2 * Copyright (C) 2011 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * There are a couple checks that try to see if a variable
20 * comes from the user. It would be better to unify them
21 * into one place. Also it we should follow the data down
22 * the call paths. Hence this file.
26 #include "smatch_slist.h"
27 #include "smatch_extra.h"
30 static int my_call_id
;
34 static const char * kstr_funcs
[] = {
35 "kstrtoull", "kstrtoll", "kstrtoul", "kstrtol", "kstrtouint",
36 "kstrtoint", "kstrtou64", "kstrtos64", "kstrtou32", "kstrtos32",
37 "kstrtou16", "kstrtos16", "kstrtou8", "kstrtos8", "kstrtoull_from_user"
38 "kstrtoll_from_user", "kstrtoul_from_user", "kstrtol_from_user",
39 "kstrtouint_from_user", "kstrtoint_from_user", "kstrtou16_from_user",
40 "kstrtos16_from_user", "kstrtou8_from_user", "kstrtos8_from_user",
41 "kstrtou64_from_user", "kstrtos64_from_user", "kstrtou32_from_user",
42 "kstrtos32_from_user",
45 static void set_points_to_user_data(struct expression
*expr
);
47 static struct stree
*start_states
;
48 static struct stree_stack
*saved_stack
;
49 static void save_start_states(struct statement
*stmt
)
51 start_states
= clone_stree(__get_cur_stree());
54 static void free_start_states(void)
56 free_stree(&start_states
);
59 static void match_save_states(struct expression
*expr
)
61 push_stree(&saved_stack
, start_states
);
65 static void match_restore_states(struct expression
*expr
)
67 free_stree(&start_states
);
68 start_states
= pop_stree(&saved_stack
);
71 static struct smatch_state
*empty_state(struct sm_state
*sm
)
73 return alloc_estate_empty();
76 static void pre_merge_hook(struct sm_state
*sm
)
78 struct smatch_state
*user
;
79 struct smatch_state
*extra
;
80 struct range_list
*rl
;
82 extra
= get_state(SMATCH_EXTRA
, sm
->name
, sm
->sym
);
83 if (!extra
|| !estate_rl(extra
))
85 user
= get_state(my_id
, sm
->name
, sm
->sym
);
86 if (!user
|| !estate_rl(user
))
88 rl
= rl_intersection(estate_rl(user
), estate_rl(extra
));
89 set_state(my_id
, sm
->name
, sm
->sym
, alloc_estate_rl(clone_rl(rl
)));
92 static void tag_inner_struct_members(struct expression
*expr
, struct symbol
*member
)
94 struct expression
*edge_member
;
95 struct symbol
*base
= get_real_base_type(member
);
99 expr
= member_expression(expr
, '.', member
->ident
);
101 FOR_EACH_PTR(base
->symbol_list
, tmp
) {
104 type
= get_real_base_type(tmp
);
108 if (type
->type
== SYM_UNION
|| type
->type
== SYM_STRUCT
) {
109 tag_inner_struct_members(expr
, tmp
);
116 edge_member
= member_expression(expr
, '.', tmp
->ident
);
117 set_state_expr(my_id
, edge_member
, alloc_estate_whole(type
));
118 } END_FOR_EACH_PTR(tmp
);
121 static void tag_struct_members(struct symbol
*type
, struct expression
*expr
)
124 struct expression
*member
;
127 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
128 expr
= strip_expr(expr
->unop
);
132 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
133 type
= get_real_base_type(tmp
);
137 if (type
->type
== SYM_UNION
|| type
->type
== SYM_STRUCT
) {
138 tag_inner_struct_members(expr
, tmp
);
145 member
= member_expression(expr
, op
, tmp
->ident
);
146 set_state_expr(my_id
, member
, alloc_estate_whole(get_type(member
)));
148 if (type
->type
== SYM_ARRAY
)
149 set_points_to_user_data(member
