show_unreachable.sh: replace tabs with spaces
[smatch.git] / check_user_data.c
blobca584e3eadac8c89d1deecfd0fd2fc5ef27b89e3
1 /*
2 * smatch/check_user_data.c
4 * Copyright (C) 2011 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
8 */
11 * There are a couple checks that try to see if a variable
12 * comes from the user. It would be better to unify them
13 * into one place. Also it we should follow the data down
14 * the call paths. Hence this file.
17 #include "smatch.h"
18 #include "smatch_slist.h"
19 #include "smatch_extra.h"
21 static int my_id;
23 STATE(capped);
24 STATE(user_data);
26 static int is_user_macro(struct expression *expr)
28 return 0;
31 static int db_user_data;
32 static int db_user_data_callback(void *unused, int argc, char **argv, char **azColName)
34 db_user_data = 1;
35 return 0;
38 static int passes_user_data(struct expression *expr)
40 struct expression *arg;
42 FOR_EACH_PTR(expr->args, arg) {
43 if (is_user_data(arg))
44 return 1;
45 } END_FOR_EACH_PTR(arg);
47 return 0;
50 static int is_user_fn_db(struct expression *expr)
52 struct symbol *sym;
53 static char sql_filter[1024];
55 if (expr->fn->type != EXPR_SYMBOL)
56 return 0;
57 sym = expr->fn->symbol;
58 if (!sym)
59 return 0;
61 if (!passes_user_data(expr))
62 return 0;
64 if (sym->ctype.modifiers & MOD_STATIC) {
65 snprintf(sql_filter, 1024, "file = '%s' and function = '%s';",
66 get_filename(), sym->ident->name);
67 } else {
68 snprintf(sql_filter, 1024, "function = '%s' and static = 0;",
69 sym->ident->name);
72 db_user_data = 0;
73 run_sql(db_user_data_callback, "select value from return_states where type=%d and %s",
74 USER_DATA, sql_filter);
75 return db_user_data;
78 static int is_user_function(struct expression *expr)
80 if (expr->type != EXPR_CALL)
81 return 0;
82 if (sym_name_is("kmemdup_user", expr->fn))
83 return 1;
84 return is_user_fn_db(expr);
87 static int is_skb_data(struct expression *expr)
89 struct symbol *sym;
90 char *name;
91 int len;
92 int ret = 0;
94 name = expr_to_var_sym(expr, &sym);
95 if (!name || !sym)
96 goto free;
98 sym = get_base_type(sym);
99 if (!sym || sym->type != SYM_PTR)
100 goto free;
101 sym = get_base_type(sym);
102 if (!sym || sym->type != SYM_STRUCT || !sym->ident)
103 goto free;
104 if (strcmp(sym->ident->name, "sk_buff") != 0)
105 goto free;
107 len = strlen(name);
108 if (len < 6)
109 goto free;
110 if (strcmp(name + len - 6, "->data") == 0)
111 ret = 1;
113 free:
114 free_string(name);
115 return ret;
118 static int in_container_of_macro(struct expression *expr)
120 char *macro;
122 macro = get_macro_name(expr->pos);
124 if (!macro)
125 return 0;
126 if (strcmp(macro, "container_of") == 0)
127 return 1;
128 return 0;
131 int is_user_data(struct expression *expr)
133 struct state_list *slist = NULL;
134 struct sm_state *tmp;
135 struct symbol *sym;
136 char *name;
137 int user = 0;
139 if (!expr)
140 return 0;
142 if (is_capped(expr))
143 return 0;
144 if (in_container_of_macro(expr))
145 return 0;
147 if (is_user_macro(expr))
148 return 1;
149 if (is_user_function(expr))
150 return 1;
151 if (is_skb_data(expr))
152 return 1;
154 expr = strip_expr(expr); /* this has to come after is_user_macro() */
156 if (expr->type == EXPR_BINOP) {
157 if (is_user_data(expr->left))
158 return 1;
159 if (is_array(expr))
160 return 0;
161 if (is_user_data(expr->right))
162 return 1;
163 return 0;
165 if (expr->type == EXPR_PREOP && (expr->op == '&' || expr->op == '*'))
166 expr = strip_expr(expr->unop);
168 tmp = get_sm_state_expr(my_id, expr);
169 if (tmp)
170 return slist_has_state(tmp->possible, &user_data);
172 name = expr_to_str_sym(expr, &sym);
173 if (!name || !sym)
174 goto free;
176 slist = get_all_states(my_id);
177 FOR_EACH_PTR(slist, tmp) {
178 if (tmp->sym != sym)
179 continue;
180 if (!strncmp(tmp->name, name, strlen(tmp->name))) {
181 if (slist_has_state(tmp->possible, &user_data))
182 user = 1;
183 goto free;
185 } END_FOR_EACH_PTR(tmp);
187 free:
188 free_slist(&slist);
189 free_string(name);
190 return user;
193 void set_param_user_data(const char *name, struct symbol *sym, char *key, char *value)
195 char fullname[256];
197 if (strncmp(key, "$$", 2))
198 return;
199 snprintf(fullname, 256, "%s%s", name, key + 2);
200 set_state(my_id, fullname, sym, &user_data);
203 static void match_syscall_definition(struct symbol *sym)
205 struct symbol *arg;
206 char *macro;
208 macro = get_macro_name(sym->pos);
209 if (!macro)
210 return;
211 if (strncmp("SYSCALL_DEFINE", macro, strlen("SYSCALL_DEFINE")) != 0 &&
