2 * Copyright (C) 2011 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * There are a couple checks that try to see if a variable
20 * comes from the user. It would be better to unify them
21 * into one place. Also it we should follow the data down
22 * the call paths. Hence this file.
26 #include "smatch_slist.h"
27 #include "smatch_extra.h"
30 static int my_call_id
;
32 static struct expression
*ignore_clear
;
41 const sval_t
*implies_start
, *implies_end
;
45 static struct user_fn_info func_table
[] = {
46 { "iov_iter_count", USER_DATA
, -1, "$" },
47 { "simple_strtol", USER_DATA
, -1, "$" },
48 { "simple_strtoll", USER_DATA
, -1, "$" },
49 { "simple_strtoul", USER_DATA
, -1, "$" },
50 { "simple_strtoull", USER_DATA
, -1, "$" },
51 { "kvm_register_read", USER_DATA
, -1, "$" },
52 { "ceph_decode_8", USER_DATA
, -1, "$" },
53 { "ceph_decode_16", USER_DATA
, -1, "$" },
54 { "ceph_decode_32", USER_DATA
, -1, "$" },
55 { "ceph_decode_64", USER_DATA
, -1, "$" },
59 static struct smatch_state
*empty_state(struct sm_state
*sm
)
61 return alloc_estate_empty();
64 static struct smatch_state
*new_state(struct symbol
*type
)
66 struct smatch_state
*state
;
68 if (!type
|| type_is_ptr(type
))
71 state
= alloc_estate_whole(type
);
72 estate_set_new(state
);
76 static void pre_merge_hook(struct sm_state
*cur
, struct sm_state
*other
)
78 struct smatch_state
*user
= cur
->state
;
79 struct smatch_state
*extra
;
80 struct smatch_state
*state
;
81 struct range_list
*rl
;
83 extra
= __get_state(SMATCH_EXTRA
, cur
->name
, cur
->sym
);
86 rl
= rl_intersection(estate_rl(user
), estate_rl(extra
));
87 state
= alloc_estate_rl(clone_rl(rl
));
88 if (estate_capped(user
) || is_capped_var_sym(cur
->name
, cur
->sym
))
89 estate_set_capped(state
);
90 if (estate_treat_untagged(user
))
91 estate_set_treat_untagged(state
);
92 if (estates_equiv(state
, cur
->state
))
94 if (estate_new(cur
->state
))
95 estate_set_new(state
);
96 set_state(my_id
, cur
->name
, cur
->sym
, state
);
99 static void extra_nomod_hook(const char *name
, struct symbol
*sym
, struct expression
*expr
, struct smatch_state
*state
)
101 struct smatch_state
*user
, *new;
102 struct range_list
*rl
;
104 user
= __get_state(my_id
, name
, sym
);
107 rl
= rl_intersection(estate_rl(user
), estate_rl(state
));
108 if (rl_equiv(rl
, estate_rl(user
)))
110 new = alloc_estate_rl(rl
);
111 if (estate_capped(user
))
112 estate_set_capped(new);
113 if (estate_treat_untagged(user
))
114 estate_set_treat_untagged(new);
115 set_state(my_id
, name
, sym
, new);
118 static void store_type_info(struct expression
*expr
, struct smatch_state
*state
)
121 char *type_str
, *member
;
123 if (__in_fake_assign
)
126 if (!estate_rl(state
))
129 expr
= strip_expr(expr
);
130 if (!expr
|| expr
->type
!= EXPR_DEREF
|| !expr
->member
)
133 type
= get_type(expr
->deref
);
134 if (!type
|| !type
->ident
)
137 type_str
= type_to_str(type
);
140 member
= get_member_name(expr
);
144 sql_insert_function_type_info(USER_DATA
, type_str
, member
, state
->name
);
147 static void set_user_data(struct expression
*expr
, struct smatch_state
*state
)
149 store_type_info(expr
, state
);
150 set_state_expr(my_id
, expr
, state
);
153 static bool user_rl_known(struct expression
*expr
)
155 struct range_list
*rl
;
158 if (!get_user_rl(expr
, &rl
))
161 close_to_max
= sval_type_max(rl_type(rl
));
162 close_to_max
.value
-= 100;
164 if (sval_cmp(rl_max(rl
), close_to_max
) >= 0)
169 static bool is_array_index_mask_nospec(struct expression
*expr
)
171 struct expression
*orig
;
173 orig
= get_assigned_expr(expr
);
174 if (!orig
|| orig
->type
!= EXPR_CALL
)
176 return sym_name_is("array_index_mask_nospec", orig
->fn
);
179 static bool binop_capped(struct expression
*expr
)
181 struct range_list
*left_rl
;
185 if (expr
->op
== '-' && get_user_rl(expr
->left
, &left_rl
)) {
186 if (user_rl_capped(expr
->left
))
188 comparison
= get_comparison(expr
->left
, expr
->right
);
189 if (comparison
&& show_special(comparison
)[0] == '>')
194 if (expr
->op
== '&' || expr
->op
== '%') {
195 bool left_user
, left_capped
, right_user
, right_capped
;
197 if (!get_value(expr
->right
, &sval
) && is_capped(expr
->right
))
199 if (is_array_index_mask_nospec(expr
->right
))
201 if (is_capped(expr
->left
))
203 left_user
= is_user_rl(expr
->left
);
204 right_user
= is_user_rl(expr
->right
);
205 if (!left_user
&& !right_user
)
208 left_capped
= user_rl_capped(expr
->left
);
209 right_capped
= user_rl_capped(expr
->right
);
211 if (left_user
&& left_capped
) {
214 if (right_user
&& right_capped
)
218 if (right_user
&& right_capped
) {
227 * Generally "capped" means that we capped it to an unknown value.
