?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
return_to_param: delete debug code
[smatch.git] / smatch_kernel_user_data.c
blob46c54f5419d6f80cc17c8b9494833cc1aaf0d01d
1 /*
2 * Copyright (C) 2011 Dan Carpenter.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 /*
19 * There are a couple checks that try to see if a variable
20 * comes from the user. It would be better to unify them
21 * into one place. Also it we should follow the data down
22 * the call paths. Hence this file.
23 */
24
25 #include "smatch.h"
26 #include "smatch_slist.h"
27 #include "smatch_extra.h"
28
29 static int my_id;
30 static int my_call_id;
31
32 STATE(called);
33 static bool func_gets_user_data;
34
35 static const char *kstr_funcs[] = {
36 "kstrtoull", "kstrtoll", "kstrtoul", "kstrtol", "kstrtouint",
37 "kstrtoint", "kstrtou64", "kstrtos64", "kstrtou32", "kstrtos32",
38 "kstrtou16", "kstrtos16", "kstrtou8", "kstrtos8", "kstrtoull_from_user"
39 "kstrtoll_from_user", "kstrtoul_from_user", "kstrtol_from_user",
40 "kstrtouint_from_user", "kstrtoint_from_user", "kstrtou16_from_user",
41 "kstrtos16_from_user", "kstrtou8_from_user", "kstrtos8_from_user",
42 "kstrtou64_from_user", "kstrtos64_from_user", "kstrtou32_from_user",
43 "kstrtos32_from_user",
44 };
45
46 static const char *returns_user_data[] = {
47 "simple_strtol", "simple_strtoll", "simple_strtoul", "simple_strtoull",
48 "kvm_register_read",
49 };
50
51 static struct stree *start_states;
52 static struct stree_stack *saved_stack;
53 static void save_start_states(struct statement *stmt)
54 {
55 start_states = clone_stree(__get_cur_stree());
56 }
57
58 static void free_start_states(void)
59 {
60 free_stree(&start_states);
61 }
62
63 static void match_save_states(struct expression *expr)
64 {
65 push_stree(&saved_stack, start_states);
66 start_states = NULL;
67 }
68
69 static void match_restore_states(struct expression *expr)
70 {
71 free_stree(&start_states);
72 start_states = pop_stree(&saved_stack);
73 }
74
75 static struct smatch_state *empty_state(struct sm_state *sm)
76 {
77 return alloc_estate_empty();
78 }
79
80 static struct smatch_state *new_state(struct symbol *type)
81 {
82 struct smatch_state *state;
83
84 if (!type || type_is_ptr(type))
85 return NULL;
86
87 state = alloc_estate_whole(type);
88 estate_set_new(state);
89 return state;
90 }
91
92 static void pre_merge_hook(struct sm_state *cur, struct sm_state *other)
93 {
94 struct smatch_state *user = cur->state;
95 struct smatch_state *extra;
96 struct smatch_state *state;
97 struct range_list *rl;
98
99 extra = __get_state(SMATCH_EXTRA, cur->name, cur->sym);
100 if (!extra)
101 return;
102 rl = rl_intersection(estate_rl(user), estate_rl(extra));
103 state = alloc_estate_rl(clone_rl(rl));
104 if (estate_capped(user) || is_capped_var_sym(cur->name, cur->sym))
105 estate_set_capped(state);
106 if (estate_treat_untagged(user))
107 estate_set_treat_untagged(state);
108 if (estates_equiv(state, cur->state))
109 return;
110 set_state(my_id, cur->name, cur->sym, state);
111 }
112
113 static void extra_nomod_hook(const char *name, struct symbol *sym, struct expression *expr, struct smatch_state *state)
114 {
115 struct smatch_state *user, *new;
116 struct range_list *rl;
117
118 user = __get_state(my_id, name, sym);
119 if (!user)
120 return;
121 rl = rl_intersection(estate_rl(user), estate_rl(state));
122 if (rl_equiv(rl, estate_rl(user)))
123 return;
124 new = alloc_estate_rl(rl);
125 if (estate_capped(user))
126 estate_set_capped(new);
127 if (estate_treat_untagged(user))
128 estate_set_treat_untagged(new);
129 set_state(my_id, name, sym, new);
130 }
131
132 static bool user_rl_known(struct expression *expr)
133 {
134 struct range_list *rl;
135 sval_t close_to_max;
136
137 if (!get_user_rl(expr, &rl))
138 return true;
139
140 close_to_max = sval_type_max(rl_type(rl));
141 close_to_max.value -= 100;
142
143 if (sval_cmp(rl_max(rl), close_to_max) >= 0)
144 return false;
145 return true;
146 }
147
148 static bool is_array_index_mask_nospec(struct expression *expr)
149 {
150 struct expression *orig;
151
152 orig = get_assigned_expr(expr);
153 if (!orig || orig->type != EXPR_CALL)
154 return false;
155 return sym_name_is("array_index_mask_nospec", orig->fn);
156 }
157
158 static bool binop_capped(struct expression *expr)
159 {
160 struct range_list *left_rl;
161 int comparison;
162 sval_t sval;
163
164 if (expr->op == '-' && get_user_rl(expr->left, &left_rl)) {
165 if (user_rl_capped(expr->left))
166 return true;
167 comparison = get_comparison(expr->left, expr->right);
168 if (comparison && show_special(comparison)[0] == '>')
169 return true;
170 return false;
171 }
172
173 if (expr->op == '&' || expr->op == '%') {
174 bool left_user, left_capped, right_user, right_capped;
175
176 if (!get_value(expr->right, &sval) && is_capped(expr->right))
177 return true;
178 if (is_array_index_mask_nospec(expr->right))
179 return true;
180 if (is_capped(expr->left))
181 return true;
182 left_user = is_user_rl(expr->left);
183 right_user = is_user_rl(expr->right);
184 if (!left_user && !right_user)
185 return true;
186
187 left_capped = user_rl_capped(expr->left);
188 right_capped = user_rl_capped(expr->right);
189
190 if (left_user && left_capped) {
191 if (!right_user)
192 return true;
193 if (right_user && right_capped)
194 return true;
195 return false;
196 }
197 if (right_user && right_capped) {
198 if (!left_user)
199 return true;
200 return false;
201 }
202 return false;
203 }
204
205 /*
206 * Generally "capped" means that we capped it to an unknown value.
