(pass_data_walloca, ctxt), xlimit_certain_p (false) |
adc577c5 | 60 | {} |
725793af DM |
61 | opt_pass *clone () final override { return new pass_walloca (m_ctxt); } |
62 | void set_pass_param (unsigned int n, bool param) final override | |
adc577c5 AH |
63 | { |
64 | gcc_assert (n == 0); | |
f974b54b MS |
65 | // Set to true to enable only warnings for alloca calls that |
66 | // are certainly in excess of the limit. This includes calls | |
67 | // with constant arguments but excludes those in ranges (that | |
68 | // can only be determined by range analysis) as well as | |
69 | // the "may be too large" kind. | |
70 | xlimit_certain_p = param; | |
adc577c5 | 71 | } |
725793af DM |
72 | bool gate (function *) final override; |
73 | unsigned int execute (function *) final override; | |
adc577c5 AH |
74 | |
75 | private: | |
76 | // Set to TRUE the first time we run this pass on a function. | |
f974b54b | 77 | bool xlimit_certain_p; |
adc577c5 AH |
78 | }; |
79 | ||
80 | bool | |
81 | pass_walloca::gate (function *fun ATTRIBUTE_UNUSED) | |
82 | { | |
00abf86c MS |
83 | // Warning is disabled when its size limit is greater than PTRDIFF_MAX |
84 | // for the target maximum, which makes the limit negative since when | |
85 | // represented in signed HOST_WIDE_INT. | |
0aaafa5e MS |
86 | unsigned HOST_WIDE_INT max = tree_to_uhwi (TYPE_MAX_VALUE (ptrdiff_type_node)); |
87 | return (adjusted_warn_limit (false) <= max | |
88 | || adjusted_warn_limit (true) <= max); | |
adc577c5 AH |
89 | } |
90 | ||
91 | // Possible problematic uses of alloca. | |
92 | enum alloca_type { | |
93 | // Alloca argument is within known bounds that are appropriate. | |
94 | ALLOCA_OK, | |
95 | ||
96 | // Alloca argument is KNOWN to have a value that is too large. | |
97 | ALLOCA_BOUND_DEFINITELY_LARGE, | |
98 | ||
99 | // Alloca argument may be too large. | |
100 | ALLOCA_BOUND_MAYBE_LARGE, | |
101 | ||
adc577c5 AH |
102 | // Alloca appears in a loop. |
103 | ALLOCA_IN_LOOP, | |
104 | ||
105 | // Alloca argument is 0. | |
106 | ALLOCA_ARG_IS_ZERO, | |
107 | ||
108 | // Alloca call is unbounded. That is, there is no controlling | |
109 | // predicate for its argument. | |
110 | ALLOCA_UNBOUNDED | |
111 | }; | |
112 | ||
113 | // Type of an alloca call with its corresponding limit, if applicable. | |
6c1dae73 MS |
114 | class alloca_type_and_limit { |
115 | public: | |
adc577c5 AH |
116 | enum alloca_type type; |
117 | // For ALLOCA_BOUND_MAYBE_LARGE and ALLOCA_BOUND_DEFINITELY_LARGE | |
118 | // types, this field indicates the assumed limit if known or | |
119 | // integer_zero_node if unknown. For any other alloca types, this | |
120 | // field is undefined. | |
121 | wide_int limit; | |
122 | alloca_type_and_limit (); | |
123 | alloca_type_and_limit (enum alloca_type type, | |
124 | wide_int i) : type(type), limit(i) { } | |
bb753cad | 125 | alloca_type_and_limit (enum alloca_type type) : type(type) |
3e350d85 JJ |
126 | { |
127 | limit = wi::to_wide (integer_zero_node); | |
bb753cad | 128 | } |
adc577c5 AH |
129 | }; |
130 | ||
495ec0b2 AH |
131 | /* Return TRUE if the user specified a limit for either VLAs or ALLOCAs. */ |
132 | ||
133 | static bool | |
134 | warn_limit_specified_p (bool is_vla) | |
135 | { | |
136 | unsigned HOST_WIDE_INT max = is_vla ? warn_vla_limit : warn_alloca_limit; | |
137 | return max != HOST_WIDE_INT_MAX; | |
138 | } | |
139 | ||
0aaafa5e MS |
140 | /* Return the value of the argument N to -Walloca-larger-than= or |