228 * This is useful because if Smatch doesn't know what the value is then
229 * we have to trust that it is correct. But if we known cap value is
230 * 100 then we can check if 100 is correct and complain if it's wrong.
232 * So then the problem is with BINOP when we take a capped variable
233 * plus a user variable which is clamped to a known range (uncapped)
234 * the result should be capped.
236 if ((user_rl_capped(expr
->left
) || user_rl_known(expr
->left
)) &&
237 (user_rl_capped(expr
->right
) || user_rl_known(expr
->right
)))
243 bool user_rl_capped_var_sym(const char *name
, struct symbol
*sym
)
245 struct smatch_state
*state
;
247 state
= get_state(my_id
, name
, sym
);
249 return estate_capped(state
);
254 bool user_rl_capped(struct expression
*expr
)
256 struct smatch_state
*state
;
257 struct range_list
*rl
;
260 expr
= strip_expr(expr
);
263 if (get_value(expr
, &sval
))
265 if (expr
->type
== EXPR_BINOP
)
266 return binop_capped(expr
);
267 if ((expr
->type
== EXPR_PREOP
|| expr
->type
== EXPR_POSTOP
) &&
268 (expr
->op
== SPECIAL_INCREMENT
|| expr
->op
== SPECIAL_DECREMENT
))
269 return user_rl_capped(expr
->unop
);
270 state
= get_state_expr(my_id
, expr
);
272 return estate_capped(state
);
274 if (!get_user_rl(expr
, &rl
)) {
276 * The non user data parts of a binop are capped and
277 * also empty user rl states are capped.
282 if (rl_to_sval(rl
, &sval
))
285 return false; /* uncapped user data */
288 bool user_rl_treat_untagged(struct expression
*expr
)
290 struct smatch_state
*state
;
291 struct range_list
*rl
;
294 expr
= strip_expr(expr
);
297 if (get_value(expr
, &sval
))
300 state
= get_state_expr(my_id
, expr
);
302 return estate_treat_untagged(state
);
304 if (get_user_rl(expr
, &rl
))
305 return false; /* uncapped user data */
307 return true; /* not actually user data */
310 static int is_dev_attr_name(struct expression
*expr
)
315 name
= expr_to_str(expr
);
318 if (strstr(name
, "->attr.name"))
324 static bool is_percent_n(struct expression
*expr
, int pos
)
331 if (expr
->type
!= EXPR_STRING
|| !expr
->string
)
334 p
= expr
->string
->data
;
337 (p
[0] == '%' && p
[1] == '%')) {
354 static void match_sscanf(const char *fn
, struct expression
*expr
, void *unused
)
356 struct expression
*str
, *format
, *arg
;
359 str
= get_argument_from_call_expr(expr
->args
, 0);
360 if (is_dev_attr_name(str
))
363 format
= get_argument_from_call_expr(expr
->args
, 1);
364 if (is_dev_attr_name(format
))
368 FOR_EACH_PTR(expr
->args
, arg
) {
372 if (is_percent_n(format
, i
- 2))
374 mark_as_user_data(deref_expression(arg
), true);
375 } END_FOR_EACH_PTR(arg
);
378 static int comes_from_skb_data(struct expression
*expr
)
380 expr
= strip_expr(expr
);
381 if (!expr
|| expr
->type
!= EXPR_PREOP
|| expr
->op
!= '*')
384 expr
= strip_expr(expr
->unop
);
387 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+')
388 expr
= strip_expr(expr
->left
);
390 return is_skb_data(expr
);
393 static int handle_get_user(struct expression
*expr
)
398 name
= get_macro_name(expr
->pos
);
399 if (!name
|| strcmp(name
, "get_user") != 0)
402 name
= expr_to_var(expr
->right
);
403 if (!name
|| (strcmp(name
, "__val_gu") != 0 && strcmp(name
, "__gu_val") != 0))
405 set_user_data(expr
->left
, new_state(get_type(expr
->left
)));
412 static bool state_is_new(struct expression
*expr
)
414 struct smatch_state
*state
;
416 state
= get_state_expr(my_id
, expr
);
417 if (estate_new(state
))
420 if (expr
->type
== EXPR_BINOP
) {
421 if (state_is_new(expr
->left
))
423 if (state_is_new(expr
->right
))
429 static struct range_list
*strip_negatives(struct range_list
*rl
)
431 sval_t min
= rl_min(rl
);
432 sval_t minus_one
= { .type
= rl_type(rl