207 * This is useful because if Smatch doesn't know what the value is then
208 * we have to trust that it is correct. But if we known cap value is
209 * 100 then we can check if 100 is correct and complain if it's wrong.
210 *
211 * So then the problem is with BINOP when we take a capped variable
212 * plus a user variable which is clamped to a known range (uncapped)
213 * the result should be capped.
214 */
215 if ((user_rl_capped(expr->left) || user_rl_known(expr->left)) &&
216 (user_rl_capped(expr->right) || user_rl_known(expr->right)))
217 return true;
218
219 return false;
220 }
221
222 bool user_rl_capped(struct expression *expr)
223 {
224 struct smatch_state *state;
225 struct range_list *rl;
226 sval_t sval;
227
228 expr = strip_expr(expr);
229 if (!expr)
230 return false;
231 if (get_value(expr, &sval))
232 return true;
233 if (expr->type == EXPR_BINOP)
234 return binop_capped(expr);
235 if ((expr->type == EXPR_PREOP || expr->type == EXPR_POSTOP) &&
236 (expr->op == SPECIAL_INCREMENT || expr->op == SPECIAL_DECREMENT))
237 return user_rl_capped(expr->unop);
238 state = get_state_expr(my_id, expr);
239 if (state)
240 return estate_capped(state);
241
242 if (!get_user_rl(expr, &rl)) {
243 /*
244 * The non user data parts of a binop are capped and
245 * also empty user rl states are capped.
246 */
247 return true;
248 }
249
250 if (rl_to_sval(rl, &sval))
251 return true;
252
253 return false; /* uncapped user data */
254 }
255
256 bool user_rl_treat_untagged(struct expression *expr)
257 {
258 struct smatch_state *state;
259 struct range_list *rl;
260 sval_t sval;
261
262 expr = strip_expr(expr);
263 if (!expr)
264 return false;
265 if (get_value(expr, &sval))
266 return true;
267
268 state = get_state_expr(my_id, expr);
269 if (state)
270 return estate_treat_untagged(state);
271
272 if (get_user_rl(expr, &rl))
273 return false; /* uncapped user data */
274
275 return true; /* not actually user data */
276 }
277
278 static void tag_inner_struct_members(struct expression *expr, struct symbol *member)
279 {
280 struct expression *edge_member;
281 struct symbol *base = get_real_base_type(member);
282 struct symbol *tmp;
283
284 if (member->ident)
285 expr = member_expression(expr, '.', member->ident);
286
287 FOR_EACH_PTR(base->symbol_list, tmp) {
288 struct symbol *type;
289
290 type = get_real_base_type(tmp);
291 if (!type)
292 continue;
293
294 if (type->type == SYM_UNION || type->type == SYM_STRUCT) {
295 tag_inner_struct_members(expr, tmp);
296 continue;
297 }
298
299 if (!tmp->ident)
300 continue;
301
302 edge_member = member_expression(expr, '.', tmp->ident);
303 set_state_expr(my_id, edge_member, new_state(type));
304 } END_FOR_EACH_PTR(tmp);
305 }
306
307 void __set_user_string(struct expression *expr);
308 static void tag_struct_members(struct symbol *type, struct expression *expr)
309 {
310 struct symbol *tmp;
311 struct expression *member;
312 int op = '*';
313
314 if (expr->type == EXPR_PREOP && expr->op == '&') {
315 expr = strip_expr(expr->unop);
316 op = '.';
317 }
318
319 FOR_EACH_PTR(type->symbol_list, tmp) {
320 type = get_real_base_type(tmp);
321 if (!type)
322 continue;
323
324 if (type->type == SYM_UNION || type->type == SYM_STRUCT) {
325 tag_inner_struct_members(expr, tmp);
326 continue;
327 }
328
329 if (!tmp->ident)
330 continue;
331
332 member = member_expression(expr, op, tmp->ident);
333 if (type->type == SYM_ARRAY) {
334 set_points_to_user_data(member);
335 } else {
336 set_state_expr(my_id, member, new_state(get_type(member)));
337 }
338 } END_FOR_EACH_PTR(tmp);
339 }
340
341 static void tag_base_type(struct expression *expr)
342 {
343 if (expr->type == EXPR_PREOP && expr->op == '&')
344 expr = strip_expr(expr->unop);
345 else
346 expr = deref_expression(expr);
347 set_state_expr(my_id, expr, new_state(get_type(expr)));
348 }
349
350 static void tag_as_user_data(struct expression *expr)
351 {
352 struct symbol *type;
353
354 expr = strip_expr(expr);
355
356 type = get_type(expr);
357 if (!type || type->type != SYM_PTR)
358 return;
359 type = get_real_base_type(type);
360 if (!type)
361 return;
362 if (type == &void_ctype) {
363 set_state_expr(my_id, deref_expression(expr), new_state(&ulong_ctype));
364 return;
365 }
366 if (type->type == SYM_BASETYPE) {
367 if (expr->type != EXPR_PREOP && expr->op != '&')
368 set_points_to_user_data(expr);
369 tag_base_type(expr);
370 return;
371 }
372 if (type->type == SYM_STRUCT || type->type == SYM_UNION) {
373 if (expr->type != EXPR_PREOP || expr->op != '&')
374 expr = deref_expression(expr);
375 else
376 set_state_expr(my_id, deref_expression(expr), new_state(&ulong_ctype));
377 tag_struct_members(type, expr);
378 }
379 }
380
381 static void match_user_copy(const char *fn, struct expression *expr, void *_param)