141 | -Wvla-larger-than= adjusted for the target data model so that | |
142 | when N == HOST_WIDE_INT_MAX, the adjusted value is set to | |
143 | PTRDIFF_MAX on the target. This is done to prevent warnings | |
144 | for unknown/unbounded allocations in the "permissive mode" | |
145 | while still diagnosing excessive and necessarily invalid | |
146 | allocations. */ | |
147 | ||
148 | static unsigned HOST_WIDE_INT | |
149 | adjusted_warn_limit (bool idx) | |
150 | { | |
151 | static HOST_WIDE_INT limits[2]; | |
152 | if (limits[idx]) | |
153 | return limits[idx]; | |
154 | ||
155 | limits[idx] = idx ? warn_vla_limit : warn_alloca_limit; | |
156 | if (limits[idx] != HOST_WIDE_INT_MAX) | |
157 | return limits[idx]; | |
158 | ||
159 | limits[idx] = tree_to_shwi (TYPE_MAX_VALUE (ptrdiff_type_node)); | |
160 | return limits[idx]; | |
161 | } | |
162 | ||
adc577c5 AH |
163 | // Analyze the alloca call in STMT and return the alloca type with its |
164 | // corresponding limit (if applicable). IS_VLA is set if the alloca | |
9e878cf1 | 165 | // call was created by the gimplifier for a VLA. |
adc577c5 | 166 | |
99b1c316 | 167 | static class alloca_type_and_limit |
fe9a499c | 168 | alloca_call_type (gimple *stmt, bool is_vla) |
adc577c5 AH |
169 | { |
170 | gcc_assert (gimple_alloca_call_p (stmt)); | |
171 | tree len = gimple_call_arg (stmt, 0); | |
adc577c5 | 172 | |
00abf86c MS |
173 | gcc_assert (!is_vla || warn_vla_limit >= 0); |
174 | gcc_assert (is_vla || warn_alloca_limit >= 0); | |
adc577c5 AH |
175 | |
176 | // Adjust warn_alloca_max_size for VLAs, by taking the underlying | |
177 | // type into account. | |
0aaafa5e | 178 | unsigned HOST_WIDE_INT max_size = adjusted_warn_limit (is_vla); |
adc577c5 AH |
179 | |
180 | // Check for the obviously bounded case. | |
181 | if (TREE_CODE (len) == INTEGER_CST) | |
182 | { | |
183 | if (tree_to_uhwi (len) > max_size) | |
8e6cdc90 RS |
184 | return alloca_type_and_limit (ALLOCA_BOUND_DEFINITELY_LARGE, |
185 | wi::to_wide (len)); | |
adc577c5 | 186 | if (integer_zerop (len)) |
00abf86c MS |
187 | { |
188 | const offset_int maxobjsize | |
189 | = wi::to_offset (max_object_size ()); | |
190 | alloca_type result = (max_size < maxobjsize | |
191 | ? ALLOCA_ARG_IS_ZERO : ALLOCA_OK); | |
192 | return alloca_type_and_limit (result); | |
193 | } | |
9e878cf1 EB |
194 | |
195 | return alloca_type_and_limit (ALLOCA_OK); | |
adc577c5 | 196 | } |
9e878cf1 | 197 | |
495ec0b2 | 198 | struct alloca_type_and_limit ret = alloca_type_and_limit (ALLOCA_OK); |
9e878cf1 | 199 | // If we have a declared maximum size, we can take it into account. |
495ec0b2 | 200 | if (gimple_call_builtin_p (stmt, BUILT_IN_ALLOCA_WITH_ALIGN_AND_MAX)) |
9e878cf1 EB |
201 | { |
202 | tree arg = gimple_call_arg (stmt, 2); | |
203 | if (compare_tree_int (arg, max_size) <= 0) | |
204 | ret = alloca_type_and_limit (ALLOCA_OK); | |
205 | else | |
00abf86c MS |
206 | { |
207 | const offset_int maxobjsize | |
208 | = wi::to_offset (max_object_size ()); | |
209 | alloca_type result = (max_size < maxobjsize | |
210 | ? ALLOCA_BOUND_MAYBE_LARGE : ALLOCA_OK); | |
211 | ret = alloca_type_and_limit (result, wi::to_wide (arg)); | |
212 | } | |
495ec0b2 AH |
213 | return ret; |
214 | } | |
215 | ||
216 | // If the user specified a limit, use it. | |
217 | int_range_max r; | |
218 | if (warn_limit_specified_p (is_vla) | |
219 | && TREE_CODE (len) == SSA_NAME | |