), .value
= -1 };
433 sval_t over
= { .type
= rl_type(rl
), .value
= INT_MAX
+ 1ULL };
434 sval_t max
= sval_type_max(rl_type(rl
));
439 if (type_unsigned(rl_type(rl
)) && type_bits(rl_type(rl
)) > 31)
440 return remove_range(rl
, over
, max
);
442 return remove_range(rl
, min
, minus_one
);
445 static bool handle_op_assign(struct expression
*expr
)
447 struct expression
*binop_expr
;
448 struct smatch_state
*state
;
449 struct range_list
*rl
;
452 case SPECIAL_ADD_ASSIGN
:
453 case SPECIAL_SUB_ASSIGN
:
454 case SPECIAL_AND_ASSIGN
:
455 case SPECIAL_MOD_ASSIGN
:
456 case SPECIAL_SHL_ASSIGN
:
457 case SPECIAL_SHR_ASSIGN
:
458 case SPECIAL_OR_ASSIGN
:
459 case SPECIAL_XOR_ASSIGN
:
460 case SPECIAL_MUL_ASSIGN
:
461 case SPECIAL_DIV_ASSIGN
:
462 binop_expr
= binop_expression(expr
->left
,
463 op_remove_assign(expr
->op
),
465 if (!get_user_rl(binop_expr
, &rl
))
468 rl
= cast_rl(get_type(expr
->left
), rl
);
469 state
= alloc_estate_rl(rl
);
470 if (expr
->op
== SPECIAL_AND_ASSIGN
||
471 expr
->op
== SPECIAL_MOD_ASSIGN
||
472 user_rl_capped(binop_expr
))
473 estate_set_capped(state
);
474 if (user_rl_treat_untagged(expr
->left
))
475 estate_set_treat_untagged(state
);
476 if (state_is_new(binop_expr
))
477 estate_set_new(state
);
478 estate_set_assigned(state
);
479 set_user_data(expr
->left
, state
);
485 static void handle_derefed_pointers(struct expression
*expr
, bool is_new
)
487 expr
= strip_expr(expr
);
488 if (expr
->type
!= EXPR_PREOP
||
491 expr
= strip_expr(expr
->unop
);
492 set_array_user_ptr(expr
, is_new
);
495 static void match_assign(struct expression
*expr
)
497 struct symbol
*left_type
, *right_type
;
498 struct range_list
*rl
= NULL
;
499 static struct expression
*handled
;
500 struct smatch_state
*state
;
501 struct expression
*faked
;
502 bool is_capped
= false;
505 left_type
= get_type(expr
->left
);
506 if (left_type
== &void_ctype
)
509 faked
= get_faked_expression();
510 if (faked
&& faked
== ignore_clear
)
513 /* FIXME: handle fake array assignments frob(&user_array[x]); */
516 faked
->type
== EXPR_ASSIGNMENT
&&
517 points_to_user_data(faked
->right
)) {
518 if (is_skb_data(faked
->right
))
520 rl
= alloc_whole_rl(left_type
);
524 if (faked
&& faked
== handled
)
526 if (is_fake_call(expr
->right
))
527 goto clear_old_state
;
528 if (handle_get_user(expr
))
530 if (points_to_user_data(expr
->right
) &&
531 is_struct_ptr(get_type(expr
->left
))) {
533 // This should be handled by smatch_points_to_user_data.c
534 // set_array_user_ptr(expr->left);
537 if (handle_op_assign(expr
))
540 goto clear_old_state
;
542 /* Handled by DB code */
543 if (expr
->right
->type
== EXPR_CALL
)
547 disable_type_val_lookups();
548 get_user_rl(expr
->right
, &rl
);
550 enable_type_val_lookups();
552 goto clear_old_state
;
554 is_capped
= user_rl_capped(expr
->right
);
555 is_new
= state_is_new(expr
->right
);
558 right_type
= get_type(expr
->right
);
559 if (type_is_ptr(left_type
)) {
560 if (right_type
&& right_type
->type
== SYM_ARRAY
)
561 set_array_user_ptr(expr
->left
, is_new
);
565 rl
= cast_rl(left_type
, rl
);
566 if (is_capped
&& type_unsigned(right_type
) && type_signed(left_type
))
567 rl
= strip_negatives(rl
);
568 state
= alloc_estate_rl(rl
);
570 estate_set_new(state
);
572 estate_set_capped(state
);
573 if (user_rl_treat_untagged(expr
->right
))
574 estate_set_treat_untagged(state
);
575 estate_set_assigned(state
);
577 set_user_data(expr
->left
, state
);
578 handle_derefed_pointers(expr
->left
, is_new
);
584 * HACK ALERT!!! This should be at the start of the function. The
585 * the problem is that handling "pointer = array;" assignments is
586 * handled in this function instead of in kernel_points_to_user_data.c.
