?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
free_strict: pass the correct expression to free hooks.
[smatch.git] / smatch_kernel_user_data.c
blobadfce8395c3ea3560ef06cf3a26c1e36ed045e27
1 /*
2 * Copyright (C) 2011 Dan Carpenter.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 /*
19 * There are a couple checks that try to see if a variable
20 * comes from the user. It would be better to unify them
21 * into one place. Also it we should follow the data down
22 * the call paths. Hence this file.
23 */
24
25 #include "smatch.h"
26 #include "smatch_slist.h"
27 #include "smatch_extra.h"
28
29 static int my_id;
30 static int my_call_id;
31
32 static struct expression *ignore_clear;
33
34 STATE(called);
35
36 struct user_fn_info {
37 const char *name;
38 int type;
39 int param;
40 const char *key;
41 const sval_t *implies_start, *implies_end;
42 func_hook *call_back;
43 };
44
45 static struct user_fn_info func_table[] = {
46 { "iov_iter_count", USER_DATA, -1, "$" },
47 { "simple_strtol", USER_DATA, -1, "$" },
48 { "simple_strtoll", USER_DATA, -1, "$" },
49 { "simple_strtoul", USER_DATA, -1, "$" },
50 { "simple_strtoull", USER_DATA, -1, "$" },
51 { "kvm_register_read", USER_DATA, -1, "$" },
52 };
53
54 static struct smatch_state *empty_state(struct sm_state *sm)
55 {
56 return alloc_estate_empty();
57 }
58
59 static struct smatch_state *new_state(struct symbol *type)
60 {
61 struct smatch_state *state;
62
63 if (!type || type_is_ptr(type))
64 return NULL;
65
66 state = alloc_estate_whole(type);
67 estate_set_new(state);
68 return state;
69 }
70
71 static void pre_merge_hook(struct sm_state *cur, struct sm_state *other)
72 {
73 struct smatch_state *user = cur->state;
74 struct smatch_state *extra;
75 struct smatch_state *state;
76 struct range_list *rl;
77
78 extra = __get_state(SMATCH_EXTRA, cur->name, cur->sym);
79 if (!extra)
80 return;
81 rl = rl_intersection(estate_rl(user), estate_rl(extra));
82 state = alloc_estate_rl(clone_rl(rl));
83 if (estate_capped(user) || is_capped_var_sym(cur->name, cur->sym))
84 estate_set_capped(state);
85 if (estate_treat_untagged(user))
86 estate_set_treat_untagged(state);
87 if (estates_equiv(state, cur->state))
88 return;
89 if (estate_new(cur->state))
90 estate_set_new(state);
91 set_state(my_id, cur->name, cur->sym, state);
92 }
93
94 static void extra_nomod_hook(const char *name, struct symbol *sym, struct expression *expr, struct smatch_state *state)
95 {
96 struct smatch_state *user, *new;
97 struct range_list *rl;
98
99 user = __get_state(my_id, name, sym);
100 if (!user)
101 return;
102 rl = rl_intersection(estate_rl(user), estate_rl(state));
103 if (rl_equiv(rl, estate_rl(user)))
104 return;
105 new = alloc_estate_rl(rl);
106 if (estate_capped(user))
107 estate_set_capped(new);
108 if (estate_treat_untagged(user))
109 estate_set_treat_untagged(new);
110 set_state(my_id, name, sym, new);
111 }
112
113 static void store_type_info(struct expression *expr, struct smatch_state *state)
114 {
115 struct symbol *type;
116 char *type_str, *member;
117
118 if (__in_fake_assign)
119 return;
120
121 if (!estate_rl(state))
122 return;
123
124 expr = strip_expr(expr);
125 if (!expr || expr->type != EXPR_DEREF || !expr->member)
126 return;
127
128 type = get_type(expr->deref);
129 if (!type || !type->ident)
130 return;
131
132 type_str = type_to_str(type);
133 if (!type_str)
134 return;
135 member = get_member_name(expr);
136 if (!member)
137 return;
138
139 sql_insert_function_type_info(USER_DATA, type_str, member, state->name);
140 }
141
142 static void set_user_data(struct expression *expr, struct smatch_state *state)
143 {
144 store_type_info(expr, state);
145 set_state_expr(my_id, expr, state);
146 }
147
148 static bool user_rl_known(struct expression *expr)
149 {
150 struct range_list *rl;
151 sval_t close_to_max;
152
153 if (!get_user_rl(expr, &rl))
154 return true;
155
156 close_to_max = sval_type_max(rl_type(rl));
157 close_to_max.value -= 100;
158
159 if (sval_cmp(rl_max(rl), close_to_max) >= 0)
160 return false;
161 return true;
162 }
163
164 static bool is_array_index_mask_nospec(struct expression *expr)
165 {
166 struct expression *orig;
167
168 orig = get_assigned_expr(expr);
169 if (!orig || orig->type != EXPR_CALL)
170 return false;
171 return sym_name_is("array_index_mask_nospec", orig->fn);
172 }
173
174 static bool binop_capped(struct expression *expr)
175 {
176 struct range_list *left_rl;
177 int comparison;
178 sval_t sval;
179
180 if (expr->op == '-' && get_user_rl(expr->left, &left_rl)) {
181 if (user_rl_capped(expr->left))
182 return true;
183 comparison = get_comparison(expr->left, expr->right);
184 if (comparison && show_special(comparison)[0] == '>')
185 return true;
186 return false;
187 }
188
189 if (expr->op == '&' || expr->op == '%') {
190 bool left_user, left_capped, right_user, right_capped;
191
192 if (!get_value(expr->right, &sval) && is_capped(expr->right))
193 return true;
194 if (is_array_index_mask_nospec(expr->right))
195 return true;
196 if (is_capped(expr->left))
197 return true;
198 left_user = is_user_rl(expr->left);
199 right_user = is_user_rl(expr->right);
200 if (!left_user && !right_user)
201 return true;
202
203 left_capped = user_rl_capped(expr->left);
204 right_capped = user_rl_capped(expr->right);
205
206 if (left_user && left_capped) {
207 if (!right_user)
208 return true;
209 if (right_user && right_capped)
210 return true;
211 return false;
212 }
213 if (right_user && right_capped) {
214 if (!left_user)
215 return true;
216 return false;
217 }
218 return false;
219 }
220
221 /*
222 * Generally "capped" means that we capped it to an unknown value.
