2 * Copyright (C) 2011 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * There are a couple checks that try to see if a variable
20 * comes from the user. It would be better to unify them
21 * into one place. Also it we should follow the data down
22 * the call paths. Hence this file.
26 #include "smatch_slist.h"
27 #include "smatch_extra.h"
30 static int my_call_id
;
33 static unsigned long func_gets_user_data
;
35 static const char *kstr_funcs
[] = {
36 "kstrtoull", "kstrtoll", "kstrtoul", "kstrtol", "kstrtouint",
37 "kstrtoint", "kstrtou64", "kstrtos64", "kstrtou32", "kstrtos32",
38 "kstrtou16", "kstrtos16", "kstrtou8", "kstrtos8", "kstrtoull_from_user"
39 "kstrtoll_from_user", "kstrtoul_from_user", "kstrtol_from_user",
40 "kstrtouint_from_user", "kstrtoint_from_user", "kstrtou16_from_user",
41 "kstrtos16_from_user", "kstrtou8_from_user", "kstrtos8_from_user",
42 "kstrtou64_from_user", "kstrtos64_from_user", "kstrtou32_from_user",
43 "kstrtos32_from_user",
46 static const char *returns_user_data
[] = {
47 "simple_strtol", "simple_strtoll", "simple_strtoul", "simple_strtoull",
51 static struct stree
*start_states
;
52 static void save_start_states(struct statement
*stmt
)
54 start_states
= clone_stree(__get_cur_stree());
57 static void free_start_states(void)
59 free_stree(&start_states
);
62 static struct smatch_state
*empty_state(struct sm_state
*sm
)
64 return alloc_estate_empty();
67 static struct smatch_state
*new_state(struct symbol
*type
)
69 struct smatch_state
*state
;
71 if (!type
|| type_is_ptr(type
))
74 state
= alloc_estate_whole(type
);
75 estate_set_new(state
);
79 static void pre_merge_hook(struct sm_state
*cur
, struct sm_state
*other
)
81 struct smatch_state
*user
= cur
->state
;
82 struct smatch_state
*extra
;
83 struct smatch_state
*state
;
84 struct range_list
*rl
;
86 extra
= __get_state(SMATCH_EXTRA
, cur
->name
, cur
->sym
);
89 rl
= rl_intersection(estate_rl(user
), estate_rl(extra
));
90 state
= alloc_estate_rl(clone_rl(rl
));
91 if (estate_capped(user
) || is_capped_var_sym(cur
->name
, cur
->sym
))
92 estate_set_capped(state
);
93 if (estate_treat_untagged(user
))
94 estate_set_treat_untagged(state
);
95 if (estates_equiv(state
, cur
->state
))
97 set_state(my_id
, cur
->name
, cur
->sym
, state
);
100 static void extra_nomod_hook(const char *name
, struct symbol
*sym
, struct expression
*expr
, struct smatch_state
*state
)
102 struct smatch_state
*user
, *new;
103 struct range_list
*rl
;
105 user
= __get_state(my_id
, name
, sym
);
108 rl
= rl_intersection(estate_rl(user
), estate_rl(state
));
109 if (rl_equiv(rl
, estate_rl(user
)))
111 new = alloc_estate_rl(rl
);
112 if (estate_capped(user
))
113 estate_set_capped(new);
114 if (estate_treat_untagged(user
))
115 estate_set_treat_untagged(new);
116 set_state(my_id
, name
, sym
, new);
119 static bool user_rl_known(struct expression
*expr
)
121 struct range_list
*rl
;
124 if (!get_user_rl(expr
, &rl
))
127 close_to_max
= sval_type_max(rl_type(rl
));
128 close_to_max
.value
-= 100;
130 if (sval_cmp(rl_max(rl
), close_to_max
) >= 0)
135 static bool is_array_index_mask_nospec(struct expression
*expr
)
137 struct expression
*orig
;
139 orig
= get_assigned_expr(expr
);
140 if (!orig
|| orig
->type
!= EXPR_CALL
)
142 return sym_name_is("array_index_mask_nospec", orig
->fn
);
145 static bool binop_capped(struct expression
*expr
)
147 struct range_list
*left_rl
;
151 if (expr
->op
== '-' && get_user_rl(expr
->left
, &left_rl
)) {
152 if (user_rl_capped(expr
->left
))
154 comparison
= get_comparison(expr
->left
, expr
->right
);
155 if (comparison
&& show_special(comparison
)[0] == '>')
160 if (expr
->op
== '&' || expr
->op
== '%') {
161 bool left_user
, left_capped
, right_user
, right_capped
;
163 if (!get_value(expr
->right
, &sval
) && is_capped(expr
->right
))
165 if (is_array_index_mask_nospec(expr
->right
))
167 if (is_capped(expr
->left
))
169 left_user
= is_user_rl(expr
->left
);
170 right_user
= is_user_rl(expr
->right
);
171 if (!left_user
&& !right_user
)
174 left_capped
= user_rl_capped(expr
->left
);
175 right_capped
= user_rl_capped(expr
->right
);
177 if (left_user
&& left_capped
) {
180 if (right_user
&& right_capped
)
184 if (right_user
&& right_capped
) {
193 * Generally "capped" means that we capped it to an unknown value.
