2 * Copyright (C) 2011 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * There are a couple checks that try to see if a variable
20 * comes from the user. It would be better to unify them
21 * into one place. Also it we should follow the data down
22 * the call paths. Hence this file.
26 #include "smatch_slist.h"
27 #include "smatch_extra.h"
30 static int my_call_id
;
33 static unsigned long func_gets_user_data
;
35 static const char *kstr_funcs
[] = {
36 "kstrtoull", "kstrtoll", "kstrtoul", "kstrtol", "kstrtouint",
37 "kstrtoint", "kstrtou64", "kstrtos64", "kstrtou32", "kstrtos32",
38 "kstrtou16", "kstrtos16", "kstrtou8", "kstrtos8", "kstrtoull_from_user"
39 "kstrtoll_from_user", "kstrtoul_from_user", "kstrtol_from_user",
40 "kstrtouint_from_user", "kstrtoint_from_user", "kstrtou16_from_user",
41 "kstrtos16_from_user", "kstrtou8_from_user", "kstrtos8_from_user",
42 "kstrtou64_from_user", "kstrtos64_from_user", "kstrtou32_from_user",
43 "kstrtos32_from_user",
46 static const char *returns_user_data
[] = {
47 "simple_strtol", "simple_strtoll", "simple_strtoul", "simple_strtoull",
48 "kvm_register_read", "xdr_inline_decode",
51 static struct smatch_state
*empty_state(struct sm_state
*sm
)
53 return alloc_estate_empty();
56 static struct smatch_state
*new_state(struct symbol
*type
)
58 struct smatch_state
*state
;
60 if (!type
|| type_is_ptr(type
))
63 state
= alloc_estate_whole(type
);
64 estate_set_new(state
);
68 static void pre_merge_hook(struct sm_state
*cur
, struct sm_state
*other
)
70 struct smatch_state
*user
= cur
->state
;
71 struct smatch_state
*extra
;
72 struct smatch_state
*state
;
73 struct range_list
*rl
;
75 extra
= __get_state(SMATCH_EXTRA
, cur
->name
, cur
->sym
);
78 rl
= rl_intersection(estate_rl(user
), estate_rl(extra
));
79 state
= alloc_estate_rl(clone_rl(rl
));
80 if (estate_capped(user
) || is_capped_var_sym(cur
->name
, cur
->sym
))
81 estate_set_capped(state
);
82 if (estate_treat_untagged(user
))
83 estate_set_treat_untagged(state
);
84 if (estates_equiv(state
, cur
->state
))
86 if (estate_new(cur
->state
))
87 estate_set_new(state
);
88 set_state(my_id
, cur
->name
, cur
->sym
, state
);
91 static void extra_nomod_hook(const char *name
, struct symbol
*sym
, struct expression
*expr
, struct smatch_state
*state
)
93 struct smatch_state
*user
, *new;
94 struct range_list
*rl
;
96 user
= __get_state(my_id
, name
, sym
);
99 rl
= rl_intersection(estate_rl(user
), estate_rl(state
));
100 if (rl_equiv(rl
, estate_rl(user
)))
102 new = alloc_estate_rl(rl
);
103 if (estate_capped(user
))
104 estate_set_capped(new);
105 if (estate_treat_untagged(user
))
106 estate_set_treat_untagged(new);
107 set_state(my_id
, name
, sym
, new);
110 static void store_type_info(struct expression
*expr
, struct smatch_state
*state
)
113 char *type_str
, *member
;
115 if (__in_fake_assign
)
118 if (!estate_rl(state
))
121 expr
= strip_expr(expr
);
122 if (!expr
|| expr
->type
!= EXPR_DEREF
|| !expr
->member
)
125 type
= get_type(expr
->deref
);
126 if (!type
|| !type
->ident
)
129 type_str
= type_to_str(type
);
132 member
= get_member_name(expr
);
136 sql_insert_function_type_info(USER_DATA
, type_str
, member
, state
->name
);
139 static void set_user_data(struct expression
*expr
, struct smatch_state
*state
)
141 store_type_info(expr
, state
);
142 set_state_expr(my_id
, expr
, state
);
145 static bool user_rl_known(struct expression
*expr
)
147 struct range_list
*rl
;
150 if (!get_user_rl(expr
, &rl
))
153 close_to_max
= sval_type_max(rl_type(rl
));
154 close_to_max
.value
-= 100;
156 if (sval_cmp(rl_max(rl
), close_to_max
) >= 0)
161 static bool is_array_index_mask_nospec(struct expression
*expr
)
163 struct expression
*orig
;
165 orig
= get_assigned_expr(expr
);
166 if (!orig
|| orig
->type
!= EXPR_CALL
)
168 return sym_name_is("array_index_mask_nospec", orig
->fn
);
171 static bool binop_capped(struct expression
*expr
)
173 struct range_list
*left_rl
;
177 if (expr
->op
== '-' && get_user_rl(expr
->left
, &left_rl
)) {
178 if (user_rl_capped(expr
->left
))
180 comparison
= get_comparison(expr
->left
, expr
->right
);
181 if (comparison
&& show_special(comparison
)[0] == '>')
186 if (expr
->op
== '&' || expr
->op
== '%') {
187 bool left_user
, left_capped
, right_user
, right_capped
;
189 if (!get_value(expr
->right
, &sval
) && is_capped(expr
->right
))
191 if (is_array_index_mask_nospec(expr
->right
))
193 if (is_capped(expr
->left
))
195 left_user
= is_user_rl(expr
->left
);
196 right_user
= is_user_rl(expr
->right
);
197 if (!left_user
&& !right_user
)
200 left_capped
= user_rl_capped(expr
->left
);
201 right_capped
= user_rl_capped(expr
->right
);
203 if (left_user
&& left_capped
) {
206 if (right_user
&& right_capped
)
210 if (right_user
&& right_capped
) {
219 * Generally "capped" means that we capped it to an unknown value.
