2 * smatch/check_user_data.c
4 * Copyright (C) 2011 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 * There are a couple checks that try to see if a variable
12 * comes from the user. It would be better to unify them
13 * into one place. Also it we should follow the data down
14 * the call paths. Hence this file.
18 #include "smatch_slist.h"
19 #include "smatch_extra.h"
26 static int is_user_macro(struct expression
*expr
)
31 static int is_skb_data(struct expression
*expr
)
38 name
= get_variable_from_expr(expr
, &sym
);
42 sym
= get_base_type(sym
);
43 if (!sym
|| sym
->type
!= SYM_PTR
)
45 sym
= get_base_type(sym
);
46 if (!sym
|| sym
->type
!= SYM_STRUCT
|| !sym
->ident
)
48 if (strcmp(sym
->ident
->name
, "sk_buff") != 0)
54 if (strcmp(name
+ len
- 6, "->data") == 0)
62 int is_user_data(struct expression
*expr
)
64 struct state_list
*slist
= NULL
;
76 if (is_user_macro(expr
))
78 if (is_skb_data(expr
))
81 expr
= strip_expr(expr
); /* this has to come after is_user_macro() */
83 if (expr
->type
== EXPR_BINOP
) {
84 if (is_user_data(expr
->left
))
86 if (is_user_data(expr
->right
))
90 if (expr
->type
== EXPR_PREOP
&& (expr
->op
== '&' || expr
->op
== '*'))
91 expr
= strip_expr(expr
->unop
);
93 tmp
= get_sm_state_expr(my_id
, expr
);
95 return slist_has_state(tmp
->possible
, &user_data
);
97 name
= get_variable_from_expr_complex(expr
, &sym
);
101 slist
= get_all_states(my_id
);
102 FOR_EACH_PTR(slist
, tmp
) {
105 if (!strncmp(tmp
->name
, name
, strlen(tmp
->name
))) {
106 if (slist_has_state(tmp
->possible
, &user_data
))
110 } END_FOR_EACH_PTR(tmp
);
118 void set_param_user_data(const char *name
, struct symbol
*sym
, char *key
, char *value
)
122 if (strncmp(key
, "$$", 2))
124 snprintf(fullname
, 256, "%s%s", name
, key
+ 2);
125 set_state(my_id
, fullname
, sym
, &user_data
);
128 static void match_condition(struct expression
*expr
)
133 case SPECIAL_UNSIGNED_LT
:
134 case SPECIAL_UNSIGNED_LTE
:
135 if (is_user_data(expr
->left
))
136 set_true_false_states_expr(my_id
, expr
->left
, &capped
, NULL
);
137 if (is_user_data(expr
->right
))
138 set_true_false_states_expr(my_id
, expr
->right
, NULL
, &capped
);
142 case SPECIAL_UNSIGNED_GT
:
143 case SPECIAL_UNSIGNED_GTE
:
144 if (is_user_data(expr
->right
))
145 set_true_false_states_expr(my_id
, expr
->right
, &capped
, NULL
);
146 if (is_user_data(expr
->left
))
147 set_true_false_states_expr(my_id
, expr
->left
, NULL
, &capped
);
150 if (is_user_data(expr
->left
))
151 set_true_false_states_expr(my_id
, expr
->left
, &capped
, NULL
);
152 if (is_user_data(expr
->right
))
153 set_true_false_states_expr(my_id
, expr
->right
, &capped
, NULL
);
155 case SPECIAL_NOTEQUAL
:
156 if (is_user_data(expr
->left
))
157 set_true_false_states_expr(my_id
, expr
->left
, NULL
, &capped
);
158 if (is_user_data(expr
->right
))
159 set_true_false_states_expr(my_id
, expr
->right
, NULL
, &capped
);
167 static void match_normal_assign(struct expression
*expr
)
169 if (is_user_data(expr
->left
))
170 set_state_expr(my_id
, expr
->left
, &capped
);
173 static void match_assign(struct expression
*expr
)
177 name
= get_macro_name(expr
->pos
);
178 if (!name
|| strcmp(name
, "get_user") != 0) {
179 match_normal_assign(expr
);
182 name
= get_variable_from_expr(expr
->right
, NULL
);
183 if (!name
|| strcmp(name
, "__val_gu") != 0)
185 set_state_expr(my_id
, expr
->left
, &user_data
);