223 * This is useful because if Smatch doesn't know what the value is then
224 * we have to trust that it is correct. But if we known cap value is
225 * 100 then we can check if 100 is correct and complain if it's wrong.
226 *
227 * So then the problem is with BINOP when we take a capped variable
228 * plus a user variable which is clamped to a known range (uncapped)
229 * the result should be capped.
230 */
231 if ((user_rl_capped(expr->left) || user_rl_known(expr->left)) &&
232 (user_rl_capped(expr->right) || user_rl_known(expr->right)))
233 return true;
234
235 return false;
236 }
237
238 bool user_rl_capped_var_sym(const char *name, struct symbol *sym)
239 {
240 struct smatch_state *state;
241
242 state = get_state(my_id, name, sym);
243 if (state)
244 return estate_capped(state);
245
246 return true;
247 }
248
249 bool user_rl_capped(struct expression *expr)
250 {
251 struct smatch_state *state;
252 struct range_list *rl;
253 sval_t sval;
254
255 expr = strip_expr(expr);
256 if (!expr)
257 return false;
258 if (get_value(expr, &sval))
259 return true;
260 if (expr->type == EXPR_BINOP)
261 return binop_capped(expr);
262 if ((expr->type == EXPR_PREOP || expr->type == EXPR_POSTOP) &&
263 (expr->op == SPECIAL_INCREMENT || expr->op == SPECIAL_DECREMENT))
264 return user_rl_capped(expr->unop);
265 state = get_state_expr(my_id, expr);
266 if (state)
267 return estate_capped(state);
268
269 if (!get_user_rl(expr, &rl)) {
270 /*
271 * The non user data parts of a binop are capped and
272 * also empty user rl states are capped.
273 */
274 return true;
275 }
276
277 if (rl_to_sval(rl, &sval))
278 return true;
279
280 return false; /* uncapped user data */
281 }
282
283 bool user_rl_treat_untagged(struct expression *expr)
284 {
285 struct smatch_state *state;
286 struct range_list *rl;
287 sval_t sval;
288
289 expr = strip_expr(expr);
290 if (!expr)
291 return false;
292 if (get_value(expr, &sval))
293 return true;
294
295 state = get_state_expr(my_id, expr);
296 if (state)
297 return estate_treat_untagged(state);
298
299 if (get_user_rl(expr, &rl))
300 return false; /* uncapped user data */
301
302 return true; /* not actually user data */
303 }
304
305 static int is_dev_attr_name(struct expression *expr)
306 {
307 char *name;
308 int ret = 0;
309
310 name = expr_to_str(expr);
311 if (!name)
312 return 0;
313 if (strstr(name, "->attr.name"))
314 ret = 1;
315 free_string(name);
316 return ret;
317 }
318
319 static bool is_percent_n(struct expression *expr, int pos)
320 {
321 char *p;
322 int cnt = 0;
323
324 if (!expr)
325 return false;
326 if (expr->type != EXPR_STRING || !expr->string)
327 return false;
328
329 p = expr->string->data;
330 while (*p) {
331 if (p[0] != '%' ||
332 (p[0] == '%' && p[1] == '%')) {
333 p++;
334 continue;
335 }
336 if (pos != cnt) {
337 cnt++;
338 p++;
339 continue;
340 }
341 if (p[1] == 'n')
342 return true;
343 return false;
344 }
345
346 return false;
347 }
348
349 static void match_sscanf(const char *fn, struct expression *expr, void *unused)
350 {
351 struct expression *str, *format, *arg;
352 int i;
353
354 str = get_argument_from_call_expr(expr->args, 0);
355 if (is_dev_attr_name(str))
356 return;
357
358 format = get_argument_from_call_expr(expr->args, 1);
359 if (is_dev_attr_name(format))
360 return;
361
362 i = -1;
363 FOR_EACH_PTR(expr->args, arg) {
364 i++;
365 if (i < 2)
366 continue;
367 if (is_percent_n(format, i - 2))
368 continue;
369 mark_as_user_data(deref_expression(arg), true);
370 } END_FOR_EACH_PTR(arg);
371 }
372
373 static int comes_from_skb_data(struct expression *expr)
374 {
375 expr = strip_expr(expr);
376 if (!expr || expr->type != EXPR_PREOP || expr->op != '*')
377 return 0;
378
379 expr = strip_expr(expr->unop);
380 if (!expr)
381 return 0;
382 if (expr->type == EXPR_BINOP && expr->op == '+')
383 expr = strip_expr(expr->left);
384
385 return is_skb_data(expr);
386 }
387
388 static int handle_get_user(struct expression *expr)
389 {
390 char *name;
391 int ret = 0;
392
393 name = get_macro_name(expr->pos);
394 if (!name || strcmp(name, "get_user") != 0)
395 return 0;
396
397 name = expr_to_var(expr->right);
398 if (!name || (strcmp(name, "__val_gu") != 0 && strcmp(name, "__gu_val") != 0))
399 goto free;
400 set_user_data(expr->left, new_state(get_type(expr->left)));
401 ret = 1;
402 free:
403 free_string(name);
404 return ret;
405 }
406
407 static bool state_is_new(struct expression *expr)
408 {
409 struct smatch_state *state;
410
411 state = get_state_expr(my_id, expr);
412 if (estate_new(state))
413 return true;
