smatch_kernel_user_data.c

   1 /*
   2  * Copyright (C) 2011 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * There are a couple checks that try to see if a variable
  20  * comes from the user.  It would be better to unify them
  21  * into one place.  Also it we should follow the data down
  22  * the call paths.  Hence this file.
  23  */
  24
  25 #include "smatch.h"
  26 #include "smatch_slist.h"
  27 #include "smatch_extra.h"
  28
  29 static int my_id;
  30 static int my_call_id;
  31
  32 static struct expression *ignore_clear;
  33
  34 STATE(called);
  35 static unsigned long func_gets_user_data;
  36
  37 struct user_fn_info {
  38         const char *name;
  39         int type;
  40         int param;
  41         const char *key;
  42         const sval_t *implies_start, *implies_end;
  43         func_hook *call_back;
  44 };
  45
  46 static struct user_fn_info func_table[] = {
  47         { "iov_iter_count", USER_DATA, -1, "$" },
  48         { "simple_strtol", USER_DATA, -1, "$" },
  49         { "simple_strtoll", USER_DATA, -1, "$" },
  50         { "simple_strtoul", USER_DATA, -1, "$" },
  51         { "simple_strtoull", USER_DATA, -1, "$" },
  52         { "kvm_register_read", USER_DATA, -1, "$" },
  53 };
  54
  55 static struct smatch_state *empty_state(struct sm_state *sm)
  56 {
  57         return alloc_estate_empty();
  58 }
  59
  60 static struct smatch_state *new_state(struct symbol *type)
  61 {
  62         struct smatch_state *state;
  63
  64         if (!type || type_is_ptr(type))
  65                 return NULL;
  66
  67         state = alloc_estate_whole(type);
  68         estate_set_new(state);
  69         return state;
  70 }
  71
  72 static void pre_merge_hook(struct sm_state *cur, struct sm_state *other)
  73 {
  74         struct smatch_state *user = cur->state;
  75         struct smatch_state *extra;
  76         struct smatch_state *state;
  77         struct range_list *rl;
  78
  79         extra = __get_state(SMATCH_EXTRA, cur->name, cur->sym);
  80         if (!extra)
  81                 return;
  82         rl = rl_intersection(estate_rl(user), estate_rl(extra));
  83         state = alloc_estate_rl(clone_rl(rl));
  84         if (estate_capped(user) || is_capped_var_sym(cur->name, cur->sym))
  85                 estate_set_capped(state);
  86         if (estate_treat_untagged(user))
  87                 estate_set_treat_untagged(state);
  88         if (estates_equiv(state, cur->state))
  89                 return;
  90         if (estate_new(cur->state))
  91                 estate_set_new(state);
  92         set_state(my_id, cur->name, cur->sym, state);
  93 }
  94
  95 static void extra_nomod_hook(const char *name, struct symbol *sym, struct expression *expr, struct smatch_state *state)
  96 {
  97         struct smatch_state *user, *new;
  98         struct range_list *rl;
  99
 100         user = __get_state(my_id, name, sym);
 101         if (!user)
 102                 return;
 103         rl = rl_intersection(estate_rl(user), estate_rl(state));
 104         if (rl_equiv(rl, estate_rl(user)))
 105                 return;
 106         new = alloc_estate_rl(rl);
 107         if (estate_capped(user))
 108                 estate_set_capped(new);
 109         if (estate_treat_untagged(user))
 110                 estate_set_treat_untagged(new);
 111         set_state(my_id, name, sym, new);
 112 }
 113
 114 static void store_type_info(struct expression *expr, struct smatch_state *state)
 115 {
 116         struct symbol *type;
 117         char *type_str, *member;
 118
 119         if (__in_fake_assign)
 120                 return;
 121
 122         if (!estate_rl(state))
 123                 return;
 124
 125         expr = strip_expr(expr);
 126         if (!expr || expr->type != EXPR_DEREF || !expr->member)
 127                 return;
 128
 129         type = get_type(expr->deref);
 130         if (!type || !type->ident)
 131                 return;
 132
 133         type_str = type_to_str(type);
 134         if (!type_str)
 135                 return;
 136         member = get_member_name(expr);
 137         if (!member)
 138                 return;
 139
 140         sql_insert_function_type_info(USER_DATA, type_str, member, state->name);
 141 }
 142
 143 static void set_user_data(struct expression *expr, struct smatch_state *state)
 144 {
 145         store_type_info(expr, state);
 146         set_state_expr(my_id, expr, state);
 147 }
 148
 149 static bool user_rl_known(struct expression *expr)
 150 {
 151         struct range_list *rl;
 152         sval_t close_to_max;
 153
 154         if (!get_user_rl(expr, &rl))
 155                 return true;
 156
 157         close_to_max = sval_type_max(rl_type(rl));
 158         close_to_max.value -= 100;
 159
 160         if (sval_cmp(rl_max(rl), close_to_max) >= 0)
 161                 return false;
 162         return true;
 163 }
 164
 165 static bool is_array_index_mask_nospec(struct expression *expr)
 166 {
 167         struct expression *orig;
 168
 169         orig = get_assigned_expr(expr);
 170         if (!orig || orig->type != EXPR_CALL)
 171                 return false;
 172         return sym_name_is("array_index_mask_nospec", orig->fn);
 173 }
 174
 175 static bool binop_capped(struct expression *expr)
 176 {
 177         struct range_list *left_rl;
 178         int comparison;
 179         sval_t sval;
 180
 181         if (expr->op == '-' && get_user_rl(expr->left, &left_rl)) {
 182                 if (user_rl_capped(expr->left))
 183                         return true;
 184                 comparison = get_comparison(expr->left, expr->right);
 185                 if (comparison && show_special(comparison)[0] == '>')
 186                         return true;
 187                 return false;
 188         }
 189
 190         if (expr->op == '&' || expr->op == '%') {
 191                 bool left_user, left_capped, right_user, right_capped;
 192
 193                 if (!get_value(expr->right, &sval) && is_capped(expr->right))
 194                         return true;
 195                 if (is_array_index_mask_nospec(expr->right))
 196                         return true;
 197                 if (is_capped(expr->left))
 198                         return true;
 199                 left_user = is_user_rl(expr->left);
 200                 right_user = is_user_rl(expr->right);
 201                 if (!left_user && !right_user)
 202                         return true;
 203
 204                 left_capped = user_rl_capped(expr->left);
 205                 right_capped = user_rl_capped(expr->right);
 206
 207                 if (left_user && left_capped) {
 208                         if (!right_user)
 209                                 return true;
 210                         if (right_user && right_capped)
 211                                 return true;
 212                         return false;
 213                 }
 214                 if (right_user && right_capped) {
 215                         if (!left_user)
 216                                 return true;
 217                         return false;
 218                 }
 219                 return false;
 220         }
 221
 222         /*
 223          * Generally "capped" means that we capped it to an unknown value.