9948daa4 | 220 | && types_compatible_p (TREE_TYPE (len), size_type_node) |
fe9a499c | 221 | && get_range_query (cfun)->range_of_expr (r, len, stmt) |
495ec0b2 AH |
222 | && !r.varying_p ()) |
223 | { | |
224 | // The invalid bits are anything outside of [0, MAX_SIZE]. | |
178abeca | 225 | int_range<2> invalid_range (size_type_node, |
cb779afe AH |
226 | wi::shwi (0, TYPE_PRECISION (size_type_node)), |
227 | wi::shwi (max_size, TYPE_PRECISION (size_type_node)), | |
fa3ccf8b | 228 | VR_ANTI_RANGE); |
495ec0b2 AH |
229 | |
230 | r.intersect (invalid_range); | |
231 | if (r.undefined_p ()) | |
232 | return alloca_type_and_limit (ALLOCA_OK); | |
233 | ||
234 | return alloca_type_and_limit (ALLOCA_BOUND_MAYBE_LARGE, | |
235 | wi::to_wide (integer_zero_node)); | |
adc577c5 AH |
236 | } |
237 | ||
495ec0b2 AH |
238 | const offset_int maxobjsize = tree_to_shwi (max_object_size ()); |
239 | /* When MAX_SIZE is greater than or equal to PTRDIFF_MAX treat | |
240 | allocations that aren't visibly constrained as OK, otherwise | |
241 | report them as (potentially) unbounded. */ | |
242 | alloca_type unbounded_result = (max_size < maxobjsize.to_uhwi () | |
243 | ? ALLOCA_UNBOUNDED : ALLOCA_OK); | |
244 | return alloca_type_and_limit (unbounded_result); | |
adc577c5 AH |
245 | } |
246 | ||
9e878cf1 | 247 | // Return TRUE if STMT is in a loop, otherwise return FALSE. |
adc577c5 AH |
248 | |
249 | static bool | |
9e878cf1 | 250 | in_loop_p (gimple *stmt) |
adc577c5 AH |
251 | { |
252 | basic_block bb = gimple_bb (stmt); | |
9e878cf1 EB |
253 | return |
254 | bb->loop_father && bb->loop_father->header != ENTRY_BLOCK_PTR_FOR_FN (cfun); | |
adc577c5 AH |
255 | } |
256 | ||
257 | unsigned int | |
258 | pass_walloca::execute (function *fun) | |
259 | { | |
e11533e2 | 260 | enable_ranger (fun); |
adc577c5 AH |
261 | basic_block bb; |
262 | FOR_EACH_BB_FN (bb, fun) | |
263 | { | |
264 | for (gimple_stmt_iterator si = gsi_start_bb (bb); !gsi_end_p (si); | |
265 | gsi_next (&si)) | |
266 | { | |
267 | gimple *stmt = gsi_stmt (si); | |
adc577c5 AH |
268 | if (!gimple_alloca_call_p (stmt)) |
269 | continue; | |
adc577c5 | 270 | |
b5228b1b MS |
271 | location_t loc = gimple_nonartificial_location (stmt); |
272 | loc = expansion_point_location_if_in_system_header (loc); | |
273 | ||
9e878cf1 EB |
274 | const bool is_vla |
275 | = gimple_call_alloca_for_var_p (as_a <gcall *> (stmt)); | |
adc577c5 AH |
276 | |
277 | // Strict mode whining for VLAs is handled by the front-end, | |
278 | // so we can safely ignore this case. Also, ignore VLAs if | |
279 | // the user doesn't care about them. | |
00abf86c | 280 | if (is_vla) |
adc577c5 | 281 | { |
00abf86c MS |
282 | if (warn_vla > 0 || warn_vla_limit < 0) |
283 | continue; | |
284 | } | |
285 | else if (warn_alloca) | |
286 | { | |
6d3bab5d | 287 | warning_at (loc, OPT_Walloca, "use of %<alloca%>"); |
adc577c5 AH |
288 | continue; |
289 | } | |
00abf86c MS |
290 | else if (warn_alloca_limit < 0) |
291 | continue; | |
adc577c5 | 292 | |
99b1c316 | 293 | class alloca_type_and_limit t |
fe9a499c | 294 | = alloca_call_type (stmt, is_vla); |
adc577c5 | 295 | |
0aaafa5e MS |
296 | unsigned HOST_WIDE_INT adjusted_alloca_limit |
297 | = adjusted_warn_limit (false); | |
9e878cf1 EB |
298 | // Even if we think the alloca call is OK, make sure it's not in a |
299 | // loop, except for a VLA, since VLAs are guaranteed to be cleaned | |
300 | // up when they go out of scope, including in a loop. | |
