2 * Copyright (C) 2011 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * There are a couple checks that try to see if a variable
20 * comes from the user. It would be better to unify them
21 * into one place. Also it we should follow the data down
22 * the call paths. Hence this file.
26 #include "smatch_slist.h"
27 #include "smatch_extra.h"
30 static int my_call_id
;
32 static struct expression
*ignore_clear
;
35 static unsigned long func_gets_user_data
;
42 const sval_t
*implies_start
, *implies_end
;
46 static struct user_fn_info func_table
[] = {
47 { "brcmf_fweh_dequeue_event", USER_DATA
, -1, "&$->emsg" },
48 { "cfg80211_find_elem_match", USER_DATA
, -1, "$" },
49 { "iov_iter_count", USER_DATA
, -1, "$" },
50 { "wilc_wlan_rxq_remove", USER_DATA
, -1, "$->buffer" },
51 { "cfg80211_find_vendor_ie", USER_DATA
, -1, "$" },
54 static const char *kstr_funcs
[] = {
55 "kstrtoull", "kstrtoll", "kstrtoul", "kstrtol", "kstrtouint",
56 "kstrtoint", "kstrtou64", "kstrtos64", "kstrtou32", "kstrtos32",
57 "kstrtou16", "kstrtos16", "kstrtou8", "kstrtos8", "kstrtoull_from_user"
58 "kstrtoll_from_user", "kstrtoul_from_user", "kstrtol_from_user",
59 "kstrtouint_from_user", "kstrtoint_from_user", "kstrtou16_from_user",
60 "kstrtos16_from_user", "kstrtou8_from_user", "kstrtos8_from_user",
61 "kstrtou64_from_user", "kstrtos64_from_user", "kstrtou32_from_user",
62 "kstrtos32_from_user",
65 static const char *returns_user_data
[] = {
66 "simple_strtol", "simple_strtoll", "simple_strtoul", "simple_strtoull",
67 "kvm_register_read", "xdr_inline_decode",
70 static struct smatch_state
*empty_state(struct sm_state
*sm
)
72 return alloc_estate_empty();
75 static struct smatch_state
*new_state(struct symbol
*type
)
77 struct smatch_state
*state
;
79 if (!type
|| type_is_ptr(type
))
82 state
= alloc_estate_whole(type
);
83 estate_set_new(state
);
87 static void pre_merge_hook(struct sm_state
*cur
, struct sm_state
*other
)
89 struct smatch_state
*user
= cur
->state
;
90 struct smatch_state
*extra
;
91 struct smatch_state
*state
;
92 struct range_list
*rl
;
94 extra
= __get_state(SMATCH_EXTRA
, cur
->name
, cur
->sym
);
97 rl
= rl_intersection(estate_rl(user
), estate_rl(extra
));
98 state
= alloc_estate_rl(clone_rl(rl
));
99 if (estate_capped(user
) || is_capped_var_sym(cur
->name
, cur
->sym
))
100 estate_set_capped(state
);
101 if (estate_treat_untagged(user
))
102 estate_set_treat_untagged(state
);
103 if (estates_equiv(state
, cur
->state
))
105 if (estate_new(cur
->state
))
106 estate_set_new(state
);
107 set_state(my_id
, cur
->name
, cur
->sym
, state
);
110 static void extra_nomod_hook(const char *name
, struct symbol
*sym
, struct expression
*expr
, struct smatch_state
*state
)
112 struct smatch_state
*user
, *new;
113 struct range_list
*rl
;
115 user
= __get_state(my_id
, name
, sym
);
118 rl
= rl_intersection(estate_rl(user
), estate_rl(state
));
119 if (rl_equiv(rl
, estate_rl(user
)))
121 new = alloc_estate_rl(rl
);
122 if (estate_capped(user
))
123 estate_set_capped(new);
124 if (estate_treat_untagged(user
))
125 estate_set_treat_untagged(new);
126 set_state(my_id
, name
, sym
, new);
129 static void store_type_info(struct expression
*expr
, struct smatch_state
*state
)
132 char *type_str
, *member
;
134 if (__in_fake_assign
)
137 if (!estate_rl(state
))
140 expr