414
415 if (expr->type == EXPR_BINOP) {
416 if (state_is_new(expr->left))
417 return true;
418 if (state_is_new(expr->right))
419 return true;
420 }
421 return false;
422 }
423
424 static struct range_list *strip_negatives(struct range_list *rl)
425 {
426 sval_t min = rl_min(rl);
427 sval_t minus_one = { .type = rl_type(rl), .value = -1 };
428 sval_t over = { .type = rl_type(rl), .value = INT_MAX + 1ULL };
429 sval_t max = sval_type_max(rl_type(rl));
430
431 if (!rl)
432 return NULL;
433
434 if (type_unsigned(rl_type(rl)) && type_bits(rl_type(rl)) > 31)
435 return remove_range(rl, over, max);
436
437 return remove_range(rl, min, minus_one);
438 }
439
440 static bool handle_op_assign(struct expression *expr)
441 {
442 struct expression *binop_expr;
443 struct smatch_state *state;
444 struct range_list *rl;
445
446 switch (expr->op) {
447 case SPECIAL_ADD_ASSIGN:
448 case SPECIAL_SUB_ASSIGN:
449 case SPECIAL_AND_ASSIGN:
450 case SPECIAL_MOD_ASSIGN:
451 case SPECIAL_SHL_ASSIGN:
452 case SPECIAL_SHR_ASSIGN:
453 case SPECIAL_OR_ASSIGN:
454 case SPECIAL_XOR_ASSIGN:
455 case SPECIAL_MUL_ASSIGN:
456 case SPECIAL_DIV_ASSIGN:
457 binop_expr = binop_expression(expr->left,
458 op_remove_assign(expr->op),
459 expr->right);
460 if (!get_user_rl(binop_expr, &rl))
461 return true;
462
463 rl = cast_rl(get_type(expr->left), rl);
464 state = alloc_estate_rl(rl);
465 if (expr->op == SPECIAL_AND_ASSIGN ||
466 expr->op == SPECIAL_MOD_ASSIGN ||
467 user_rl_capped(binop_expr))
468 estate_set_capped(state);
469 if (user_rl_treat_untagged(expr->left))
470 estate_set_treat_untagged(state);
471 if (state_is_new(binop_expr))
472 estate_set_new(state);
473 estate_set_assigned(state);
474 set_user_data(expr->left, state);
475 return true;
476 }
477 return false;
478 }
479
480 static void handle_derefed_pointers(struct expression *expr, bool is_new)
481 {
482 expr = strip_expr(expr);
483 if (expr->type != EXPR_PREOP ||
484 expr->op != '*')
485 return;
486 expr = strip_expr(expr->unop);
487 set_array_user_ptr(expr, is_new);
488 }
489
490 static void match_assign(struct expression *expr)
491 {
492 struct symbol *left_type, *right_type;
493 struct range_list *rl = NULL;
494 static struct expression *handled;
495 struct smatch_state *state;
496 struct expression *faked;
497 bool is_capped = false;
498 bool is_new = false;
499
500 left_type = get_type(expr->left);
501 if (left_type == &void_ctype)
502 return;
503
504 faked = get_faked_expression();
505 if (faked && faked == ignore_clear)
506 return;
507
508 /* FIXME: handle fake array assignments frob(&user_array[x]); */
509
510 if (faked &&
511 faked->type == EXPR_ASSIGNMENT &&
512 points_to_user_data(faked->right)) {
513 if (is_skb_data(faked->right))
514 is_new = true;
515 rl = alloc_whole_rl(left_type);
516 goto set;
517 }
518
519 if (faked && faked == handled)
520 return;
521 if (is_fake_call(expr->right))
522 goto clear_old_state;
523 if (handle_get_user(expr))
524 return;
525 if (points_to_user_data(expr->right) &&
526 is_struct_ptr(get_type(expr->left))) {
527 handled = expr;
528 // This should be handled by smatch_points_to_user_data.c
529 // set_array_user_ptr(expr->left);
530 }
531
532 if (handle_op_assign(expr))
533 return;
534 if (expr->op != '=')
535 goto clear_old_state;
536
537 /* Handled by DB code */
538 if (expr->right->type == EXPR_CALL)
539 return;
540
541 if (faked)
542 disable_type_val_lookups();
543 get_user_rl(expr->right, &rl);
544 if (faked)
545 enable_type_val_lookups();
546 if (!rl)
547 goto clear_old_state;
548
549 is_capped = user_rl_capped(expr->right);
550 is_new = state_is_new(expr->right);
551
552 set:
553 right_type = get_type(expr->right);
554 if (type_is_ptr(left_type)) {
555 if (right_type && right_type->type == SYM_ARRAY)
556 set_array_user_ptr(expr->left, is_new);
557 return;
558 }
559
560 rl = cast_rl(left_type, rl);
561 if (is_capped && type_unsigned(right_type) && type_signed(left_type))
562 rl = strip_negatives(rl);
563 state = alloc_estate_rl(rl);
564 if (is_new)
565 estate_set_new(state);
566 if (is_capped)
567 estate_set_capped(state);
568 if (user_rl_treat_untagged(expr->right))
569 estate_set_treat_untagged(state);
570 estate_set_assigned(state);
571
572 set_user_data(expr->left, state);
573 handle_derefed_pointers(expr->left, is_new);
574 return;
575
576 clear_old_state:
577
578 /*
579 * HACK ALERT!!! This should be at the start of the function. The
580 * the problem is that handling "pointer = array;" assignments is
581 * handled in this function instead of in kernel_points_to_user_data.c.