194 * This is useful because if Smatch doesn't know what the value is then
195 * we have to trust that it is correct. But if we known cap value is
196 * 100 then we can check if 100 is correct and complain if it's wrong.
198 * So then the problem is with BINOP when we take a capped variable
199 * plus a user variable which is clamped to a known range (uncapped)
200 * the result should be capped.
202 if ((user_rl_capped(expr
->left
) || user_rl_known(expr
->left
)) &&
203 (user_rl_capped(expr
->right
) || user_rl_known(expr
->right
)))
209 bool user_rl_capped(struct expression
*expr
)
211 struct smatch_state
*state
;
212 struct range_list
*rl
;
215 expr
= strip_expr(expr
);
218 if (get_value(expr
, &sval
))
220 if (expr
->type
== EXPR_BINOP
)
221 return binop_capped(expr
);
222 if ((expr
->type
== EXPR_PREOP
|| expr
->type
== EXPR_POSTOP
) &&
223 (expr
->op
== SPECIAL_INCREMENT
|| expr
->op
== SPECIAL_DECREMENT
))
224 return user_rl_capped(expr
->unop
);
225 state
= get_state_expr(my_id
, expr
);
227 return estate_capped(state
);
229 if (!get_user_rl(expr
, &rl
)) {
231 * The non user data parts of a binop are capped and
232 * also empty user rl states are capped.
237 if (rl_to_sval(rl
, &sval
))
240 return false; /* uncapped user data */
243 bool user_rl_treat_untagged(struct expression
*expr
)
245 struct smatch_state
*state
;
246 struct range_list
*rl
;
249 expr
= strip_expr(expr
);
252 if (get_value(expr
, &sval
))
255 state
= get_state_expr(my_id
, expr
);
257 return estate_treat_untagged(state
);
259 if (get_user_rl(expr
, &rl
))
260 return false; /* uncapped user data */
262 return true; /* not actually user data */
265 static void tag_inner_struct_members(struct expression
*expr
, struct symbol
*member
)
267 struct expression
*edge_member
;
268 struct symbol
*base
= get_real_base_type(member
);
272 expr
= member_expression(expr
, '.', member
->ident
);
274 FOR_EACH_PTR(base
->symbol_list
, tmp
) {
277 type
= get_real_base_type(tmp
);
281 if (type
->type
== SYM_UNION
|| type
->type
== SYM_STRUCT
) {
282 tag_inner_struct_members(expr
, tmp
);
289 edge_member
= member_expression(expr
, '.', tmp
->ident
);
290 set_state_expr(my_id
, edge_member
, new_state(type
));
291 } END_FOR_EACH_PTR(tmp
);
294 void __set_user_string(struct expression
*expr
);
295 static void tag_struct_members(struct symbol
*type
, struct expression
*expr
)
298 struct expression
*member
;
301 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
302 expr
= strip_expr(expr
->unop
);
306 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
307 type
= get_real_base_type(tmp
);
311 if (type
->type
== SYM_UNION
|| type
->type
== SYM_STRUCT
) {
312 tag_inner_struct_members(expr
, tmp
);
319 member
= member_expression(expr
, op
, tmp
->ident
);
320 if (type
->type
== SYM_ARRAY
) {
321 set_points_to_user_data(member
);
323 set_state_expr(my_id
, member
, new_state(get_type(member
)));
325 } END_FOR_EACH_PTR(tmp
);
328 static void tag_base_type(struct expression
*expr
)
330 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
331 expr
= strip_expr(expr
->unop
);
333 expr
= deref_expression(expr
);
334 set_state_expr(my_id
, expr
, new_state(get_type(expr
)));
337 static void tag_as_user_data(struct expression
*expr
)
341 expr
= strip_expr(expr
);
343 type
= get_type(expr
);
344 if (!type
|| type
->type
!= SYM_PTR
)
346 type
= get_real_base_type(type
);
349 if (type
== &void_ctype
) {
350 set_state_expr(my_id
, deref_expression(expr
), new_state(&ulong_ctype
));
353 if (type
->type
== SYM_BASETYPE
) {
354 if (expr
->type
!= EXPR_PREOP
&& expr
->op
!= '&')
355 set_points_to_user_data(expr
);
359 if (type
->type
== SYM_STRUCT
|| type
->type
== SYM_UNION
) {
360 if (expr
->type
!= EXPR_PREOP
|| expr
->op
!= '&')
361 expr
= deref_expression(expr
);