588 if (type_is_ptr(left_type
))
591 if (get_state_expr(my_id
, expr
->left
))
592 set_user_data(expr
->left
, alloc_estate_empty());
595 static void handle_eq_noteq(struct expression
*expr
)
597 struct smatch_state
*left_orig
, *right_orig
;
599 left_orig
= get_state_expr(my_id
, expr
->left
);
600 right_orig
= get_state_expr(my_id
, expr
->right
);
602 if (!left_orig
&& !right_orig
)
604 if (left_orig
&& right_orig
)
608 set_true_false_states_expr(my_id
, expr
->left
,
609 expr
->op
== SPECIAL_EQUAL
? alloc_estate_empty() : NULL
,
610 expr
->op
== SPECIAL_EQUAL
? NULL
: alloc_estate_empty());
612 set_true_false_states_expr(my_id
, expr
->right
,
613 expr
->op
== SPECIAL_EQUAL
? alloc_estate_empty() : NULL
,
614 expr
->op
== SPECIAL_EQUAL
? NULL
: alloc_estate_empty());
618 static void handle_compare(struct expression
*expr
)
620 struct expression
*left
, *right
;
621 struct range_list
*left_rl
= NULL
;
622 struct range_list
*right_rl
= NULL
;
623 struct range_list
*user_rl
;
624 struct smatch_state
*capped_state
;
625 struct smatch_state
*left_true
= NULL
;
626 struct smatch_state
*left_false
= NULL
;
627 struct smatch_state
*right_true
= NULL
;
628 struct smatch_state
*right_false
= NULL
;
632 left
= strip_expr(expr
->left
);
633 right
= strip_expr(expr
->right
);
635 while (left
->type
== EXPR_ASSIGNMENT
)
636 left
= strip_expr(left
->left
);
639 * Conditions are mostly handled by smatch_extra.c, but there are some
640 * times where the exact values are not known so we can't do that.
642 * Normally, we might consider using smatch_capped.c to supliment smatch
643 * extra but that doesn't work when we merge unknown uncapped kernel
644 * data with unknown capped user data. The result is uncapped user
645 * data. We need to keep it separate and say that the user data is
646 * capped. In the past, I would have marked this as just regular
647 * kernel data (not user data) but we can't do that these days because
648 * we need to track user data for Spectre.
650 * The other situation which we have to handle is when we do have an
651 * int and we compare against an unknown unsigned kernel variable. In
652 * that situation we assume that the kernel data is less than INT_MAX.
653 * Otherwise then we get all sorts of array underflow false positives.
657 /* Handled in smatch_extra.c */
658 if (get_implied_value(left
, &sval
) ||
659 get_implied_value(right
, &sval
))
662 get_user_rl(left
, &left_rl
);
663 get_user_rl(right
, &right_rl
);
666 if (!left_rl
&& !right_rl
)
668 /* if both sides are user data that's not a good limit */
669 if (left_rl
&& right_rl
)
677 type
= get_type(expr
);
678 if (type_unsigned(type
))
679 user_rl
= strip_negatives(user_rl
);
680 capped_state
= alloc_estate_rl(user_rl
);
681 estate_set_capped(capped_state
);
685 case SPECIAL_UNSIGNED_LT
:
687 case SPECIAL_UNSIGNED_LTE
:
689 left_true
= capped_state
;
691 right_false
= capped_state
;
694 case SPECIAL_UNSIGNED_GT
:
696 case SPECIAL_UNSIGNED_GTE
:
698 left_false
= capped_state
;
700 right_true
= capped_state
;
704 set_true_false_states_expr(my_id
, left
, left_true
, left_false
);
705 set_true_false_states_expr(my_id
, right
, right_true
, right_false
);
708 static void match_condition(struct expression
*expr
)
710 if (expr
->type
!= EXPR_COMPARE
)
713 if (expr
->op
== SPECIAL_EQUAL
||
714 expr
->op
== SPECIAL_NOTEQUAL
) {
715 handle_eq_noteq(expr
);
719 handle_compare(expr
);
722 static int get_user_macro_rl(struct expression
*expr
, struct range_list
**rl
)
724 struct expression
*parent
;
730 macro
= get_macro_name(expr
->pos
);
734 /* handle ntohl(foo[i]) where "i" is trusted */
735 parent
= expr_get_parent_expr(expr
);
736 while (parent
&& parent
->type
!= EXPR_BINOP
)
737 parent
= expr_get_parent_expr(parent
);
738 if (parent
&& parent
->type
== EXPR_BINOP
) {
739 char *parent_macro
= get_macro_name(parent
->pos
);
741 if (parent_macro
&& strcmp(macro
, parent_macro
) == 0)
745 if (strcmp(macro
, "ntohl") == 0) {
746 *rl
= alloc_whole_rl(&uint_ctype
);
749 if (strcmp(macro
, "ntohs") == 0) {
750 *rl
= alloc_whole_rl(&ushort_ctype
);
756 static int has_user_data(struct symbol
*sym
)