);
150 } END_FOR_EACH_PTR(tmp
);
153 static void tag_base_type(struct expression
*expr
)
155 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
156 expr
= strip_expr(expr
->unop
);
158 expr
= deref_expression(expr
);
159 set_state_expr(my_id
, expr
, alloc_estate_whole(get_type(expr
)));
162 static void tag_as_user_data(struct expression
*expr
)
166 expr
= strip_expr(expr
);
168 type
= get_type(expr
);
169 if (!type
|| type
->type
!= SYM_PTR
)
171 type
= get_real_base_type(type
);
174 if (type
== &void_ctype
) {
175 set_state_expr(my_id
, deref_expression(expr
), alloc_estate_whole(&ulong_ctype
));
178 if (type
->type
== SYM_BASETYPE
)
180 if (type
->type
== SYM_STRUCT
) {
181 if (expr
->type
!= EXPR_PREOP
|| expr
->op
!= '&')
182 expr
= deref_expression(expr
);
184 set_state_expr(my_id
, deref_expression(expr
), alloc_estate_whole(&ulong_ctype
));
185 tag_struct_members(type
, expr
);
189 static void match_user_copy(const char *fn
, struct expression
*expr
, void *_param
)
191 int param
= PTR_INT(_param
);
192 struct expression
*dest
;
194 dest
= get_argument_from_call_expr(expr
->args
, param
);
195 dest
= strip_expr(dest
);
198 tag_as_user_data(dest
);
201 static void match_sscanf(const char *fn
, struct expression
*expr
, void *unused
)
203 struct expression
*arg
;
207 FOR_EACH_PTR(expr
->args
, arg
) {
211 tag_as_user_data(arg
);
212 } END_FOR_EACH_PTR(arg
);
215 static int points_to_user_data(struct expression
*expr
)
217 struct smatch_state
*state
;
223 expr
= strip_expr(expr
);
225 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+') {
226 if (points_to_user_data(expr
->left
))
228 if (points_to_user_data(expr
->right
))
233 name
= expr_to_var_sym(expr
, &sym
);
236 snprintf(buf
, sizeof(buf
), "*%s", name
);
237 state
= get_state(my_id
, buf
, sym
);
238 if (state
&& estate_rl(state
))
245 static void set_points_to_user_data(struct expression
*expr
)
251 name
= expr_to_var_sym(expr
, &sym
);
254 snprintf(buf
, sizeof(buf
), "*%s", name
);
255 set_state(my_id
, buf
, sym
, alloc_estate_whole(&llong_ctype
));
260 static int is_skb_data(struct expression
*expr
)
264 expr
= strip_expr(expr
);
265 if (!expr
|| expr
->type
!= EXPR_DEREF
)
270 if (strcmp(expr
->member
->name
, "data") != 0)
273 sym
= expr_to_sym(expr
->deref
);
276 sym
= get_real_base_type(sym
);
277 if (!sym
|| sym
->type
!= SYM_PTR
)
279 sym
= get_real_base_type(sym
);
280 if (!sym
|| sym
->type
!= SYM_STRUCT
|| !sym
->ident
)
282 if (strcmp(sym
->ident
->name
, "sk_buff") != 0)
288 static int comes_from_skb_data(struct expression
*expr
)
290 expr
= strip_expr(expr
);
294 switch (expr
->type
) {
296 if (comes_from_skb_data(expr
->left
))
298 if (comes_from_skb_data(expr
->right
))
302 return comes_from_skb_data(expr
->unop
);
304 if (is_skb_data(expr
))
306 return comes_from_skb_data(expr
->deref
);
313 static int handle_struct_assignment(struct expression
*expr
)
315 struct expression
*right
;
316 struct symbol
*left_type
, *right_type
;
318 left_type
= get_type(expr
->left
);
319 if (!left_type
|| left_type
->type
!= SYM_PTR
)
321 left_type
= get_real_base_type(left_type
);
322 if (!left_type
|| left_type
->type
!= SYM_STRUCT
)
326 * Ignore struct to struct assignments because for those we look at the
327 * individual members.