582 */
583 if (type_is_ptr(left_type))
584 return;
585
586 if (get_state_expr(my_id, expr->left))
587 set_user_data(expr->left, alloc_estate_empty());
588 }
589
590 static void handle_eq_noteq(struct expression *expr)
591 {
592 struct smatch_state *left_orig, *right_orig;
593
594 left_orig = get_state_expr(my_id, expr->left);
595 right_orig = get_state_expr(my_id, expr->right);
596
597 if (!left_orig && !right_orig)
598 return;
599 if (left_orig && right_orig)
600 return;
601
602 if (left_orig) {
603 set_true_false_states_expr(my_id, expr->left,
604 expr->op == SPECIAL_EQUAL ? alloc_estate_empty() : NULL,
605 expr->op == SPECIAL_EQUAL ? NULL : alloc_estate_empty());
606 } else {
607 set_true_false_states_expr(my_id, expr->right,
608 expr->op == SPECIAL_EQUAL ? alloc_estate_empty() : NULL,
609 expr->op == SPECIAL_EQUAL ? NULL : alloc_estate_empty());
610 }
611 }
612
613 static void handle_compare(struct expression *expr)
614 {
615 struct expression *left, *right;
616 struct range_list *left_rl = NULL;
617 struct range_list *right_rl = NULL;
618 struct range_list *user_rl;
619 struct smatch_state *capped_state;
620 struct smatch_state *left_true = NULL;
621 struct smatch_state *left_false = NULL;
622 struct smatch_state *right_true = NULL;
623 struct smatch_state *right_false = NULL;
624 struct symbol *type;
625 sval_t sval;
626
627 left = strip_expr(expr->left);
628 right = strip_expr(expr->right);
629
630 while (left->type == EXPR_ASSIGNMENT)
631 left = strip_expr(left->left);
632
633 /*
634 * Conditions are mostly handled by smatch_extra.c, but there are some
635 * times where the exact values are not known so we can't do that.
636 *
637 * Normally, we might consider using smatch_capped.c to supliment smatch
638 * extra but that doesn't work when we merge unknown uncapped kernel
639 * data with unknown capped user data. The result is uncapped user
640 * data. We need to keep it separate and say that the user data is
641 * capped. In the past, I would have marked this as just regular
642 * kernel data (not user data) but we can't do that these days because
643 * we need to track user data for Spectre.
644 *
645 * The other situation which we have to handle is when we do have an
646 * int and we compare against an unknown unsigned kernel variable. In
647 * that situation we assume that the kernel data is less than INT_MAX.
648 * Otherwise then we get all sorts of array underflow false positives.
649 *
650 */
651
652 /* Handled in smatch_extra.c */
653 if (get_implied_value(left, &sval) ||
654 get_implied_value(right, &sval))
655 return;
656
657 get_user_rl(left, &left_rl);
658 get_user_rl(right, &right_rl);
659
660 /* nothing to do */
661 if (!left_rl && !right_rl)
662 return;
663 /* if both sides are user data that's not a good limit */
664 if (left_rl && right_rl)
665 return;
666
667 if (left_rl)
668 user_rl = left_rl;
669 else
670 user_rl = right_rl;
671
672 type = get_type(expr);
673 if (type_unsigned(type))
674 user_rl = strip_negatives(user_rl);
675 capped_state = alloc_estate_rl(user_rl);
676 estate_set_capped(capped_state);
677
678 switch (expr->op) {
679 case '<':
680 case SPECIAL_UNSIGNED_LT:
681 case SPECIAL_LTE:
682 case SPECIAL_UNSIGNED_LTE:
683 if (left_rl)
684 left_true = capped_state;
685 else
686 right_false = capped_state;
687 break;
688 case '>':
689 case SPECIAL_UNSIGNED_GT:
690 case SPECIAL_GTE:
691 case SPECIAL_UNSIGNED_GTE:
692 if (left_rl)
693 left_false = capped_state;
694 else
695 right_true = capped_state;
696 break;
697 }
698
699 set_true_false_states_expr(my_id, left, left_true, left_false);
700 set_true_false_states_expr(my_id, right, right_true, right_false);
701 }
702
703 static void match_condition(struct expression *expr)
704 {
705 if (expr->type != EXPR_COMPARE)
706 return;
707
708 if (expr->op == SPECIAL_EQUAL ||
709 expr->op == SPECIAL_NOTEQUAL) {
710 handle_eq_noteq(expr);
711 return;
712 }
713
714 handle_compare(expr);
715 }
716
717 static int get_user_macro_rl(struct expression *expr, struct range_list **rl)
718 {
719 struct expression *parent;
720 char *macro;
721
722 if (!expr)
723 return 0;
724
725 macro = get_macro_name(expr->pos);
726 if (!macro)
727 return 0;
728
729 /* handle ntohl(foo[i]) where "i" is trusted */
730 parent = expr_get_parent_expr(expr);
731 while (parent && parent->type != EXPR_BINOP)
732 parent = expr_get_parent_expr(parent);
733 if (parent && parent->type == EXPR_BINOP) {
734 char *parent_macro = get_macro_name(parent->pos);
735
736 if (parent_macro && strcmp(macro, parent_macro) == 0)
737 return 0;
738 }
739
740 if (strcmp(macro, "ntohl") == 0) {
741 *rl = alloc_whole_rl(&uint_ctype);
742 return 1;
743 }
744 if (strcmp(macro, "ntohs") == 0) {
745 *rl = alloc_whole_rl(&ushort_ctype);
746 return 1;
747 }
748 return 0;
749 }
750
751 static int has_user_data(struct symbol *sym)
752 {
753 struct sm_state *tmp;
754
755 FOR_EACH_MY_SM(my_id, __get_cur_stree(), tmp) {
