2 * smatch/check_user_data.c
4 * Copyright (C) 2011 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 * There are a couple checks that try to see if a variable
12 * comes from the user. It would be better to unify them
13 * into one place. Also it we should follow the data down
14 * the call paths. Hence this file.
18 #include "smatch_slist.h"
19 #include "smatch_extra.h"
21 void tag_as_user_data(struct expression
*expr
);
23 #define NEW_USER_DATA 1
24 #define PASSED_IN_USER_DATA 2
31 static int is_user_macro(struct expression
*expr
)
36 static int has_user_data_state(struct expression
*expr
, struct state_list
*my_slist
)
42 expr
= strip_expr(expr
);
43 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
44 expr
= strip_expr(expr
->unop
);
46 name
= expr_to_str_sym(expr
, &sym
);
51 FOR_EACH_PTR(my_slist
, sm
) {
54 } END_FOR_EACH_PTR(sm
);
58 static int passes_user_data(struct expression
*expr
)
60 struct state_list
*slist
;
61 struct expression
*arg
;
63 slist
= get_all_states(my_id
);
64 FOR_EACH_PTR(expr
->args
, arg
) {
65 if (is_user_data(arg
))
67 if (has_user_data_state(arg
, slist
))
69 } END_FOR_EACH_PTR(arg
);
74 static struct expression
*db_expr
;
75 static int db_user_data
;
76 static int db_user_data_callback(void *unused
, int argc
, char **argv
, char **azColName
)
78 if (atoi(argv
[0]) == PASSED_IN_USER_DATA
&& !passes_user_data(db_expr
))
84 static int is_user_fn_db(struct expression
*expr
)
87 static char sql_filter
[1024];
89 if (expr
->fn
->type
!= EXPR_SYMBOL
)
91 sym
= expr
->fn
->symbol
;
95 if (sym
->ctype
.modifiers
& MOD_STATIC
) {
96 snprintf(sql_filter
, 1024, "file = '%s' and function = '%s';",
97 get_filename(), sym
->ident
->name
);
99 snprintf(sql_filter
, 1024, "function = '%s' and static = 0;",
105 run_sql(db_user_data_callback
,
106 "select value from return_states where type=%d and parameter = -1 and key = '$$' and %s",
107 USER_DATA
, sql_filter
);
111 static int is_user_function(struct expression
*expr
)
113 if (expr
->type
!= EXPR_CALL
)
115 if (sym_name_is("kmemdup_user", expr
->fn
))
117 return is_user_fn_db(expr
);
120 static int is_skb_data(struct expression
*expr
)
127 name
= expr_to_var_sym(expr
, &sym
);
131 sym
= get_base_type(sym
);
132 if (!sym
|| sym
->type
!= SYM_PTR
)
134 sym
= get_base_type(sym
);
135 if (!sym
|| sym
->type
!= SYM_STRUCT
|| !sym
->ident
)
137 if (strcmp(sym
->ident
->name
, "sk_buff") != 0)
143 if (strcmp(name
+ len
- 6, "->data") == 0)
151 static int in_container_of_macro(struct expression
*expr
)
155 macro
= get_macro_name(expr
->pos
);
159 if (strcmp(macro
, "container_of") == 0)
164 static int is_user_data_state(struct expression
*expr
)
166 struct state_list
*slist
= NULL
;
167 struct sm_state
*tmp
;
172 tmp
= get_sm_state_expr(my_id
, expr
);
174 return slist_has_state(tmp
->possible
, &user_data
);
176 name
= expr_to_str_sym(expr
, &sym
);
180 slist
= get_all_states(my_id
);
181 FOR_EACH_PTR(slist
, tmp
) {
184 if (!strncmp(tmp
->name
, name
, strlen(tmp
->name
))) {
185 if (slist_has_state(tmp
->possible
, &user_data
))
189 } END_FOR_EACH_PTR(tmp
);
197 int is_user_data(struct expression
*expr
)
204 if (in_container_of_macro(expr
))
207 if (is_user_macro(expr
))
209 if (is_user_function(expr
))
211 if (is_skb_data(expr
))
214 expr
= strip_expr(expr
); /* this has to come after is_user_macro() */
216 if (expr
->type
== EXPR_BINOP
) {
217 if (is_user_data(expr
->left
))
221 if (is_user_data(expr
->right
))
225 if (expr
->type
== EXPR_PREOP
&& (expr
->op
== '&' || expr
->op
== '*'))
226 expr
= strip_expr(expr
->unop
);
228 return is_user_data_state(expr
);
231 int is_capped_user_data(struct expression