363 set_state_expr(my_id
, deref_expression(expr
), new_state(&ulong_ctype
));
364 tag_struct_members(type
, expr
);
368 static struct expression
*ignore_param_set
;
369 static void match_user_copy(const char *fn
, struct expression
*expr
, void *_param
)
371 int param
= PTR_INT(_param
);
372 struct expression
*dest
;
374 func_gets_user_data
= true;
375 ignore_param_set
= expr
;
377 dest
= get_argument_from_call_expr(expr
->args
, param
);
378 dest
= strip_expr(dest
);
381 tag_as_user_data(dest
);
384 static int is_dev_attr_name(struct expression
*expr
)
389 name
= expr_to_str(expr
);
392 if (strstr(name
, "->attr.name"))
398 static int ends_in_n(struct expression
*expr
)
404 if (expr
->type
!= EXPR_STRING
|| !expr
->string
)
411 if (str
->data
[str
->length
- 3] == '%' &&
412 str
->data
[str
->length
- 2] == 'n')
417 static void match_sscanf(const char *fn
, struct expression
*expr
, void *unused
)
419 struct expression
*str
, *format
, *arg
;
422 func_gets_user_data
= true;
424 str
= get_argument_from_call_expr(expr
->args
, 0);
425 if (is_dev_attr_name(str
))
428 format
= get_argument_from_call_expr(expr
->args
, 1);
429 if (is_dev_attr_name(format
))
432 last
= ptr_list_size((struct ptr_list
*)expr
->args
) - 1;
435 FOR_EACH_PTR(expr
->args
, arg
) {
439 if (i
== last
&& ends_in_n(format
))
441 tag_as_user_data(arg
);
442 } END_FOR_EACH_PTR(arg
);
445 static int get_rl_from_function(struct expression
*expr
, struct range_list
**rl
)
449 if (expr
->type
!= EXPR_CALL
|| expr
->fn
->type
!= EXPR_SYMBOL
||
450 !expr
->fn
->symbol_name
|| !expr
->fn
->symbol_name
->name
)
453 for (i
= 0; i
< ARRAY_SIZE(returns_user_data
); i
++) {
454 if (strcmp(expr
->fn
->symbol_name
->name
, returns_user_data
[i
]) == 0) {
455 *rl
= alloc_whole_rl(get_type(expr
));
462 static int comes_from_skb_data(struct expression
*expr
)
464 expr
= strip_expr(expr
);
465 if (!expr
|| expr
->type
!= EXPR_PREOP
|| expr
->op
!= '*')
468 expr
= strip_expr(expr
->unop
);
471 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+')
472 expr
= strip_expr(expr
->left
);
474 return is_skb_data(expr
);
477 static int handle_get_user(struct expression
*expr
)
482 name
= get_macro_name(expr
->pos
);
483 if (!name
|| strcmp(name
, "get_user") != 0)
486 name
= expr_to_var(expr
->right
);
487 if (!name
|| (strcmp(name
, "__val_gu") != 0 && strcmp(name
, "__gu_val") != 0))
489 set_state_expr(my_id
, expr
->left
, new_state(get_type(expr
->left
)));
496 static bool state_is_new(struct expression
*expr
)
498 struct smatch_state
*state
;
500 state
= get_state_expr(my_id
, expr
);
501 if (estate_new(state
))
504 if (expr
->type
== EXPR_BINOP
) {
505 if (state_is_new(expr
->left
))
507 if (state_is_new(expr
->right
))
513 static bool handle_op_assign(struct expression
*expr
)
515 struct expression
*binop_expr
;
516 struct smatch_state
*state
;
517 struct range_list
*rl
;
520 case SPECIAL_ADD_ASSIGN
:
521 case SPECIAL_SUB_ASSIGN
:
522 case SPECIAL_AND_ASSIGN
:
523 case SPECIAL_MOD_ASSIGN
:
524 case SPECIAL_SHL_ASSIGN
:
525 case SPECIAL_SHR_ASSIGN
:
526 case SPECIAL_OR_ASSIGN
:
527 case SPECIAL_XOR_ASSIGN
:
528 case SPECIAL_MUL_ASSIGN
:
529 case SPECIAL_DIV_ASSIGN
:
530 binop_expr
= binop_expression(expr
->left
,
531 op_remove_assign(expr
->op
),
533 if (!get_user_rl(binop_expr
, &rl
))
536 rl
= cast_rl(get_type(expr
->left
), rl
);
537 state
= alloc_estate_rl(rl
);
538 if (user_rl_capped(binop_expr
))
539 estate_set_capped(state
);
540 if (user_rl_treat_untagged(expr
->left
))
541 estate_set_treat_untagged(state
);
542 if (state_is_new(binop_expr
))
543 estate_set_new(state
);
544 set_state_expr(my_id
, expr
->left
, state
);
550 static void match_assign(struct expression
*expr
)
552 struct symbol
*left_type
, *right_type
;
553 struct range_list
*rl
;
554 static struct expression