382 {
383 int param = PTR_INT(_param);
384 struct expression *dest;
385
386 func_gets_user_data = true;
387
388 dest = get_argument_from_call_expr(expr->args, param);
389 dest = strip_expr(dest);
390 if (!dest)
391 return;
392 tag_as_user_data(dest);
393 }
394
395 static int is_dev_attr_name(struct expression *expr)
396 {
397 char *name;
398 int ret = 0;
399
400 name = expr_to_str(expr);
401 if (!name)
402 return 0;
403 if (strstr(name, "->attr.name"))
404 ret = 1;
405 free_string(name);
406 return ret;
407 }
408
409 static int ends_in_n(struct expression *expr)
410 {
411 struct string *str;
412
413 if (!expr)
414 return 0;
415 if (expr->type != EXPR_STRING || !expr->string)
416 return 0;
417
418 str = expr->string;
419 if (str->length < 3)
420 return 0;
421
422 if (str->data[str->length - 3] == '%' &&
423 str->data[str->length - 2] == 'n')
424 return 1;
425 return 0;
426 }
427
428 static void match_sscanf(const char *fn, struct expression *expr, void *unused)
429 {
430 struct expression *str, *format, *arg;
431 int i, last;
432
433 func_gets_user_data = true;
434
435 str = get_argument_from_call_expr(expr->args, 0);
436 if (is_dev_attr_name(str))
437 return;
438
439 format = get_argument_from_call_expr(expr->args, 1);
440 if (is_dev_attr_name(format))
441 return;
442
443 last = ptr_list_size((struct ptr_list *)expr->args) - 1;
444
445 i = -1;
446 FOR_EACH_PTR(expr->args, arg) {
447 i++;
448 if (i < 2)
449 continue;
450 if (i == last && ends_in_n(format))
451 continue;
452 tag_as_user_data(arg);
453 } END_FOR_EACH_PTR(arg);
454 }
455
456 static int get_rl_from_function(struct expression *expr, struct range_list **rl)
457 {
458 int i;
459
460 if (expr->type != EXPR_CALL || expr->fn->type != EXPR_SYMBOL ||
461 !expr->fn->symbol_name || !expr->fn->symbol_name->name)
462 return 0;
463
464 for (i = 0; i < ARRAY_SIZE(returns_user_data); i++) {
465 if (strcmp(expr->fn->symbol_name->name, returns_user_data[i]) == 0) {
466 *rl = alloc_whole_rl(get_type(expr));
467 return 1;
468 }
469 }
470 return 0;
471 }
472
473 static int comes_from_skb_data(struct expression *expr)
474 {
475 expr = strip_expr(expr);
476 if (!expr || expr->type != EXPR_PREOP || expr->op != '*')
477 return 0;
478
479 expr = strip_expr(expr->unop);
480 if (!expr)
481 return 0;
482 if (expr->type == EXPR_BINOP && expr->op == '+')
483 expr = strip_expr(expr->left);
484
485 return is_skb_data(expr);
486 }
487
488 static int handle_get_user(struct expression *expr)
489 {
490 char *name;
491 int ret = 0;
492
493 name = get_macro_name(expr->pos);
494 if (!name || strcmp(name, "get_user") != 0)
495 return 0;
496
497 name = expr_to_var(expr->right);
498 if (!name || (strcmp(name, "__val_gu") != 0 && strcmp(name, "__gu_val") != 0))
499 goto free;
500 set_state_expr(my_id, expr->left, new_state(get_type(expr->left)));
501 ret = 1;
502 free:
503 free_string(name);
504 return ret;
505 }
506
507 static bool state_is_new(struct expression *expr)
508 {
509 struct smatch_state *state;
510
511 state = get_state_expr(my_id, expr);
512 if (estate_new(state))
513 return true;
514
515 if (expr->type == EXPR_BINOP) {
516 if (state_is_new(expr->left))
517 return true;
518 if (state_is_new(expr->right))
519 return true;
520 }
521 return false;
522 }
523
524 static bool handle_op_assign(struct expression *expr)
525 {
526 struct expression *binop_expr;
527 struct smatch_state *state;
528 struct range_list *rl;
529
530 switch (expr->op) {
531 case SPECIAL_ADD_ASSIGN:
532 case SPECIAL_SUB_ASSIGN:
533 case SPECIAL_AND_ASSIGN:
534 case SPECIAL_MOD_ASSIGN:
535 case SPECIAL_SHL_ASSIGN:
536 case SPECIAL_SHR_ASSIGN:
537 case SPECIAL_OR_ASSIGN:
538 case SPECIAL_XOR_ASSIGN:
539 case SPECIAL_MUL_ASSIGN:
540 case SPECIAL_DIV_ASSIGN:
541 binop_expr = binop_expression(expr->left,
542 op_remove_assign(expr->op),
543 expr->right);
544 if (!get_user_rl(binop_expr, &rl))
545 return true;
546
547 rl = cast_rl(get_type(expr->left), rl);
548 state = alloc_estate_rl(rl);
549 if (user_rl_capped(binop_expr))
550 estate_set_capped(state);
551 if (user_rl_treat_untagged(expr->left))
552 estate_set_treat_untagged(state);
553 if (state_is_new(binop_expr))
554 estate_set_new(state);
555 set_state_expr(my_id, expr->left, state);
556 return true;
557 }
558 return false;
559 }
560
561 static void match_assign(struct expression *expr)
562 {
563 struct symbol *left_type, *right_type;
564 struct range_list *rl;
565 static struct expression *handled;
566 struct smatch_state *state;
567 struct expression *faked;
568 bool is_capped = false;
569 bool is_new = false;
570
571 left_type = get_type(expr->left);
572 if (left_type == &void_ctype)
573 return;
574
575 faked = get_faked_expression();
576
577 /* FIXME: handle fake array assignments frob(&user_array[x]); */