220 * This is useful because if Smatch doesn't know what the value is then
221 * we have to trust that it is correct. But if we known cap value is
222 * 100 then we can check if 100 is correct and complain if it's wrong.
224 * So then the problem is with BINOP when we take a capped variable
225 * plus a user variable which is clamped to a known range (uncapped)
226 * the result should be capped.
228 if ((user_rl_capped(expr
->left
) || user_rl_known(expr
->left
)) &&
229 (user_rl_capped(expr
->right
) || user_rl_known(expr
->right
)))
235 bool user_rl_capped_var_sym(const char *name
, struct symbol
*sym
)
237 struct smatch_state
*state
;
239 state
= get_state(my_id
, name
, sym
);
241 return estate_capped(state
);
246 bool user_rl_capped(struct expression
*expr
)
248 struct smatch_state
*state
;
249 struct range_list
*rl
;
252 expr
= strip_expr(expr
);
255 if (get_value(expr
, &sval
))
257 if (expr
->type
== EXPR_BINOP
)
258 return binop_capped(expr
);
259 if ((expr
->type
== EXPR_PREOP
|| expr
->type
== EXPR_POSTOP
) &&
260 (expr
->op
== SPECIAL_INCREMENT
|| expr
->op
== SPECIAL_DECREMENT
))
261 return user_rl_capped(expr
->unop
);
262 state
= get_state_expr(my_id
, expr
);
264 return estate_capped(state
);
266 if (!get_user_rl(expr
, &rl
)) {
268 * The non user data parts of a binop are capped and
269 * also empty user rl states are capped.
274 if (rl_to_sval(rl
, &sval
))
277 return false; /* uncapped user data */
280 bool user_rl_treat_untagged(struct expression
*expr
)
282 struct smatch_state
*state
;
283 struct range_list
*rl
;
286 expr
= strip_expr(expr
);
289 if (get_value(expr
, &sval
))
292 state
= get_state_expr(my_id
, expr
);
294 return estate_treat_untagged(state
);
296 if (get_user_rl(expr
, &rl
))
297 return false; /* uncapped user data */
299 return true; /* not actually user data */
302 static void tag_inner_struct_members(struct expression
*expr
, struct symbol
*member
)
304 struct expression
*edge_member
;
305 struct symbol
*base
= get_real_base_type(member
);
309 expr
= member_expression(expr
, '.', member
->ident
);
311 FOR_EACH_PTR(base
->symbol_list
, tmp
) {
314 type
= get_real_base_type(tmp
);
318 if (type
->type
== SYM_UNION
|| type
->type
== SYM_STRUCT
) {
319 tag_inner_struct_members(expr
, tmp
);
326 edge_member
= member_expression(expr
, '.', tmp
->ident
);
327 set_user_data(edge_member
, new_state(type
));
328 } END_FOR_EACH_PTR(tmp
);
331 void __set_user_string(struct expression
*expr
);
332 static void tag_struct_members(struct symbol
*type
, struct expression
*expr
)
335 struct expression
*member
;
338 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
339 expr
= strip_expr(expr
->unop
);
343 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
344 type
= get_real_base_type(tmp
);
348 if (type
->type
== SYM_UNION
|| type
->type
== SYM_STRUCT
) {
349 tag_inner_struct_members(expr
, tmp
);
356 member
= member_expression(expr
, op
, tmp
->ident
);
357 if (type
->type
== SYM_ARRAY
) {
358 set_points_to_user_data(member
, true);
360 set_user_data(member
, new_state(get_type(member
)));
362 } END_FOR_EACH_PTR(tmp
);
365 static void tag_base_type(struct expression
*expr
)
367 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
368 expr
= strip_expr(expr
->unop
);
370 expr
= deref_expression(expr
);
371 set_user_data(expr
, new_state(get_type(expr
)));
374 static void tag_as_user_data(struct expression
*expr
)
378 expr
= strip_expr(expr
);
380 type
= get_type(expr
);
381 if (!type
|| type
->type
!= SYM_PTR
)
383 type
= get_real_base_type(type
);
386 if (type
== &void_ctype
) {
387 set_user_data(deref_expression(expr
), new_state(&ulong_ctype
));
390 if (type
->type
== SYM_BASETYPE
) {
391 if (expr
->type
!= EXPR_PREOP
&& expr
->op
!= '&')
392 set_points_to_user_data(expr
, true);
396 if (type
->type
== SYM_STRUCT
|| type
->type
== SYM_UNION
) {
397 if (expr
->type
!= EXPR_PREOP
|| expr
->op
!= '&')
398 expr
= deref_expression(expr
);
400 set_user_data(deref_expression(expr
), new_state(&ulong_ctype
));
401 tag_struct_members(type
, expr
);
405 static struct expression
*ignore_param_set
;
406 static void match_user_copy(const char *fn