*handled
;
555 struct smatch_state
*state
;
556 struct expression
*faked
;
557 bool is_capped
= false;
560 left_type
= get_type(expr
->left
);
561 if (left_type
== &void_ctype
)
564 faked
= get_faked_expression();
566 /* FIXME: handle fake array assignments frob(&user_array[x]); */
568 if (is_fake_call(expr
->right
) && faked
&&
569 faked
->type
== EXPR_ASSIGNMENT
&&
570 points_to_user_data(faked
->right
)) {
571 if (is_skb_data(faked
->right
))
572 func_gets_user_data
= true;
573 rl
= alloc_whole_rl(get_type(expr
->left
));
578 if (faked
&& faked
== handled
)
580 if (is_fake_call(expr
->right
))
581 goto clear_old_state
;
582 if (handle_get_user(expr
))
584 if (points_to_user_data(expr
->right
) &&
585 is_struct_ptr(get_type(expr
->left
))) {
587 // This should be handled by smatch_points_to_user_data.c
588 // set_points_to_user_data(expr->left);
591 if (handle_op_assign(expr
))
594 goto clear_old_state
;
596 /* Handled by DB code */
597 if (expr
->right
->type
== EXPR_CALL
|| __in_fake_parameter_assign
)
600 if (!get_user_rl(expr
->right
, &rl
))
601 goto clear_old_state
;
602 is_capped
= user_rl_capped(expr
->right
);
603 is_new
= state_is_new(expr
->right
);
606 if (type_is_ptr(left_type
)) {
607 right_type
= get_type(expr
->right
);
608 if (right_type
&& right_type
->type
== SYM_ARRAY
)
609 set_points_to_user_data(expr
->left
);
613 rl
= cast_rl(left_type
, rl
);
614 state
= alloc_estate_rl(rl
);
616 estate_set_new(state
);
618 estate_set_capped(state
);
619 if (user_rl_treat_untagged(expr
->right
))
620 estate_set_treat_untagged(state
);
622 set_state_expr(my_id
, expr
->left
, state
);
629 * HACK ALERT!!! This should be at the start of the function. The
630 * the problem is that handling "pointer = array;" assignments is
631 * handled in this function instead of in kernel_points_to_user_data.c.
633 if (type_is_ptr(left_type
))
636 if (get_state_expr(my_id
, expr
->left
))
637 set_state_expr(my_id
, expr
->left
, alloc_estate_empty());
640 static void handle_eq_noteq(struct expression
*expr
)
642 struct smatch_state
*left_orig
, *right_orig
;
644 left_orig
= get_state_expr(my_id
, expr
->left
);
645 right_orig
= get_state_expr(my_id
, expr
->right
);
647 if (!left_orig
&& !right_orig
)
649 if (left_orig
&& right_orig
)
653 set_true_false_states_expr(my_id
, expr
->left
,
654 expr
->op
== SPECIAL_EQUAL
? alloc_estate_empty() : NULL
,
655 expr
->op
== SPECIAL_EQUAL
? NULL
: alloc_estate_empty());
657 set_true_false_states_expr(my_id
, expr
->right
,
658 expr
->op
== SPECIAL_EQUAL
? alloc_estate_empty() : NULL
,
659 expr
->op
== SPECIAL_EQUAL
? NULL
: alloc_estate_empty());
663 static struct range_list
*strip_negatives(struct range_list
*rl
)
665 sval_t min
= rl_min(rl
);
666 sval_t minus_one
= { .type
= rl_type(rl
), .value
= -1 };
667 sval_t over
= { .type
= rl_type(rl
), .value
= INT_MAX
+ 1ULL };
668 sval_t max
= sval_type_max(rl_type(rl
));
673 if (type_unsigned(rl_type(rl
)) && type_bits(rl_type(rl
)) > 31)
674 return remove_range(rl
, over
, max
);
676 return remove_range(rl
, min
, minus_one
);
679 static void handle_compare(struct expression
*expr
)
681 struct expression
*left
, *right
;
682 struct range_list
*left_rl
= NULL
;
683 struct range_list
*right_rl
= NULL
;
684 struct range_list
*user_rl
;
685 struct smatch_state
*capped_state
;
686 struct smatch_state
*left_true
= NULL
;
687 struct smatch_state
*left_false
= NULL
;
688 struct smatch_state
*right_true
= NULL
;
689 struct smatch_state
*right_false
= NULL
;
693 left
= strip_expr(expr
->left
);
694 right
= strip_expr(expr
->right
);
696 while (left
->type
== EXPR_ASSIGNMENT
)
697 left
= strip_expr(left
->left
);
700 * Conditions are mostly handled by smatch_extra.c, but there are some
701 * times where the exact values are not known so we can't do that.