578
579 if (is_fake_call(expr->right) && faked &&
580 faked->type == EXPR_ASSIGNMENT &&
581 points_to_user_data(faked->right)) {
582 if (is_skb_data(faked->right))
583 func_gets_user_data = true;
584 rl = alloc_whole_rl(get_type(expr->left));
585 is_new = true;
586 goto set;
587 }
588
589 if (faked && faked == handled)
590 return;
591 if (is_fake_call(expr->right))
592 goto clear_old_state;
593 if (handle_get_user(expr))
594 return;
595 if (points_to_user_data(expr->right) &&
596 is_struct_ptr(get_type(expr->left))) {
597 handled = expr;
598 // This should be handled by smatch_points_to_user_data.c
599 // set_points_to_user_data(expr->left);
600 }
601
602 if (handle_op_assign(expr))
603 return;
604 if (expr->op != '=')
605 goto clear_old_state;
606
607 /* Handled by DB code */
608 if (expr->right->type == EXPR_CALL || __in_fake_parameter_assign)
609 return;
610
611 if (!get_user_rl(expr->right, &rl))
612 goto clear_old_state;
613 is_capped = user_rl_capped(expr->right);
614 is_new = state_is_new(expr->right);
615
616 set:
617 if (type_is_ptr(left_type)) {
618 right_type = get_type(expr->right);
619 if (right_type && right_type->type == SYM_ARRAY)
620 set_points_to_user_data(expr->left);
621 return;
622 }
623
624 rl = cast_rl(left_type, rl);
625 state = alloc_estate_rl(rl);
626 if (is_new)
627 estate_set_new(state);
628 if (is_capped)
629 estate_set_capped(state);
630 if (user_rl_treat_untagged(expr->right))
631 estate_set_treat_untagged(state);
632
633 if (local_debug)
634 sm_msg("%s: left = '%s' user_state = '%s'", __func__, expr_to_str(expr->left), state->name);
635 set_state_expr(my_id, expr->left, state);
636
637 return;
638
639 clear_old_state:
640
641 /*
642 * HACK ALERT!!! This should be at the start of the function. The
643 * the problem is that handling "pointer = array;" assignments is
644 * handled in this function instead of in kernel_points_to_user_data.c.
645 */
646 if (type_is_ptr(left_type))
647 return;
648
649 if (get_state_expr(my_id, expr->left))
650 set_state_expr(my_id, expr->left, alloc_estate_empty());
651 }
652
653 static void handle_eq_noteq(struct expression *expr)
654 {
655 struct smatch_state *left_orig, *right_orig;
656
657 left_orig = get_state_expr(my_id, expr->left);
658 right_orig = get_state_expr(my_id, expr->right);
659
660 if (!left_orig && !right_orig)
661 return;
662 if (left_orig && right_orig)
663 return;
664
665 if (left_orig) {
666 set_true_false_states_expr(my_id, expr->left,
667 expr->op == SPECIAL_EQUAL ? alloc_estate_empty() : NULL,
668 expr->op == SPECIAL_EQUAL ? NULL : alloc_estate_empty());
669 } else {
670 set_true_false_states_expr(my_id, expr->right,
671 expr->op == SPECIAL_EQUAL ? alloc_estate_empty() : NULL,
672 expr->op == SPECIAL_EQUAL ? NULL : alloc_estate_empty());
673 }
674 }
675
676 static struct range_list *strip_negatives(struct range_list *rl)
677 {
678 sval_t min = rl_min(rl);
679 sval_t minus_one = { .type = rl_type(rl), .value = -1 };
680 sval_t over = { .type = rl_type(rl), .value = INT_MAX + 1ULL };
681 sval_t max = sval_type_max(rl_type(rl));
682
683 if (!rl)
684 return NULL;
685
686 if (type_unsigned(rl_type(rl)) && type_bits(rl_type(rl)) > 31)
687 return remove_range(rl, over, max);
688
689 return remove_range(rl, min, minus_one);
690 }
691
692 static void handle_compare(struct expression *expr)
693 {
694 struct expression *left, *right;
695 struct range_list *left_rl = NULL;
696 struct range_list *right_rl = NULL;
697 struct range_list *user_rl;
698 struct smatch_state *capped_state;
699 struct smatch_state *left_true = NULL;
700 struct smatch_state *left_false = NULL;
701 struct smatch_state *right_true = NULL;
702 struct smatch_state *right_false = NULL;
703 struct symbol *type;
704 sval_t sval;
705
706 left = strip_expr(expr->left);
707 right = strip_expr(expr->right);
708
709 while (left->type == EXPR_ASSIGNMENT)
710 left = strip_expr(left->left);
711
712 /*
713 * Conditions are mostly handled by smatch_extra.c, but there are some
714 * times where the exact values are not known so we can't do that.
715 *
716 * Normally, we might consider using smatch_capped.c to supliment smatch
717 * extra but that doesn't work when we merge unknown uncapped kernel
718 * data with unknown capped user data. The result is uncapped user
719 * data. We need to keep it separate and say that the user data is
720 * capped. In the past, I would have marked this as just regular
721 * kernel data (not user data) but we can't do that these days because
722 * we need to track user data for Spectre.
723 *
724 * The other situation which we have to handle is when we do have an
725 * int and we compare against an unknown unsigned kernel variable. In
726 * that situation we assume that the kernel data is less than INT_MAX.