758 struct sm_state
*tmp
;
760 FOR_EACH_MY_SM(my_id
, __get_cur_stree(), tmp
) {
763 } END_FOR_EACH_SM(tmp
);
767 bool we_pass_user_data(struct expression
*call
)
769 struct expression
*arg
;
772 FOR_EACH_PTR(call
->args
, arg
) {
773 if (points_to_user_data(arg
))
775 sym
= expr_to_sym(arg
);
778 if (has_user_data(sym
))
780 } END_FOR_EACH_PTR(arg
);
785 // TODO: faked_assign this should already be handled
786 static int db_returned_user_rl(struct expression
*call
, struct range_list
**rl
)
788 struct smatch_state
*state
;
791 if (is_fake_call(call
))
793 snprintf(buf
, sizeof(buf
), "return %p", call
);
794 state
= get_state(my_id
, buf
, NULL
);
795 if (!state
|| !estate_rl(state
))
797 *rl
= estate_rl(state
);
801 struct stree
*get_user_stree(void)
803 return get_all_states_stree(my_id
);
806 static struct int_stack
*user_data_flags
, *no_user_data_flags
;
808 static void set_flag(struct int_stack
**stack
)
812 num
= pop_int(stack
);
814 push_int(stack
, num
);
817 struct range_list
*var_user_rl(struct expression
*expr
)
819 struct smatch_state
*state
;
820 struct range_list
*rl
;
821 struct range_list
*absolute_rl
;
823 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
824 set_flag(&no_user_data_flags
);
828 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '%') {
829 struct range_list
*left
, *right
;
831 if (!get_user_rl(expr
->right
, &right
))
833 get_absolute_rl(expr
->left
, &left
);
834 rl
= rl_binop(left
, '%', right
);
838 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '/') {
839 struct range_list
*left
= NULL
;
840 struct range_list
*right
= NULL
;
841 struct range_list
*abs_right
;
844 * The specific bug I'm dealing with is:
846 * foo = capped_user / unknown;
848 * Instead of just saying foo is now entirely user_rl we should
849 * probably say instead that it is not at all user data.
853 get_user_rl(expr
->left
, &left
);
854 get_user_rl(expr
->right
, &right
);
855 get_absolute_rl(expr
->right
, &abs_right
);
857 if (left
&& !right
) {
858 rl
= rl_binop(left
, '/', abs_right
);
859 if (sval_cmp(rl_max(left
), rl_max(rl
)) < 0)
860 set_flag(&no_user_data_flags
);
866 if (get_user_macro_rl(expr
, &rl
))
869 if (comes_from_skb_data(expr
)) {
870 rl
= alloc_whole_rl(get_type(expr
));
874 state
= get_state_expr(my_id
, expr
);
875 if (state
&& estate_rl(state
)) {
876 rl
= estate_rl(state
);
880 if (expr
->type
== EXPR_CALL
&& db_returned_user_rl(expr
, &rl
))
883 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '*' &&
884 points_to_user_data(expr
->unop
)) {
885 rl
= var_to_absolute_rl(expr
);
889 if (is_array(expr
)) {
890 struct expression
*array
= get_array_base(expr
);
892 if (!get_state_expr(my_id
, array
)) {
893 set_flag(&no_user_data_flags
);
900 set_flag(&user_data_flags
);
901 absolute_rl
= var_to_absolute_rl(expr
);
902 return rl_intersection(rl
, absolute_rl
);
905 static bool is_ptr_subtract(struct expression
*expr
)
907 expr
= strip_expr(expr
);
910 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '-' &&
911 type_is_ptr(get_type(expr
->left
))) {
917 int get_user_rl(struct expression
*expr
, struct range_list
**rl
)
919 int user_data
, no_user_data
;
924 if (__in_fake_struct_assign
&&
925 !has_states(__get_cur_stree(), my_id
))
928 if (is_ptr_subtract(expr
))
931 push_int(&user_data_flags
, 0);
932 push_int(&no_user_data_flags
, 0);
934 custom_get_absolute_rl(expr
, &var_user_rl
, rl
);
936 user_data
= pop_int(&user_data_flags
);
937 no_user_data
= pop_int(&no_user_data_flags
);
939 if (!user_data
|| no_user_data
)
945 int is_user_rl(struct expression
*expr
)
947 struct range_list
*tmp
;
949 return get_user_rl(expr
, &tmp
) && tmp
;
952 int get_user_rl_var_sym(const char *name
, struct symbol
*sym
, struct range_list
**rl
)
954 struct smatch_state
*state
, *extra
;
956 state
= get_state(my_id
, name
, sym
);
957 if (!estate_rl(state
))
959 *rl
= estate_rl(state
);
961 extra
= get_state(SMATCH_EXTRA
, name
, sym
);
962 if (estate_rl(extra
))
963 *rl
= rl_intersection(estate_rl(state
), estate_rl(extra
));
968 bool is_socket_stuff(struct symbol
*sym
)
973 * Basically I never want to consider an skb or sk as user pointer.