301 | if (t.type == ALLOCA_OK && !is_vla && in_loop_p (stmt)) | |
00abf86c MS |
302 | { |
303 | /* As in other instances, only diagnose this when the limit | |
304 | is less than the maximum valid object size. */ | |
305 | const offset_int maxobjsize | |
306 | = wi::to_offset (max_object_size ()); | |
0aaafa5e | 307 | if (adjusted_alloca_limit < maxobjsize.to_uhwi ()) |
00abf86c MS |
308 | t = alloca_type_and_limit (ALLOCA_IN_LOOP); |
309 | } | |
adc577c5 AH |
310 | |
311 | enum opt_code wcode | |
312 | = is_vla ? OPT_Wvla_larger_than_ : OPT_Walloca_larger_than_; | |
0d00385e | 313 | char buff[WIDE_INT_MAX_INL_PRECISION / 4 + 4]; |
adc577c5 AH |
314 | switch (t.type) |
315 | { | |
316 | case ALLOCA_OK: | |
317 | break; | |
318 | case ALLOCA_BOUND_MAYBE_LARGE: | |
097f82ec | 319 | { |
f974b54b MS |
320 | if (xlimit_certain_p) |
321 | break; | |
322 | ||
097f82ec DM |
323 | auto_diagnostic_group d; |
324 | if (warning_at (loc, wcode, | |
b5228b1b | 325 | (is_vla |
6d3bab5d | 326 | ? G_("argument to variable-length " |
b5228b1b | 327 | "array may be too large") |
6d3bab5d MS |
328 | : G_("argument to %<alloca%> may be too " |
329 | "large"))) | |
097f82ec DM |
330 | && t.limit != 0) |
331 | { | |
0d00385e | 332 | gcc_assert (t.limit.get_len () < WIDE_INT_MAX_INL_ELTS); |
097f82ec | 333 | print_decu (t.limit, buff); |
723a52f9 JJ |
334 | inform (loc, "limit is %wu bytes, but argument " |
335 | "may be as large as %s", | |
0aaafa5e MS |
336 | is_vla ? warn_vla_limit : adjusted_alloca_limit, |
337 | buff); | |
097f82ec DM |
338 | } |
339 | } | |
adc577c5 AH |
340 | break; |
341 | case ALLOCA_BOUND_DEFINITELY_LARGE: | |
097f82ec DM |
342 | { |
343 | auto_diagnostic_group d; | |
344 | if (warning_at (loc, wcode, | |
b5228b1b | 345 | (is_vla |
6d3bab5d | 346 | ? G_("argument to variable-length" |
b5228b1b | 347 | " array is too large") |
6d3bab5d | 348 | : G_("argument to %<alloca%> is too large"))) |
097f82ec DM |
349 | && t.limit != 0) |
350 | { | |
0d00385e | 351 | gcc_assert (t.limit.get_len () < WIDE_INT_MAX_INL_ELTS); |
097f82ec | 352 | print_decu (t.limit, buff); |
723a52f9 | 353 | inform (loc, "limit is %wu bytes, but argument is %s", |
b5228b1b MS |
354 | is_vla ? warn_vla_limit : adjusted_alloca_limit, |
355 | buff); | |
097f82ec DM |
356 | } |
357 | } | |
adc577c5 | 358 | break; |
adc577c5 | 359 | case ALLOCA_UNBOUNDED: |
f974b54b MS |
360 | if (xlimit_certain_p) |
361 | break; | |
362 | ||
adc577c5 | 363 | warning_at (loc, wcode, |
b5228b1b | 364 | (is_vla |
6d3bab5d MS |
365 | ? G_("unbounded use of variable-length array") |
366 | : G_("unbounded use of %<alloca%>"))); | |
adc577c5 AH |
367 | break; |
368 | case ALLOCA_IN_LOOP: | |
369 | gcc_assert (!is_vla); | |
b5228b1b | 370 | warning_at (loc, wcode, |
6d3bab5d | 371 | "use of %<alloca%> within a loop"); |
adc577c5 | 372 | break; |
adc577c5 AH |
373 | case ALLOCA_ARG_IS_ZERO: |
374 | warning_at (loc, wcode, | |
b5228b1b | 375 | (is_vla |
6d3bab5d | 376 | ? G_("argument to variable-length array " |
b5228b1b | 377 | "is zero") |
6d3bab5d | 378 | : G_("argument to %<alloca%> is zero"))); |
adc577c5 AH |
379 | break; |
380 | default: | |
381 | gcc_unreachable (); | |
382 | } | |
383 | } | |
384 | } | |
fe9a499c | 385 | disable_ranger (fun); |
adc577c5 AH |
386 | return 0; |
387 | } | |
388 | ||
389 | gimple_opt_pass * | |
390 | make_pass_walloca (gcc::context *ctxt) | |
391 | { | |
392 | return new pass_walloca (ctxt); | |
393 | } |