727 * Otherwise then we get all sorts of array underflow false positives.
728 *
729 */
730
731 /* Handled in smatch_extra.c */
732 if (get_implied_value(left, &sval) ||
733 get_implied_value(right, &sval))
734 return;
735
736 get_user_rl(left, &left_rl);
737 get_user_rl(right, &right_rl);
738
739 /* nothing to do */
740 if (!left_rl && !right_rl)
741 return;
742 /* if both sides are user data that's not a good limit */
743 if (left_rl && right_rl)
744 return;
745
746 if (left_rl)
747 user_rl = left_rl;
748 else
749 user_rl = right_rl;
750
751 type = get_type(expr);
752 if (type_unsigned(type))
753 user_rl = strip_negatives(user_rl);
754 capped_state = alloc_estate_rl(user_rl);
755 estate_set_capped(capped_state);
756
757 switch (expr->op) {
758 case '<':
759 case SPECIAL_UNSIGNED_LT:
760 case SPECIAL_LTE:
761 case SPECIAL_UNSIGNED_LTE:
762 if (left_rl)
763 left_true = capped_state;
764 else
765 right_false = capped_state;
766 break;
767 case '>':
768 case SPECIAL_UNSIGNED_GT:
769 case SPECIAL_GTE:
770 case SPECIAL_UNSIGNED_GTE:
771 if (left_rl)
772 left_false = capped_state;
773 else
774 right_true = capped_state;
775 break;
776 }
777
778 set_true_false_states_expr(my_id, left, left_true, left_false);
779 set_true_false_states_expr(my_id, right, right_true, right_false);
780 }
781
782 static void match_condition(struct expression *expr)
783 {
784 if (expr->type != EXPR_COMPARE)
785 return;
786
787 if (expr->op == SPECIAL_EQUAL ||
788 expr->op == SPECIAL_NOTEQUAL) {
789 handle_eq_noteq(expr);
790 return;
791 }
792
793 handle_compare(expr);
794 }
795
796 static void match_returns_user_rl(const char *fn, struct expression *expr, void *unused)
797 {
798 func_gets_user_data = true;
799 }
800
801 static int get_user_macro_rl(struct expression *expr, struct range_list **rl)
802 {
803 struct expression *parent;
804 char *macro;
805
806 if (!expr)
807 return 0;
808
809 macro = get_macro_name(expr->pos);
810 if (!macro)
811 return 0;
812
813 /* handle ntohl(foo[i]) where "i" is trusted */
814 parent = expr_get_parent_expr(expr);
815 while (parent && parent->type != EXPR_BINOP)
816 parent = expr_get_parent_expr(parent);
817 if (parent && parent->type == EXPR_BINOP) {
818 char *parent_macro = get_macro_name(parent->pos);
819
820 if (parent_macro && strcmp(macro, parent_macro) == 0)
821 return 0;
822 }
823
824 if (strcmp(macro, "ntohl") == 0) {
825 *rl = alloc_whole_rl(&uint_ctype);
826 return 1;
827 }
828 if (strcmp(macro, "ntohs") == 0) {
829 *rl = alloc_whole_rl(&ushort_ctype);
830 return 1;
831 }
832 return 0;
833 }
834
835 static int has_user_data(struct symbol *sym)
836 {
837 struct sm_state *tmp;
838
839 FOR_EACH_MY_SM(my_id, __get_cur_stree(), tmp) {
840 if (tmp->sym == sym)
841 return 1;
842 } END_FOR_EACH_SM(tmp);
843 return 0;
844 }
845
846 bool we_pass_user_data(struct expression *call)
847 {
848 struct expression *arg;
849 struct symbol *sym;
850
851 FOR_EACH_PTR(call->args, arg) {
852 if (local_debug)
853 sm_msg("%s: arg = '%s' %s", __func__,
854 expr_to_str(arg),
855 points_to_user_data(arg) ? "user pointer" : "not");
856 if (points_to_user_data(arg))
857 return true;
858 sym = expr_to_sym(arg);
859 if (!sym)
860 continue;
861 if (has_user_data(sym))
862 return true;
863 } END_FOR_EACH_PTR(arg);
864
865 return false;
866 }
867
868 static int db_returned_user_rl(struct expression *call, struct range_list **rl)
869 {
870 struct smatch_state *state;
871 char buf[48];
872
873 if (is_fake_call(call))
874 return 0;
875 snprintf(buf, sizeof(buf), "return %p", call);
876 state = get_state(my_id, buf, NULL);
877 if (!state || !estate_rl(state))
878 return 0;
879 *rl = estate_rl(state);
880 return 1;
881 }
882
883 struct stree *get_user_stree(void)
884 {
885 return get_all_states_stree(my_id);
886 }
887
888 static int user_data_flag;
889 static int no_user_data_flag;
890 struct range_list *var_user_rl(struct expression *expr)
891 {
892 struct smatch_state *state;
893 struct range_list *rl;
894 struct range_list *absolute_rl;
895
896 if (expr->type == EXPR_PREOP && expr->op == '&') {
897 no_user_data_flag = 1;
898 return NULL;
899 }
900
901 if (expr->type == EXPR_BINOP && expr->op == '%') {
902 struct range_list *left, *right;
903
904 if (!get_user_rl(expr->right, &right))
905 return NULL;
906 get_absolute_rl(expr->left, &left);
907 rl = rl_binop(left, '%', right);
908 goto found;
909 }
910
911 if (expr->type == EXPR_BINOP && expr->op == '/') {
912 struct range_list *left = NULL;
913 struct range_list *right = NULL;
914 struct range_list *abs_right;
915
916 /*
917 * The specific bug I'm dealing with is:
918 *
919 * foo = capped_user / unknown;
920 *
921 * Instead of just saying foo is now entirely user_rl we should
922 * probably say instead that it is not at all user data.