, struct expression
*expr
, void *_param
)
408 int param
= PTR_INT(_param
);
409 struct expression
*dest
;
411 func_gets_user_data
= true;
412 ignore_param_set
= expr
;
414 dest
= get_argument_from_call_expr(expr
->args
, param
);
415 dest
= strip_expr(dest
);
418 tag_as_user_data(dest
);
421 static int is_dev_attr_name(struct expression
*expr
)
426 name
= expr_to_str(expr
);
429 if (strstr(name
, "->attr.name"))
435 static int ends_in_n(struct expression
*expr
)
441 if (expr
->type
!= EXPR_STRING
|| !expr
->string
)
448 if (str
->data
[str
->length
- 3] == '%' &&
449 str
->data
[str
->length
- 2] == 'n')
454 static void match_sscanf(const char *fn
, struct expression
*expr
, void *unused
)
456 struct expression
*str
, *format
, *arg
;
459 func_gets_user_data
= true;
461 str
= get_argument_from_call_expr(expr
->args
, 0);
462 if (is_dev_attr_name(str
))
465 format
= get_argument_from_call_expr(expr
->args
, 1);
466 if (is_dev_attr_name(format
))
469 last
= ptr_list_size((struct ptr_list
*)expr
->args
) - 1;
472 FOR_EACH_PTR(expr
->args
, arg
) {
476 if (i
== last
&& ends_in_n(format
))
478 tag_as_user_data(arg
);
479 } END_FOR_EACH_PTR(arg
);
482 static int get_rl_from_function(struct expression
*expr
, struct range_list
**rl
)
486 if (expr
->type
!= EXPR_CALL
|| expr
->fn
->type
!= EXPR_SYMBOL
||
487 !expr
->fn
->symbol_name
|| !expr
->fn
->symbol_name
->name
)
490 for (i
= 0; i
< ARRAY_SIZE(returns_user_data
); i
++) {
491 if (strcmp(expr
->fn
->symbol_name
->name
, returns_user_data
[i
]) == 0) {
492 *rl
= alloc_whole_rl(get_type(expr
));
499 static int comes_from_skb_data(struct expression
*expr
)
501 expr
= strip_expr(expr
);
502 if (!expr
|| expr
->type
!= EXPR_PREOP
|| expr
->op
!= '*')
505 expr
= strip_expr(expr
->unop
);
508 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+')
509 expr
= strip_expr(expr
->left
);
511 return is_skb_data(expr
);
514 static int handle_get_user(struct expression
*expr
)
519 name
= get_macro_name(expr
->pos
);
520 if (!name
|| strcmp(name
, "get_user") != 0)
523 name
= expr_to_var(expr
->right
);
524 if (!name
|| (strcmp(name
, "__val_gu") != 0 && strcmp(name
, "__gu_val") != 0))
526 set_user_data(expr
->left
, new_state(get_type(expr
->left
)));
533 static bool state_is_new(struct expression
*expr
)
535 struct smatch_state
*state
;
537 state
= get_state_expr(my_id
, expr
);
538 if (estate_new(state
))
541 if (expr
->type
== EXPR_BINOP
) {
542 if (state_is_new(expr
->left
))
544 if (state_is_new(expr
->right
))
550 static bool handle_op_assign(struct expression
*expr
)
552 struct expression
*binop_expr
;
553 struct smatch_state
*state
;
554 struct range_list
*rl
;
557 case SPECIAL_ADD_ASSIGN
:
558 case SPECIAL_SUB_ASSIGN
:
559 case SPECIAL_AND_ASSIGN
:
560 case SPECIAL_MOD_ASSIGN
:
561 case SPECIAL_SHL_ASSIGN
:
562 case SPECIAL_SHR_ASSIGN
:
563 case SPECIAL_OR_ASSIGN
:
564 case SPECIAL_XOR_ASSIGN
:
565 case SPECIAL_MUL_ASSIGN
:
566 case SPECIAL_DIV_ASSIGN
:
567 binop_expr
= binop_expression(expr
->left
,
568 op_remove_assign(expr
->op
),
570 if (!get_user_rl(binop_expr
, &rl
))
573 rl
= cast_rl(get_type(expr
->left
), rl
);
574 state
= alloc_estate_rl(rl
);
575 if (expr
->op
== SPECIAL_AND_ASSIGN
||
576 expr
->op
== SPECIAL_MOD_ASSIGN
||
577 user_rl_capped(binop_expr
))
578 estate_set_capped(state
);
579 if (user_rl_treat_untagged(expr
->left
))
580 estate_set_treat_untagged(state
);
581 if (state_is_new(binop_expr
))
582 estate_set_new(state
);
583 estate_set_assigned(state
);
584 set_user_data(expr
->left
, state
);
590 static void handle_derefed_pointers(struct expression
*expr
, bool is_new
)
592 expr
= strip_expr(expr
);
593 if (expr
->type
!= EXPR_PREOP
||
596 expr
= strip_expr(expr
->unop
);
597 set_points_to_user_data(expr
, is_new
);
600 static void match_assign(struct expression
*expr
)
602 struct symbol
*left_type
, *right_type
;
603 struct range_list
*rl
= NULL
;
604 static struct expression
*handled
;
605 struct smatch_state
*state
;
606 struct expression
*faked
;
607 bool is_capped
= false;
610 left_type
= get_type(expr
->left
);
611 if (left_type
== &void_ctype
)
614 faked