756 if (tmp->sym == sym)
757 return 1;
758 } END_FOR_EACH_SM(tmp);
759 return 0;
760 }
761
762 bool we_pass_user_data(struct expression *call)
763 {
764 struct expression *arg;
765 struct symbol *sym;
766
767 FOR_EACH_PTR(call->args, arg) {
768 if (points_to_user_data(arg))
769 return true;
770 sym = expr_to_sym(arg);
771 if (!sym)
772 continue;
773 if (has_user_data(sym))
774 return true;
775 } END_FOR_EACH_PTR(arg);
776
777 return false;
778 }
779
780 // TODO: faked_assign this should already be handled
781 static int db_returned_user_rl(struct expression *call, struct range_list **rl)
782 {
783 struct smatch_state *state;
784 char buf[48];
785
786 if (is_fake_call(call))
787 return 0;
788 snprintf(buf, sizeof(buf), "return %p", call);
789 state = get_state(my_id, buf, NULL);
790 if (!state || !estate_rl(state))
791 return 0;
792 *rl = estate_rl(state);
793 return 1;
794 }
795
796 struct stree *get_user_stree(void)
797 {
798 return get_all_states_stree(my_id);
799 }
800
801 static struct int_stack *user_data_flags, *no_user_data_flags;
802
803 static void set_flag(struct int_stack **stack)
804 {
805 int num;
806
807 num = pop_int(stack);
808 num = 1;
809 push_int(stack, num);
810 }
811
812 struct range_list *var_user_rl(struct expression *expr)
813 {
814 struct smatch_state *state;
815 struct range_list *rl;
816 struct range_list *absolute_rl;
817
818 if (expr->type == EXPR_PREOP && expr->op == '&') {
819 set_flag(&no_user_data_flags);
820 return NULL;
821 }
822
823 if (expr->type == EXPR_BINOP && expr->op == '%') {
824 struct range_list *left, *right;
825
826 if (!get_user_rl(expr->right, &right))
827 return NULL;
828 get_absolute_rl(expr->left, &left);
829 rl = rl_binop(left, '%', right);
830 goto found;
831 }
832
833 if (expr->type == EXPR_BINOP && expr->op == '/') {
834 struct range_list *left = NULL;
835 struct range_list *right = NULL;
836 struct range_list *abs_right;
837
838 /*
839 * The specific bug I'm dealing with is:
840 *
841 * foo = capped_user / unknown;
842 *
843 * Instead of just saying foo is now entirely user_rl we should
844 * probably say instead that it is not at all user data.
845 *
846 */
847
848 get_user_rl(expr->left, &left);
849 get_user_rl(expr->right, &right);
850 get_absolute_rl(expr->right, &abs_right);
851
852 if (left && !right) {
853 rl = rl_binop(left, '/', abs_right);
854 if (sval_cmp(rl_max(left), rl_max(rl)) < 0)
855 set_flag(&no_user_data_flags);
856 }
857
858 return NULL;
859 }
860
861 if (get_user_macro_rl(expr, &rl))
862 goto found;
863
864 if (comes_from_skb_data(expr)) {
865 rl = alloc_whole_rl(get_type(expr));
866 goto found;
867 }
868
869 state = get_state_expr(my_id, expr);
870 if (state && estate_rl(state)) {
871 rl = estate_rl(state);
872 goto found;
873 }
874
875 if (expr->type == EXPR_CALL && db_returned_user_rl(expr, &rl))
876 goto found;
877
878 if (expr->type == EXPR_PREOP && expr->op == '*' &&
879 points_to_user_data(expr->unop)) {
880 rl = var_to_absolute_rl(expr);
881 goto found;
882 }
883
884 if (is_array(expr)) {
885 struct expression *array = get_array_base(expr);
886
887 if (!get_state_expr(my_id, array)) {
888 set_flag(&no_user_data_flags);
889 return NULL;
890 }
891 }
892
893 return NULL;
894 found:
895 set_flag(&user_data_flags);
896 absolute_rl = var_to_absolute_rl(expr);
897 return rl_intersection(rl, absolute_rl);
898 }
899
900 static bool is_ptr_subtract(struct expression *expr)
901 {
902 expr = strip_expr(expr);
903 if (!expr)
904 return false;
905 if (expr->type == EXPR_BINOP && expr->op == '-' &&
906 type_is_ptr(get_type(expr->left))) {
907 return true;
908 }
909 return false;
910 }
911
912 int get_user_rl(struct expression *expr, struct range_list **rl)
913 {
914 int user_data, no_user_data;
915
916 if (!expr)
917 return 0;
918
919 if (__in_fake_struct_assign &&
920 !has_states(__get_cur_stree(), my_id))
921 return 0;
922
923 if (is_ptr_subtract(expr))
924 return 0;
925
926 push_int(&user_data_flags, 0);
927 push_int(&no_user_data_flags, 0);
928
929 custom_get_absolute_rl(expr, &var_user_rl, rl);
930
931 user_data = pop_int(&user_data_flags);
932 no_user_data = pop_int(&no_user_data_flags);
933
934 if (!user_data || no_user_data)
935 *rl = NULL;
936
937 return !!*rl;
938 }
939
940 int is_user_rl(struct expression *expr)
941 {
942 struct range_list *tmp;
943
944 return get_user_rl(expr, &tmp) && tmp;
945 }
946
947 int get_user_rl_var_sym(const char *name, struct symbol *sym, struct range_list **rl)
948 {
949 struct smatch_state *state, *extra;
950
951 state = get_state(my_id, name, sym);
952 if (!estate_rl(state))
953 return 0;
954 *rl = estate_rl(state);
955
956 extra = get_state(SMATCH_EXTRA, name, sym);
957 if (estate_rl(extra))
958 *rl = rl_intersection(estate_rl(state), estate_rl(extra));
959
960 return 1;
961 }
962
963 bool is_socket_stuff(struct symbol *sym)
964 {
965 struct symbol *type;
966
967 /* This is a hack.