329 right
= strip_expr(expr
->right
);
330 right_type
= get_type(right
);
331 if (!right_type
|| right_type
->type
!= SYM_PTR
)
334 /* If we are assigning struct members then normally that is handled
335 * by fake assignments, however if we cast one struct to a different
336 * of struct then we handle that here.
338 right_type
= get_real_base_type(right_type
);
339 if (right_type
== left_type
)
342 if (!points_to_user_data(right
) && !is_skb_data(right
))
345 tag_as_user_data(expr
->left
);
349 static int handle_get_user(struct expression
*expr
)
354 name
= get_macro_name(expr
->pos
);
355 if (!name
|| strcmp(name
, "get_user") != 0)
358 name
= expr_to_var(expr
->right
);
359 if (!name
|| strcmp(name
, "__val_gu") != 0)
361 set_state_expr(my_id
, expr
->left
, alloc_estate_whole(get_type(expr
->left
)));
368 static void match_assign(struct expression
*expr
)
370 struct range_list
*rl
;
372 if (is_fake_call(expr
->right
))
374 if (handle_get_user(expr
))
376 if (points_to_user_data(expr
->right
))
377 set_points_to_user_data(expr
->left
);
378 if (handle_struct_assignment(expr
))
381 if (expr
->right
->type
== EXPR_CALL
||
382 !get_user_rl(expr
->right
, &rl
))
383 goto clear_old_state
;
385 rl
= cast_rl(get_type(expr
->left
), rl
);
386 set_state_expr(my_id
, expr
->left
, alloc_estate_rl(rl
));
391 if (get_state_expr(my_id
, expr
->left
))
392 set_state_expr(my_id
, expr
->left
, alloc_estate_empty());
395 static void match_user_assign_function(const char *fn
, struct expression
*expr
, void *unused
)
397 tag_as_user_data(expr
->left
);
398 set_points_to_user_data(expr
->left
);
401 static void match_simple_strtoul(const char *fn
, struct expression
*expr
, void *unused
)
403 set_state_expr(my_id
, expr
->left
, alloc_estate_whole(get_type(expr
->left
)));
406 static int get_user_macro_rl(struct expression
*expr
, struct range_list
**rl
)
412 macro
= get_macro_name(expr
->pos
);
417 if (strcmp(macro
, "ntohl") == 0) {
418 *rl
= alloc_whole_rl(&uint_ctype
);
421 if (strcmp(macro
, "ntohs") == 0) {
422 *rl
= alloc_whole_rl(&ushort_ctype
);
428 static int user_data_flag
;
429 static struct range_list
*var_user_rl(struct expression
*expr
)
431 struct smatch_state
*state
;
432 struct range_list
*rl
;
433 struct range_list
*absolute_rl
;
435 if (get_user_macro_rl(expr
, &rl
))
438 if (comes_from_skb_data(expr
)) {
439 rl
= alloc_whole_rl(get_type(expr
));
443 state
= get_state_expr(my_id
, expr
);
444 if (state
&& estate_rl(state
)) {
445 rl
= estate_rl(state
);
452 absolute_rl
= var_to_absolute_rl(expr
);
453 return clone_rl(rl_intersection(rl
, absolute_rl
));
456 int get_user_rl(struct expression
*expr
, struct range_list
**rl
)
460 custom_get_absolute_rl(expr
, &var_user_rl
, rl
);
461 if (!user_data_flag
) {
468 int get_user_rl_var_sym(const char *name
, struct symbol
*sym
, struct range_list
**rl
)
470 struct smatch_state
*state
;
472 state
= get_state(my_id
, name
, sym
);
473 if (state
&& estate_rl(state
)) {
474 *rl
= estate_rl(state
);
480 static void match_call_info(struct expression
*expr
)
482 struct range_list
*rl
;
483 struct expression
*arg
;
487 FOR_EACH_PTR(expr
->args
, arg
) {
490 if (!get_user_rl(arg
, &rl
))
493 sql_insert_caller_info(expr
, USER_DATA3
, i
, "$", show_rl(rl
));
494 } END_FOR_EACH_PTR(arg
);
497 static void struct_member_callback(struct expression
*call
, int param
, char *printed_name
, struct sm_state
*sm
)