= get_faked_expression();
616 /* FIXME: handle fake array assignments frob(&user_array[x]); */
619 faked
->type
== EXPR_ASSIGNMENT
&&
620 points_to_user_data(faked
->right
)) {
621 if (is_skb_data(faked
->right
))
622 func_gets_user_data
= true;
623 rl
= alloc_whole_rl(get_type(expr
->left
));
628 if (faked
&& faked
== handled
)
630 if (is_fake_call(expr
->right
))
631 goto clear_old_state
;
632 if (handle_get_user(expr
))
634 if (points_to_user_data(expr
->right
) &&
635 is_struct_ptr(get_type(expr
->left
))) {
637 // This should be handled by smatch_points_to_user_data.c
638 // set_points_to_user_data(expr->left);
641 if (handle_op_assign(expr
))
644 goto clear_old_state
;
646 /* Handled by DB code */
647 if (expr
->right
->type
== EXPR_CALL
)
651 disable_type_val_lookups();
652 get_user_rl(expr
->right
, &rl
);
654 enable_type_val_lookups();
656 goto clear_old_state
;
658 is_capped
= user_rl_capped(expr
->right
);
659 is_new
= state_is_new(expr
->right
);
662 if (type_is_ptr(left_type
)) {
663 right_type
= get_type(expr
->right
);
664 if (right_type
&& right_type
->type
== SYM_ARRAY
)
665 set_points_to_user_data(expr
->left
, is_new
);
669 rl
= cast_rl(left_type
, rl
);
670 state
= alloc_estate_rl(rl
);
672 estate_set_new(state
);
674 estate_set_capped(state
);
675 if (user_rl_treat_untagged(expr
->right
))
676 estate_set_treat_untagged(state
);
677 estate_set_assigned(state
);
679 set_user_data(expr
->left
, state
);
680 handle_derefed_pointers(expr
->left
, is_new
);
686 * HACK ALERT!!! This should be at the start of the function. The
687 * the problem is that handling "pointer = array;" assignments is
688 * handled in this function instead of in kernel_points_to_user_data.c.
690 if (type_is_ptr(left_type
))
693 if (get_state_expr(my_id
, expr
->left
))
694 set_user_data(expr
->left
, alloc_estate_empty());
697 static void handle_eq_noteq(struct expression
*expr
)
699 struct smatch_state
*left_orig
, *right_orig
;
701 left_orig
= get_state_expr(my_id
, expr
->left
);
702 right_orig
= get_state_expr(my_id
, expr
->right
);
704 if (!left_orig
&& !right_orig
)
706 if (left_orig
&& right_orig
)
710 set_true_false_states_expr(my_id
, expr
->left
,
711 expr
->op
== SPECIAL_EQUAL
? alloc_estate_empty() : NULL
,
712 expr
->op
== SPECIAL_EQUAL
? NULL
: alloc_estate_empty());
714 set_true_false_states_expr(my_id
, expr
->right
,
715 expr
->op
== SPECIAL_EQUAL
? alloc_estate_empty() : NULL
,
716 expr
->op
== SPECIAL_EQUAL
? NULL
: alloc_estate_empty());
720 static struct range_list
*strip_negatives(struct range_list
*rl
)
722 sval_t min
= rl_min(rl
);
723 sval_t minus_one
= { .type
= rl_type(rl
), .value
= -1 };
724 sval_t over
= { .type
= rl_type(rl
), .value
= INT_MAX
+ 1ULL };
725 sval_t max
= sval_type_max(rl_type(rl
));
730 if (type_unsigned(rl_type(rl
)) && type_bits(rl_type(rl
)) > 31)
731 return remove_range(rl
, over
, max
);
733 return remove_range(rl
, min
, minus_one
);
736 static void handle_compare(struct expression
*expr
)
738 struct expression
*left
, *right
;
739 struct range_list
*left_rl
= NULL
;
740 struct range_list
*right_rl
= NULL
;
741 struct range_list
*user_rl
;
742 struct smatch_state
*capped_state
;
743 struct smatch_state
*left_true
= NULL
;
744 struct smatch_state
*left_false
= NULL
;
745 struct smatch_state
*right_true
= NULL
;
746 struct smatch_state
*right_false
= NULL
;
750 left
= strip_expr(expr
->left
);
751 right
= strip_expr(expr
->right
);
753 while (left
->type
== EXPR_ASSIGNMENT
)
754 left
= strip_expr(left
->left
);
757 * Conditions are mostly handled by smatch_extra.c, but there are some
758 * times where the exact values are not known so we can't do that.
760 * Normally, we might consider using smatch_capped.c to supliment smatch
761 * extra but that doesn't work when we merge unknown uncapped kernel
762 * data with unknown capped user data. The result is uncapped user
763 * data. We need to keep it separate and say that the user data is
764 * capped. In the past, I would have marked this as just regular
765 * kernel data (not user data) but we can't do that these days because
766 * we need to track user data for Spectre.