 224          * This is useful because if Smatch doesn't know what the value is then
 225          * we have to trust that it is correct.  But if we known cap value is
 226          * 100 then we can check if 100 is correct and complain if it's wrong.
 227          *
 228          * So then the problem is with BINOP when we take a capped variable
 229          * plus a user variable which is clamped to a known range (uncapped)
 230          * the result should be capped.
 231          */
 232         if ((user_rl_capped(expr->left) || user_rl_known(expr->left)) &&
 233             (user_rl_capped(expr->right) || user_rl_known(expr->right)))
 234                 return true;
 235
 236         return false;
 237 }
 238
 239 bool user_rl_capped_var_sym(const char *name, struct symbol *sym)
 240 {
 241         struct smatch_state *state;
 242
 243         state = get_state(my_id, name, sym);
 244         if (state)
 245                 return estate_capped(state);
 246
 247         return true;
 248 }
 249
 250 bool user_rl_capped(struct expression *expr)
 251 {
 252         struct smatch_state *state;
 253         struct range_list *rl;
 254         sval_t sval;
 255
 256         expr = strip_expr(expr);
 257         if (!expr)
 258                 return false;
 259         if (get_value(expr, &sval))
 260                 return true;
 261         if (expr->type == EXPR_BINOP)
 262                 return binop_capped(expr);
 263         if ((expr->type == EXPR_PREOP || expr->type == EXPR_POSTOP) &&
 264             (expr->op == SPECIAL_INCREMENT || expr->op == SPECIAL_DECREMENT))
 265                 return user_rl_capped(expr->unop);
 266         state = get_state_expr(my_id, expr);
 267         if (state)
 268                 return estate_capped(state);
 269
 270         if (!get_user_rl(expr, &rl)) {
 271                 /*
 272                  * The non user data parts of a binop are capped and
 273                  * also empty user rl states are capped.
 274                  */
 275                 return true;
 276         }
 277
 278         if (rl_to_sval(rl, &sval))
 279                 return true;
 280
 281         return false;  /* uncapped user data */
 282 }
 283
 284 bool user_rl_treat_untagged(struct expression *expr)
 285 {
 286         struct smatch_state *state;
 287         struct range_list *rl;
 288         sval_t sval;
 289
 290         expr = strip_expr(expr);
 291         if (!expr)
 292                 return false;
 293         if (get_value(expr, &sval))
 294                 return true;
 295
 296         state = get_state_expr(my_id, expr);
 297         if (state)
 298                 return estate_treat_untagged(state);
 299
 300         if (get_user_rl(expr, &rl))
 301                 return false;  /* uncapped user data */
 302
 303         return true;  /* not actually user data */
 304 }
 305
 306 static int is_dev_attr_name(struct expression *expr)
 307 {
 308         char *name;
 309         int ret = 0;
 310
 311         name = expr_to_str(expr);
 312         if (!name)
 313                 return 0;
 314         if (strstr(name, "->attr.name"))
 315                 ret = 1;
 316         free_string(name);
 317         return ret;
 318 }
 319
 320 static bool is_percent_n(struct expression *expr, int pos)
 321 {
 322         char *p;
 323         int cnt = 0;
 324
 325         if (!expr)
 326                 return false;
 327         if (expr->type != EXPR_STRING || !expr->string)
 328                 return false;
 329
 330         p = expr->string->data;
 331         while (*p) {
 332                 if (p[0] != '%' ||
 333                     (p[0] == '%' && p[1] == '%')) {
 334                         p++;
 335                         continue;
 336                 }
 337                 if (pos != cnt) {
 338                         cnt++;
 339                         p++;
 340                         continue;
 341                 }
 342                 if (p[1] == 'n')
 343                         return true;
 344                 return false;
 345         }
 346
 347         return false;
 348 }
 349
 350 static void match_sscanf(const char *fn, struct expression *expr, void *unused)
 351 {
 352         struct expression *str, *format, *arg;
 353         int i;
 354
 355         func_gets_user_data = true;
 356
 357         str = get_argument_from_call_expr(expr->args, 0);
 358         if (is_dev_attr_name(str))
 359                 return;
 360
 361         format = get_argument_from_call_expr(expr->args, 1);
 362         if (is_dev_attr_name(format))
 363                 return;
 364
 365         i = -1;
 366         FOR_EACH_PTR(expr->args, arg) {
 367                 i++;
 368                 if (i < 2)
 369                         continue;
 370                 if (is_percent_n(format, i - 2))
 371                         continue;
 372                 mark_as_user_data(deref_expression(arg), true);
 373         } END_FOR_EACH_PTR(arg);
 374 }
 375
 376 static int comes_from_skb_data(struct expression *expr)
 377 {
 378         expr = strip_expr(expr);
 379         if (!expr || expr->type != EXPR_PREOP || expr->op != '*')
 380                 return 0;
 381
 382         expr = strip_expr(expr->unop);
 383         if (!expr)
 384                 return 0;
 385         if (expr->type == EXPR_BINOP && expr->op == '+')
 386                 expr = strip_expr(expr->left);
 387
 388         return is_skb_data(expr);
 389 }
 390
 391 static int handle_get_user(struct expression *expr)
 392 {
 393         char *name;
 394         int ret = 0;
 395
 396         name = get_macro_name(expr->pos);
 397         if (!name || strcmp(name, "get_user") != 0)
 398                 return 0;
 399
 400         name = expr_to_var(expr->right);
 401         if (!name || (strcmp(name, "__val_gu") != 0 && strcmp(name, "__gu_val") != 0))
 402                 goto free;
 403         set_user_data(expr->left, new_state(get_type(expr->left)));
 404         ret = 1;
 405 free:
 406         free_string(name);
 407         return ret;
 408 }
 409
 410 static bool state_is_new(struct expression *expr)
 411 {
 412         struct smatch_state *state;
 413
 414         state = get_state_expr(my_id, expr);
 415         if (estate_new(state))
 416                 return true;
 417
 418         if (expr->type == EXPR_BINOP) {