499 struct smatch_state
*state
;
500 struct range_list
*rl
;
502 if (strcmp(sm
->state
->name
, "") == 0)
505 state
= get_state(SMATCH_EXTRA
, sm
->name
, sm
->sym
);
506 if (!state
|| !estate_rl(state
))
507 rl
= estate_rl(sm
->state
);
509 rl
= rl_intersection(estate_rl(sm
->state
), estate_rl(state
));
511 sql_insert_caller_info(call
, USER_DATA3
, param
, printed_name
, show_rl(rl
));
514 static void set_param_user_data(const char *name
, struct symbol
*sym
, char *key
, char *value
)
516 struct range_list
*rl
= NULL
;
517 struct smatch_state
*state
;
521 if (strcmp(key
, "*$") == 0)
522 snprintf(fullname
, sizeof(fullname
), "*%s", name
);
523 else if (strncmp(key
, "$", 1) == 0)
524 snprintf(fullname
, 256, "%s%s", name
, key
+ 1);
528 type
= get_member_type_from_key(symbol_expression(sym
), key
);
530 /* if the caller passes a void pointer with user data */
531 if (strcmp(key
, "*$") == 0 && type
&& type
!= &void_ctype
) {
532 struct expression
*expr
= symbol_expression(sym
);
534 tag_as_user_data(expr
);
535 set_points_to_user_data(expr
);
538 str_to_rl(type
, value
, &rl
);
539 state
= alloc_estate_rl(rl
);
540 set_state(my_id
, fullname
, sym
, state
);
543 static void set_called(const char *name
, struct symbol
*sym
, char *key
, char *value
)
545 set_state(my_call_id
, "this_function", NULL
, &called
);
548 static void match_syscall_definition(struct symbol
*sym
)
555 macro
= get_macro_name(sym
->pos
);
557 (strncmp("SYSCALL_DEFINE", macro
, strlen("SYSCALL_DEFINE")) == 0 ||
558 strncmp("COMPAT_SYSCALL_DEFINE", macro
, strlen("COMPAT_SYSCALL_DEFINE")) == 0))
561 name
= get_function();
562 if (!option_no_db
&& get_state(my_call_id
, "this_function", NULL
) != &called
) {
563 if (name
&& strncmp(name
, "sys_", 4) == 0)
567 if (name
&& strncmp(name
, "compat_sys_", 11) == 0)
573 FOR_EACH_PTR(sym
->ctype
.base_type
->arguments
, arg
) {
574 set_state(my_id
, arg
->ident
->name
, arg
, alloc_estate_whole(get_real_base_type(arg
)));
575 } END_FOR_EACH_PTR(arg
);
578 static void returns_param_user_data(struct expression
*expr
, int param
, char *key
, char *value
)
580 struct expression
*arg
;
584 struct range_list
*rl
= NULL
;
586 while (expr
->type
== EXPR_ASSIGNMENT
)
587 expr
= strip_expr(expr
->right
);
588 if (expr
->type
!= EXPR_CALL
)
591 arg
= get_argument_from_call_expr(expr
->args
, param
);
594 type
= get_member_type_from_key(arg
, key
);
595 name
= get_variable_from_key(arg
, key
, &sym
);
599 call_results_to_rl(expr
, type
, value
, &rl
);
601 set_state(my_id
, name
, sym
, alloc_estate_rl(rl
));
606 static int has_empty_state(struct sm_state
*sm
)
608 struct sm_state
*tmp
;
610 FOR_EACH_PTR(sm
->possible
, tmp
) {
611 if (!estate_rl(tmp
->state
))
613 } END_FOR_EACH_PTR(tmp
);
618 static void param_set_to_user_data(int return_id
, char *return_ranges
, struct expression
*expr
)
621 struct smatch_state
*start_state
;
623 const char *param_name
;
625 FOR_EACH_MY_SM(my_id
, __get_cur_stree(), sm
) {
626 if (has_empty_state(sm
))
629 param
= get_param_num_from_sym(sm
->sym
);
631 if (expr_to_sym(expr
) == sm
->sym
)
637 /* The logic here was that if we were passed in a user data then
638 * we don't record that. It's like the difference between
639 * param_filter and param_set. When I think about it, I'm not
640 * sure it actually works. It's probably harmless because we
641 * checked earlier that we're not returning a parameter...