768 * The other situation which we have to handle is when we do have an
769 * int and we compare against an unknown unsigned kernel variable. In
770 * that situation we assume that the kernel data is less than INT_MAX.
771 * Otherwise then we get all sorts of array underflow false positives.
775 /* Handled in smatch_extra.c */
776 if (get_implied_value(left
, &sval
) ||
777 get_implied_value(right
, &sval
))
780 get_user_rl(left
, &left_rl
);
781 get_user_rl(right
, &right_rl
);
784 if (!left_rl
&& !right_rl
)
786 /* if both sides are user data that's not a good limit */
787 if (left_rl
&& right_rl
)
795 type
= get_type(expr
);
796 if (type_unsigned(type
))
797 user_rl
= strip_negatives(user_rl
);
798 capped_state
= alloc_estate_rl(user_rl
);
799 estate_set_capped(capped_state
);
803 case SPECIAL_UNSIGNED_LT
:
805 case SPECIAL_UNSIGNED_LTE
:
807 left_true
= capped_state
;
809 right_false
= capped_state
;
812 case SPECIAL_UNSIGNED_GT
:
814 case SPECIAL_UNSIGNED_GTE
:
816 left_false
= capped_state
;
818 right_true
= capped_state
;
822 set_true_false_states_expr(my_id
, left
, left_true
, left_false
);
823 set_true_false_states_expr(my_id
, right
, right_true
, right_false
);
826 static void match_condition(struct expression
*expr
)
828 if (expr
->type
!= EXPR_COMPARE
)
831 if (expr
->op
== SPECIAL_EQUAL
||
832 expr
->op
== SPECIAL_NOTEQUAL
) {
833 handle_eq_noteq(expr
);
837 handle_compare(expr
);
840 static void match_returns_user_rl(const char *fn
, struct expression
*expr
, void *unused
)
842 func_gets_user_data
= true;
845 static int get_user_macro_rl(struct expression
*expr
, struct range_list
**rl
)
847 struct expression
*parent
;
853 macro
= get_macro_name(expr
->pos
);
857 /* handle ntohl(foo[i]) where "i" is trusted */
858 parent
= expr_get_parent_expr(expr
);
859 while (parent
&& parent
->type
!= EXPR_BINOP
)
860 parent
= expr_get_parent_expr(parent
);
861 if (parent
&& parent
->type
== EXPR_BINOP
) {
862 char *parent_macro
= get_macro_name(parent
->pos
);
864 if (parent_macro
&& strcmp(macro
, parent_macro
) == 0)
868 if (strcmp(macro
, "ntohl") == 0) {
869 *rl
= alloc_whole_rl(&uint_ctype
);
872 if (strcmp(macro
, "ntohs") == 0) {
873 *rl
= alloc_whole_rl(&ushort_ctype
);
879 static int has_user_data(struct symbol
*sym
)
881 struct sm_state
*tmp
;
883 FOR_EACH_MY_SM(my_id
, __get_cur_stree(), tmp
) {
886 } END_FOR_EACH_SM(tmp
);
890 bool we_pass_user_data(struct expression
*call
)
892 struct expression
*arg
;
895 FOR_EACH_PTR(call
->args
, arg
) {
896 if (points_to_user_data(arg
))
898 sym
= expr_to_sym(arg
);
901 if (has_user_data(sym
))
903 } END_FOR_EACH_PTR(arg
);
908 // TODO: faked_assign this should already be handled
909 static int db_returned_user_rl(struct expression
*call
, struct range_list
**rl
)
911 struct smatch_state
*state
;
914 if (is_fake_call(call
))
916 snprintf(buf
, sizeof(buf
), "return %p", call
);
917 state
= get_state(my_id
, buf
, NULL
);
918 if (!state
|| !estate_rl(state
))
920 *rl
= estate_rl(state
);
924 struct stree
*get_user_stree(void)
926 return get_all_states_stree(my_id
);
929 static int user_data_flag
;
930 static int no_user_data_flag
;
931 struct range_list
*var_user_rl(struct expression
*expr
)
933 struct smatch_state
*state
;
934 struct range_list
*rl
;
935 struct range_list
*absolute_rl
;
937 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
938 no_user_data_flag
= 1;
942 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '%') {
943 struct range_list
*left
, *right
;
945 if (!get_user_rl(expr
->right
, &right
))
947 get_absolute_rl(expr
->left
, &left
);
948 rl
= rl_binop(left
, '%', right
);
952 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '/') {
953 struct range_list
*left
= NULL
;
954 struct range_list
*right
= NULL
;
955 struct range_list
*abs_right
;
958 * The specific bug I'm dealing with is:
960 * foo = capped_user / unknown;
962 * Instead of just saying foo is now entirely user_rl we should
963 * probably say instead that it is not at all user data.