 419                 if (state_is_new(expr->left))
 420                         return true;
 421                 if (state_is_new(expr->right))
 422                         return true;
 423         }
 424         return false;
 425 }
 426
 427 static struct range_list *strip_negatives(struct range_list *rl)
 428 {
 429         sval_t min = rl_min(rl);
 430         sval_t minus_one = { .type = rl_type(rl), .value = -1 };
 431         sval_t over = { .type = rl_type(rl), .value = INT_MAX + 1ULL };
 432         sval_t max = sval_type_max(rl_type(rl));
 433
 434         if (!rl)
 435                 return NULL;
 436
 437         if (type_unsigned(rl_type(rl)) && type_bits(rl_type(rl)) > 31)
 438                 return remove_range(rl, over, max);
 439
 440         return remove_range(rl, min, minus_one);
 441 }
 442
 443 static bool handle_op_assign(struct expression *expr)
 444 {
 445         struct expression *binop_expr;
 446         struct smatch_state *state;
 447         struct range_list *rl;
 448
 449         switch (expr->op) {
 450         case SPECIAL_ADD_ASSIGN:
 451         case SPECIAL_SUB_ASSIGN:
 452         case SPECIAL_AND_ASSIGN:
 453         case SPECIAL_MOD_ASSIGN:
 454         case SPECIAL_SHL_ASSIGN:
 455         case SPECIAL_SHR_ASSIGN:
 456         case SPECIAL_OR_ASSIGN:
 457         case SPECIAL_XOR_ASSIGN:
 458         case SPECIAL_MUL_ASSIGN:
 459         case SPECIAL_DIV_ASSIGN:
 460                 binop_expr = binop_expression(expr->left,
 461                                               op_remove_assign(expr->op),
 462                                               expr->right);
 463                 if (!get_user_rl(binop_expr, &rl))
 464                         return true;
 465
 466                 rl = cast_rl(get_type(expr->left), rl);
 467                 state = alloc_estate_rl(rl);
 468                 if (expr->op == SPECIAL_AND_ASSIGN ||
 469                     expr->op == SPECIAL_MOD_ASSIGN ||
 470                     user_rl_capped(binop_expr))
 471                         estate_set_capped(state);
 472                 if (user_rl_treat_untagged(expr->left))
 473                         estate_set_treat_untagged(state);
 474                 if (state_is_new(binop_expr))
 475                         estate_set_new(state);
 476                 estate_set_assigned(state);
 477                 set_user_data(expr->left, state);
 478                 return true;
 479         }
 480         return false;
 481 }
 482
 483 static void handle_derefed_pointers(struct expression *expr, bool is_new)
 484 {
 485         expr = strip_expr(expr);
 486         if (expr->type != EXPR_PREOP ||
 487             expr->op != '*')
 488                 return;
 489         expr = strip_expr(expr->unop);
 490         set_array_user_ptr(expr, is_new);
 491 }
 492
 493 static void match_assign(struct expression *expr)
 494 {
 495         struct symbol *left_type, *right_type;
 496         struct range_list *rl = NULL;
 497         static struct expression *handled;
 498         struct smatch_state *state;
 499         struct expression *faked;
 500         bool is_capped = false;
 501         bool is_new = false;
 502
 503         left_type = get_type(expr->left);
 504         if (left_type == &void_ctype)
 505                 return;
 506
 507         faked = get_faked_expression();
 508         if (faked && faked == ignore_clear)
 509                 return;
 510
 511         /* FIXME: handle fake array assignments frob(&user_array[x]); */
 512
 513         if (faked &&
 514             faked->type == EXPR_ASSIGNMENT &&
 515             points_to_user_data(faked->right)) {
 516                 if (is_skb_data(faked->right)) {
 517                         func_gets_user_data = true;
 518                         is_new = true;
 519                 }
 520                 rl = alloc_whole_rl(left_type);
 521                 goto set;
 522         }
 523
 524         if (faked && faked == handled)
 525                 return;
 526         if (is_fake_call(expr->right))
 527                 goto clear_old_state;
 528         if (handle_get_user(expr))
 529                 return;
 530         if (points_to_user_data(expr->right) &&
 531             is_struct_ptr(get_type(expr->left))) {
 532                 handled = expr;
 533                 // This should be handled by smatch_points_to_user_data.c
 534                 // set_array_user_ptr(expr->left);
 535         }
 536
 537         if (handle_op_assign(expr))
 538                 return;
 539         if (expr->op != '=')
 540                 goto clear_old_state;
 541
 542         /* Handled by DB code */
 543         if (expr->right->type == EXPR_CALL)
 544                 return;
 545
 546         if (faked)
 547                 disable_type_val_lookups();
 548         get_user_rl(expr->right, &rl);
 549         if (faked)
 550                 enable_type_val_lookups();
 551         if (!rl)
 552                 goto clear_old_state;
 553
 554         is_capped = user_rl_capped(expr->right);
 555         is_new = state_is_new(expr->right);
 556
 557 set:
 558         right_type = get_type(expr->right);
 559         if (type_is_ptr(left_type)) {
 560                 if (right_type && right_type->type == SYM_ARRAY)
 561                         set_array_user_ptr(expr->left, is_new);
 562                 return;
 563         }
 564
 565         rl = cast_rl(left_type, rl);
 566         if (is_capped && type_unsigned(right_type) && type_signed(left_type))
 567                 rl = strip_negatives(rl);
 568         state = alloc_estate_rl(rl);
 569         if (is_new)
 570                 estate_set_new(state);
 571         if (is_capped)
 572                 estate_set_capped(state);
 573         if (user_rl_treat_untagged(expr->right))
 574                 estate_set_treat_untagged(state);
 575         estate_set_assigned(state);
 576
 577         set_user_data(expr->left, state);
 578         handle_derefed_pointers(expr->left, is_new);
 579         return;
 580
 581 clear_old_state:
 582
 583         /*
 584          * HACK ALERT!!!  This should be at the start of the function.  The
 585          * the problem is that handling "pointer = array;" assignments is
 586          * handled in this function instead of in kernel_points_to_user_data.c.
