2 * Copyright (C) 2020 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * The problem here is that we can have:
23 * In the olden days we would just set "*p = 0-255" which meant that it pointed
24 * to user data. But then if we say "if (*p == 11) {" that means that "*p" is
25 * not user data any more, so then "*(p + 1)" is marked as not user data but it
28 * So now we've separated out the stuff that points to a user_buf from the other
31 * There is a further complication because what if "p" points to a struct? In
32 * that case all the struct members are handled by smatch_kernel_user_data.c
33 * but we still need to keep in mind that "*(p + 1)" is user data. I'm not
34 * totally 100% sure how this will work.
36 * Generally a user pointer should be a void pointer, or an array etc. But if
37 * it points to a struct that can only be used for pointer math.
42 #include "smatch_slist.h"
43 #include "smatch_extra.h"
48 static const char *returns_pointer_to_user_data
[] = {
49 "nlmsg_data", "nla_data", "memdup_user", "kmap_atomic", "skb_network_header",
50 "cfg80211_find_elem_match", "ieee80211_bss_get_elem", "cfg80211_find_elem",
51 "ieee80211_bss_get_ie",
54 bool is_skb_data(struct expression
*expr
)
58 expr
= strip_expr(expr
);
62 expr
= strip_expr(expr
);
65 if (expr
->type
!= EXPR_DEREF
)
70 if (strcmp(expr
->member
->name
, "data") != 0)
73 sym
= get_type(expr
->deref
);
76 if (sym
->type
== SYM_PTR
)
77 sym
= get_real_base_type(sym
);
78 if (!sym
|| sym
->type
!= SYM_STRUCT
|| !sym
->ident
)
80 if (strcmp(sym
->ident
->name
, "sk_buff") != 0)
86 bool is_user_data_fn(struct symbol
*fn
)
90 if (!fn
|| !fn
->ident
)
93 for (i
= 0; i
< ARRAY_SIZE(returns_pointer_to_user_data
); i
++) {
94 if (strcmp(fn
->ident
->name
, returns_pointer_to_user_data
[i
]) == 0) {
95 // func_gets_user_data = true;
102 static bool is_points_to_user_data_fn(struct expression
*expr
)
104 expr
= strip_expr(expr
);
105 if (!expr
|| expr
->type
!= EXPR_CALL
|| expr
->fn
->type
!= EXPR_SYMBOL
||
108 return is_user_data_fn(expr
->fn
->symbol
);
111 static bool is_array_of_user_data(struct expression
*expr
)
113 struct expression
*deref
;
116 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
117 expr
= strip_expr(expr
->unop
);
118 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '*')
119 expr
= strip_expr(expr
->unop
);
122 /* This is for array elements &foo->data[4] */
123 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+') {
124 if (points_to_user_data(expr
->left
))
126 if (points_to_user_data(expr
->right
))
130 /* This is for if you have: foo = skb->data; frob(foo->array); */
131 type
= get_type(expr
);
132 if (!type
|| type
->type
!= SYM_ARRAY
)
135 if (expr
->type
!= EXPR_DEREF
)
137 deref
= strip_expr(expr
->deref
);
138 if (deref
->type
!= EXPR_PREOP
|| deref
->op
!= '*')
140 deref
= strip_expr(deref
->unop
);
141 return points_to_user_data(deref
);
144 bool points_to_user_data(struct expression
*expr
)
148 expr
= strip_expr(expr
);
152 if (is_fake_call(expr
))
155 if (expr
->type
== EXPR_ASSIGNMENT
)
156 return points_to_user_data(expr
->left
);
158 if (is_array_of_user_data(expr
))
161 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+')
162 expr
= strip_expr(expr
->left
);
164 if (is_skb_data(expr
))
167 if (is_points_to_user_data_fn(expr
))
170 sm
= get_sm_state_expr(my_id
, expr
);
171 if (sm
&& slist_has_state(sm
->possible
, &user_data
))
176 void set_points_to_user_data(struct expression
*expr
)
178 set_state_expr(my_id
, expr
, &user_data
);
181 static void match_assign(struct expression
*expr
)
183 if (is_fake_call(expr
->right
))
186 if (!is_ptr_type(get_type(expr
->left
)))
189 if (points_to_user_data(expr