190 static void match_user_copy(const char *fn
, struct expression
*expr
, void *_param
)
192 int param
= PTR_INT(_param
);
193 struct expression
*dest
;
195 dest
= get_argument_from_call_expr(expr
->args
, param
);
196 dest
= strip_expr(dest
);
199 /* the first thing I tested this on pass &foo to a function */
200 set_state_expr(my_id
, dest
, &user_data
);
201 if (dest
->type
== EXPR_PREOP
&& dest
->op
== '&') {
202 /* but normally I'd think it would pass the actual variable */
204 set_state_expr(my_id
, dest
, &user_data
);
208 static void match_user_assign_function(const char *fn
, struct expression
*expr
, void *unused
)
210 set_state_expr(my_id
, expr
->left
, &user_data
);
213 static void match_assign_userdata(struct expression
*expr
)
215 if (is_user_data(expr
->right
))
216 set_state_expr(my_id
, expr
->left
, &user_data
);
219 static void match_caller_info(struct expression
*expr
)
221 struct expression
*tmp
;
225 func
= get_fnptr_name(expr
->fn
);
230 FOR_EACH_PTR(expr
->args
, tmp
) {
231 if (is_user_data(tmp
))
232 sm_msg("info: passes user_data %s %d '$$' %s", func
, i
,
233 is_static(expr
->fn
) ? "static" : "global");
235 } END_FOR_EACH_PTR(tmp
);
238 static void struct_member_callback(char *fn
, char *global_static
, int param
, char *printed_name
, struct smatch_state
*state
)
240 if (state
== &capped
)
242 sm_msg("info: passes user_data '%s' %d '%s' %s", fn
, param
, printed_name
, global_static
);
245 static void match_return(struct expression
*expr
)
247 if (is_user_data(expr
))
248 sm_msg("info: returns_user_data %s", global_static());
251 static int db_user_data
;
252 static int db_user_data_callback(void *unused
, int argc
, char **argv
, char **azColName
)
258 static int passes_user_data(struct expression
*expr
)
260 struct expression
*arg
;
262 FOR_EACH_PTR(expr
->args
, arg
) {
263 if (is_user_data(arg
))
265 } END_FOR_EACH_PTR(arg
);
270 static void match_call_assignment(struct expression
*expr
)
273 static char sql_filter
[1024];
275 if (expr
->right
->fn
->type
!= EXPR_SYMBOL
)
277 sym
= expr
->right
->fn
->symbol
;
281 if (!passes_user_data(expr
->right
))
284 if (sym
->ctype
.modifiers
& MOD_STATIC
) {
285 snprintf(sql_filter
, 1024, "file = '%s' and function = '%s' and type = %d;",
286 get_filename(), sym
->ident
->name
, USER_DATA
);
288 snprintf(sql_filter
, 1024, "function = '%s' and static = 0 and type = %d;",
289 sym
->ident
->name
, USER_DATA
);
293 run_sql(db_user_data_callback
, "select value from return_info where %s",
296 set_state_expr(my_id
, expr
->left
, &user_data
);
299 void check_user_data(int id
)
301 if (option_project
!= PROJ_KERNEL
)
304 add_definition_db_callback(set_param_user_data
, USER_DATA
);
305 add_hook(match_call_assignment
, CALL_ASSIGNMENT_HOOK
);
306 add_hook(&match_condition
, CONDITION_HOOK
);
307 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
308 add_hook(&match_assign_userdata
, ASSIGNMENT_HOOK
);
309 add_function_hook("copy_from_user", &match_user_copy
, INT_PTR(0));
310 add_function_hook("__copy_from_user", &match_user_copy
, INT_PTR(0));
311 add_function_hook("memcpy_fromiovec", &match_user_copy
, INT_PTR(0));
312 add_function_assign_hook("kmemdup_user", &match_user_assign_function
, NULL
);
314 add_hook(&match_caller_info
, FUNCTION_CALL_HOOK
);
315 add_member_info_callback(my_id
, struct_member_callback
);
316 add_hook(&match_return
, RETURN_HOOK
);