974 * The skb->data is already marked as a source of user data, and if
975 * anything else is marked as user data it's almost certainly wrong.
977 * Ideally, I would figure out where this bogus data is coming from,
978 * but possibly it just was stuck in the database from previous updates
979 * and can't get cleared out without deleting all user data. Things
980 * like this gets stuck in the DB because of recursion.
982 * I could make this a temporary hack, but I keep wanting to do it so
983 * I'm just going to make it permanent. It either doesn't change
984 * anything or it makes life better.
987 type
= get_real_base_type(sym
);
988 if (!type
|| type
->type
!= SYM_PTR
)
990 type
= get_real_base_type(type
);
991 if (!type
|| type
->type
!= SYM_STRUCT
|| !type
->ident
)
994 if (strcmp(type
->ident
->name
, "sk_buff") == 0)
996 if (strcmp(type
->ident
->name
, "sock") == 0)
998 if (strcmp(type
->ident
->name
, "socket") == 0)
1004 static void return_info_callback(int return_id
, char *return_ranges
,
1005 struct expression
*returned_expr
,
1007 const char *printed_name
,
1008 struct sm_state
*sm
)
1010 struct smatch_state
*extra
;
1011 struct range_list
*rl
;
1014 if (is_socket_stuff(sm
->sym
))
1016 if (is_ignored_kernel_data(printed_name
))
1020 if (strcmp(printed_name
, "$") == 0)
1022 if (!param_was_set_var_sym(sm
->name
, sm
->sym
))
1024 if (!estate_assigned(sm
->state
) &&
1025 !estate_new(sm
->state
))
1028 rl
= estate_rl(sm
->state
);
1031 extra
= get_state(SMATCH_EXTRA
, sm
->name
, sm
->sym
);
1032 if (estate_rl(extra
))
1033 rl
= rl_intersection(estate_rl(sm
->state
), estate_rl(extra
));
1037 snprintf(buf
, sizeof(buf
), "%s%s%s",
1039 estate_capped(sm
->state
) ? "[c]" : "",
1040 estate_treat_untagged(sm
->state
) ? "[u]" : "");
1041 sql_insert_return_states(return_id
, return_ranges
,
1042 estate_new(sm
->state
) ? USER_DATA_SET
: USER_DATA
,
1043 param
, printed_name
, buf
);
1046 static bool is_ignored_macro(struct position pos
)
1050 macro
= get_macro_name(pos
);
1053 if (strcmp(macro
, "v4l2_subdev_call") == 0)
1058 static void caller_info_callback(struct expression
*call
, int param
, char *printed_name
, struct sm_state
*sm
)
1060 struct smatch_state
*state
;
1061 struct range_list
*rl
;
1062 struct symbol
*type
;
1065 if (is_ignored_macro(call
->pos
))
1068 if (is_socket_stuff(sm
->sym
))
1070 if (is_ignored_kernel_data(printed_name
))
1074 * Smatch uses a hack where if we get an unsigned long we say it's
1075 * both user data and it points to user data. But if we pass it to a
1076 * function which takes an int, then it's just user data. There's not
1077 * enough bytes for it to be a pointer.
