From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from aserp2120.oracle.com ([141.146.126.78]:38778 "EHLO aserp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1358151AbhELSm7 (ORCPT ); Wed, 12 May 2021 14:42:59 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : in-reply-to; s=corp-2020-01-29; bh=Zw+X49itU1fOKPzYUNNipEEQbtmfR67XEHWjjdsVt+A=; b=LnuqipKvsI4GeGMKZtuNLL3yHgBU/V2KISfQBteV2KA4UL/EVzSLyL5TFXZJDhpmijjE x3Ji0Fv8eaRaKdBWoulmAezDaPPfgMQeJReOZQ4YPq2IzDPYMjxcpnfQ3zCchPQcFw3e efYqMOZZdqziQC//OkPTDcujf+A316iFMAKnbxfwkbtVRf6/s++ISkgoamSbXmY2+pVk GnyQ3n13j4Zc+UPHtg9uOCPVw/CVoUzTMgAM5n31PNs4B838obkSVps8Mok/wnRWnpWQ szsPylvXRv6RSs3Wljqx1eIVVOQ3ePcr3gK9z6+/awIp/cFPJ+JEH4Mg0C+ly8Yh6D9e dw== Date: Wed, 12 May 2021 21:41:36 +0300 From: Dan Carpenter Subject: Re: Retrieving status of local variables Message-ID: <20210512184136.GD1922@kadam> References: <20210512171358.GY1955@kadam> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210512171358.GY1955@kadam> List-ID: To: Norbert Manthey Cc: smatch@vger.kernel.org On Wed, May 12, 2021 at 08:13:59PM +0300, Dan Carpenter wrote: > On Wed, May 12, 2021 at 05:15:06PM +0200, Norbert Manthey wrote: > > Dear all, > > > > I would like to retrieve the information whether variables inside source > > files can be influenced from user land, e.g. to identify variables that > > store arguments to syscalls. Is there already a tool that offers this > > feature? > > > > I understand that the 'smatch_data/db/smdb.py $func' tool can be used to > > trace calls to a function $func. Furthermore, 'smatch_data/db/smdb.py > > trace_param $func' allows to trace how function parameters are traced. > > However, both commands do not present the information I am looking for. > > I also did not find such labels in the tables of the created data base file. > > Yes. This is information is recorded in the DB. > > $ smdb esas2r_read_vda | grep USER > drivers/scsi/esas2r/esas2r_ioctl.c | esas2r_ioctl_handler | esas2r_read_vda | USER_DATA | 3 | count | s32min-s32max > > The s32min-s32max is the range the user can set it to. Smatch tracks > tagged pointers in ARM but I didn't write that code and don't remember > the details. If the data is capped against an unknown value then there > would be a [c] "s32min-s32max[c]" > > if (foo < 100) > <-- foo is "s32min-99[c]" I don't know why I put a [c] here. That would not be capped, because 99 is a known limit. Capped is only for when it's capped to an unknown limit. > > if (foo < x) > <-- foo is "s32min-s32max[c]" regards, dan carpenter