 587          */
 588         if (type_is_ptr(left_type))
 589                 return;
 590
 591         if (get_state_expr(my_id, expr->left))
 592                 set_user_data(expr->left, alloc_estate_empty());
 593 }
 594
 595 static void handle_eq_noteq(struct expression *expr)
 596 {
 597         struct smatch_state *left_orig, *right_orig;
 598
 599         left_orig = get_state_expr(my_id, expr->left);
 600         right_orig = get_state_expr(my_id, expr->right);
 601
 602         if (!left_orig && !right_orig)
 603                 return;
 604         if (left_orig && right_orig)
 605                 return;
 606
 607         if (left_orig) {
 608                 set_true_false_states_expr(my_id, expr->left,
 609                                 expr->op == SPECIAL_EQUAL ? alloc_estate_empty() : NULL,
 610                                 expr->op == SPECIAL_EQUAL ? NULL : alloc_estate_empty());
 611         } else {
 612                 set_true_false_states_expr(my_id, expr->right,
 613                                 expr->op == SPECIAL_EQUAL ? alloc_estate_empty() : NULL,
 614                                 expr->op == SPECIAL_EQUAL ? NULL : alloc_estate_empty());
 615         }
 616 }
 617
 618 static void handle_compare(struct expression *expr)
 619 {
 620         struct expression  *left, *right;
 621         struct range_list *left_rl = NULL;
 622         struct range_list *right_rl = NULL;
 623         struct range_list *user_rl;
 624         struct smatch_state *capped_state;
 625         struct smatch_state *left_true = NULL;
 626         struct smatch_state *left_false = NULL;
 627         struct smatch_state *right_true = NULL;
 628         struct smatch_state *right_false = NULL;
 629         struct symbol *type;
 630         sval_t sval;
 631
 632         left = strip_expr(expr->left);
 633         right = strip_expr(expr->right);
 634
 635         while (left->type == EXPR_ASSIGNMENT)
 636                 left = strip_expr(left->left);
 637
 638         /*
 639          * Conditions are mostly handled by smatch_extra.c, but there are some
 640          * times where the exact values are not known so we can't do that.
 641          *
 642          * Normally, we might consider using smatch_capped.c to supliment smatch
 643          * extra but that doesn't work when we merge unknown uncapped kernel
 644          * data with unknown capped user data.  The result is uncapped user
 645          * data.  We need to keep it separate and say that the user data is
 646          * capped.  In the past, I would have marked this as just regular
 647          * kernel data (not user data) but we can't do that these days because
 648          * we need to track user data for Spectre.
 649          *
 650          * The other situation which we have to handle is when we do have an
 651          * int and we compare against an unknown unsigned kernel variable.  In
 652          * that situation we assume that the kernel data is less than INT_MAX.
 653          * Otherwise then we get all sorts of array underflow false positives.
 654          *
 655          */
 656
 657         /* Handled in smatch_extra.c */
 658         if (get_implied_value(left, &sval) ||
 659             get_implied_value(right, &sval))
 660                 return;
 661
 662         get_user_rl(left, &left_rl);
 663         get_user_rl(right, &right_rl);
 664
 665         /* nothing to do */
 666         if (!left_rl && !right_rl)
 667                 return;
 668         /* if both sides are user data that's not a good limit */
 669         if (left_rl && right_rl)
 670                 return;
 671
 672         if (left_rl)
 673                 user_rl = left_rl;
 674         else
 675                 user_rl = right_rl;
 676
 677         type = get_type(expr);
 678         if (type_unsigned(type))
 679                 user_rl = strip_negatives(user_rl);
 680         capped_state = alloc_estate_rl(user_rl);
 681         estate_set_capped(capped_state);
 682
 683         switch (expr->op) {
 684         case '<':
 685         case SPECIAL_UNSIGNED_LT:
 686         case SPECIAL_LTE:
 687         case SPECIAL_UNSIGNED_LTE:
 688                 if (left_rl)
 689                         left_true = capped_state;
 690                 else
 691                         right_false = capped_state;
 692                 break;
 693         case '>':
 694         case SPECIAL_UNSIGNED_GT:
 695         case SPECIAL_GTE:
 696         case SPECIAL_UNSIGNED_GTE:
 697                 if (left_rl)
 698                         left_false = capped_state;
 699                 else
 700                         right_true = capped_state;
 701                 break;
 702         }
 703
 704         set_true_false_states_expr(my_id, left, left_true, left_false);