1080 type
= get_arg_type(call
->fn
, param
);
1081 if (strcmp(printed_name
, "$") != 0 && type
&& type_bits(type
) < type_bits(&ptr_ctype
))
1084 if (strcmp(sm
->state
->name
, "") == 0)
1087 state
= __get_state(SMATCH_EXTRA
, sm
->name
, sm
->sym
);
1088 if (!state
|| !estate_rl(state
))
1089 rl
= estate_rl(sm
->state
);
1091 rl
= rl_intersection(estate_rl(sm
->state
), estate_rl(state
));
1096 snprintf(buf
, sizeof(buf
), "%s%s%s", show_rl(rl
),
1097 estate_capped(sm
->state
) ? "[c]" : "",
1098 estate_treat_untagged(sm
->state
) ? "[u]" : "");
1099 sql_insert_caller_info(call
, USER_DATA
, param
, printed_name
, buf
);
1102 static void db_param_set(struct expression
*expr
, int param
, char *key
, char *value
)
1104 struct expression
*arg
;
1107 struct smatch_state
*state
;
1109 while (expr
->type
== EXPR_ASSIGNMENT
)
1110 expr
= strip_expr(expr
->right
);
1111 if (expr
->type
!= EXPR_CALL
)
1113 if (expr
== ignore_clear
)
1116 arg
= get_argument_from_call_expr(expr
->args
, param
);
1119 name
= get_variable_from_key(arg
, key
, &sym
);
1123 state
= get_state(my_id
, name
, sym
);
1127 set_state(my_id
, name
, sym
, alloc_estate_empty());
1132 static bool param_data_capped(const char *value
)
1134 if (strstr(value
, ",c") || strstr(value
, "[c"))
1139 static bool param_data_treat_untagged(const char *value
)
1141 if (strstr(value
, ",u") || strstr(value
, "[u"))
1146 static void set_param_user_data(const char *name
, struct symbol
*sym
, char *key
, char *value
)
1148 struct expression
*expr
;
1149 struct range_list
*rl
= NULL
;
1150 struct smatch_state
*state
;
1151 struct symbol
*type
;
1154 expr
= symbol_expression(sym
);
1155 fullname
= get_variable_from_key(expr
, key
, NULL
);
1159 type
= get_member_type_from_key(expr
, key
);
1160 if (type
&& type
->type
== SYM_STRUCT
)
1166 str_to_rl(type
, value
, &rl
);
1167 rl
= swap_mtag_seed(expr
, rl
);
1168 state
= alloc_estate_rl(rl
);
1169 if (param_data_capped(value
) || is_capped(expr
))
1170 estate_set_capped(state
);
1171 if (param_data_treat_untagged(value
) || sym
->ctype
.as
== 5)
1172 estate_set_treat_untagged(state
);
1173 set_state(my_id
, fullname
, sym
, state
);
1176 static void set_called(const char *name
, struct symbol
*sym
, char *key
, char *value
)
1178 set_state(my_call_id
, "this_function", NULL
, &called
);
1181 static void match_syscall_definition(struct symbol
*sym
)
1188 macro
= get_macro_name(sym
->pos
);
1190 (strncmp("SYSCALL_DEFINE", macro
, strlen("SYSCALL_DEFINE")) == 0 ||
1191 strncmp("COMPAT_SYSCALL_DEFINE", macro
, strlen("COMPAT_SYSCALL_DEFINE")) == 0))
1194 name
= get_function();
1195 if (!option_no_db
&& get_state(my_call_id
, "this_function", NULL
) != &called
) {
1196 if (name
&& strncmp(name
, "sys_", 4) == 0)
1200 if (name
&& strncmp(name
, "compat_sys_", 11) == 0)
1206 FOR_EACH_PTR(sym
->ctype
.base_type
->arguments
, arg
) {
1207 set_state(my_id
, arg
->ident
->name
, arg
, alloc_estate_whole(get_real_base_type(arg
)));
1208 } END_FOR_EACH_PTR(arg
);
1214 static void store_user_data_return(struct expression
*expr
, char *key
, char *value
, bool is_new
)
1216 struct smatch_state
*state
;
1217 struct range_list
*rl
;
1218 struct symbol
*type
;
1224 type
= get_type(expr
);
1225 snprintf(buf
, sizeof(buf
), "return %p%s", expr
, key
+ 1);
1226 call_results_to_rl(expr
, type
, value
, &rl
);
1228 state
= alloc_estate_rl(rl
);
1230 estate_set_new(state
);
1232 set_state(my_id
, buf
, NULL
, state
);
1235 // FIXME: not a fan of this name, would prefer set_to_user_data() but that's
1237 void mark_as_user_data(struct expression
*expr
, bool isnew
)
1239 struct smatch_state
*state
;
1241 state
= alloc_estate_whole(get_type(expr
));
1243 estate_set_new(state
);
1244 set_state_expr(my_id
, expr
, state
);
1247 static void set_to_user_data(struct expression
*expr
, char *key
, char *value
, bool is_new
)
1249 struct smatch_state
*state
;
1252 struct symbol
*type
;
1253 struct range_list
*rl
= NULL
;
1255 type
= get_member_type_from_key(expr
, key
);
1256 name
= get_variable_from_key(expr