= strip_expr(expr
);
141 if (!expr
|| expr
->type
!= EXPR_DEREF
|| !expr
->member
)
144 type
= get_type(expr
->deref
);
145 if (!type
|| !type
->ident
)
148 type_str
= type_to_str(type
);
151 member
= get_member_name(expr
);
155 sql_insert_function_type_info(USER_DATA
, type_str
, member
, state
->name
);
158 static void set_user_data(struct expression
*expr
, struct smatch_state
*state
)
160 store_type_info(expr
, state
);
161 set_state_expr(my_id
, expr
, state
);
164 static bool user_rl_known(struct expression
*expr
)
166 struct range_list
*rl
;
169 if (!get_user_rl(expr
, &rl
))
172 close_to_max
= sval_type_max(rl_type(rl
));
173 close_to_max
.value
-= 100;
175 if (sval_cmp(rl_max(rl
), close_to_max
) >= 0)
180 static bool is_array_index_mask_nospec(struct expression
*expr
)
182 struct expression
*orig
;
184 orig
= get_assigned_expr(expr
);
185 if (!orig
|| orig
->type
!= EXPR_CALL
)
187 return sym_name_is("array_index_mask_nospec", orig
->fn
);
190 static bool binop_capped(struct expression
*expr
)
192 struct range_list
*left_rl
;
196 if (expr
->op
== '-' && get_user_rl(expr
->left
, &left_rl
)) {
197 if (user_rl_capped(expr
->left
))
199 comparison
= get_comparison(expr
->left
, expr
->right
);
200 if (comparison
&& show_special(comparison
)[0] == '>')
205 if (expr
->op
== '&' || expr
->op
== '%') {
206 bool left_user
, left_capped
, right_user
, right_capped
;
208 if (!get_value(expr
->right
, &sval
) && is_capped(expr
->right
))
210 if (is_array_index_mask_nospec(expr
->right
))
212 if (is_capped(expr
->left
))
214 left_user
= is_user_rl(expr
->left
);
215 right_user
= is_user_rl(expr
->right
);
216 if (!left_user
&& !right_user
)
219 left_capped
= user_rl_capped(expr
->left
);
220 right_capped
= user_rl_capped(expr
->right
);
222 if (left_user
&& left_capped
) {
225 if (right_user
&& right_capped
)
229 if (right_user
&& right_capped
) {
238 * Generally "capped" means that we capped it to an unknown value.
239 * This is useful because if Smatch doesn't know what the value is then
240 * we have to trust that it is correct. But if we known cap value is
241 * 100 then we can check if 100 is correct and complain if it's wrong.
243 * So then the problem is with BINOP when we take a capped variable
244 * plus a user variable which is clamped to a known range (uncapped)
245 * the result should be capped.
247 if ((user_rl_capped(expr
->left
) || user_rl_known(expr
->left
)) &&
248 (user_rl_capped(expr
->right
) || user_rl_known(expr
->right
)))
254 bool user_rl_capped_var_sym(const char *name
, struct symbol
*sym
)
256 struct smatch_state
*state
;
258 state
= get_state(my_id
, name
, sym
);
260 return estate_capped(state
);
265 bool user_rl_capped(struct expression
*expr
)
267 struct smatch_state
*state
;
268 struct range_list
*rl
;
271 expr
= strip_expr(expr
);
274 if (get_value(expr
, &sval
))
276 if (expr
->type
== EXPR_BINOP
)
277 return binop_capped(expr
);
278 if ((expr
->type
== EXPR_PREOP
|| expr
->type
== EXPR_POSTOP
) &&
279 (expr
->op
== SPECIAL_INCREMENT
|| expr
->op
== SPECIAL_DECREMENT
))
280 return user_rl_capped(expr
->unop
);
281 state
= get_state_expr(my_id
, expr
);
283 return estate_capped(state
);
285 if (!get_user_rl(expr
, &rl
)) {
287 * The non user data parts of a binop are capped and
288 * also empty user rl states are capped.