 705         set_true_false_states_expr(my_id, right, right_true, right_false);
 706 }
 707
 708 static void match_condition(struct expression *expr)
 709 {
 710         if (expr->type != EXPR_COMPARE)
 711                 return;
 712
 713         if (expr->op == SPECIAL_EQUAL ||
 714             expr->op == SPECIAL_NOTEQUAL) {
 715                 handle_eq_noteq(expr);
 716                 return;
 717         }
 718
 719         handle_compare(expr);
 720 }
 721
 722 static int get_user_macro_rl(struct expression *expr, struct range_list **rl)
 723 {
 724         struct expression *parent;
 725         char *macro;
 726
 727         if (!expr)
 728                 return 0;
 729
 730         macro = get_macro_name(expr->pos);
 731         if (!macro)
 732                 return 0;
 733
 734         /* handle ntohl(foo[i]) where "i" is trusted */
 735         parent = expr_get_parent_expr(expr);
 736         while (parent && parent->type != EXPR_BINOP)
 737                 parent = expr_get_parent_expr(parent);
 738         if (parent && parent->type == EXPR_BINOP) {
 739                 char *parent_macro = get_macro_name(parent->pos);
 740
 741                 if (parent_macro && strcmp(macro, parent_macro) == 0)
 742                         return 0;
 743         }
 744
 745         if (strcmp(macro, "ntohl") == 0) {
 746                 *rl = alloc_whole_rl(&uint_ctype);
 747                 return 1;
 748         }
 749         if (strcmp(macro, "ntohs") == 0) {
 750                 *rl = alloc_whole_rl(&ushort_ctype);
 751                 return 1;
 752         }
 753         return 0;
 754 }
 755
 756 static int has_user_data(struct symbol *sym)
 757 {
 758         struct sm_state *tmp;
 759
 760         FOR_EACH_MY_SM(my_id, __get_cur_stree(), tmp) {
 761                 if (tmp->sym == sym)
 762                         return 1;
 763         } END_FOR_EACH_SM(tmp);
 764         return 0;
 765 }
 766
 767 bool we_pass_user_data(struct expression *call)
 768 {
 769         struct expression *arg;
 770         struct symbol *sym;
 771
 772         FOR_EACH_PTR(call->args, arg) {
 773                 if (points_to_user_data(arg))
 774                         return true;
 775                 sym = expr_to_sym(arg);
 776                 if (!sym)
 777                         continue;
 778                 if (has_user_data(sym))
 779                         return true;
 780         } END_FOR_EACH_PTR(arg);
 781
 782         return false;
 783 }
 784
 785 // TODO: faked_assign this should already be handled
 786 static int db_returned_user_rl(struct expression *call, struct range_list **rl)
 787 {
 788         struct smatch_state *state;
 789         char buf[48];
 790
 791         if (is_fake_call(call))
 792                 return 0;
 793         snprintf(buf, sizeof(buf), "return %p", call);
 794         state = get_state(my_id, buf, NULL);
 795         if (!state || !estate_rl(state))
 796                 return 0;
 797         *rl = estate_rl(state);
 798         return 1;
 799 }
 800
 801 struct stree *get_user_stree(void)
 802 {
 803         return get_all_states_stree(my_id);
 804 }
 805
 806 static struct int_stack *user_data_flags, *no_user_data_flags;
 807
 808 static void set_flag(struct int_stack **stack)
 809 {
 810         int num;
 811
 812         num = pop_int(stack);
 813         num = 1;
 814         push_int(stack, num);
 815 }
 816
 817 struct range_list *var_user_rl(struct expression *expr)
 818 {
 819         struct smatch_state *state;
 820         struct range_list *rl;
 821         struct range_list *absolute_rl;
 822
 823         if (expr->type == EXPR_PREOP && expr->op == '&') {
 824                 set_flag(&no_user_data_flags);
 825                 return NULL;
 826         }
 827
 828         if (expr->type == EXPR_BINOP && expr->op == '%') {
 829                 struct range_list *left, *right;
 830
 831                 if (!get_user_rl(expr->right, &right))
 832                         return NULL;
 833                 get_absolute_rl(expr->left, &left);
 834                 rl = rl_binop(left, '%', right);
 835                 goto found;
 836         }
 837
 838         if (expr->type == EXPR_BINOP && expr->op == '/') {
 839                 struct range_list *left = NULL;
 840                 struct range_list *right = NULL;
 841                 struct range_list *abs_right;
 842
 843                 /*
 844                  * The specific bug I'm dealing with is:
 845                  *
 846                  * foo = capped_user / unknown;
 847                  *
 848                  * Instead of just saying foo is now entirely user_rl we should
 849                  * probably say instead that it is not at all user data.