, key
, &sym
);
1260 call_results_to_rl(expr
, type
, value
, &rl
);
1262 state
= alloc_estate_rl(rl
);
1263 if (param_data_capped(value
))
1264 estate_set_capped(state
);
1265 if (param_data_treat_untagged(value
))
1266 estate_set_treat_untagged(state
);
1268 estate_set_new(state
);
1269 estate_set_assigned(state
);
1270 set_state(my_id
, name
, sym
, state
);
1275 static void returns_param_user_data(struct expression
*expr
, int param
, char *key
, char *value
)
1277 struct expression
*arg
;
1278 struct expression
*call
;
1281 while (call
->type
== EXPR_ASSIGNMENT
)
1282 call
= strip_expr(call
->right
);
1283 if (call
->type
!= EXPR_CALL
)
1286 if (!we_pass_user_data(call
))
1290 if (expr
->type
!= EXPR_ASSIGNMENT
) {
1291 // TODO: faked_assign this should all be handled as a fake assignment
1292 store_user_data_return(expr
, key
, value
, OLD
);
1295 set_to_user_data(expr
->left
, key
, value
, OLD
);
1299 arg
= get_argument_from_call_expr(call
->args
, param
);
1302 set_to_user_data(arg
, key
, value
, OLD
);
1305 static void returns_param_user_data_set(struct expression
*expr
, int param
, char *key
, char *value
)
1307 struct expression
*arg
;
1310 if (expr
->type
!= EXPR_ASSIGNMENT
) {
1311 store_user_data_return(expr
, key
, value
, NEW
);
1314 set_to_user_data(expr
->left
, key
, value
, NEW
);
1318 while (expr
->type
== EXPR_ASSIGNMENT
)
1319 expr
= strip_expr(expr
->right
);
1320 if (expr
->type
!= EXPR_CALL
)
1323 arg
= get_argument_from_call_expr(expr
->args
, param
);
1326 set_to_user_data(arg
, key
, value
, NEW
);
1329 static void set_param_key_user_data(struct expression
*expr
, const char *name
,
1330 struct symbol
*sym
, void *data
)
1332 struct expression
*arg
;
1334 arg
= gen_expression_from_name_sym(name
, sym
);
1335 set_state_expr(my_id
, arg
, new_state(get_type(arg
)));
1338 static void match_capped(struct expression
*expr
, const char *name
, struct symbol
*sym
, void *info
)
1340 struct smatch_state
*state
, *new;
1342 state
= get_state(my_id
, name
, sym
);
1343 if (!state
|| estate_capped(state
))
1346 new = clone_estate(state
);
1347 estate_set_capped(new);
1349 set_state(my_id
, name
, sym
, new);
1352 void register_kernel_user_data(int id
)
1354 struct user_fn_info
*info
;
1359 if (option_project
!= PROJ_KERNEL
)
1362 set_dynamic_states(my_id
);
1364 add_unmatched_state_hook(my_id
, &empty_state
);
1365 add_extra_nomod_hook(&extra_nomod_hook
);
1366 add_pre_merge_hook(my_id
, &pre_merge_hook
);
1367 add_merge_hook(my_id
, &merge_estates
);
1369 add_function_hook("sscanf", &match_sscanf
, NULL
);
1371 add_hook(&match_syscall_definition
, AFTER_DEF_HOOK
);
1373 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
1374 select_return_states_hook(PARAM_SET
, &db_param_set
);
1375 add_hook(&match_condition
, CONDITION_HOOK
);
1377 add_caller_info_callback(my_id
, caller_info_callback
);
1378 add_return_info_callback(my_id
, return_info_callback
);
1379 select_caller_info_hook(set_param_user_data
, USER_DATA
);
1380 select_return_states_hook(USER_DATA
, &returns_param_user_data
);
1381 select_return_states_hook(USER_DATA_SET
, &returns_param_user_data_set
);
1383 select_return_param_key(CAPPED_DATA
, &match_capped
);
1384 add_function_param_key_hook_late("memcpy", &match_capped
, 2, "$", NULL
);
1385 add_function_param_key_hook_late("_memcpy", &match_capped
, 2, "$", NULL
);
1386 add_function_param_key_hook_late("__memcpy", &match_capped
, 2, "$", NULL
);
1387 add_function_param_key_hook_late("memset", &match_capped
, 2, "$", NULL
);
1388 add_function_param_key_hook_late("_memset", &match_capped
, 2, "$", NULL
);
1389 add_function_param_key_hook_late("__memset", &match_capped
, 2, "$", NULL
);
1391 for (i
= 0; i
< ARRAY_SIZE(func_table
); i
++) {
1392 info
= &func_table
[i
];
1393 add_function_param_key_hook_late(info
->name
, &set_param_key_user_data
,
1394 info
->param
, info
->key
, info
);
1398 void register_kernel_user_data2(int id
)
1402 if (option_project
!= PROJ_KERNEL
)
1404 select_caller_info_hook(set_called
, INTERNAL
);