703 * Normally, we might consider using smatch_capped.c to supliment smatch
704 * extra but that doesn't work when we merge unknown uncapped kernel
705 * data with unknown capped user data. The result is uncapped user
706 * data. We need to keep it separate and say that the user data is
707 * capped. In the past, I would have marked this as just regular
708 * kernel data (not user data) but we can't do that these days because
709 * we need to track user data for Spectre.
711 * The other situation which we have to handle is when we do have an
712 * int and we compare against an unknown unsigned kernel variable. In
713 * that situation we assume that the kernel data is less than INT_MAX.
714 * Otherwise then we get all sorts of array underflow false positives.
718 /* Handled in smatch_extra.c */
719 if (get_implied_value(left
, &sval
) ||
720 get_implied_value(right
, &sval
))
723 get_user_rl(left
, &left_rl
);
724 get_user_rl(right
, &right_rl
);
727 if (!left_rl
&& !right_rl
)
729 /* if both sides are user data that's not a good limit */
730 if (left_rl
&& right_rl
)
738 type
= get_type(expr
);
739 if (type_unsigned(type
))
740 user_rl
= strip_negatives(user_rl
);
741 capped_state
= alloc_estate_rl(user_rl
);
742 estate_set_capped(capped_state
);
746 case SPECIAL_UNSIGNED_LT
:
748 case SPECIAL_UNSIGNED_LTE
:
750 left_true
= capped_state
;
752 right_false
= capped_state
;
755 case SPECIAL_UNSIGNED_GT
:
757 case SPECIAL_UNSIGNED_GTE
:
759 left_false
= capped_state
;
761 right_true
= capped_state
;
765 set_true_false_states_expr(my_id
, left
, left_true
, left_false
);
766 set_true_false_states_expr(my_id
, right
, right_true
, right_false
);
769 static void match_condition(struct expression
*expr
)
771 if (expr
->type
!= EXPR_COMPARE
)
774 if (expr
->op
== SPECIAL_EQUAL
||
775 expr
->op
== SPECIAL_NOTEQUAL
) {
776 handle_eq_noteq(expr
);
780 handle_compare(expr
);
783 static void match_returns_user_rl(const char *fn
, struct expression
*expr
, void *unused
)
785 func_gets_user_data
= true;
788 static int get_user_macro_rl(struct expression
*expr
, struct range_list
**rl
)
790 struct expression
*parent
;
796 macro
= get_macro_name(expr
->pos
);
800 /* handle ntohl(foo[i]) where "i" is trusted */
801 parent
= expr_get_parent_expr(expr
);
802 while (parent
&& parent
->type
!= EXPR_BINOP
)
803 parent
= expr_get_parent_expr(parent
);
804 if (parent
&& parent
->type
== EXPR_BINOP
) {
805 char *parent_macro
= get_macro_name(parent
->pos
);
807 if (parent_macro
&& strcmp(macro
, parent_macro
) == 0)
811 if (strcmp(macro
, "ntohl") == 0) {
812 *rl
= alloc_whole_rl(&uint_ctype
);
815 if (strcmp(macro
, "ntohs") == 0) {
816 *rl
= alloc_whole_rl(&ushort_ctype
);
822 static int has_user_data(struct symbol
*sym
)
824 struct sm_state
*tmp
;
826 FOR_EACH_MY_SM(my_id
, __get_cur_stree(), tmp
) {
829 } END_FOR_EACH_SM(tmp
);
833 bool we_pass_user_data(struct expression
*call
)
835 struct expression
*arg
;
838 FOR_EACH_PTR(call
->args
, arg
) {
839 if (points_to_user_data(arg
))
841 sym
= expr_to_sym(arg
);
844 if (has_user_data(sym
))
846 } END_FOR_EACH_PTR(arg
);
851 static int db_returned_user_rl(struct expression
*call
, struct range_list
**rl
)
853 struct smatch_state
*state
;
856 if (is_fake_call(call
))
858 snprintf(buf
, sizeof(buf
), "return %p", call
);
859 state
= get_state(my_id
, buf
, NULL
);
860 if (!state
|| !estate_rl(state
))
862 *rl
= estate_rl(state
);
866 struct stree
*get_user_stree(void)
868 return get_all_states_stree(my_id
);
871 static int user_data_flag
;
872 static int no_user_data_flag
;
873 struct range_list
*var_user_rl(struct expression
*expr
)
875 struct smatch_state
*state
;
876 struct range_list
*rl
;
877 struct range_list
*absolute_rl
;
879 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
880 no_user_data_flag
= 1;
884 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '%') {
885 struct range_list
*left
, *right
;
887 if (!get_user_rl(expr
->right
, &right
))
889 get_absolute_rl(expr
->left
, &left
);
890 rl
= rl_binop(left
, '%', right
);
894 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '/') {
895 struct range_list
*left
= NULL
;
896 struct range_list
*right
= NULL
;
897 struct range_list
*abs_right
;
900 * The specific bug I'm dealing with is:
902 * foo = capped_user / unknown;
904 * Instead of just saying foo is now entirely user_rl we should
905 * probably say instead that it is not at all user data.