923 *
924 */
925
926 get_user_rl(expr->left, &left);
927 get_user_rl(expr->right, &right);
928 get_absolute_rl(expr->right, &abs_right);
929
930 if (left && !right) {
931 rl = rl_binop(left, '/', abs_right);
932 if (sval_cmp(rl_max(left), rl_max(rl)) < 0)
933 no_user_data_flag = 1;
934 }
935
936 return NULL;
937 }
938
939 if (get_rl_from_function(expr, &rl))
940 goto found;
941
942 if (get_user_macro_rl(expr, &rl))
943 goto found;
944
945 if (comes_from_skb_data(expr)) {
946 rl = alloc_whole_rl(get_type(expr));
947 goto found;
948 }
949
950 state = get_state_expr(my_id, expr);
951 if (state && estate_rl(state)) {
952 rl = estate_rl(state);
953 goto found;
954 }
955
956 if (expr->type == EXPR_CALL && db_returned_user_rl(expr, &rl))
957 goto found;
958
959 if (expr->type == EXPR_PREOP && expr->op == '*' &&
960 points_to_user_data(expr->unop)) {
961 rl = var_to_absolute_rl(expr);
962 goto found;
963 }
964
965 if (is_array(expr)) {
966 struct expression *array = get_array_base(expr);
967
968 if (!get_state_expr(my_id, array)) {
969 no_user_data_flag = 1;
970 return NULL;
971 }
972 }
973
974 return NULL;
975 found:
976 user_data_flag = 1;
977 absolute_rl = var_to_absolute_rl(expr);
978 return clone_rl(rl_intersection(rl, absolute_rl));
979 }
980
981 static bool is_ptr_subtract(struct expression *expr)
982 {
983 expr = strip_expr(expr);
984 if (!expr)
985 return false;
986 if (expr->type == EXPR_BINOP && expr->op == '-' &&
987 type_is_ptr(get_type(expr->left))) {
988 return true;
989 }
990 return false;
991 }
992
993 int get_user_rl(struct expression *expr, struct range_list **rl)
994 {
995 if (is_ptr_subtract(expr))
996 return 0;
997
998 user_data_flag = 0;
999 no_user_data_flag = 0;
1000 custom_get_absolute_rl(expr, &var_user_rl, rl);
1001 if (!user_data_flag || no_user_data_flag)
1002 *rl = NULL;
1003
1004 return !!*rl;
1005 }
1006
1007 int is_user_rl(struct expression *expr)
1008 {
1009 struct range_list *tmp;
1010
1011 return get_user_rl(expr, &tmp) && tmp;
1012 }
1013
1014 int get_user_rl_var_sym(const char *name, struct symbol *sym, struct range_list **rl)
1015 {
1016 struct smatch_state *state;
1017
1018 state = get_state(my_id, name, sym);
1019 if (state && estate_rl(state)) {
1020 *rl = estate_rl(state);
1021 return 1;
1022 }
1023 return 0;
1024 }
1025
1026 static void return_info_callback(int return_id, char *return_ranges,
1027 struct expression *returned_expr,
1028 int param,
1029 const char *printed_name,
1030 struct sm_state *sm)
1031 {
1032 struct smatch_state *extra;
1033 struct range_list *rl;
1034 char buf[64];
1035
1036 if (param >= 0) {
1037 if (strcmp(printed_name, "$") == 0)
1038 return;
1039 if (!param_was_set_var_sym(sm->name, sm->sym))
1040 return;
1041 }
1042 rl = estate_rl(sm->state);
1043 if (!rl)
1044 return;
1045 extra = get_state(SMATCH_EXTRA, sm->name, sm->sym);
1046 if (estate_rl(extra))
1047 rl = rl_intersection(estate_rl(sm->state), estate_rl(extra));
1048 if (!rl)
1049 return;
1050
1051 snprintf(buf, sizeof(buf), "%s%s%s",
1052 show_rl(rl),
1053 estate_capped(sm->state) ? "[c]" : "",
1054 estate_treat_untagged(sm->state) ? "[u]" : "");
1055 sql_insert_return_states(return_id, return_ranges,
1056 estate_new(sm->state) ? USER_DATA_SET : USER_DATA,
1057 param, printed_name, buf);
1058 }
1059
1060 static void caller_info_callback(struct expression *call, int param, char *printed_name, struct sm_state *sm)
1061 {
1062 struct smatch_state *state;
1063 struct range_list *rl;
1064 struct symbol *type;
1065 char buf[64];
1066
1067 if (local_debug)
1068 sm_msg("%s: name = '%s' sm = '%s'", __func__, printed_name, show_sm(sm));
1069
1070 /*
1071 * Smatch uses a hack where if we get an unsigned long we say it's
1072 * both user data and it points to user data. But if we pass it to a
1073 * function which takes an int, then it's just user data. There's not
1074 * enough bytes for it to be a pointer.
