user_data: the pointer returned from container_of() is ok
[smatch.git] / check_user_data.c
blob283868ab5b664718f4e13aa7d34b0da4e6f1063a
1 /*
2 * smatch/check_user_data.c
4 * Copyright (C) 2011 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
8 */
11 * There are a couple checks that try to see if a variable
12 * comes from the user. It would be better to unify them
13 * into one place. Also it we should follow the data down
14 * the call paths. Hence this file.
17 #include "smatch.h"
18 #include "smatch_slist.h"
19 #include "smatch_extra.h"
21 static int my_id;
23 STATE(capped);
24 STATE(user_data);
26 static int is_user_macro(struct expression *expr)
28 return 0;
31 static int db_user_data;
32 static int db_user_data_callback(void *unused, int argc, char **argv, char **azColName)
34 db_user_data = 1;
35 return 0;
38 static int passes_user_data(struct expression *expr)
40 struct expression *arg;
42 FOR_EACH_PTR(expr->args, arg) {
43 if (is_user_data(arg))
44 return 1;
45 } END_FOR_EACH_PTR(arg);
47 return 0;
50 static int is_user_fn_db(struct expression *expr)
52 struct symbol *sym;
53 static char sql_filter[1024];
55 if (expr->fn->type != EXPR_SYMBOL)
56 return 0;
57 sym = expr->fn->symbol;
58 if (!sym)
59 return 0;
61 if (!passes_user_data(expr))
62 return 0;
64 if (sym->ctype.modifiers & MOD_STATIC) {
65 snprintf(sql_filter, 1024, "file = '%s' and function = '%s';",
66 get_filename(), sym->ident->name);
67 } else {
68 snprintf(sql_filter, 1024, "function = '%s' and static = 0;",
69 sym->ident->name);
72 db_user_data = 0;
73 run_sql(db_user_data_callback, "select value from return_states where type=%d and %s",
74 USER_DATA, sql_filter);
75 return db_user_data;
78 static int is_user_function(struct expression *expr)
80 if (expr->type != EXPR_CALL)
81 return 0;
82 if (sym_name_is("kmemdup_user", expr->fn))
83 return 1;
84 return is_user_fn_db(expr);
87 static int is_skb_data(struct expression *expr)
89 struct symbol *sym;
90 char *name;
91 int len;
92 int ret = 0;
94 name = expr_to_var_sym(expr, &sym);
95 if (!name || !sym)
96 goto free;
98 sym = get_base_type(sym);
99 if (!sym || sym->type != SYM_PTR)
100 goto free;
101 sym = get_base_type(sym);
102 if (!sym || sym->type != SYM_STRUCT || !sym->ident)
103 goto free;
104 if (strcmp(sym->ident->name, "sk_buff") != 0)
105 goto free;
107 len = strlen(name);
108 if (len < 6)
109 goto free;
110 if (strcmp(name + len - 6, "->data") == 0)
111 ret = 1;
113 free:
114 free_string(name);
115 return ret;
118 static int in_container_of_macro(struct expression *expr)
120 char *macro;
122 macro = get_macro_name(expr->pos);
124 if (!macro)
125 return 0;
126 if (strcmp(macro, "container_of") == 0)
127 return 1;
128 return 0;
131 int is_user_data(struct expression *expr)
133 struct state_list *slist = NULL;
134 struct sm_state *tmp;
135 struct symbol *sym;
136 char *name;
137 int user = 0;
139 if (!expr)
140 return 0;
142 if (is_capped(expr))
143 return 0;
144 if (in_container_of_macro(expr))
145 return 0;
147 if (is_user_macro(expr))
148 return 1;
149 if (is_user_function(expr))
150 return 1;
151 if (is_skb_data(expr))
152 return 1;
154 expr = strip_expr(expr); /* this has to come after is_user_macro() */
156 if (expr->type == EXPR_BINOP) {
157 if (is_user_data(expr->left))
158 return 1;
159 if (is_user_data(expr->right))
160 return 1;
161 return 0;
163 if (expr->type == EXPR_PREOP && (expr->op == '&' || expr->op == '*'))
164 expr = strip_expr(expr->unop);
166 tmp = get_sm_state_expr(my_id, expr);
167 if (tmp)
168 return slist_has_state(tmp->possible, &user_data);
170 name = expr_to_str_sym(expr, &sym);
171 if (!name || !sym)
172 goto free;
174 slist = get_all_states(my_id);
175 FOR_EACH_PTR(slist, tmp) {
176 if (tmp->sym != sym)
177 continue;
178 if (!strncmp(tmp->name, name, strlen(tmp->name))) {
179 if (slist_has_state(tmp->possible, &user_data))
180 user = 1;
181 goto free;
183 } END_FOR_EACH_PTR(tmp);
185 free:
186 free_slist(&slist);
187 free_string(name);
188 return user;
191 void set_param_user_data(const char *name, struct symbol *sym, char *key, char *value)
193 char fullname[256];
195 if (strncmp(key, "$$", 2))
196 return;
197 snprintf(fullname, 256, "%s%s", name, key + 2);
198 set_state(my_id, fullname, sym, &user_data);
201 static void match_syscall_definition(struct symbol *sym)
203 struct symbol *arg;
204 char *macro;
206 macro = get_macro_name(sym->pos);
207 if (!macro)
208 return;
209 if (strncmp("SYSCALL_DEFINE", macro, strlen("SYSCALL_DEFINE")))