968 * Basically I never want to consider an skb or sk as user pointer.
969 * The skb->data is already marked as a source of user data, and if
970 * anything else is marked as user data it's almost certainly wrong.
971 *
972 * Ideally, I would figure out where this bogus data is coming from,
973 * but possibly it just was stuck in the database from previous updates
974 * and can't get cleared out without deleting all user data. Things
975 * like this gets stuck in the DB because of recursion.
976 *
977 * I could make this a temporary hack, but I keep wanting to do it so
978 * I'm just going to make it permanent. It either doesn't change
979 * anything or it makes life better.
980 */
981
982 type = get_real_base_type(sym);
983 if (!type || type->type != SYM_PTR)
984 return false;
985 type = get_real_base_type(type);
986 if (!type || type->type != SYM_STRUCT || !type->ident)
987 return false;
988
989 if (strcmp(type->ident->name, "sk_buff") == 0)
990 return true;
991 if (strcmp(type->ident->name, "sock") == 0)
992 return true;
993 if (strcmp(type->ident->name, "socket") == 0)
994 return true;
995
996 return false;
997 }
998
999 static void return_info_callback(int return_id, char *return_ranges,
1000 struct expression *returned_expr,
1001 int param,
1002 const char *printed_name,
1003 struct sm_state *sm)
1004 {
1005 struct smatch_state *extra;
1006 struct range_list *rl;
1007 char buf[64];
1008
1009 if (is_socket_stuff(sm->sym))
1010 return;
1011 if (is_ignored_kernel_data(printed_name))
1012 return;
1013
1014 if (param >= 0) {
1015 if (strcmp(printed_name, "$") == 0)
1016 return;
1017 if (!estate_assigned(sm->state) &&
1018 !estate_new(sm->state))
1019 return;
1020 }
1021 rl = estate_rl(sm->state);
1022 if (!rl)
1023 return;
1024 extra = get_state(SMATCH_EXTRA, sm->name, sm->sym);
1025 if (estate_rl(extra))
1026 rl = rl_intersection(estate_rl(sm->state), estate_rl(extra));
1027 if (!rl)
1028 return;
1029
1030 snprintf(buf, sizeof(buf), "%s%s%s",
1031 show_rl(rl),
1032 estate_capped(sm->state) ? "[c]" : "",
1033 estate_treat_untagged(sm->state) ? "[u]" : "");
1034 sql_insert_return_states(return_id, return_ranges,
1035 estate_new(sm->state) ? USER_DATA_SET : USER_DATA,
1036 param, printed_name, buf);
1037 }
1038
1039 static bool is_ignored_macro(struct position pos)
1040 {
1041 const char *macro;
1042
1043 macro = get_macro_name(pos);
1044 if (!macro)
1045 return false;
1046 if (strcmp(macro, "v4l2_subdev_call") == 0)
1047 return true;
1048 return false;
1049 }
1050
1051 static void caller_info_callback(struct expression *call, int param, char *printed_name, struct sm_state *sm)
1052 {
1053 struct smatch_state *state;
1054 struct range_list *rl;
1055 struct symbol *type;
1056 char buf[64];
1057
1058 if (is_ignored_macro(call->pos))
1059 return;
1060
1061 if (is_socket_stuff(sm->sym))
1062 return;
1063 if (is_ignored_kernel_data(printed_name))
1064 return;
1065
1066 /*
1067 * Smatch uses a hack where if we get an unsigned long we say it's
1068 * both user data and it points to user data. But if we pass it to a
1069 * function which takes an int, then it's just user data. There's not
1070 * enough bytes for it to be a pointer.