1075 *
1076 */
1077 type = get_arg_type(call->fn, param);
1078 if (strcmp(printed_name, "$") != 0 && type && type_bits(type) < type_bits(&ptr_ctype))
1079 return;
1080
1081 if (strcmp(sm->state->name, "") == 0)
1082 return;
1083
1084 state = __get_state(SMATCH_EXTRA, sm->name, sm->sym);
1085 if (!state || !estate_rl(state))
1086 rl = estate_rl(sm->state);
1087 else
1088 rl = rl_intersection(estate_rl(sm->state), estate_rl(state));
1089
1090 if (!rl)
1091 return;
1092
1093 snprintf(buf, sizeof(buf), "%s%s%s", show_rl(rl),
1094 estate_capped(sm->state) ? "[c]" : "",
1095 estate_treat_untagged(sm->state) ? "[u]" : "");
1096 sql_insert_caller_info(call, USER_DATA, param, printed_name, buf);
1097 }
1098
1099 static void db_param_set(struct expression *expr, int param, char *key, char *value)
1100 {
1101 struct expression *arg;
1102 char *name;
1103 struct symbol *sym;
1104 struct smatch_state *state;
1105
1106 while (expr->type == EXPR_ASSIGNMENT)
1107 expr = strip_expr(expr->right);
1108 if (expr->type != EXPR_CALL)
1109 return;
1110
1111 arg = get_argument_from_call_expr(expr->args, param);
1112 if (!arg)
1113 return;
1114 name = get_variable_from_key(arg, key, &sym);
1115 if (!name || !sym)
1116 goto free;
1117
1118 state = get_state(my_id, name, sym);
1119 if (!state)
1120 goto free;
1121
1122 set_state(my_id, name, sym, alloc_estate_empty());
1123 free:
1124 free_string(name);
1125 }
1126
1127 static bool param_data_capped(const char *value)
1128 {
1129 if (strstr(value, ",c") || strstr(value, "[c"))
1130 return true;
1131 return false;
1132 }
1133
1134 static bool param_data_treat_untagged(const char *value)
1135 {
1136 if (strstr(value, ",u") || strstr(value, "[u"))
1137 return true;
1138 return false;
1139 }
1140
1141 static void set_param_user_data(const char *name, struct symbol *sym, char *key, char *value)
1142 {
1143 struct expression *expr;
1144 struct range_list *rl = NULL;
1145 struct smatch_state *state;
1146 struct symbol *type;
1147 char *fullname;
1148
1149 expr = symbol_expression(sym);
1150 fullname = get_variable_from_key(expr, key, NULL);
1151 if (!fullname)
1152 return;
1153
1154 type = get_member_type_from_key(expr, key);
1155 if (type && type->type == SYM_STRUCT) {
1156 sm_info("%s: user data struct. key='%s' value='%s'",
1157 __func__, key, value);
1158 return;
1159 }
1160
1161 // FIXME: This is temporary. Just run this on Thursday and then
1162 // let's make it a printf() and then delete it.
1163 if (!type) {
1164 sm_msg("%s: no type for '%s'", __func__, fullname);
1165 return;
1166 }
1167
1168 str_to_rl(type, value, &rl);
1169 rl = swap_mtag_seed(expr, rl);
1170 state = alloc_estate_rl(rl);
1171 if (param_data_capped(value) || is_capped(expr))
1172 estate_set_capped(state);
1173 if (param_data_treat_untagged(value) || sym->ctype.as == 5)
1174 estate_set_treat_untagged(state);
1175 set_state(my_id, fullname, sym, state);
1176 }
1177
1178 static void set_called(const char *name, struct symbol *sym, char *key, char *value)
1179 {
1180 set_state(my_call_id, "this_function", NULL, &called);
1181 }
1182
1183 static void match_syscall_definition(struct symbol *sym)
1184 {
1185 struct symbol *arg;
1186 char *macro;
1187 char *name;
1188 int is_syscall = 0;
1189
1190 macro = get_macro_name(sym->pos);
1191 if (macro &&
1192 (strncmp("SYSCALL_DEFINE", macro, strlen("SYSCALL_DEFINE")) == 0 ||
1193 strncmp("COMPAT_SYSCALL_DEFINE", macro, strlen("COMPAT_SYSCALL_DEFINE")) == 0))
1194 is_syscall = 1;
1195
1196 name = get_function();
1197 if (!option_no_db && get_state(my_call_id, "this_function", NULL) != &called) {
1198 if (name && strncmp(name, "sys_", 4) == 0)
1199 is_syscall = 1;
1200 }
1201
1202 if (name && strncmp(name, "compat_sys_", 11) == 0)
1203 is_syscall = 1;
1204
1205 if (!is_syscall)
1206 return;
1207
1208 FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
1209 set_state(my_id, arg->ident->name, arg, alloc_estate_whole(get_real_base_type(arg)));
1210 } END_FOR_EACH_PTR(arg);
1211 }
1212
1213 #define OLD 0
1214 #define NEW 1
1215
1216 static void store_user_data_return(struct expression *expr, char *key, char *value, bool is_new)
1217 {
1218 struct smatch_state *state;
1219 struct range_list *rl;
1220 struct symbol *type;
1221 char buf[48];
1222
1223 if (key[0] != '$')
1224 return;
1225
1226 type = get_type(expr);
1227 snprintf(buf, sizeof(buf), "return %p%s", expr, key + 1);
1228 call_results_to_rl(expr, type, value, &rl);
1229
1230 state = alloc_estate_rl(rl);
1231 if (is_new)
1232 estate_set_new(state);
1233
1234 set_state(my_id, buf, NULL, state);
1235 }
1236
1237 static void set_to_user_data(struct expression *expr, char *key, char *value, bool is_new)
1238 {
1239 struct smatch_state *state;
1240 char *name;
1241 struct symbol *sym;
1242 struct symbol *type;
1243 struct range_list *rl = NULL;
1244
1245 type = get_member_type_from_key(expr, key);
1246 name = get_variable_from_key(expr, key, &sym);
1247 if (!name || !sym)
1248 goto free;
1249
1250 call_results_to_rl(expr, type, value, &rl);