212 strncmp("COMPAT_SYSCALL_DEFINE", macro, strlen("COMPAT_SYSCALL_DEFINE")) != 0)
213 return;
215 FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
216 set_state(my_id, arg->ident->name, arg, &user_data);
217 } END_FOR_EACH_PTR(arg);
220 static void match_condition(struct expression *expr)
222 switch (expr->op) {
223 case '<':
224 case SPECIAL_LTE:
225 case SPECIAL_UNSIGNED_LT:
226 case SPECIAL_UNSIGNED_LTE:
227 if (is_user_data(expr->left))
228 set_true_false_states_expr(my_id, expr->left, &capped, NULL);
229 if (is_user_data(expr->right))
230 set_true_false_states_expr(my_id, expr->right, NULL, &capped);
231 break;
232 case '>':
233 case SPECIAL_GTE:
234 case SPECIAL_UNSIGNED_GT:
235 case SPECIAL_UNSIGNED_GTE:
236 if (is_user_data(expr->right))
237 set_true_false_states_expr(my_id, expr->right, &capped, NULL);
238 if (is_user_data(expr->left))
239 set_true_false_states_expr(my_id, expr->left, NULL, &capped);
240 break;
241 case SPECIAL_EQUAL:
242 if (is_user_data(expr->left))
243 set_true_false_states_expr(my_id, expr->left, &capped, NULL);
244 if (is_user_data(expr->right))
245 set_true_false_states_expr(my_id, expr->right, &capped, NULL);
246 break;
247 case SPECIAL_NOTEQUAL:
248 if (is_user_data(expr->left))
249 set_true_false_states_expr(my_id, expr->left, NULL, &capped);
250 if (is_user_data(expr->right))
251 set_true_false_states_expr(my_id, expr->right, NULL, &capped);
252 break;
253 default:
254 return;
258 static void match_normal_assign(struct expression *expr)
260 if (is_user_data(expr->right))
261 set_state_expr(my_id, expr->left, &user_data);
262 if (expr->op != '=')
263 return;
264 if (is_user_data(expr->left))
265 set_state_expr(my_id, expr->left, &capped);
268 static void match_assign(struct expression *expr)
270 char *name;
272 name = get_macro_name(expr->pos);
273 if (!name || strcmp(name, "get_user") != 0) {
274 match_normal_assign(expr);
275 return;
277 name = expr_to_var(expr->right);
278 if (!name || strcmp(name, "__val_gu") != 0)
279 goto free;
280 set_state_expr(my_id, expr->left, &user_data);
281 free:
282 free_string(name);
285 static void match_user_copy(const char *fn, struct expression *expr, void *_param)
287 int param = PTR_INT(_param);
288 struct expression *dest;
290 dest = get_argument_from_call_expr(expr->args, param);
291 dest = strip_expr(dest);
292 if (!dest)
293 return;
294 /* the first thing I tested this on pass &foo to a function */
295 set_state_expr(my_id, dest, &user_data);
296 if (dest->type == EXPR_PREOP && dest->op == '&') {
297 /* but normally I'd think it would pass the actual variable */
298 dest = dest->unop;
299 set_state_expr(my_id, dest, &user_data);
303 static void match_user_assign_function(const char *fn, struct expression *expr, void *unused)
305 set_state_expr(my_id, expr->left, &user_data);
308 static void match_assign_userdata(struct expression *expr)
310 if (is_user_data(expr->right))
311 set_state_expr(my_id, expr->left, &user_data);
314 static void match_caller_info(struct expression *expr)
316 struct expression *tmp;
317 int i;
319 i = 0;
320 FOR_EACH_PTR(expr->args, tmp) {
321 if (is_user_data(tmp))
322 sql_insert_caller_info(expr, USER_DATA, i, "$$", "1");
323 i++;
324 } END_FOR_EACH_PTR(tmp);
327 static void struct_member_callback(struct expression *call, int param, char *printed_name, struct smatch_state *state)
329 if (state == &capped)
330 return;
331 sql_insert_caller_info(call, USER_DATA, param, printed_name, "1");
334 static void print_returned_user_data(int return_id, char *return_ranges, struct expression *expr, struct state_list *slist)
336 if (is_user_data(expr)) {
337 sql_insert_return_states(return_id, return_ranges, USER_DATA,
338 -1, "", "");
342 void check_user_data(int id)
344 if (option_project != PROJ_KERNEL)
345 return;
346 my_id = id;
347 add_definition_db_callback(set_param_user_data, USER_DATA);
348 add_hook(&match_syscall_definition, FUNC_DEF_HOOK);
349 add_hook(&match_condition, CONDITION_HOOK);
350 add_hook(&match_assign, ASSIGNMENT_HOOK);
351 add_hook(&match_assign_userdata, ASSIGNMENT_HOOK);
352 add_function_hook("copy_from_user", &match_user_copy, INT_PTR(0));
353 add_function_hook("__copy_from_user", &match_user_copy, INT_PTR(0));
354 add_function_hook("memcpy_fromiovec", &match_user_copy, INT_PTR(0));
355 add_function_assign_hook("kmemdup_user", &match_user_assign_function, NULL);
357 add_hook(&match_caller_info, FUNCTION_CALL_HOOK);
358 add_member_info_callback(my_id, struct_member_callback);
359 add_returned_state_callback(print_returned_user_data);