*expr
)
235 sm
= get_sm_state_expr(my_id
, expr
);
238 if (slist_has_state(sm
->possible
, &capped
))
243 void set_param_user_data(const char *name
, struct symbol
*sym
, char *key
, char *value
)
247 /* sanity check. this should always be true. */
248 if (strncmp(key
, "$$", 2) != 0)
250 snprintf(fullname
, 256, "%s%s", name
, key
+ 2);
251 set_state(my_id
, fullname
, sym
, &user_data
);
254 static void match_syscall_definition(struct symbol
*sym
)
259 macro
= get_macro_name(sym
->pos
);
262 if (strncmp("SYSCALL_DEFINE", macro
, strlen("SYSCALL_DEFINE")) != 0 &&
263 strncmp("COMPAT_SYSCALL_DEFINE", macro
, strlen("COMPAT_SYSCALL_DEFINE")) != 0)
266 FOR_EACH_PTR(sym
->ctype
.base_type
->arguments
, arg
) {
267 set_state(my_id
, arg
->ident
->name
, arg
, &user_data
);
268 } END_FOR_EACH_PTR(arg
);
271 static void match_condition(struct expression
*expr
)
276 case SPECIAL_UNSIGNED_LT
:
277 case SPECIAL_UNSIGNED_LTE
:
278 if (is_user_data(expr
->left
))
279 set_true_false_states_expr(my_id
, expr
->left
, &capped
, NULL
);
280 if (is_user_data(expr
->right
))
281 set_true_false_states_expr(my_id
, expr
->right
, NULL
, &capped
);
285 case SPECIAL_UNSIGNED_GT
:
286 case SPECIAL_UNSIGNED_GTE
:
287 if (is_user_data(expr
->right
))
288 set_true_false_states_expr(my_id
, expr
->right
, &capped
, NULL
);
289 if (is_user_data(expr
->left
))
290 set_true_false_states_expr(my_id
, expr
->left
, NULL
, &capped
);
293 if (is_user_data(expr
->left
))
294 set_true_false_states_expr(my_id
, expr
->left
, &capped
, NULL
);
295 if (is_user_data(expr
->right
))
296 set_true_false_states_expr(my_id
, expr
->right
, &capped
, NULL
);
298 case SPECIAL_NOTEQUAL
:
299 if (is_user_data(expr
->left
))
300 set_true_false_states_expr(my_id
, expr
->left
, NULL
, &capped
);
301 if (is_user_data(expr
->right
))
302 set_true_false_states_expr(my_id
, expr
->right
, NULL
, &capped
);
309 static void set_capped(struct sm_state
*sm
, struct expression
*mod_expr
)
311 set_state(my_id
, sm
->name
, sm
->sym
, &capped
);
314 static void match_normal_assign(struct expression
*expr
)
316 if (is_user_data(expr
->right
))
317 set_state_expr(my_id
, expr
->left
, &user_data
);
320 static void match_assign(struct expression
*expr
)
324 name
= get_macro_name(expr
->pos
);
325 if (!name
|| strcmp(name
, "get_user") != 0) {
326 match_normal_assign(expr
);
329 name
= expr_to_var(expr
->right
);
330 if (!name
|| strcmp(name
, "__val_gu") != 0)
332 set_state_expr(my_id
, expr
->left
, &user_data
);
337 static void tag_struct_members(struct symbol
*type
, struct expression
*expr
)
340 struct expression
*member
;
343 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
344 expr
= strip_expr(expr
->unop
);
348 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
351 member
= member_expression(expr
, op
, tmp
->ident
);
352 set_state_expr(my_id
, member
, &user_data
);
353 } END_FOR_EACH_PTR(tmp
);
356 static void tag_base_type(struct expression
*expr
)
358 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
359 expr
= strip_expr(expr
->unop
);
361 expr
= deref_expression(expr
);
362 set_state_expr(my_id
, expr
, &user_data
);
365 void tag_as_user_data(struct expression
*expr
)
369 expr
= strip_expr(expr
);
371 type
= get_type(expr
);
372 if (!type
|| type
->type
!= SYM_PTR
)
374 type
= get_real_base_type(type
);
377 if (type
== &void_ctype
) {
378 set_state_expr(my_id
, deref_expression(expr
), &user_data
);
381 if (type
->type
== SYM_BASETYPE
)
383 if (type
->type
== SYM_STRUCT
) {
384 if (expr
->type
!= EXPR_PREOP
|| expr
->op
!= '&')
385 expr
= deref_expression(expr
);
386 tag_struct_members(type
