Re: Treat macro call like ordinary functions in smatch.

Oh, may I ask how to do that with Smatch?

My pipeline is like this

1. Run syzkaller to have all the uncovered branches.
2. Extract conditions from these branch
3. Use dataflow/manual analysis to analyze these condition.

I am kind of still in step 2, and I want to see what these conditions
look like before deciding to use Smatch or something else.
That's why I am trying to hook stuff with "WHOLE_CONDITION_HOOK" as
it's more friendly to manual analysis.

To switch the topic a little bit, is there any plan to add documents of Sma=
tch?
I'd like to get involved as I am also using it for my own project.

Sorry if I am a bit annoying and keep asking questions.

Best,
Hongyi


Dan Carpenter <[email protected]> =E4=BA=8E 2024=E5=B9=B46=E6=9C=882=
0=E6=97=A5=E5=91=A8=E5=9B=9B 20:33=E5=86=99=E9=81=93=EF=BC=9A
>
> On Thu, Jun 20, 2024 at 08:10:06PM +0800, Hongyi Lu wrote:
> > Oh, thank you for the suggestions.
> >
> > I'll give CONDITION_HOOK a try. It's just that I really need to know th=
e
> > "source location" of the condition so the WHOLE_CONDITION_HOOK makes su=
re
> > composited conditions like A and B in (A && B) appear together.
>
> I mean, if you want to and it's working then that's great.  But
> generally we wouldn't want to differentiate between:
>
> ONE:
>         if (A && B)
>                 return;
> TWO:
>         if (A) {
>                 if (B)
>                         return;
>         }
>
> I guess, what I'm imagining you want is something like this.  How is
> some_function() reachable from the user?
>
> int driver_ioctl(...)
> {
>
>         if (!foo)
>                 return -EINVAL;
>         if (bar)
>                 return -EINVAL;
>
>         return some_function();
> }
>
> If we did something like stored conditions we could make a list of all
> the conditions which are true and which are false when we call
> some_function().
>
> regards,
> dan carpenter
>