967 get_user_rl(expr
->left
, &left
);
968 get_user_rl(expr
->right
, &right
);
969 get_absolute_rl(expr
->right
, &abs_right
);
971 if (left
&& !right
) {
972 rl
= rl_binop(left
, '/', abs_right
);
973 if (sval_cmp(rl_max(left
), rl_max(rl
)) < 0)
974 no_user_data_flag
= 1;
980 if (get_rl_from_function(expr
, &rl
))
983 if (get_user_macro_rl(expr
, &rl
))
986 if (comes_from_skb_data(expr
)) {
987 rl
= alloc_whole_rl(get_type(expr
));
991 state
= get_state_expr(my_id
, expr
);
992 if (state
&& estate_rl(state
)) {
993 rl
= estate_rl(state
);
997 if (expr
->type
== EXPR_CALL
&& db_returned_user_rl(expr
, &rl
))
1000 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '*' &&
1001 points_to_user_data(expr
->unop
)) {
1002 rl
= var_to_absolute_rl(expr
);
1006 if (is_array(expr
)) {
1007 struct expression
*array
= get_array_base(expr
);
1009 if (!get_state_expr(my_id
, array
)) {
1010 no_user_data_flag
= 1;
1018 absolute_rl
= var_to_absolute_rl(expr
);
1019 return rl_intersection(rl
, absolute_rl
);
1022 static bool is_ptr_subtract(struct expression
*expr
)
1024 expr
= strip_expr(expr
);
1027 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '-' &&
1028 type_is_ptr(get_type(expr
->left
))) {
1034 int get_user_rl(struct expression
*expr
, struct range_list
**rl
)
1036 if (is_ptr_subtract(expr
))
1040 no_user_data_flag
= 0;
1041 custom_get_absolute_rl(expr
, &var_user_rl
, rl
);
1042 if (!user_data_flag
|| no_user_data_flag
)
1048 int is_user_rl(struct expression
*expr
)
1050 struct range_list
*tmp
;
1052 return get_user_rl(expr
, &tmp
) && tmp
;
1055 int get_user_rl_var_sym(const char *name
, struct symbol
*sym
, struct range_list
**rl
)
1057 struct smatch_state
*state
, *extra
;
1059 state
= get_state(my_id
, name
, sym
);
1060 if (!estate_rl(state
))
1062 *rl
= estate_rl(state
);
1064 extra
= get_state(SMATCH_EXTRA
, name
, sym
);
1065 if (estate_rl(extra
))
1066 *rl
= rl_intersection(estate_rl(state
), estate_rl(extra
));
1071 bool is_socket_stuff(struct symbol
*sym
)
1073 struct symbol
*type
;
1076 * Basically I never want to consider an skb or sk as user pointer.
1077 * The skb->data is already marked as a source of user data, and if
1078 * anything else is marked as user data it's almost certainly wrong.
1080 * Ideally, I would figure out where this bogus data is coming from,
1081 * but possibly it just was stuck in the database from previous updates
1082 * and can't get cleared out without deleting all user data. Things
1083 * like this gets stuck in the DB because of recursion.
1085 * I could make this a temporary hack, but I keep wanting to do it so
1086 * I'm just going to make it permanent. It either doesn't change
1087 * anything or it makes life better.
1090 type
= get_real_base_type(sym
);
1091 if (!type
|| type
->type
!= SYM_PTR
)
1093 type
= get_real_base_type(type
);
1094 if (!type
|| type
->type
!= SYM_STRUCT
|| !type
->ident
)
1097 if (strcmp(type
->ident
->name
, "sk_buff") == 0)
1099 if (strcmp(type
->ident
->name
, "sock") == 0)
1101 if (strcmp(type
->ident
->name
, "socket") == 0)
1107 static void return_info_callback(int return_id
, char *return_ranges
,
1108 struct expression
*returned_expr
,
1110 const char *printed_name
,
1111 struct sm_state
*sm
)
1113 struct smatch_state
*extra
;
1114 struct range_list
*rl
;
1117 if (is_socket_stuff(sm
->sym
))
1121 if (strcmp(printed_name
, "$") == 0)
1123 if (!estate_assigned(sm
->state
) &&
1124 !estate_new(sm
->state
))
1127 rl
= estate_rl(sm
->state
);
1130 extra
= get_state(SMATCH_EXTRA
, sm
->name
, sm
->sym
);
1131 if (estate_rl(extra
))
1132 rl
= rl_intersection(estate_rl(sm
->state
), estate_rl(extra
));
1136 snprintf(buf
, sizeof(buf
), "%s%s%s",
1138 estate_capped(sm
->state
) ? "[c]" : "",
1139 estate_treat_untagged(sm
->state
) ? "[u]" : "");
1140 sql_insert_return_states(return_id
, return_ranges
,
1141 estate_new(sm
->state
) ? USER_DATA_SET
: USER_DATA
,
1142 param
, printed_name
, buf
);
1145 static bool is_ignored_macro(struct position pos
)
1149 macro
= get_macro_name(pos
);
1152 if (strcmp(macro
, "v4l2_subdev_call") == 0)
1157 static void caller_info_callback(struct expression
*call
, int param
, char *printed_name
, struct sm_state
*sm
)
1159 struct smatch_state
*state
;
1160 struct range_list
*rl
;
1161 struct symbol
*type
;
1164 if (is_ignored_macro(call
->pos
))
1167 if (is_socket_stuff(sm
->sym
))
1171 * Smatch uses a hack where if we get an unsigned long we say it's
1172 * both user data and it points to user data. But if we pass it to a
1173 * function which takes an int, then it's just user data. There's not
1174 * enough bytes for it to be a pointer.