, expr
);
390 static void match_user_copy(const char *fn
, struct expression
*expr
, void *_param
)
392 int param
= PTR_INT(_param
);
393 struct expression
*dest
;
395 dest
= get_argument_from_call_expr(expr
->args
, param
);
396 dest
= strip_expr(dest
);
399 tag_as_user_data(dest
);
402 static void match_user_assign_function(const char *fn
, struct expression
*expr
, void *unused
)
404 set_state_expr(my_id
, expr
->left
, &user_data
);
407 static void match_assign_userdata(struct expression
*expr
)
409 if (is_user_data(expr
->right
))
410 set_state_expr(my_id
, expr
->left
, &user_data
);
413 static void match_caller_info(struct expression
*expr
)
415 struct expression
*tmp
;
419 FOR_EACH_PTR(expr
->args
, tmp
) {
420 if (is_user_data(tmp
))
421 sql_insert_caller_info(expr
, USER_DATA
, i
, "$$", "");
423 } END_FOR_EACH_PTR(tmp
);
426 static void struct_member_callback(struct expression
*call
, int param
, char *printed_name
, struct smatch_state
*state
)
428 if (state
== &capped
)
430 sql_insert_caller_info(call
, USER_DATA
, param
, printed_name
, "");
433 static void returned_member_callback(int return_id
, char *return_ranges
, char *printed_name
, struct smatch_state
*state
)
435 if (state
== &capped
)
437 sql_insert_return_states(return_id
, return_ranges
, USER_DATA
, -1, printed_name
, "");
440 int was_passed_in_user_data(struct expression
*expr
)
444 __set_fake_cur_slist_fast(get_start_states());
445 ret
= is_user_data_state(expr
);
446 __pop_fake_cur_slist_fast();
450 static void print_returned_user_data(int return_id
, char *return_ranges
, struct expression
*expr
)
452 struct state_list
*my_slist
;
453 struct sm_state
*tmp
;
455 const char *passed_or_new
;
457 passed_or_new
= was_passed_in_user_data(expr
) ? "2" : "1";
458 if (is_user_data(expr
)) {
459 sql_insert_return_states(return_id
, return_ranges
, USER_DATA
,
460 -1, "$$", passed_or_new
);
463 my_slist
= get_all_states(my_id
);
465 FOR_EACH_PTR(my_slist
, tmp
) {
466 const char *param_name
;
468 param
= get_param_num_from_sym(tmp
->sym
);
472 if (is_capped_var_sym(tmp
->name
, tmp
->sym
))
474 if (get_state_slist(get_start_states(), my_id
, tmp
->name
, tmp
->sym
))
477 param_name
= get_param_name(tmp
);
481 sql_insert_return_states(return_id
, return_ranges
, USER_DATA
,
482 param
, param_name
, passed_or_new
);
483 } END_FOR_EACH_PTR(tmp
);
485 free_slist(&my_slist
);
488 static void db_return_states_userdata(struct expression
*expr
, int param
, char *key
, char *value
)
493 name
= return_state_to_var_sym(expr
, param
, key
, &sym
);
497 set_state(my_id
, name
, sym
, &user_data
);
502 void check_user_data(int id
)
504 if (option_project
!= PROJ_KERNEL
)
507 select_caller_info_hook(set_param_user_data
, USER_DATA
);
508 add_hook(&match_syscall_definition
, FUNC_DEF_HOOK
);
509 add_hook(&match_condition
, CONDITION_HOOK
);
510 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
511 add_hook(&match_assign_userdata
, ASSIGNMENT_HOOK
);
512 add_function_hook("copy_from_user", &match_user_copy
, INT_PTR(0));
513 add_function_hook("__copy_from_user", &match_user_copy
, INT_PTR(0));
514 add_function_hook("memcpy_fromiovec", &match_user_copy
, INT_PTR(0));
515 add_function_assign_hook("kmemdup_user", &match_user_assign_function
, NULL
);
517 add_hook(&match_caller_info
, FUNCTION_CALL_HOOK
);
518 add_member_info_callback(my_id
, struct_member_callback
);
519 add_returned_member_callback(my_id
, returned_member_callback
);
520 add_returned_state_callback(print_returned_user_data
);
521 select_return_states_hook(USER_DATA
, &db_return_states_userdata
);
523 add_modification_hook(my_id
, &set_capped
);