2 * Copyright (C) 2011 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
18 /* Does a search for Dan Rosenberg style info leaks */
20 /* fixme: struct includes a struct with a hole in it */
21 /* function is called that clears the struct */
25 #include "smatch_function_hashtable.h"
26 #include "smatch_slist.h"
27 #include "smatch_extra.h"
29 static int my_whole_id
;
30 static int my_member_id
;
34 static void extra_mod_hook(const char *name
, struct symbol
*sym
, struct smatch_state
*state
)
36 set_state(my_member_id
, name
, sym
, state
);
39 static void print_holey_warning(struct expression
*data
, const char *member
)
43 name
= expr_to_str(data
);
45 sm_msg("warn: check that '%s' doesn't leak information (struct has a hole after '%s')",
48 sm_msg("warn: check that '%s' doesn't leak information (struct has holes)",
54 static int check_struct(struct expression
*expr
, struct symbol
*type
)
56 struct symbol
*tmp
, *base_type
;
57 const char *prev
= NULL
;
61 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
62 base_type
= get_real_base_type(tmp
);
63 if (base_type
&& base_type
->type
== SYM_STRUCT
) {
64 if (check_struct(expr
, base_type
))
67 if (type
->ctype
.attribute
->is_packed
)
70 if (!tmp
->ctype
.alignment
) {
71 sm_msg("warn: cannot determine the alignment here\n");
72 } else if (align
% tmp
->ctype
.alignment
) {
73 print_holey_warning(expr
, prev
);
77 if (base_type
== &bool_ctype
)
79 else if (type_bits(tmp
) <= 0)
82 align
+= type_bytes(tmp
);
85 prev
= tmp
->ident
->name
;
88 } END_FOR_EACH_PTR(tmp
);
90 if (align
% type
->ctype
.alignment
) {
91 print_holey_warning(expr
, prev
);
98 static int warn_on_holey_struct(struct expression
*expr
)
101 type
= get_type(expr
);
102 if (!type
|| type
->type
!= SYM_STRUCT
)
105 return check_struct(expr
, type
);
108 static int has_global_scope(struct expression
*expr
)
112 if (expr
->type
!= EXPR_SYMBOL
)
115 return toplevel(sym
->scope
);
118 static int was_initialized(struct expression
*expr
)
123 name
= expr_to_var_sym(expr
, &sym
);
126 if (sym
->initializer
)
131 static void match_clear(const char *fn
, struct expression
*expr
, void *_arg_no
)
133 struct expression
*ptr
;
134 int arg_no
= PTR_INT(_arg_no
);
136 ptr
= get_argument_from_call_expr(expr
->args
, arg_no
);
139 if (ptr
->type
!= EXPR_PREOP
|| ptr
->op
!= '&')
141 ptr
= strip_expr(ptr
->unop
);
142 set_state_expr(my_whole_id
, ptr
, &cleared
);
145 static int was_memset(struct expression
*expr
)
147 if (get_state_expr(my_whole_id
, expr
) == &cleared
)
152 static int member_initialized(char *name
, struct symbol
*outer
, struct symbol
*member
, int pointer
)
157 base
= get_base_type(member
);
158 if (!base
|| base
->type
!= SYM_BASETYPE
|| !member
->ident
)
162 snprintf(buf
, 256, "%s->%s", name
, member
->ident
->name
);
164 snprintf(buf
, 256, "%s.%s", name
, member
->ident
->name
);
166 if (get_state(my_member_id
, buf
, outer
))
172 static int member_uninitialized(char *name
, struct symbol
*outer
, struct symbol
*member
, int pointer
)
178 base
= get_base_type(member
);
179 if (!base
|| base
->type
!= SYM_BASETYPE
|| !member
->ident
)
183 snprintf(buf
, 256, "%s->%s", name
, member
->ident
->name
);
185 snprintf(buf
, 256, "%s.%s", name
, member
->ident
->name
);
187 sm
= get_sm_state(my_member_id
, buf
, outer
);
188 if (sm
&& !slist_has_state(sm
->possible
, &undefined
))
191 sm_msg("warn: check that '%s' doesn't leak information", buf
);
195 static int check_members_initialized(struct expression
*expr
)
198 struct symbol
*outer
;
204 sym
= get_type(expr
);
205 if (sym
&& sym
->type
== SYM_PTR
) {
207 sym
= get_real_base_type(sym
);
211 if (sym
->type
!= SYM_STRUCT
)
214 name
= expr_to_var_sym(expr
, &outer
);
216 if (get_state(my_member_id
, name
, outer
))
220 * check that at least one member was set. If all of them were not set
221 * it's more likely a problem in the check than a problem in the kernel
224 FOR_EACH_PTR(sym
->symbol_list
, tmp
) {
225 if (member_initialized(name
, outer
, tmp
, pointer
))
227 } END_FOR_EACH_PTR(tmp
);
231 FOR_EACH_PTR(sym
->symbol_list
, tmp
) {
232 if (member_uninitialized(name
, outer
, tmp
, pointer
)) {
236 } END_FOR_EACH_PTR(tmp
);
242 static void match_copy_to_user(const char *fn
, struct expression
*expr
, void *_arg
)
244 int arg
= PTR_INT(_arg
);
245 struct expression
*data
;
247 data
= get_argument_from_call_expr(expr
->args
, arg
);
248 data
= strip_expr(data
);
251 if (data
->type
== EXPR_PREOP
&& data
->op
== '&')
252 data
= strip_expr(data
->unop
);
253 if (data
->type
!= EXPR_SYMBOL
)
256 if (has_global_scope(data
))
258 if (was_initialized(data
))
260 if (was_memset(data
))
262 if (warn_on_holey_struct(data
))
264 check_members_initialized(data
);
267 static void db_param_cleared(struct expression
*expr
, int param
, char *key
, char *value
)
269 while (expr
->type
== EXPR_ASSIGNMENT
)
270 expr
= strip_expr(expr
->right
);
271 if (expr
->type
!= EXPR_CALL
)
274 match_clear(NULL
, expr
, INT_PTR(param
));
277 static void register_clears_argument(void)
283 token
= get_tokens_file("kernel.clears_argument");
286 if (token_type(token
) != TOKEN_STREAMBEGIN
)
289 while (token_type(token
) != TOKEN_STREAMEND
) {
290 if (token_type(token
) != TOKEN_IDENT
)
292 func
= show_ident(token
->ident
);
294 if (token_type(token
) != TOKEN_NUMBER
)
296 arg
= atoi(token
->number
);
298 add_function_hook(func
, &match_clear
, INT_PTR(arg
));
304 void check_rosenberg(int id
)
306 if (option_project
!= PROJ_KERNEL
)
310 add_function_hook("memset", &match_clear
, INT_PTR(0));
311 add_function_hook("memcpy", &match_clear
, INT_PTR(0));
312 add_function_hook("__memzero", &match_clear
, INT_PTR(0));
313 add_function_hook("memzero", &match_clear
, INT_PTR(0));
314 register_clears_argument();
316 add_function_hook("copy_to_user", &match_copy_to_user
, INT_PTR(1));
317 add_function_hook("__copy_to_user", &match_copy_to_user
, INT_PTR(1));
318 add_function_hook("nla_put", &match_copy_to_user
, INT_PTR(3));
319 select_return_states_hook(PARAM_CLEARED
, &db_param_cleared
);
322 void check_rosenberg2(int id
)
324 if (option_project
!= PROJ_KERNEL
)
328 add_extra_mod_hook(&extra_mod_hook
);