1177 type
= get_arg_type(call
->fn
, param
);
1178 if (strcmp(printed_name
, "$") != 0 && type
&& type_bits(type
) < type_bits(&ptr_ctype
))
1181 if (strcmp(sm
->state
->name
, "") == 0)
1184 state
= __get_state(SMATCH_EXTRA
, sm
->name
, sm
->sym
);
1185 if (!state
|| !estate_rl(state
))
1186 rl
= estate_rl(sm
->state
);
1188 rl
= rl_intersection(estate_rl(sm
->state
), estate_rl(state
));
1193 snprintf(buf
, sizeof(buf
), "%s%s%s", show_rl(rl
),
1194 estate_capped(sm
->state
) ? "[c]" : "",
1195 estate_treat_untagged(sm
->state
) ? "[u]" : "");
1196 sql_insert_caller_info(call
, USER_DATA
, param
, printed_name
, buf
);
1199 static void db_param_set(struct expression
*expr
, int param
, char *key
, char *value
)
1201 struct expression
*arg
;
1204 struct smatch_state
*state
;
1206 while (expr
->type
== EXPR_ASSIGNMENT
)
1207 expr
= strip_expr(expr
->right
);
1208 if (expr
->type
!= EXPR_CALL
)
1210 if (expr
== ignore_param_set
)
1213 arg
= get_argument_from_call_expr(expr
->args
, param
);
1216 name
= get_variable_from_key(arg
, key
, &sym
);
1220 state
= get_state(my_id
, name
, sym
);
1224 set_state(my_id
, name
, sym
, alloc_estate_empty());
1229 static bool param_data_capped(const char *value
)
1231 if (strstr(value
, ",c") || strstr(value
, "[c"))
1236 static bool param_data_treat_untagged(const char *value
)
1238 if (strstr(value
, ",u") || strstr(value
, "[u"))
1243 static void set_param_user_data(const char *name
, struct symbol
*sym
, char *key
, char *value
)
1245 struct expression
*expr
;
1246 struct range_list
*rl
= NULL
;
1247 struct smatch_state
*state
;
1248 struct symbol
*type
;
1251 expr
= symbol_expression(sym
);
1252 fullname
= get_variable_from_key(expr
, key
, NULL
);
1256 type
= get_member_type_from_key(expr
, key
);
1257 if (type
&& type
->type
== SYM_STRUCT
)
1263 str_to_rl(type
, value
, &rl
);
1264 rl
= swap_mtag_seed(expr
, rl
);
1265 state
= alloc_estate_rl(rl
);
1266 if (param_data_capped(value
) || is_capped(expr
))
1267 estate_set_capped(state
);
1268 if (param_data_treat_untagged(value
) || sym
->ctype
.as
== 5)
1269 estate_set_treat_untagged(state
);
1270 set_state(my_id
, fullname
, sym
, state
);
1273 static void set_called(const char *name
, struct symbol
*sym
, char *key
, char *value
)
1275 set_state(my_call_id
, "this_function", NULL
, &called
);
1278 static void match_syscall_definition(struct symbol
*sym
)
1285 macro
= get_macro_name(sym
->pos
);
1287 (strncmp("SYSCALL_DEFINE", macro
, strlen("SYSCALL_DEFINE")) == 0 ||
1288 strncmp("COMPAT_SYSCALL_DEFINE", macro
, strlen("COMPAT_SYSCALL_DEFINE")) == 0))
1291 name
= get_function();
1292 if (!option_no_db
&& get_state(my_call_id
, "this_function", NULL
) != &called
) {
1293 if (name
&& strncmp(name
, "sys_", 4) == 0)
1297 if (name
&& strncmp(name
, "compat_sys_", 11) == 0)
1303 FOR_EACH_PTR(sym
->ctype
.base_type
->arguments
, arg
) {
1304 set_state(my_id
, arg
->ident
->name
, arg
, alloc_estate_whole(get_real_base_type(arg
)));
1305 } END_FOR_EACH_PTR(arg
);
1311 static void store_user_data_return(struct expression
*expr
, char *key
, char *value
, bool is_new
)
1313 struct smatch_state
*state
;
1314 struct range_list
*rl
;
1315 struct symbol
*type
;
1321 type
= get_type(expr
);
1322 snprintf(buf
, sizeof(buf
), "return %p%s", expr
, key
+ 1);
1323 call_results_to_rl(expr
, type
, value
, &rl
);
1325 state
= alloc_estate_rl(rl
);
1327 estate_set_new(state
);
1329 set_state(my_id
, buf
, NULL
, state
);
1332 static void set_to_user_data(struct expression
*expr
, char *key
, char *value
, bool is_new
)
1334 struct smatch_state
*state
;
1337 struct symbol
*type
;
1338 struct range_list
*rl
= NULL
;
1340 type
= get_member_type_from_key(expr
, key
);
1341 name
= get_variable_from_key(expr
, key
, &sym
);
1345 call_results_to_rl(expr
, type
, value
, &rl
);
1347 state
= alloc_estate_rl(rl
);
1348 if (param_data_capped(value
))
1349 estate_set_capped(state
);
1350 if (param_data_treat_untagged(value
))
1351 estate_set_treat_untagged(state
);
1353 estate_set_new(state
);
1354 estate_set_assigned(state
);
1355 set_state(my_id
, name
, sym
, state
);
1360 static void returns_param_user_data(struct expression