 850                  *
 851                  */
 852
 853                 get_user_rl(expr->left, &left);
 854                 get_user_rl(expr->right, &right);
 855                 get_absolute_rl(expr->right, &abs_right);
 856
 857                 if (left && !right) {
 858                         rl = rl_binop(left, '/', abs_right);
 859                         if (sval_cmp(rl_max(left), rl_max(rl)) < 0)
 860                                 set_flag(&no_user_data_flags);
 861                 }
 862
 863                 return NULL;
 864         }
 865
 866         if (get_user_macro_rl(expr, &rl))
 867                 goto found;
 868
 869         if (comes_from_skb_data(expr)) {
 870                 rl = alloc_whole_rl(get_type(expr));
 871                 goto found;
 872         }
 873
 874         state = get_state_expr(my_id, expr);
 875         if (state && estate_rl(state)) {
 876                 rl = estate_rl(state);
 877                 goto found;
 878         }
 879
 880         if (expr->type == EXPR_CALL && db_returned_user_rl(expr, &rl))
 881                 goto found;
 882
 883         if (expr->type == EXPR_PREOP && expr->op == '*' &&
 884             points_to_user_data(expr->unop)) {
 885                 rl = var_to_absolute_rl(expr);
 886                 goto found;
 887         }
 888
 889         if (is_array(expr)) {
 890                 struct expression *array = get_array_base(expr);
 891
 892                 if (!get_state_expr(my_id, array)) {
 893                         set_flag(&no_user_data_flags);
 894                         return NULL;
 895                 }
 896         }
 897
 898         return NULL;
 899 found:
 900         set_flag(&user_data_flags);
 901         absolute_rl = var_to_absolute_rl(expr);
 902         return rl_intersection(rl, absolute_rl);
 903 }
 904
 905 static bool is_ptr_subtract(struct expression *expr)
 906 {
 907         expr = strip_expr(expr);
 908         if (!expr)
 909                 return false;
 910         if (expr->type == EXPR_BINOP && expr->op == '-' &&
 911             type_is_ptr(get_type(expr->left))) {
 912                 return true;
 913         }
 914         return false;
 915 }
 916
 917 int get_user_rl(struct expression *expr, struct range_list **rl)
 918 {
 919         int user_data, no_user_data;
 920
 921         if (!expr)
 922                 return 0;
 923
 924         if (__in_fake_struct_assign &&
 925             !has_states(__get_cur_stree(), my_id))
 926                 return 0;
 927
 928         if (is_ptr_subtract(expr))
 929                 return 0;
 930
 931         push_int(&user_data_flags, 0);
 932         push_int(&no_user_data_flags, 0);
 933
 934         custom_get_absolute_rl(expr, &var_user_rl, rl);
 935
 936         user_data = pop_int(&user_data_flags);
 937         no_user_data = pop_int(&no_user_data_flags);
 938
 939         if (!user_data || no_user_data)
 940                 *rl = NULL;
 941
 942         return !!*rl;
 943 }
 944
 945 int is_user_rl(struct expression *expr)
 946 {
 947         struct range_list *tmp;
 948
 949         return get_user_rl(expr, &tmp) && tmp;
 950 }
 951
 952 int get_user_rl_var_sym(const char *name, struct symbol *sym, struct range_list **rl)
 953 {
 954         struct smatch_state *state, *extra;
 955
 956         state = get_state(my_id, name, sym);
 957         if (!estate_rl(state))
 958                 return 0;
 959         *rl = estate_rl(state);
 960
 961         extra = get_state(SMATCH_EXTRA, name, sym);
 962         if (estate_rl(extra))
 963                 *rl = rl_intersection(estate_rl(state), estate_rl(extra));
 964
 965         return 1;
 966 }
 967
 968 bool is_socket_stuff(struct symbol *sym)
 969 {
 970         struct symbol *type;
 971
 972         /* This is a hack.
 973          * Basically I never want to consider an skb or sk as user pointer.
 974          * The skb->data is already marked as a source of user data, and if
 975          * anything else is marked as user data it's almost certainly wrong.
 976          *
 977          * Ideally, I would figure out where this bogus data is coming from,
 978          * but possibly it just was stuck in the database from previous updates
 979          * and can't get cleared out without deleting all user data.  Things
 980          * like this gets stuck in the DB because of recursion.
 981          *
 982          * I could make this a temporary hack, but I keep wanting to do it so
 983          * I'm just going to make it permanent.  It either doesn't change
 984          * anything or it makes life better.
 985          */
 986
 987         type = get_real_base_type(sym);
 988         if (!type || type->type != SYM_PTR)
 989                 return false;
 990         type = get_real_base_type(type);
 991         if (!type || type->type != SYM_STRUCT || !type->ident)
 992                 return false;
 993
 994         if (strcmp(type->ident->name, "sk_buff") == 0)
 995                 return true;
 996         if (strcmp(type->ident->name, "sock") == 0)
 997                 return true;
 998         if (strcmp(type->ident->name, "socket") == 0)
 999                 return true;
1000
1001         return false;
1002 }
1003
1004 static void return_info_callback(int return_id, char *return_ranges,
1005                                  struct expression *returned_expr,
1006                                  int param,
1007                                  const char *printed_name,
1008                                  struct sm_state *sm)
1009 {
1010         struct smatch_state *extra;
1011         struct range_list *rl;
1012         char buf[64];
1013
1014         if (is_socket_stuff(sm->sym))
1015                 return;
1016         if (is_ignored_kernel_data(printed_name))
1017                 return;
1018
1019         if (param >= 0) {
1020                 if (strcmp(printed_name, "$") == 0)
1021                         return;
1022                 if (!estate_assigned(sm->state) &&
1023                     !estate_new(sm->state))
1024                         return;
1025         }
1026         rl = estate_rl(sm->state);
1027         if (!rl)
1028                 return;
1029         extra = get_state(SMATCH_EXTRA, sm->name, sm->sym);
1030         if (estate_rl(extra))
1031                 rl = rl_intersection(estate_rl(sm->state), estate_rl(extra));
1032         if (!rl)
1033                 return;
1034
1035         snprintf(buf, sizeof(buf), "%s%s%s",
1036                  show_rl(rl),
1037                  estate_capped(sm->state) ? "[c]" : "",
1038                  estate_treat_untagged(sm->state) ? "[u]" : "");
1039         sql_insert_return_states(return_id, return_ranges,
1040                                  estate_new(sm->state) ? USER_DATA_SET : USER_DATA,
1041                                  param, printed_name, buf);
1042 }
1043
1044 static bool is_ignored_macro(struct position pos)
1045 {
1046         const char *macro;
1047
1048         macro = get_macro_name(pos);
1049         if (!macro)
1050                 return false;
1051         if (strcmp(macro, "v4l2_subdev_call") == 0)
1052                 return true;
1053         return false;
1054 }
1055
1056 static void caller_info_callback(struct expression *call, int param, char *printed_name, struct sm_state *sm)
1057 {
1058         struct smatch_state *state;
1059         struct range_list *rl;
1060         struct symbol *type;
1061         char buf[64];
1062
1063         if (is_ignored_macro(call->pos))
1064                 return;
1065
1066         if (is_socket_stuff(sm->sym))
1067                 return;
1068         if (is_ignored_kernel_data(printed_name))
1069                 return;
1070
1071         /*
1072          * Smatch uses a hack where if we get an unsigned long we say it's
1073          * both user data and it points to user data.  But if we pass it to a
1074          * function which takes an int, then it's just user data.  There's not
1075          * enough bytes for it to be a pointer.