210 return;
212 FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
213 set_state(my_id, arg->ident->name, arg, &user_data);
214 } END_FOR_EACH_PTR(arg);
217 static void match_condition(struct expression *expr)
219 switch (expr->op) {
220 case '<':
221 case SPECIAL_LTE:
222 case SPECIAL_UNSIGNED_LT:
223 case SPECIAL_UNSIGNED_LTE:
224 if (is_user_data(expr->left))
225 set_true_false_states_expr(my_id, expr->left, &capped, NULL);
226 if (is_user_data(expr->right))
227 set_true_false_states_expr(my_id, expr->right, NULL, &capped);
228 break;
229 case '>':
230 case SPECIAL_GTE:
231 case SPECIAL_UNSIGNED_GT:
232 case SPECIAL_UNSIGNED_GTE:
233 if (is_user_data(expr->right))
234 set_true_false_states_expr(my_id, expr->right, &capped, NULL);
235 if (is_user_data(expr->left))
236 set_true_false_states_expr(my_id, expr->left, NULL, &capped);
237 break;
238 case SPECIAL_EQUAL:
239 if (is_user_data(expr->left))
240 set_true_false_states_expr(my_id, expr->left, &capped, NULL);
241 if (is_user_data(expr->right))
242 set_true_false_states_expr(my_id, expr->right, &capped, NULL);
243 break;
244 case SPECIAL_NOTEQUAL:
245 if (is_user_data(expr->left))
246 set_true_false_states_expr(my_id, expr->left, NULL, &capped);
247 if (is_user_data(expr->right))
248 set_true_false_states_expr(my_id, expr->right, NULL, &capped);
249 break;
250 default:
251 return;
255 static void match_normal_assign(struct expression *expr)
257 if (is_user_data(expr->right))
258 set_state_expr(my_id, expr->left, &user_data);
259 if (expr->op != '=')
260 return;
261 if (is_user_data(expr->left))
262 set_state_expr(my_id, expr->left, &capped);
265 static void match_assign(struct expression *expr)
267 char *name;
269 name = get_macro_name(expr->pos);
270 if (!name || strcmp(name, "get_user") != 0) {
271 match_normal_assign(expr);
272 return;
274 name = expr_to_var(expr->right);
275 if (!name || strcmp(name, "__val_gu") != 0)
276 goto free;
277 set_state_expr(my_id, expr->left, &user_data);
278 free:
279 free_string(name);
282 static void match_user_copy(const char *fn, struct expression *expr, void *_param)
284 int param = PTR_INT(_param);
285 struct expression *dest;
287 dest = get_argument_from_call_expr(expr->args, param);
288 dest = strip_expr(dest);
289 if (!dest)
290 return;
291 /* the first thing I tested this on pass &foo to a function */
292 set_state_expr(my_id, dest, &user_data);
293 if (dest->type == EXPR_PREOP && dest->op == '&') {
294 /* but normally I'd think it would pass the actual variable */
295 dest = dest->unop;
296 set_state_expr(my_id, dest, &user_data);
300 static void match_user_assign_function(const char *fn, struct expression *expr, void *unused)
302 set_state_expr(my_id, expr->left, &user_data);
305 static void match_assign_userdata(struct expression *expr)
307 if (is_user_data(expr->right))
308 set_state_expr(my_id, expr->left, &user_data);
311 static void match_caller_info(struct expression *expr)
313 struct expression *tmp;
314 int i;
316 i = 0;
317 FOR_EACH_PTR(expr->args, tmp) {
318 if (is_user_data(tmp))
319 sql_insert_caller_info(expr, USER_DATA, i, "$$", "1");
320 i++;
321 } END_FOR_EACH_PTR(tmp);
324 static void struct_member_callback(struct expression *call, int param, char *printed_name, struct smatch_state *state)
326 if (state == &capped)
327 return;
328 sql_insert_caller_info(call, USER_DATA, param, printed_name, "1");
331 static void print_returned_user_data(int return_id, char *return_ranges, struct expression *expr, struct state_list *slist)
333 if (is_user_data(expr)) {
334 sql_insert_return_states(return_id, return_ranges, USER_DATA,
335 -1, "", "");
339 void check_user_data(int id)
341 if (option_project != PROJ_KERNEL)
342 return;
343 my_id = id;
344 add_definition_db_callback(set_param_user_data, USER_DATA);
345 add_hook(&match_syscall_definition, FUNC_DEF_HOOK);
346 add_hook(&match_condition, CONDITION_HOOK);
347 add_hook(&match_assign, ASSIGNMENT_HOOK);
348 add_hook(&match_assign_userdata, ASSIGNMENT_HOOK);
349 add_function_hook("copy_from_user", &match_user_copy, INT_PTR(0));
350 add_function_hook("__copy_from_user", &match_user_copy, INT_PTR(0));
351 add_function_hook("memcpy_fromiovec", &match_user_copy, INT_PTR(0));
352 add_function_assign_hook("kmemdup_user", &match_user_assign_function, NULL);
354 add_hook(&match_caller_info, FUNCTION_CALL_HOOK);
355 add_member_info_callback(my_id, struct_member_callback);
356 add_returned_state_callback(print_returned_user_data);