2 * smatch/check_user_data.c
4 * Copyright (C) 2011 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 * There are a couple checks that try to see if a variable
12 * comes from the user. It would be better to unify them
13 * into one place. Also it we should follow the data down
14 * the call paths. Hence this file.
18 #include "smatch_slist.h"
19 #include "smatch_extra.h"
24 STATE(user_data_passed
);
32 int is_user_macro(struct expression
*expr
)
35 struct range_list
*rl
;
37 macro
= get_macro_name(expr
->pos
);
41 if (get_implied_rl(expr
, &rl
) && !is_whole_rl(rl
))
43 if (strcmp(macro
, "ntohl") == 0)
45 if (strcmp(macro
, "ntohs") == 0)
50 static int has_user_data_state(struct expression
*expr
, struct state_list
*my_slist
)
56 expr
= strip_expr(expr
);
57 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
58 expr
= strip_expr(expr
->unop
);
60 name
= expr_to_str_sym(expr
, &sym
);
65 FOR_EACH_PTR(my_slist
, sm
) {
68 } END_FOR_EACH_PTR(sm
);
72 static int passes_user_data(struct expression
*expr
)
74 struct state_list
*slist
;
75 struct expression
*arg
;
77 slist
= get_all_states(my_id
);
78 FOR_EACH_PTR(expr
->args
, arg
) {
79 if (is_user_data(arg
))
81 if (has_user_data_state(arg
, slist
))
83 } END_FOR_EACH_PTR(arg
);
88 static struct expression
*db_expr
;
89 static int db_user_data
;
90 static int db_user_data_callback(void *unused
, int argc
, char **argv
, char **azColName
)
92 if (atoi(argv
[0]) == PASSED_DATA
&& !passes_user_data(db_expr
))
98 static int is_user_fn_db(struct expression
*expr
)
101 static char sql_filter
[1024];
103 if (is_fake_call(expr
))
105 if (expr
->fn
->type
!= EXPR_SYMBOL
)
107 sym
= expr
->fn
->symbol
;
111 if (sym
->ctype
.modifiers
& MOD_STATIC
) {
112 snprintf(sql_filter
, 1024, "file = '%s' and function = '%s';",
113 get_filename(), sym
->ident
->name
);
115 snprintf(sql_filter
, 1024, "function = '%s' and static = 0;",
121 run_sql(db_user_data_callback
,
122 "select value from return_states where type=%d and parameter = -1 and key = '$$' and %s",
123 USER_DATA
, sql_filter
);
127 static int is_user_function(struct expression
*expr
)
129 if (expr
->type
!= EXPR_CALL
)
131 return is_user_fn_db(expr
);
134 static int is_skb_data(struct expression
*expr
)
141 name
= expr_to_var_sym(expr
, &sym
);
145 sym
= get_base_type(sym
);
146 if (!sym
|| sym
->type
!= SYM_PTR
)
148 sym
= get_base_type(sym
);
149 if (!sym
|| sym
->type
!= SYM_STRUCT
|| !sym
->ident
)
151 if (strcmp(sym
->ident
->name
, "sk_buff") != 0)
157 if (strcmp(name
+ len
- 6, "->data") == 0)
165 static int in_container_of_macro(struct expression
*expr
)
169 macro
= get_macro_name(expr
->pos
);
173 if (strcmp(macro
, "container_of") == 0)
178 static int is_user_data_state(struct expression
*expr
)
180 struct state_list
*slist
= NULL
;
181 struct sm_state
*tmp
;
186 tmp
= get_sm_state_expr(my_id
, expr
);
188 if (slist_has_state(tmp
->possible
, &user_data_set
))
190 if (slist_has_state(tmp
->possible
, &user_data_passed
))
195 name
= expr_to_str_sym(expr
, &sym
);
199 slist
= get_all_states(my_id
);
200 FOR_EACH_PTR(slist
, tmp
) {
203 if (!strncmp(tmp
->name
, name
, strlen(tmp
->name
))) {
204 if (slist_has_state(tmp
->possible
, &user_data_set
))
206 else if (slist_has_state(tmp
->possible
, &user_data_passed
))
210 } END_FOR_EACH_PTR(tmp
);
218 int is_user_data(struct expression
*expr
)
227 if (in_container_of_macro(expr
))
230 user_data
= is_user_macro(expr
);
233 user_data
= is_user_function(expr
);
236 user_data
= is_skb_data(expr
);
240 expr
= strip_expr(expr
); /* this has to come after is_user_macro() */
242 if (expr
->type
== EXPR_BINOP
) {
243 user_data
= is_user_data(expr
->left
);
248 user_data
= is_user_data(expr
->right
);
253 if (expr
->type
== EXPR_PREOP
&& (expr
->op
== '&' || expr
->op
== '*'))
254 expr
= strip_expr(expr
->unop
);
256 return is_user_data_state(expr
);
259 int is_capped_user_data(struct expression