909 get_user_rl(expr
->left
, &left
);
910 get_user_rl(expr
->right
, &right
);
911 get_absolute_rl(expr
->right
, &abs_right
);
913 if (left
&& !right
) {
914 rl
= rl_binop(left
, '/', abs_right
);
915 if (sval_cmp(rl_max(left
), rl_max(rl
)) < 0)
916 no_user_data_flag
= 1;
922 if (get_rl_from_function(expr
, &rl
))
925 if (get_user_macro_rl(expr
, &rl
))
928 if (comes_from_skb_data(expr
)) {
929 rl
= alloc_whole_rl(get_type(expr
));
933 state
= get_state_expr(my_id
, expr
);
934 if (state
&& estate_rl(state
)) {
935 rl
= estate_rl(state
);
939 if (expr
->type
== EXPR_CALL
&& db_returned_user_rl(expr
, &rl
))
942 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '*' &&
943 points_to_user_data(expr
->unop
)) {
944 rl
= var_to_absolute_rl(expr
);
948 if (is_array(expr
)) {
949 struct expression
*array
= get_array_base(expr
);
951 if (!get_state_expr(my_id
, array
)) {
952 no_user_data_flag
= 1;
960 absolute_rl
= var_to_absolute_rl(expr
);
961 return clone_rl(rl_intersection(rl
, absolute_rl
));
964 static bool is_ptr_subtract(struct expression
*expr
)
966 expr
= strip_expr(expr
);
969 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '-' &&
970 type_is_ptr(get_type(expr
->left
))) {
976 int get_user_rl(struct expression
*expr
, struct range_list
**rl
)
978 if (is_ptr_subtract(expr
))
982 no_user_data_flag
= 0;
983 custom_get_absolute_rl(expr
, &var_user_rl
, rl
);
984 if (!user_data_flag
|| no_user_data_flag
)
990 int is_user_rl(struct expression
*expr
)
992 struct range_list
*tmp
;
994 return get_user_rl(expr
, &tmp
) && tmp
;
997 int get_user_rl_var_sym(const char *name
, struct symbol
*sym
, struct range_list
**rl
)
999 struct smatch_state
*state
;
1001 state
= get_state(my_id
, name
, sym
);
1002 if (state
&& estate_rl(state
)) {
1003 *rl
= estate_rl(state
);
1009 static void return_info_callback(int return_id
, char *return_ranges
,
1010 struct expression
*returned_expr
,
1012 const char *printed_name
,
1013 struct sm_state
*sm
)
1015 struct smatch_state
*extra
;
1016 struct range_list
*rl
;
1020 if (strcmp(printed_name
, "$") == 0)
1022 if (!param_was_set_var_sym(sm
->name
, sm
->sym
))
1025 rl
= estate_rl(sm
->state
);
1028 extra
= get_state(SMATCH_EXTRA
, sm
->name
, sm
->sym
);
1029 if (estate_rl(extra
))
1030 rl
= rl_intersection(estate_rl(sm
->state
), estate_rl(extra
));
1034 snprintf(buf
, sizeof(buf
), "%s%s%s",
1036 estate_capped(sm
->state
) ? "[c]" : "",
1037 estate_treat_untagged(sm
->state
) ? "[u]" : "");
1038 sql_insert_return_states(return_id
, return_ranges
,
1039 estate_new(sm
->state
) ? USER_DATA_SET
: USER_DATA
,
1040 param
, printed_name
, buf
);
1043 static void caller_info_callback(struct expression
*call
, int param
, char *printed_name
, struct sm_state
*sm
)
1045 struct smatch_state
*state
;
1046 struct range_list
*rl
;
1047 struct symbol
*type
;
1051 * Smatch uses a hack where if we get an unsigned long we say it's
1052 * both user data and it points to user data. But if we pass it to a
1053 * function which takes an int, then it's just user data. There's not
1054 * enough bytes for it to be a pointer.
