check_info_leak.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include "smatch.h"
  19 #include "smatch_slist.h"
  20
  21 static int my_id;
  22
  23 STATE(alloced);
  24 STATE(string);
  25
  26 static char *my_get_variable(struct expression *expr, struct symbol **sym)
  27 {
  28         char *name;
  29
  30         name = expr_to_var_sym(expr, sym);
  31         free_string(name);
  32         if (!name || !*sym)
  33                 return NULL;
  34
  35         return (*sym)->ident->name;
  36 }
  37
  38 static void match_kmalloc(const char *fn, struct expression *expr, void *unused)
  39 {
  40         char *name;
  41         struct symbol *sym;
  42
  43         name = my_get_variable(expr->left, &sym);
  44         if (!name)
  45                 return;
  46         set_state(my_id, name, sym, &alloced);
  47 }
  48
  49 static void match_strcpy(const char *fn, struct expression *expr, void *unused)
  50 {
  51         struct expression *dest;
  52         char *name;
  53         struct symbol *sym;
  54
  55         dest = get_argument_from_call_expr(expr->args, 0);
  56         name = my_get_variable(dest, &sym);
  57         if (!name || !sym)
  58                 return;
  59         if (!get_state(my_id, name, sym))
  60                 return;
  61         set_state(my_id, name, sym, &string);
  62 }
  63
  64 static void match_copy_to_user(const char *fn, struct expression *expr, void *unused)
  65 {
  66         struct expression *src;
  67         char *name;
  68         struct symbol *sym;
  69         struct sm_state *sm;
  70
  71         src = get_argument_from_call_expr(expr->args, 1);
  72         name = my_get_variable(src, &sym);
  73         if (!name || !sym)
  74                 return;
  75         sm = get_sm_state(my_id, name, sym);
  76         if (!sm || !slist_has_state(sm->possible, &string))
  77                 return;
  78         name = expr_to_var(src);
  79         sm_warning("possible info leak '%s'", name);
  80         free_string(name);
  81 }
  82
  83 void check_info_leak(int id)
  84 {
  85         if (option_project != PROJ_KERNEL)
  86                 return;
  87         my_id = id;
  88         add_function_assign_hook("kmalloc", &match_kmalloc, NULL);
  89         add_function_hook("strcpy", &match_strcpy, NULL);
  90         add_function_hook("strlcpy", &match_strcpy, NULL);
  91         add_function_hook("strlcat", &match_strcpy, NULL);
  92         add_function_hook("strncpy", &match_strcpy, NULL);
  93         add_function_hook("copy_to_user", &match_copy_to_user, NULL);
  94 }