1071 *
1072 */
1073 type = get_arg_type(call->fn, param);
1074 if (strcmp(printed_name, "$") != 0 && type && type_bits(type) < type_bits(&ptr_ctype))
1075 return;
1076
1077 if (strcmp(sm->state->name, "") == 0)
1078 return;
1079
1080 state = __get_state(SMATCH_EXTRA, sm->name, sm->sym);
1081 if (!state || !estate_rl(state))
1082 rl = estate_rl(sm->state);
1083 else
1084 rl = rl_intersection(estate_rl(sm->state), estate_rl(state));
1085
1086 if (!rl)
1087 return;
1088
1089 snprintf(buf, sizeof(buf), "%s%s%s", show_rl(rl),
1090 estate_capped(sm->state) ? "[c]" : "",
1091 estate_treat_untagged(sm->state) ? "[u]" : "");
1092 sql_insert_caller_info(call, USER_DATA, param, printed_name, buf);
1093 }
1094
1095 static void db_param_set(struct expression *expr, int param, char *key, char *value)
1096 {
1097 struct expression *arg;
1098 char *name;
1099 struct symbol *sym;
1100 struct smatch_state *state;
1101
1102 while (expr->type == EXPR_ASSIGNMENT)
1103 expr = strip_expr(expr->right);
1104 if (expr->type != EXPR_CALL)
1105 return;
1106 if (expr == ignore_clear)
1107 return;
1108
1109 arg = get_argument_from_call_expr(expr->args, param);
1110 if (!arg)
1111 return;
1112 name = get_variable_from_key(arg, key, &sym);
1113 if (!name || !sym)
1114 goto free;
1115
1116 state = get_state(my_id, name, sym);
1117 if (!state)
1118 goto free;
1119
1120 set_state(my_id, name, sym, alloc_estate_empty());
1121 free:
1122 free_string(name);
1123 }
1124
1125 static bool param_data_capped(const char *value)
1126 {
1127 if (strstr(value, ",c") || strstr(value, "[c"))
1128 return true;
1129 return false;
1130 }
1131
1132 static bool param_data_treat_untagged(const char *value)
1133 {
1134 if (strstr(value, ",u") || strstr(value, "[u"))
1135 return true;
1136 return false;
1137 }
1138
1139 static void set_param_user_data(const char *name, struct symbol *sym, char *key, char *value)
1140 {
1141 struct expression *expr;
1142 struct range_list *rl = NULL;
1143 struct smatch_state *state;
1144 struct symbol *type;
1145 char *fullname;
1146
1147 expr = symbol_expression(sym);
1148 fullname = get_variable_from_key(expr, key, NULL);
1149 if (!fullname)
1150 return;
1151
1152 type = get_member_type_from_key(expr, key);
1153 if (type && type->type == SYM_STRUCT)
1154 return;
1155
1156 if (!type)
1157 return;
1158
1159 str_to_rl(type, value, &rl);
1160 rl = swap_mtag_seed(expr, rl);
1161 state = alloc_estate_rl(rl);
1162 if (param_data_capped(value) || is_capped(expr))
1163 estate_set_capped(state);
1164 if (param_data_treat_untagged(value) || sym->ctype.as == 5)
1165 estate_set_treat_untagged(state);
1166 set_state(my_id, fullname, sym, state);
1167 }
1168
1169 static void set_called(const char *name, struct symbol *sym, char *key, char *value)
1170 {
1171 set_state(my_call_id, "this_function", NULL, &called);
1172 }
1173
1174 static void match_syscall_definition(struct symbol *sym)
1175 {
1176 struct symbol *arg;
1177 char *macro;
1178 char *name;
1179 int is_syscall = 0;
1180
1181 macro = get_macro_name(sym->pos);
1182 if (macro &&
1183 (strncmp("SYSCALL_DEFINE", macro, strlen("SYSCALL_DEFINE")) == 0 ||
1184 strncmp("COMPAT_SYSCALL_DEFINE", macro, strlen("COMPAT_SYSCALL_DEFINE")) == 0))
1185 is_syscall = 1;
1186
1187 name = get_function();
1188 if (!option_no_db && get_state(my_call_id, "this_function", NULL) != &called) {
1189 if (name && strncmp(name, "sys_", 4) == 0)
1190 is_syscall = 1;
1191 }
1192
1193 if (name && strncmp(name, "compat_sys_", 11) == 0)
1194 is_syscall = 1;
1195
1196 if (!is_syscall)
1197 return;
1198
1199 FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
1200 set_state(my_id, arg->ident->name, arg, alloc_estate_whole(get_real_base_type(arg)));
1201 } END_FOR_EACH_PTR(arg);
1202 }
1203
1204 #define OLD 0
1205 #define NEW 1
1206
1207 static void store_user_data_return(struct expression *expr, char *key, char *value, bool is_new)
1208 {
1209 struct smatch_state *state;
1210 struct range_list *rl;
1211 struct symbol *type;
1212 char buf[48];
1213
1214 if (key[0] != '$')
1215 return;
1216
1217 type = get_type(expr);
1218 snprintf(buf, sizeof(buf), "return %p%s", expr, key + 1);
1219 call_results_to_rl(expr, type, value, &rl);
1220
1221 state = alloc_estate_rl(rl);
1222 if (is_new)
1223 estate_set_new(state);
1224
1225 set_state(my_id, buf, NULL, state);
1226 }
1227
1228 // FIXME: not a fan of this name, would prefer set_to_user_data() but that's
1229 // already used.