*expr
, int param
, char *key
, char *value
)
1362 struct expression
*arg
;
1363 struct expression
*call
;
1366 while (call
->type
== EXPR_ASSIGNMENT
)
1367 call
= strip_expr(call
->right
);
1368 if (call
->type
!= EXPR_CALL
)
1371 if (!we_pass_user_data(call
))
1375 if (expr
->type
!= EXPR_ASSIGNMENT
) {
1376 // TODO: faked_assign this should all be handled as a fake assignment
1377 store_user_data_return(expr
, key
, value
, OLD
);
1380 set_to_user_data(expr
->left
, key
, value
, OLD
);
1384 arg
= get_argument_from_call_expr(call
->args
, param
);
1387 set_to_user_data(arg
, key
, value
, OLD
);
1390 static void returns_param_user_data_set(struct expression
*expr
, int param
, char *key
, char *value
)
1392 struct expression
*arg
;
1394 func_gets_user_data
= true;
1397 if (expr
->type
!= EXPR_ASSIGNMENT
) {
1398 store_user_data_return(expr
, key
, value
, NEW
);
1401 set_to_user_data(expr
->left
, key
, value
, NEW
);
1405 while (expr
->type
== EXPR_ASSIGNMENT
)
1406 expr
= strip_expr(expr
->right
);
1407 if (expr
->type
!= EXPR_CALL
)
1410 arg
= get_argument_from_call_expr(expr
->args
, param
);
1413 set_to_user_data(arg
, key
, value
, NEW
);
1416 static void match_capped(struct expression
*expr
, const char *name
, struct symbol
*sym
, void *info
)
1418 struct smatch_state
*state
, *new;
1420 state
= get_state(my_id
, name
, sym
);
1421 if (!state
|| estate_capped(state
))
1424 new = clone_estate(state
);
1425 estate_set_capped(new);
1427 set_state(my_id
, name
, sym
, new);
1430 static void match_function_def(struct symbol
*sym
)
1432 if (is_user_data_fn(sym
))
1433 func_gets_user_data
= true;
1436 void register_kernel_user_data(int id
)
1442 if (option_project
!= PROJ_KERNEL
)
1445 set_dynamic_states(my_id
);
1447 add_function_data(&func_gets_user_data
);
1448 add_hook(&match_function_def
, FUNC_DEF_HOOK
);
1450 add_unmatched_state_hook(my_id
, &empty_state
);
1451 add_extra_nomod_hook(&extra_nomod_hook
);
1452 add_pre_merge_hook(my_id
, &pre_merge_hook
);
1453 add_merge_hook(my_id
, &merge_estates
);
1455 add_function_hook("copy_from_user", &match_user_copy
, INT_PTR(0));
1456 add_function_hook("__copy_from_user", &match_user_copy
, INT_PTR(0));
1457 add_function_hook("memcpy_fromiovec", &match_user_copy
, INT_PTR(0));
1458 for (i
= 0; i
< ARRAY_SIZE(kstr_funcs
); i
++)
1459 add_function_hook_late(kstr_funcs
[i
], &match_user_copy
, INT_PTR(2));
1460 add_function_hook("usb_control_msg", &match_user_copy
, INT_PTR(6));
1461 add_function_hook("kvm_read_guest_virt", &match_user_copy
, INT_PTR(2));
1462 add_function_hook("vpu_iface_receive_msg", &match_user_copy
, INT_PTR(1));
1463 add_function_hook("xdr_stream_decode_u32", &match_user_copy
, INT_PTR(1));
1465 for (i
= 0; i
< ARRAY_SIZE(returns_user_data
); i
++)
1466 add_function_hook(returns_user_data
[i
], &match_returns_user_rl
, NULL
);
1468 add_function_hook("sscanf", &match_sscanf
, NULL
);
1470 add_hook(&match_syscall_definition
, AFTER_DEF_HOOK
);
1472 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
1473 select_return_states_hook(PARAM_SET
, &db_param_set
);
1474 add_hook(&match_condition
, CONDITION_HOOK
);
1476 add_caller_info_callback(my_id
, caller_info_callback
);
1477 add_return_info_callback(my_id
, return_info_callback
);
1478 select_caller_info_hook(set_param_user_data
, USER_DATA
);
1479 select_return_states_hook(USER_DATA
, &returns_param_user_data
);
1480 select_return_states_hook(USER_DATA_SET
, &returns_param_user_data_set
);
1482 select_return_param_key(CAPPED_DATA
, &match_capped
);
1483 add_function_param_key_hook_late("memcpy", &match_capped
, 2, "$", NULL
);
1484 add_function_param_key_hook_late("_memcpy", &match_capped
, 2, "$", NULL
);
1485 add_function_param_key_hook_late("__memcpy", &match_capped
, 2, "$", NULL
);
1486 add_function_param_key_hook_late("memset", &match_capped
, 2, "$", NULL
);
1487 add_function_param_key_hook_late("_memset", &match_capped
, 2, "$", NULL
);
1488 add_function_param_key_hook_late("__memset", &match_capped
, 2, "$", NULL
);
1491 void register_kernel_user_data2(int id
)
1495 if (option_project
!= PROJ_KERNEL
)
1497 select_caller_info_hook(set_called
, INTERNAL
);