1057 type
= get_arg_type(call
->fn
, param
);
1058 if (strcmp(printed_name
, "$") != 0 && type
&& type_bits(type
) < type_bits(&ptr_ctype
))
1061 if (strcmp(sm
->state
->name
, "") == 0)
1064 state
= __get_state(SMATCH_EXTRA
, sm
->name
, sm
->sym
);
1065 if (!state
|| !estate_rl(state
))
1066 rl
= estate_rl(sm
->state
);
1068 rl
= rl_intersection(estate_rl(sm
->state
), estate_rl(state
));
1073 snprintf(buf
, sizeof(buf
), "%s%s%s", show_rl(rl
),
1074 estate_capped(sm
->state
) ? "[c]" : "",
1075 estate_treat_untagged(sm
->state
) ? "[u]" : "");
1076 sql_insert_caller_info(call
, USER_DATA
, param
, printed_name
, buf
);
1079 static void db_param_set(struct expression
*expr
, int param
, char *key
, char *value
)
1081 struct expression
*arg
;
1084 struct smatch_state
*state
;
1086 while (expr
->type
== EXPR_ASSIGNMENT
)
1087 expr
= strip_expr(expr
->right
);
1088 if (expr
->type
!= EXPR_CALL
)
1090 if (expr
== ignore_param_set
)
1093 arg
= get_argument_from_call_expr(expr
->args
, param
);
1096 name
= get_variable_from_key(arg
, key
, &sym
);
1100 state
= get_state(my_id
, name
, sym
);
1104 set_state(my_id
, name
, sym
, alloc_estate_empty());
1109 static bool param_data_capped(const char *value
)
1111 if (strstr(value
, ",c") || strstr(value
, "[c"))
1116 static bool param_data_treat_untagged(const char *value
)
1118 if (strstr(value
, ",u") || strstr(value
, "[u"))
1123 static void set_param_user_data(const char *name
, struct symbol
*sym
, char *key
, char *value
)
1125 struct expression
*expr
;
1126 struct range_list
*rl
= NULL
;
1127 struct smatch_state
*state
;
1128 struct symbol
*type
;
1131 expr
= symbol_expression(sym
);
1132 fullname
= get_variable_from_key(expr
, key
, NULL
);
1136 type
= get_member_type_from_key(expr
, key
);
1137 if (type
&& type
->type
== SYM_STRUCT
)
1140 // FIXME: This is temporary. Just run this on Thursday and then
1141 // let's make it a printf() and then delete it.
1145 str_to_rl(type
, value
, &rl
);
1146 rl
= swap_mtag_seed(expr
, rl
);
1147 state
= alloc_estate_rl(rl
);
1148 if (param_data_capped(value
) || is_capped(expr
))
1149 estate_set_capped(state
);
1150 if (param_data_treat_untagged(value
) || sym
->ctype
.as
== 5)
1151 estate_set_treat_untagged(state
);
1152 set_state(my_id
, fullname
, sym
, state
);
1155 static void set_called(const char *name
, struct symbol
*sym
, char *key
, char *value
)
1157 set_state(my_call_id
, "this_function", NULL
, &called
);
1160 static void match_syscall_definition(struct symbol
*sym
)
1167 macro
= get_macro_name(sym
->pos
);
1169 (strncmp("SYSCALL_DEFINE", macro
, strlen("SYSCALL_DEFINE")) == 0 ||
1170 strncmp("COMPAT_SYSCALL_DEFINE", macro
, strlen("COMPAT_SYSCALL_DEFINE")) == 0))
1173 name
= get_function();
1174 if (!option_no_db
&& get_state(my_call_id
, "this_function", NULL
) != &called
) {
1175 if (name
&& strncmp(name
, "sys_", 4) == 0)
1179 if (name
&& strncmp(name
, "compat_sys_", 11) == 0)
1185 FOR_EACH_PTR(sym
->ctype
.base_type
->arguments
, arg
) {
1186 set_state(my_id
, arg
->ident
->name
, arg
, alloc_estate_whole(get_real_base_type(arg
)));
1187 } END_FOR_EACH_PTR(arg
);
1193 static void store_user_data_return(struct expression
*expr
, char *key
, char *value
, bool is_new
)
1195 struct smatch_state
*state
;
1196 struct range_list
*rl
;
1197 struct symbol
*type
;
1203 type
= get_type(expr
);
1204 snprintf(buf
, sizeof(buf
), "return %p%s", expr
, key
+ 1);
1205 call_results_to_rl(expr
, type
, value
, &rl
);
1207 state
= alloc_estate_rl(rl
);
1209 estate_set_new(state
);
1211 set_state(my_id
, buf
, NULL
, state
);
1214 static void set_to_user_data(struct expression
*expr
, char *key
, char *value
, bool is_new
)
1216 struct smatch_state
*state
;
1219 struct symbol
*type
;
1220 struct range_list
*rl
= NULL
;
1222 type
= get_member_type_from_key(expr
, key
);
1223 name
= get_variable_from_key(expr
, key
, &sym
);
1227 call_results_to_rl(expr
, type
, value