->right
)) {
190 set_points_to_user_data(expr
->left
);
194 if (get_state_expr(my_id
, expr
->left
))
195 set_state_expr(my_id
, expr
->left
, &undefined
);
198 static void match_memcpy(const char *fn
, struct expression
*expr
, void *_unused
)
200 struct expression
*dest
, *src
;
202 dest
= get_argument_from_call_expr(expr
->args
, 0);
203 src
= get_argument_from_call_expr(expr
->args
, 1);
205 if (points_to_user_data(src
)) {
206 set_points_to_user_data(dest
);
210 if (get_state_expr(my_id
, dest
))
211 set_state_expr(my_id
, dest
, &undefined
);
214 static void match_user_copy(const char *fn
, struct expression
*expr
, void *_unused
)
216 struct expression
*dest
, *size
;
219 dest
= get_argument_from_call_expr(expr
->args
, 0);
220 dest
= strip_expr(dest
);
224 size
= get_argument_from_call_expr(expr
->args
, 2);
225 if (get_implied_value(size
, &sval
))
228 set_state_expr(my_id
, dest
, &user_data
);
231 static void return_info_callback(int return_id
, char *return_ranges
,
232 struct expression
*returned_expr
,
234 const char *printed_name
,
237 int type
= USER_PTR_SET
;
239 if (!slist_has_state(sm
->possible
, &user_data
))
243 if (get_state_stree(get_start_states(), my_id
, sm
->name
, sm
->sym
))
246 if (!param_was_set_var_sym(sm
->name
, sm
->sym
))
249 if (parent_is_gone_var_sym(sm
->name
, sm
->sym
))
252 sql_insert_return_states(return_id
, return_ranges
, type
,
253 param
, printed_name
, "");
256 static void returns_user_ptr_helper(struct expression
*expr
, int param
, char *key
, char *value
, bool set
)
258 struct expression
*arg
;
259 struct expression
*call
;
264 while (call
->type
== EXPR_ASSIGNMENT
)
265 call
= strip_expr(call
->right
);
266 if (call
->type
!= EXPR_CALL
)
269 if (!set
&& !we_pass_user_data(call
))
273 if (expr
->type
!= EXPR_ASSIGNMENT
) {
274 /* Nothing to do. Fake assignments should handle it */
281 arg
= get_argument_from_call_expr(call
->args
, param
);
285 name
= get_variable_from_key(arg
, key
, &sym
);
288 set_state(my_id
, name
, sym
, &user_data
);
293 static void returns_user_ptr(struct expression
*expr
, int param
, char *key
, char *value
)
295 returns_user_ptr_helper(expr
, param
, key
, value
, false);
298 static void returns_user_ptr_set(struct expression
*expr
, int param
, char *key
, char *value
)
300 returns_user_ptr_helper(expr
, param
, key
, value
, true);
303 static void set_param_user_ptr(const char *name
, struct symbol
*sym
, char *key
, char *value
)
305 struct expression
*expr
;
308 expr
= symbol_expression(sym
);
309 fullname
= get_variable_from_key(expr
, key
, NULL
);
312 set_state(my_id
, fullname
, sym
, &user_data
);
315 static void caller_info_callback(struct expression
*call
, int param
, char *printed_name
, struct sm_state
*sm
)
317 if (!slist_has_state(sm
->possible
, &user_data
))
319 sql_insert_caller_info(call
, USER_PTR
, param
, printed_name
, "");
322 void register_points_to_user_data(int id
)
326 if (option_project
!= PROJ_KERNEL
)
329 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
331 add_function_hook("copy_from_user", &match_user_copy
, NULL
);
332 add_function_hook("memcpy_from_msg", &match_user_copy
, NULL
);
333 add_function_hook("__copy_from_user", &match_user_copy
, NULL
);
335 add_function_hook("memcpy", &match_memcpy
, NULL
);
336 add_function_hook("__memcpy", &match_memcpy
, NULL
);
338 add_caller_info_callback(my_id
, caller_info_callback
);
339 add_return_info_callback(my_id
, return_info_callback
);
341 select_caller_info_hook(set_param_user_ptr
, USER_PTR
);
342 select_return_states_hook(USER_PTR
, &returns_user_ptr
);
343 select_return_states_hook(USER_PTR_SET
, &returns_user_ptr_set
);