*expr
)
263 sm
= get_sm_state_expr(my_id
, expr
);
266 if (slist_has_state(sm
->possible
, &capped
))
271 static void set_param_user_data(const char *name
, struct symbol
*sym
, char *key
, char *value
)
275 /* sanity check. this should always be true. */
276 if (strncmp(key
, "$$", 2) != 0)
278 snprintf(fullname
, 256, "%s%s", name
, key
+ 2);
279 set_state(my_id
, fullname
, sym
, &user_data_passed
);
282 static void match_syscall_definition(struct symbol
*sym
)
287 macro
= get_macro_name(sym
->pos
);
290 if (strncmp("SYSCALL_DEFINE", macro
, strlen("SYSCALL_DEFINE")) != 0 &&
291 strncmp("COMPAT_SYSCALL_DEFINE", macro
, strlen("COMPAT_SYSCALL_DEFINE")) != 0)
294 FOR_EACH_PTR(sym
->ctype
.base_type
->arguments
, arg
) {
295 set_state(my_id
, arg
->ident
->name
, arg
, &user_data_set
);
296 } END_FOR_EACH_PTR(arg
);
299 static void match_condition(struct expression
*expr
)
304 case SPECIAL_UNSIGNED_LT
:
305 case SPECIAL_UNSIGNED_LTE
:
306 if (is_user_data(expr
->left
))
307 set_true_false_states_expr(my_id
, expr
->left
, &capped
, NULL
);
308 if (is_user_data(expr
->right
))
309 set_true_false_states_expr(my_id
, expr
->right
, NULL
, &capped
);
313 case SPECIAL_UNSIGNED_GT
:
314 case SPECIAL_UNSIGNED_GTE
:
315 if (is_user_data(expr
->right
))
316 set_true_false_states_expr(my_id
, expr
->right
, &capped
, NULL
);
317 if (is_user_data(expr
->left
))
318 set_true_false_states_expr(my_id
, expr
->left
, NULL
, &capped
);
321 if (is_user_data(expr
->left
))
322 set_true_false_states_expr(my_id
, expr
->left
, &capped
, NULL
);
323 if (is_user_data(expr
->right
))
324 set_true_false_states_expr(my_id
, expr
->right
, &capped
, NULL
);
326 case SPECIAL_NOTEQUAL
:
327 if (is_user_data(expr
->left
))
328 set_true_false_states_expr(my_id
, expr
->left
, NULL
, &capped
);
329 if (is_user_data(expr
->right
))
330 set_true_false_states_expr(my_id
, expr
->right
, NULL
, &capped
);
337 static void set_capped(struct sm_state
*sm
, struct expression
*mod_expr
)
339 set_state(my_id
, sm
->name
, sm
->sym
, &capped
);
342 static int handle_get_user(struct expression
*expr
)
347 name
= get_macro_name(expr
->pos
);
348 if (!name
|| strcmp(name
, "get_user") != 0)
351 name
= expr_to_var(expr
->right
);
352 if (!name
|| strcmp(name
, "__val_gu") != 0)
354 set_state_expr(my_id
, expr
->left
, &user_data_set
);
361 static void match_assign(struct expression
*expr
)
365 if (handle_get_user(expr
))
368 user_data
= is_user_data(expr
->right
);
369 if (user_data
== PASSED_DATA
)
370 set_state_expr(my_id
, expr
->left
, &user_data_passed
);
371 else if (user_data
== SET_DATA
)
372 set_state_expr(my_id
, expr
->left
, &user_data_set
);
375 static void tag_struct_members(struct symbol
*type
, struct expression
*expr
)
378 struct expression
*member
;
381 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
382 expr
= strip_expr(expr
->unop
);
386 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
389 member
= member_expression(expr
, op
, tmp
->ident
);
390 set_state_expr(my_id
, member
, &user_data_set
);
391 } END_FOR_EACH_PTR(tmp
);
394 static void tag_base_type(struct expression
*expr
)
396 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
397 expr
= strip_expr(expr
->unop
);
399 expr
= deref_expression(expr
);
400 set_state_expr(my_id
, expr
, &user_data_set
);
403 static void tag_as_user_data(struct expression
*expr
)
407 expr
= strip_expr(expr
);
409 type
= get_type(expr
);
410 if (!type
|| type
->type
!= SYM_PTR
)
412 type
= get_real_base_type(type
);
415 if (type
== &void_ctype
) {
416 set_state_expr(my_id
, deref_expression(expr
), &user_data_set
);
419 if (type
->type
== SYM_BASETYPE
)
421 if (type
->type
== SYM_STRUCT
) {
422 if (expr
->type
!= EXPR_PREOP
|| expr
->op
!= '&')
423 expr
= deref_expression(expr
);
424 tag_struct_members(type
, expr
);
428 static void match_user_copy(const char *fn
, struct expression