, &rl
);
1229 state
= alloc_estate_rl(rl
);
1230 if (param_data_capped(value
))
1231 estate_set_capped(state
);
1232 if (param_data_treat_untagged(value
))
1233 estate_set_treat_untagged(state
);
1235 estate_set_new(state
);
1236 set_state(my_id
, name
, sym
, state
);
1241 static void returns_param_user_data(struct expression
*expr
, int param
, char *key
, char *value
)
1243 struct expression
*arg
;
1244 struct expression
*call
;
1247 while (call
->type
== EXPR_ASSIGNMENT
)
1248 call
= strip_expr(call
->right
);
1249 if (call
->type
!= EXPR_CALL
)
1252 if (!we_pass_user_data(call
))
1256 if (expr
->type
!= EXPR_ASSIGNMENT
) {
1257 store_user_data_return(expr
, key
, value
, OLD
);
1260 set_to_user_data(expr
->left
, key
, value
, OLD
);
1264 arg
= get_argument_from_call_expr(call
->args
, param
);
1267 set_to_user_data(arg
, key
, value
, OLD
);
1270 static void returns_param_user_data_set(struct expression
*expr
, int param
, char *key
, char *value
)
1272 struct expression
*arg
;
1274 func_gets_user_data
= true;
1277 if (expr
->type
!= EXPR_ASSIGNMENT
) {
1278 store_user_data_return(expr
, key
, value
, NEW
);
1281 set_to_user_data(expr
->left
, key
, value
, NEW
);
1285 while (expr
->type
== EXPR_ASSIGNMENT
)
1286 expr
= strip_expr(expr
->right
);
1287 if (expr
->type
!= EXPR_CALL
)
1290 arg
= get_argument_from_call_expr(expr
->args
, param
);
1293 set_to_user_data(arg
, key
, value
, NEW
);
1296 static void returns_param_capped(struct expression
*expr
, int param
, char *key
, char *value
)
1298 struct smatch_state
*state
, *new;
1302 name
= get_name_sym_from_key(expr
, param
, key
, &sym
);
1306 state
= get_state(my_id
, name
, sym
);
1307 if (!state
|| estate_capped(state
))
1310 new = clone_estate(state
);
1311 estate_set_capped(new);
1313 set_state(my_id
, name
, sym
, new);
1318 static void match_function_def(struct symbol
*sym
)
1320 if (is_user_data_fn(sym
))
1321 func_gets_user_data
= true;
1324 void register_kernel_user_data(int id
)
1330 if (option_project
!= PROJ_KERNEL
)
1333 set_dynamic_states(my_id
);
1335 add_function_data(&func_gets_user_data
);
1336 add_hook(&match_function_def
, FUNC_DEF_HOOK
);
1338 add_hook(&save_start_states
, AFTER_DEF_HOOK
);
1339 add_hook(&free_start_states
, AFTER_FUNC_HOOK
);
1340 add_function_data((unsigned long *)&start_states
);
1342 add_unmatched_state_hook(my_id
, &empty_state
);
1343 add_extra_nomod_hook(&extra_nomod_hook
);
1344 add_pre_merge_hook(my_id
, &pre_merge_hook
);
1345 add_merge_hook(my_id
, &merge_estates
);
1347 add_function_hook("copy_from_user", &match_user_copy
, INT_PTR(0));
1348 add_function_hook("__copy_from_user", &match_user_copy
, INT_PTR(0));
1349 add_function_hook("memcpy_fromiovec", &match_user_copy
, INT_PTR(0));
1350 for (i
= 0; i
< ARRAY_SIZE(kstr_funcs
); i
++)
1351 add_function_hook_late(kstr_funcs
[i
], &match_user_copy
, INT_PTR(2));
1352 add_function_hook("usb_control_msg", &match_user_copy
, INT_PTR(6));
1354 for (i
= 0; i
< ARRAY_SIZE(returns_user_data
); i
++)
1355 add_function_hook(returns_user_data
[i
], &match_returns_user_rl
, NULL
);
1357 add_function_hook("sscanf", &match_sscanf
, NULL
);
1359 add_hook(&match_syscall_definition
, AFTER_DEF_HOOK
);
1361 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
1362 select_return_states_hook(PARAM_SET
, &db_param_set
);
1363 add_hook(&match_condition
, CONDITION_HOOK
);
1365 add_caller_info_callback(my_id
, caller_info_callback
);
1366 add_return_info_callback(my_id
, return_info_callback
);
1367 select_caller_info_hook(set_param_user_data
, USER_DATA
);
1368 select_return_states_hook(USER_DATA
, &returns_param_user_data
);
1369 select_return_states_hook(USER_DATA_SET
, &returns_param_user_data_set
);
1370 select_return_states_hook(CAPPED_DATA
, &returns_param_capped
);
1373 void register_kernel_user_data2(int id
)
1377 if (option_project
!= PROJ_KERNEL
)
1379 select_caller_info_hook(set_called
, INTERNAL
);