1251
1252 state = alloc_estate_rl(rl);
1253 if (param_data_capped(value))
1254 estate_set_capped(state);
1255 if (param_data_treat_untagged(value))
1256 estate_set_treat_untagged(state);
1257 if (is_new)
1258 estate_set_new(state);
1259 set_state(my_id, name, sym, state);
1260 free:
1261 free_string(name);
1262 }
1263
1264 static void returns_param_user_data(struct expression *expr, int param, char *key, char *value)
1265 {
1266 struct expression *arg;
1267 struct expression *call;
1268
1269 call = expr;
1270 while (call->type == EXPR_ASSIGNMENT)
1271 call = strip_expr(call->right);
1272 if (call->type != EXPR_CALL)
1273 return;
1274
1275 if (!we_pass_user_data(call))
1276 return;
1277
1278 if (param == -1) {
1279 if (expr->type != EXPR_ASSIGNMENT) {
1280 store_user_data_return(expr, key, value, OLD);
1281 return;
1282 }
1283 set_to_user_data(expr->left, key, value, OLD);
1284 return;
1285 }
1286
1287 arg = get_argument_from_call_expr(call->args, param);
1288 if (!arg)
1289 return;
1290 set_to_user_data(arg, key, value, OLD);
1291 }
1292
1293 static void returns_param_user_data_set(struct expression *expr, int param, char *key, char *value)
1294 {
1295 struct expression *arg;
1296
1297 func_gets_user_data = true;
1298
1299 if (param == -1) {
1300 if (expr->type != EXPR_ASSIGNMENT) {
1301 store_user_data_return(expr, key, value, NEW);
1302 return;
1303 }
1304 set_to_user_data(expr->left, key, value, NEW);
1305 return;
1306 }
1307
1308 while (expr->type == EXPR_ASSIGNMENT)
1309 expr = strip_expr(expr->right);
1310 if (expr->type != EXPR_CALL)
1311 return;
1312
1313 arg = get_argument_from_call_expr(expr->args, param);
1314 if (!arg)
1315 return;
1316 set_to_user_data(arg, key, value, NEW);
1317 }
1318
1319 static void returns_param_capped(struct expression *expr, int param, char *key, char *value)
1320 {
1321 struct smatch_state *state, *new;
1322 struct symbol *sym;
1323 char *name;
1324
1325 name = return_state_to_var_sym(expr, param, key, &sym);
1326 if (!name || !sym)
1327 goto free;
1328
1329 state = get_state(my_id, name, sym);
1330 if (!state || estate_capped(state))
1331 goto free;
1332
1333 new = clone_estate(state);
1334 estate_set_capped(new);
1335
1336 set_state(my_id, name, sym, new);
1337 free:
1338 free_string(name);
1339 }
1340
1341 static struct int_stack *gets_data_stack;
1342 static void match_function_def(struct symbol *sym)
1343 {
1344 func_gets_user_data = false;
1345
1346 if (is_user_data_fn(sym))
1347 func_gets_user_data = true;
1348 }
1349
1350 static void match_inline_start(struct expression *expr)
1351 {
1352 push_int(&gets_data_stack, func_gets_user_data);
1353 }
1354
1355 static void match_inline_end(struct expression *expr)
1356 {
1357 func_gets_user_data = pop_int(&gets_data_stack);
1358 }
1359
1360 void register_kernel_user_data(int id)
1361 {
1362 int i;
1363
1364 my_id = id;
1365
1366 if (option_project != PROJ_KERNEL)
1367 return;
1368
1369 set_dynamic_states(my_id);
1370
1371 add_hook(&match_function_def, FUNC_DEF_HOOK);
1372 add_hook(&match_inline_start, INLINE_FN_START);
1373 add_hook(&match_inline_end, INLINE_FN_END);
1374
1375 add_hook(&save_start_states, AFTER_DEF_HOOK);
1376 add_hook(&free_start_states, AFTER_FUNC_HOOK);
1377 add_hook(&match_save_states, INLINE_FN_START);
1378 add_hook(&match_restore_states, INLINE_FN_END);
1379
1380 add_unmatched_state_hook(my_id, &empty_state);
1381 add_extra_nomod_hook(&extra_nomod_hook);
1382 add_pre_merge_hook(my_id, &pre_merge_hook);
1383 add_merge_hook(my_id, &merge_estates);
1384
1385 add_function_hook("copy_from_user", &match_user_copy, INT_PTR(0));
1386 add_function_hook("__copy_from_user", &match_user_copy, INT_PTR(0));
1387 add_function_hook("memcpy_fromiovec", &match_user_copy, INT_PTR(0));
1388 for (i = 0; i < ARRAY_SIZE(kstr_funcs); i++)
1389 add_function_hook(kstr_funcs[i], &match_user_copy, INT_PTR(2));
1390 add_function_hook("usb_control_msg", &match_user_copy, INT_PTR(6));
1391
1392 for (i = 0; i < ARRAY_SIZE(returns_user_data); i++)
1393 add_function_hook(returns_user_data[i], &match_returns_user_rl, NULL);
1394
1395 add_function_hook("sscanf", &match_sscanf, NULL);
1396
1397 add_hook(&match_syscall_definition, AFTER_DEF_HOOK);
1398
1399 add_hook(&match_assign, ASSIGNMENT_HOOK);
1400 select_return_states_hook(PARAM_SET, &db_param_set);
1401 add_hook(&match_condition, CONDITION_HOOK);
1402
1403 add_caller_info_callback(my_id, caller_info_callback);
1404 add_return_info_callback(my_id, return_info_callback);
1405 select_caller_info_hook(set_param_user_data, USER_DATA);
1406 select_return_states_hook(USER_DATA, &returns_param_user_data);
1407 select_return_states_hook(USER_DATA_SET, &returns_param_user_data_set);
1408 select_return_states_hook(CAPPED_DATA, &returns_param_capped);
1409 }
1410
1411 void register_kernel_user_data2(int id)
1412 {
1413 my_call_id = id;
1414
1415 if (option_project != PROJ_KERNEL)
1416 return;
1417 select_caller_info_hook(set_called, INTERNAL);
1418 }
1419
Static analysis for C