*expr
, void *_param
)
430 int param
= PTR_INT(_param
);
431 struct expression
*dest
;
433 dest
= get_argument_from_call_expr(expr
->args
, param
);
434 dest
= strip_expr(dest
);
437 tag_as_user_data(dest
);
440 static void match_user_assign_function(const char *fn
, struct expression
*expr
, void *unused
)
442 set_state_expr(my_id
, expr
->left
, &user_data_set
);
445 static void match_macro_assign(const char *fn
, struct expression
*expr
, void *_bits
)
449 bits
= nr_bits(expr
->left
);
452 if (bits
> nr_bits(expr
->right
))
454 set_state_expr(my_id
, expr
->left
, &user_data_set
);
457 static void match_caller_info(struct expression
*expr
)
459 struct expression
*tmp
;
463 FOR_EACH_PTR(expr
->args
, tmp
) {
464 if (is_user_data(tmp
))
465 sql_insert_caller_info(expr
, USER_DATA
, i
, "$$", "");
467 } END_FOR_EACH_PTR(tmp
);
470 static void struct_member_callback(struct expression
*call
, int param
, char *printed_name
, struct smatch_state
*state
)
472 if (state
== &capped
)
474 sql_insert_caller_info(call
, USER_DATA
, param
, printed_name
, "");
477 static void returned_member_callback(int return_id
, char *return_ranges
, char *printed_name
, struct smatch_state
*state
)
479 if (state
== &capped
)
481 sql_insert_return_states(return_id
, return_ranges
, USER_DATA
, -1, printed_name
, "");
484 static void print_returned_user_data(int return_id
, char *return_ranges
, struct expression
*expr
)
486 struct state_list
*my_slist
;
487 struct sm_state
*tmp
;
490 const char *passed_or_new
;
492 user_data
= is_user_data(expr
);
493 if (user_data
== PASSED_DATA
) {
494 sql_insert_return_states(return_id
, return_ranges
, USER_DATA
,
497 if (user_data
== SET_DATA
) {
498 sql_insert_return_states(return_id
, return_ranges
, USER_DATA
,
502 my_slist
= get_all_states(my_id
);
504 FOR_EACH_PTR(my_slist
, tmp
) {
505 const char *param_name
;
507 param
= get_param_num_from_sym(tmp
->sym
);
511 if (is_capped_var_sym(tmp
->name
, tmp
->sym
))
513 /* ignore states that were already USER_DATA to begin with */
514 if (get_state_slist(get_start_states(), my_id
, tmp
->name
, tmp
->sym
))
517 param_name
= get_param_name(tmp
);
521 if (slist_has_state(tmp
->possible
, &user_data_set
))
523 else if (slist_has_state(tmp
->possible
, &user_data_passed
))
528 sql_insert_return_states(return_id
, return_ranges
, USER_DATA
,
529 param
, param_name
, passed_or_new
);
530 } END_FOR_EACH_PTR(tmp
);
532 free_slist(&my_slist
);
535 static void db_return_states_userdata(struct expression
*expr
, int param
, char *key
, char *value
)
540 if (expr
->type
== EXPR_ASSIGNMENT
&& param
== -1 && strcmp(key
, "*$$") == 0) {
541 tag_as_user_data(expr
->left
);
545 name
= return_state_to_var_sym(expr
, param
, key
, &sym
);
549 set_state(my_id
, name
, sym
, &user_data_set
);
554 void check_user_data(int id
)
556 if (option_project
!= PROJ_KERNEL
)
559 select_caller_info_hook(set_param_user_data
, USER_DATA
);
560 add_hook(&match_syscall_definition
, FUNC_DEF_HOOK
);
561 add_hook(&match_condition
, CONDITION_HOOK
);
562 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
563 add_function_hook("copy_from_user", &match_user_copy
, INT_PTR(0));
564 add_function_hook("__copy_from_user", &match_user_copy
, INT_PTR(0));
565 add_function_hook("memcpy_fromiovec", &match_user_copy
, INT_PTR(0));
566 add_function_assign_hook("kmemdup_user", &match_user_assign_function
, NULL
);
568 add_hook(&match_caller_info
, FUNCTION_CALL_HOOK
);
569 add_member_info_callback(my_id
, struct_member_callback
);
570 add_returned_member_callback(my_id
, returned_member_callback
);
571 add_split_return_callback(print_returned_user_data
);
572 select_return_states_hook(USER_DATA
, &db_return_states_userdata
);
574 add_modification_hook(my_id
, &set_capped
);
576 add_macro_assign_hook("ntohl", &match_macro_assign
, NULL
);
577 add_macro_assign_hook("ntohs", &match_macro_assign
, NULL
);