642 * Let's mark this as a TODO.
644 start_state
= get_state_stree(start_states
, my_id
, sm
->name
, sm
->sym
);
645 if (start_state
&& estates_equiv(sm
->state
, start_state
))
648 param_name
= get_param_name(sm
);
651 if (strcmp(param_name
, "$") == 0)
654 sql_insert_return_states(return_id
, return_ranges
, USER_DATA3
,
655 param
, param_name
, show_rl(estate_rl(sm
->state
)));
656 } END_FOR_EACH_SM(sm
);
659 void check_user_data2(int id
)
665 if (option_project
!= PROJ_KERNEL
)
668 add_hook(&save_start_states
, AFTER_DEF_HOOK
);
669 add_hook(&free_start_states
, AFTER_FUNC_HOOK
);
670 add_hook(&match_save_states
, INLINE_FN_START
);
671 add_hook(&match_restore_states
, INLINE_FN_END
);
673 add_unmatched_state_hook(my_id
, &empty_state
);
674 add_pre_merge_hook(my_id
, &pre_merge_hook
);
675 add_merge_hook(my_id
, &merge_estates
);
677 add_function_hook("copy_from_user", &match_user_copy
, INT_PTR(0));
678 add_function_hook("__copy_from_user", &match_user_copy
, INT_PTR(0));
679 add_function_hook("memcpy_fromiovec", &match_user_copy
, INT_PTR(0));
680 for (i
= 0; i
< ARRAY_SIZE(kstr_funcs
); i
++)
681 add_function_hook(kstr_funcs
[i
], &match_user_copy
, INT_PTR(2));
683 add_function_assign_hook("simple_strtol", &match_simple_strtoul
, NULL
);
684 add_function_assign_hook("simple_strtoll", &match_simple_strtoul
, NULL
);
685 add_function_assign_hook("simple_strtoul", &match_simple_strtoul
, NULL
);
686 add_function_assign_hook("simple_strtoull", &match_simple_strtoul
, NULL
);
688 add_function_hook("sscanf", &match_sscanf
, NULL
);
690 add_function_assign_hook("memdup_user", &match_user_assign_function
, NULL
);
691 add_function_assign_hook("kmap_atomic", &match_user_assign_function
, NULL
);
692 add_function_assign_hook("skb_network_header", &match_user_assign_function
, NULL
);
694 add_hook(&match_syscall_definition
, AFTER_DEF_HOOK
);
696 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
698 add_hook(&match_call_info
, FUNCTION_CALL_HOOK
);
699 add_member_info_callback(my_id
, struct_member_callback
);
700 select_caller_info_hook(set_param_user_data
, USER_DATA3
);
701 select_return_states_hook(USER_DATA3
, &returns_param_user_data
);
702 add_split_return_callback(¶m_set_to_user_data
);
705 void check_user_data3(int id
)
709 if (option_project
!= PROJ_KERNEL
)
711 select_caller_info_hook(set_called
, INTERNAL
);