1076          *
1077          */
1078         type = get_arg_type(call->fn, param);
1079         if (strcmp(printed_name, "$") != 0 && type && type_bits(type) < type_bits(&ptr_ctype))
1080                 return;
1081
1082         if (strcmp(sm->state->name, "") == 0)
1083                 return;
1084
1085         state = __get_state(SMATCH_EXTRA, sm->name, sm->sym);
1086         if (!state || !estate_rl(state))
1087                 rl = estate_rl(sm->state);
1088         else
1089                 rl = rl_intersection(estate_rl(sm->state), estate_rl(state));
1090
1091         if (!rl)
1092                 return;
1093
1094         snprintf(buf, sizeof(buf), "%s%s%s", show_rl(rl),
1095                  estate_capped(sm->state) ? "[c]" : "",
1096                  estate_treat_untagged(sm->state) ? "[u]" : "");
1097         sql_insert_caller_info(call, USER_DATA, param, printed_name, buf);
1098 }
1099
1100 static void db_param_set(struct expression *expr, int param, char *key, char *value)
1101 {
1102         struct expression *arg;
1103         char *name;
1104         struct symbol *sym;
1105         struct smatch_state *state;
1106
1107         while (expr->type == EXPR_ASSIGNMENT)
1108                 expr = strip_expr(expr->right);
1109         if (expr->type != EXPR_CALL)
1110                 return;
1111         if (expr == ignore_clear)
1112                 return;
1113
1114         arg = get_argument_from_call_expr(expr->args, param);
1115         if (!arg)
1116                 return;
1117         name = get_variable_from_key(arg, key, &sym);
1118         if (!name || !sym)
1119                 goto free;
1120
1121         state = get_state(my_id, name, sym);
1122         if (!state)
1123                 goto free;
1124
1125         set_state(my_id, name, sym, alloc_estate_empty());
1126 free:
1127         free_string(name);
1128 }
1129
1130 static bool param_data_capped(const char *value)
1131 {
1132         if (strstr(value, ",c") || strstr(value, "[c"))
1133                 return true;
1134         return false;
1135 }
1136
1137 static bool param_data_treat_untagged(const char *value)
1138 {
1139         if (strstr(value, ",u") || strstr(value, "[u"))
1140                 return true;
1141         return false;
1142 }
1143
1144 static void set_param_user_data(const char *name, struct symbol *sym, char *key, char *value)
1145 {
1146         struct expression *expr;
1147         struct range_list *rl = NULL;
1148         struct smatch_state *state;
1149         struct symbol *type;
1150         char *fullname;
1151
1152         expr = symbol_expression(sym);
1153         fullname = get_variable_from_key(expr, key, NULL);
1154         if (!fullname)
1155                 return;
1156
1157         type = get_member_type_from_key(expr, key);
1158         if (type && type->type == SYM_STRUCT)
1159                 return;
1160
1161         if (!type)
1162                 return;
1163
1164         str_to_rl(type, value, &rl);
1165         rl = swap_mtag_seed(expr, rl);
1166         state = alloc_estate_rl(rl);
1167         if (param_data_capped(value) || is_capped(expr))
1168                 estate_set_capped(state);
1169         if (param_data_treat_untagged(value) || sym->ctype.as == 5)
1170                 estate_set_treat_untagged(state);
1171         set_state(my_id, fullname, sym, state);
1172 }
1173
1174 static void set_called(const char *name, struct symbol *sym, char *key, char *value)
1175 {
1176         set_state(my_call_id, "this_function", NULL, &called);
1177 }
1178
1179 static void match_syscall_definition(struct symbol *sym)
1180 {
1181         struct symbol *arg;
1182         char *macro;
1183         char *name;
1184         int is_syscall = 0;
1185
1186         macro = get_macro_name(sym->pos);
1187         if (macro &&
1188             (strncmp("SYSCALL_DEFINE", macro, strlen("SYSCALL_DEFINE")) == 0 ||
1189              strncmp("COMPAT_SYSCALL_DEFINE", macro, strlen("COMPAT_SYSCALL_DEFINE")) == 0))
1190                 is_syscall = 1;
1191
1192         name = get_function();
1193         if (!option_no_db && get_state(my_call_id, "this_function", NULL) != &called) {
1194                 if (name && strncmp(name, "sys_", 4) == 0)
1195                         is_syscall = 1;
1196         }
1197
1198         if (name && strncmp(name, "compat_sys_", 11) == 0)
1199                 is_syscall = 1;
1200
1201         if (!is_syscall)
1202                 return;
1203
1204         FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
1205                 set_state(my_id, arg->ident->name, arg, alloc_estate_whole(get_real_base_type(arg)));
1206         } END_FOR_EACH_PTR(arg);
1207 }
1208
1209 #define OLD 0
1210 #define NEW 1
1211
1212 static void store_user_data_return(struct expression *expr, char *key, char *value, bool is_new)
1213 {
1214         struct smatch_state *state;
1215         struct range_list *rl;
1216         struct symbol *type;
1217         char buf[48];
1218
1219         if (key[0] != '$')
1220                 return;
1221
1222         type = get_type(expr);
1223         snprintf(buf, sizeof(buf), "return %p%s", expr, key + 1);
1224         call_results_to_rl(expr, type, value, &rl);
1225
1226         state = alloc_estate_rl(rl);
1227         if (is_new)
1228                 estate_set_new(state);
1229
1230         set_state(my_id, buf, NULL, state);
1231 }
1232
1233 // FIXME: not a fan of this name, would prefer set_to_user_data() but that's
1234 //        already used.
