[Bug] DDG ERROR when parse vma->vm_file->private_data

[hac425xxx]

code

https://github.com/torvalds/linux/blob/master/drivers/hwtracing/intel_th/msu.c#L1585

static void msc_mmap_open(struct vm_area_struct *vma)
{
	struct msc_iter *iter = vma->vm_file->private_data;
	struct msc *msc = iter->msc;

	atomic_inc(&msc->mmap_count);
}

the ddg

the dataflow from vma->vm_file to vma->vm_file->private_data is missed.

example sc

var src = m.parameter
var sink = cpg.call.argument
sink.reachableByFlows(src).p

result

  """
┌─────────────────┬─────────────────────────────────────────┬────┬─────────────┬─────┐
│nodeType         │tracked                                  │line│method       │file │
├─────────────────┼─────────────────────────────────────────┼────┼─────────────┼─────┤
│MethodParameterIn│msc_mmap_open(struct vm_area_struct *vma)│1583│msc_mmap_open│msu.c│
│Call             │*iter = vma->vm_file->private_data       │1585│msc_mmap_open│msu.c│
└─────────────────┴─────────────────────────────────────────┴────┴─────────────┴─────┘""",
  """
┌─────────────────┬─────────────────────────────────────────┬────┬─────────────┬─────┐
│nodeType         │tracked                                  │line│method       │file │
├─────────────────┼─────────────────────────────────────────┼────┼─────────────┼─────┤
│MethodParameterIn│msc_mmap_open(struct vm_area_struct *vma)│1583│msc_mmap_open│msu.c│
│Identifier       │*iter = vma->vm_file->private_data       │1585│msc_mmap_open│msu.c│
└─────────────────┴─────────────────────────────────────────┴────┴─────────────┴─────┘"""

[hac425xxx]

path from vma->vm_file->private_data is work

var m = cpg.method.name("msc_mmap_open").next()
var src = cpg.call.filter(_.method.name == "msc_mmap_open").filter(_.name == "<operator>.indirectFieldAccess").code(".*vma.*")
var sink = cpg.call.filter(_.method.name == "msc_mmap_open").filter(_.name == "atomic_inc")
sink.reachableByFlows(src).p

result

  """
┌──────────┬──────────────────────────────────┬────┬─────────────┬─────┐
│nodeType  │tracked                           │line│method       │file │
├──────────┼──────────────────────────────────┼────┼─────────────┼─────┤
│Call      │*iter = vma->vm_file->private_data│1585│msc_mmap_open│msu.c│
│Identifier│*iter = vma->vm_file->private_data│1585│msc_mmap_open│msu.c│
│Call      │*msc = iter->msc                  │1586│msc_mmap_open│msu.c│
│Identifier│*msc = iter->msc                  │1586│msc_mmap_open│msu.c│
│Call      │atomic_inc(&msc->mmap_count)      │1588│msc_mmap_open│msu.c│
│Call      │atomic_inc(&msc->mmap_count)      │1588│msc_mmap_open│msu.c│
└──────────┴──────────────────────────────────┴────┴─────────────┴─────┘"""

[hac425xxx]

it seems is the bug when process indirectFieldAccess, I try to make it generate to call custom_xxxx

      case IASTBinaryExpression.op_pmdot            => "custom_xxxx"
      case IASTBinaryExpression.op_pmarrow          => "custom_xxxx"

the dataflow seems fine.

  """_________________________________________________________________________________________
| nodeType          | tracked                        | lineNumber| method        | file  |
|========================================================================================|
| MethodParameterIn | msc_mmap_open(struct vm_are... | 1583      | msc_mmap_open | msu.c |
| Identifier        | vma->vm_file                   | 1585      | msc_mmap_open | msu.c |
| Call              | vma->vm_file                   | 1585      | msc_mmap_open | msu.c |
| Call              | vma->vm_file->private_data     | 1585      | msc_mmap_open | msu.c |
| Identifier        | *iter = vma->vm_file->priva... | 1585      | msc_mmap_open | msu.c |
| Identifier        | iter->msc                      | 1586      | msc_mmap_open | msu.c |
| Call              | iter->msc                      | 1586      | msc_mmap_open | msu.c |
| Identifier        | *msc = iter->msc               | 1586      | msc_mmap_open | msu.c |
| Identifier        | msc->mmap_count                | 1588      | msc_mmap_open | msu.c |
| Call              | atomic_inc(&msc->mmap_count)   | 1588      | msc_mmap_open | msu.c |
""",

the ast graph

[hac425xxx]

make isGenericMemberAccessName always return false, the dataflow works.

diff --git a/semanticcpg/src/main/scala/io/shiftleft/semanticcpg/utils/MemberAccess.scala b/semanticcpg/src/main/scala/io/shiftleft/semanticcpg/utils/MemberAccess.scala
index d27f04c81..ff57bfd9d 100644
--- a/semanticcpg/src/main/scala/io/shiftleft/semanticcpg/utils/MemberAccess.scala
+++ b/semanticcpg/src/main/scala/io/shiftleft/semanticcpg/utils/MemberAccess.scala
@@ -20,6 +20,8 @@ object MemberAccess {
     (name == Operators.indirectIndexAccess) ||
     (name == Operators.pointerShift) ||
     (name == Operators.getElementPtr)
+    return false
+
   }