1230 void mark_as_user_data(struct expression *expr, bool isnew)
1231 {
1232 struct smatch_state *state;
1233
1234 state = alloc_estate_whole(get_type(expr));
1235 if (isnew)
1236 estate_set_new(state);
1237 set_state_expr(my_id, expr, state);
1238 }
1239
1240 static void set_to_user_data(struct expression *expr, char *key, char *value, bool is_new)
1241 {
1242 struct smatch_state *state;
1243 char *name;
1244 struct symbol *sym;
1245 struct symbol *type;
1246 struct range_list *rl = NULL;
1247
1248 type = get_member_type_from_key(expr, key);
1249 name = get_variable_from_key(expr, key, &sym);
1250 if (!name || !sym)
1251 goto free;
1252
1253 call_results_to_rl(expr, type, value, &rl);
1254
1255 state = alloc_estate_rl(rl);
1256 if (param_data_capped(value))
1257 estate_set_capped(state);
1258 if (param_data_treat_untagged(value))
1259 estate_set_treat_untagged(state);
1260 if (is_new)
1261 estate_set_new(state);
1262 estate_set_assigned(state);
1263 set_state(my_id, name, sym, state);
1264 free:
1265 free_string(name);
1266 }
1267
1268 static void returns_param_user_data(struct expression *expr, int param, char *key, char *value)
1269 {
1270 struct expression *arg;
1271 struct expression *call;
1272
1273 call = expr;
1274 while (call->type == EXPR_ASSIGNMENT)
1275 call = strip_expr(call->right);
1276 if (call->type != EXPR_CALL)
1277 return;
1278
1279 if (!we_pass_user_data(call))
1280 return;
1281
1282 if (param == -1) {
1283 if (expr->type != EXPR_ASSIGNMENT) {
1284 // TODO: faked_assign this should all be handled as a fake assignment
1285 store_user_data_return(expr, key, value, OLD);
1286 return;
1287 }
1288 set_to_user_data(expr->left, key, value, OLD);
1289 return;
1290 }
1291
1292 arg = get_argument_from_call_expr(call->args, param);
1293 if (!arg)
1294 return;
1295 set_to_user_data(arg, key, value, OLD);
1296 }
1297
1298 static void returns_param_user_data_set(struct expression *expr, int param, char *key, char *value)
1299 {
1300 struct expression *arg;
1301
1302 if (param == -1) {
1303 if (expr->type != EXPR_ASSIGNMENT) {
1304 store_user_data_return(expr, key, value, NEW);
1305 return;
1306 }
1307 set_to_user_data(expr->left, key, value, NEW);
1308 return;
1309 }
1310
1311 while (expr->type == EXPR_ASSIGNMENT)
1312 expr = strip_expr(expr->right);
1313 if (expr->type != EXPR_CALL)
1314 return;
1315
1316 arg = get_argument_from_call_expr(expr->args, param);
1317 if (!arg)
1318 return;
1319 set_to_user_data(arg, key, value, NEW);
1320 }
1321
1322 static void set_param_key_user_data(struct expression *expr, const char *name,
1323 struct symbol *sym, void *data)
1324 {
1325 struct expression *arg;
1326
1327 arg = gen_expression_from_name_sym(name, sym);
1328 set_state_expr(my_id, arg, new_state(get_type(arg)));
1329 }
1330
1331 static void match_capped(struct expression *expr, const char *name, struct symbol *sym, void *info)
1332 {
1333 struct smatch_state *state, *new;
1334
1335 state = get_state(my_id, name, sym);
1336 if (!state || estate_capped(state))
1337 return;
1338
1339 new = clone_estate(state);
1340 estate_set_capped(new);
1341
1342 set_state(my_id, name, sym, new);
1343 }
1344
1345 void register_kernel_user_data(int id)
1346 {
1347 struct user_fn_info *info;
1348 int i;
1349
1350 my_id = id;
1351
1352 if (option_project != PROJ_KERNEL)
1353 return;
1354
1355 set_dynamic_states(my_id);
1356
1357 add_unmatched_state_hook(my_id, &empty_state);
1358 add_extra_nomod_hook(&extra_nomod_hook);
1359 add_pre_merge_hook(my_id, &pre_merge_hook);
1360 add_merge_hook(my_id, &merge_estates);
1361
1362 add_function_hook("sscanf", &match_sscanf, NULL);
1363
1364 add_hook(&match_syscall_definition, AFTER_DEF_HOOK);
1365
1366 add_hook(&match_assign, ASSIGNMENT_HOOK);
1367 select_return_states_hook(PARAM_SET, &db_param_set);
1368 add_hook(&match_condition, CONDITION_HOOK);
1369
1370 add_caller_info_callback(my_id, caller_info_callback);
1371 add_return_info_callback(my_id, return_info_callback);
1372 select_caller_info_hook(set_param_user_data, USER_DATA);
1373 select_return_states_hook(USER_DATA, &returns_param_user_data);
1374 select_return_states_hook(USER_DATA_SET, &returns_param_user_data_set);
1375
1376 select_return_param_key(CAPPED_DATA, &match_capped);
1377 add_function_param_key_hook_late("memcpy", &match_capped, 2, "$", NULL);
1378 add_function_param_key_hook_late("_memcpy", &match_capped, 2, "$", NULL);
1379 add_function_param_key_hook_late("__memcpy", &match_capped, 2, "$", NULL);
1380 add_function_param_key_hook_late("memset", &match_capped, 2, "$", NULL);
1381 add_function_param_key_hook_late("_memset", &match_capped, 2, "$", NULL);
1382 add_function_param_key_hook_late("__memset", &match_capped, 2, "$", NULL);
1383
1384 for (i = 0; i < ARRAY_SIZE(func_table); i++) {
1385 info = &func_table[i];
1386 add_function_param_key_hook_late(info->name, &set_param_key_user_data,
1387 info->param, info->key, info);
1388 }
1389 }
1390
1391 void register_kernel_user_data2(int id)
1392 {
1393 my_call_id = id;
1394
1395 if (option_project != PROJ_KERNEL)
1396 return;
1397 select_caller_info_hook(set_called, INTERNAL);
1398 }
Static analysis for C