1235 void mark_as_user_data(struct expression *expr, bool isnew)
1236 {
1237         struct smatch_state *state;
1238
1239         state = alloc_estate_whole(get_type(expr));
1240         if (isnew) {
1241                 func_gets_user_data = true;
1242                 estate_set_new(state);
1243         }
1244         set_state_expr(my_id, expr, state);
1245 }
1246
1247 static void set_to_user_data(struct expression *expr, char *key, char *value, bool is_new)
1248 {
1249         struct smatch_state *state;
1250         char *name;
1251         struct symbol *sym;
1252         struct symbol *type;
1253         struct range_list *rl = NULL;
1254
1255         type = get_member_type_from_key(expr, key);
1256         name = get_variable_from_key(expr, key, &sym);
1257         if (!name || !sym)
1258                 goto free;
1259
1260         call_results_to_rl(expr, type, value, &rl);
1261
1262         state = alloc_estate_rl(rl);
1263         if (param_data_capped(value))
1264                 estate_set_capped(state);
1265         if (param_data_treat_untagged(value))
1266                 estate_set_treat_untagged(state);
1267         if (is_new)
1268                 estate_set_new(state);
1269         estate_set_assigned(state);
1270         set_state(my_id, name, sym, state);
1271 free:
1272         free_string(name);
1273 }
1274
1275 static void returns_param_user_data(struct expression *expr, int param, char *key, char *value)
1276 {
1277         struct expression *arg;
1278         struct expression *call;
1279
1280         call = expr;
1281         while (call->type == EXPR_ASSIGNMENT)
1282                 call = strip_expr(call->right);
1283         if (call->type != EXPR_CALL)
1284                 return;
1285
1286         if (!we_pass_user_data(call))
1287                 return;
1288
1289         if (param == -1) {
1290                 if (expr->type != EXPR_ASSIGNMENT) {
1291                         // TODO: faked_assign this should all be handled as a fake assignment
1292                         store_user_data_return(expr, key, value, OLD);
1293                         return;
1294                 }
1295                 set_to_user_data(expr->left, key, value, OLD);
1296                 return;
1297         }
1298
1299         arg = get_argument_from_call_expr(call->args, param);
1300         if (!arg)
1301                 return;
1302         set_to_user_data(arg, key, value, OLD);
1303 }
1304
1305 static void returns_param_user_data_set(struct expression *expr, int param, char *key, char *value)
1306 {
1307         struct expression *arg;
1308
1309         func_gets_user_data = true;
1310
1311         if (param == -1) {
1312                 if (expr->type != EXPR_ASSIGNMENT) {
1313                         store_user_data_return(expr, key, value, NEW);
1314                         return;
1315                 }
1316                 set_to_user_data(expr->left, key, value, NEW);
1317                 return;
1318         }
1319
1320         while (expr->type == EXPR_ASSIGNMENT)
1321                 expr = strip_expr(expr->right);
1322         if (expr->type != EXPR_CALL)
1323                 return;
1324
1325         arg = get_argument_from_call_expr(expr->args, param);
1326         if (!arg)
1327                 return;
1328         set_to_user_data(arg, key, value, NEW);
1329 }
1330
1331 static void set_param_key_user_data(struct expression *expr, const char *name,
1332                                     struct symbol *sym, void *data)
1333 {
1334         struct expression *arg;
1335
1336         func_gets_user_data = true;
1337         arg = gen_expression_from_name_sym(name, sym);
1338         set_state_expr(my_id, arg, new_state(get_type(arg)));
1339 }
1340
1341 static void match_capped(struct expression *expr, const char *name, struct symbol *sym, void *info)
1342 {
1343         struct smatch_state *state, *new;
1344
1345         state = get_state(my_id, name, sym);
1346         if (!state || estate_capped(state))
1347                 return;
1348
1349         new = clone_estate(state);
1350         estate_set_capped(new);
1351
1352         set_state(my_id, name, sym, new);
1353 }
1354
1355 void register_kernel_user_data(int id)
1356 {
1357         struct user_fn_info *info;
1358         int i;
1359
1360         my_id = id;
1361
1362         if (option_project != PROJ_KERNEL)
1363                 return;
1364
1365         set_dynamic_states(my_id);
1366
1367         add_function_data(&func_gets_user_data);
1368
1369         add_unmatched_state_hook(my_id, &empty_state);
1370         add_extra_nomod_hook(&extra_nomod_hook);
1371         add_pre_merge_hook(my_id, &pre_merge_hook);
1372         add_merge_hook(my_id, &merge_estates);
1373
1374         add_function_hook("sscanf", &match_sscanf, NULL);
1375
1376         add_hook(&match_syscall_definition, AFTER_DEF_HOOK);
1377
1378         add_hook(&match_assign, ASSIGNMENT_HOOK);
1379         select_return_states_hook(PARAM_SET, &db_param_set);
1380         add_hook(&match_condition, CONDITION_HOOK);
1381
1382         add_caller_info_callback(my_id, caller_info_callback);
1383         add_return_info_callback(my_id, return_info_callback);
1384         select_caller_info_hook(set_param_user_data, USER_DATA);
1385         select_return_states_hook(USER_DATA, &returns_param_user_data);
1386         select_return_states_hook(USER_DATA_SET, &returns_param_user_data_set);
1387
1388         select_return_param_key(CAPPED_DATA, &match_capped);
1389         add_function_param_key_hook_late("memcpy", &match_capped, 2, "$", NULL);
1390         add_function_param_key_hook_late("_memcpy", &match_capped, 2, "$", NULL);
1391         add_function_param_key_hook_late("__memcpy", &match_capped, 2, "$", NULL);
1392         add_function_param_key_hook_late("memset", &match_capped, 2, "$", NULL);
1393         add_function_param_key_hook_late("_memset", &match_capped, 2, "$", NULL);
1394         add_function_param_key_hook_late("__memset", &match_capped, 2, "$", NULL);
1395
1396         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
1397                 info = &func_table[i];
1398                 add_function_param_key_hook_late(info->name, &set_param_key_user_data,
1399                                                  info->param, info->key, info);
1400         }
1401 }
1402
1403 void register_kernel_user_data2(int id)
1404 {
1405         my_call_id = id;
1406
1407         if (option_project != PROJ_KERNEL)
1408                 return;
1409         select_caller_info_hook(set_called, INTERNAL);
1410 }