Re: Retrieving status of local variables

[Dan Carpenter <dan.carpenter@oracle.com>]

On Wed, May 12, 2021 at 08:13:59PM +0300, Dan Carpenter wrote:
> On Wed, May 12, 2021 at 05:15:06PM +0200, Norbert Manthey wrote:
> > Dear all,
> > 
> > I would like to retrieve the information whether variables inside source
> > files can be influenced from user land, e.g. to identify variables that
> > store arguments to syscalls. Is there already a tool that offers this
> > feature?
> > 
> > I understand that the 'smatch_data/db/smdb.py $func' tool can be used to
> > trace calls to a function $func. Furthermore, 'smatch_data/db/smdb.py
> > trace_param $func' allows to trace how function parameters are traced.
> > However, both commands do not present the information I am looking for.
> > I also did not find such labels in the tables of the created data base file.
> 
> Yes.  This is information is recorded in the DB.
> 
> $ smdb esas2r_read_vda | grep USER
> drivers/scsi/esas2r/esas2r_ioctl.c | esas2r_ioctl_handler |      esas2r_read_vda |          USER_DATA |  3 |           count | s32min-s32max
> 
> The s32min-s32max is the range the user can set it to.  Smatch tracks
> tagged pointers in ARM but I didn't write that code and don't remember
> the details.  If the data is capped against an unknown value then there
> would be a [c] "s32min-s32max[c]"
> 
> 	if (foo < 100)
> 		<-- foo is "s32min-99[c]"

I don't know why I put a [c] here.  That would not be capped, because
99 is a known limit.  Capped is only for when it's capped to an unknown
limit.
> 
> 	if (foo < x)
> 		<-- foo is "s32min-s32max[c]"

regards,
dan carpenter