293 if (rl_to_sval(rl
, &sval
))
296 return false; /* uncapped user data */
299 bool user_rl_treat_untagged(struct expression
*expr
)
301 struct smatch_state
*state
;
302 struct range_list
*rl
;
305 expr
= strip_expr(expr
);
308 if (get_value(expr
, &sval
))
311 state
= get_state_expr(my_id
, expr
);
313 return estate_treat_untagged(state
);
315 if (get_user_rl(expr
, &rl
))
316 return false; /* uncapped user data */
318 return true; /* not actually user data */
321 static void tag_inner_struct_members(struct expression
*expr
, struct symbol
*member
)
323 struct expression
*edge_member
;
324 struct symbol
*base
= get_real_base_type(member
);
328 expr
= member_expression(expr
, '.', member
->ident
);
330 FOR_EACH_PTR(base
->symbol_list
, tmp
) {
333 type
= get_real_base_type(tmp
);
337 if (type
->type
== SYM_UNION
|| type
->type
== SYM_STRUCT
) {
338 tag_inner_struct_members(expr
, tmp
);
345 edge_member
= member_expression(expr
, '.', tmp
->ident
);
346 set_user_data(edge_member
, new_state(type
));
347 } END_FOR_EACH_PTR(tmp
);
350 void __set_user_string(struct expression
*expr
);
351 static void tag_struct_members(struct symbol
*type
, struct expression
*expr
)
353 struct symbol
*tmp
, *member_type
;
354 struct expression
*member
;
357 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
358 expr
= strip_expr(expr
->unop
);
362 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
363 member_type
= get_real_base_type(tmp
);
367 if (member_type
->type
== SYM_UNION
||
368 member_type
->type
== SYM_STRUCT
) {
369 tag_inner_struct_members(expr
, tmp
);
376 member
= member_expression(expr
, op
, tmp
->ident
);
377 if (member_type
->type
== SYM_ARRAY
) {
378 set_points_to_user_data(member
, true);
380 set_user_data(member
, new_state(get_type(member
)));
382 } END_FOR_EACH_PTR(tmp
);
385 static void tag_base_type(struct expression
*expr
)
387 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
388 expr
= strip_expr(expr
->unop
);
390 expr
= deref_expression(expr
);
391 set_user_data(expr
, new_state(get_type(expr
)));
394 static void tag_as_user_data(struct expression
*expr
)
398 expr
= strip_expr(expr
);
400 type
= get_type(expr
);
401 if (!type
|| type
->type
!= SYM_PTR
)
403 type
= get_real_base_type(type
);
406 if (type
== &void_ctype
) {
407 set_user_data(deref_expression(expr
), new_state(&ulong_ctype
));
410 if (type
->type
== SYM_BASETYPE
) {
411 if (expr
->type
!= EXPR_PREOP
&& expr
->op
!= '&')
412 set_points_to_user_data(expr
, true);
416 if (type
->type
== SYM_STRUCT
|| type
->type
== SYM_UNION
) {
417 if (expr
->type
!= EXPR_PREOP
|| expr
->op
!= '&')
418 expr
= deref_expression(expr
);
420 set_user_data(deref_expression(expr
), new_state(&ulong_ctype
));
421 tag_struct_members(type
, expr
);
425 static void match_user_copy(const char *fn
, struct expression
*expr
, void *_param
)
427 int param
= PTR_INT(_param
);
428 struct expression
*dest
;
430 func_gets_user_data
= true;
433 dest
= get_argument_from_call_expr(expr
->args
, param
);
434 dest
= strip_expr(dest
);
437 tag_as_user_data(dest
);
440 static int is_dev_attr_name(struct expression
*expr
)
445 name
= expr_to_str(expr
);
448 if (strstr(name
, "->attr.name"))
454 static bool is_percent_n(struct expression
*expr
, int pos
)
461 if (expr
->type
!= EXPR_STRING
|| !expr
->string
)
464 p
= expr
->string
->data
;
467 (p
[0] == '%' && p
[1] == '%')) {
484 static void match_sscanf(const char *fn
, struct expression
*expr
, void *unused
)
486 struct expression
*str
, *format
, *arg
;
489 func_gets_user_data
= true;
491 str
= get_argument_from_call_expr(expr
->args
, 0);
492 if (is_dev_attr_name(str
))
495 format
= get_argument_from_call_expr(expr
->args
, 1);
496 if (is_dev_attr_name(format
))
500 FOR_EACH_PTR(expr
->args
, arg
) {
504 if (is_percent_n(format
, i
- 2))
506 tag_as_user_data(arg
);
507 } END_FOR_EACH_PTR(arg
);
510 static int get_rl_from_function(struct expression
*expr
, struct range_list
**rl
)
514 if (expr
->type
!= EXPR_CALL
|| expr
->fn
->type
!= EXPR_SYMBOL
||
515 !expr
->fn
->symbol_name
)
518 for (i
= 0; i
< ARRAY_SIZE(returns_user_data
); i
++) {
519 if (strcmp(expr
->fn
->symbol_name
->name
, returns_user_data
[i
]) == 0) {
520 *rl
= alloc_whole_rl(get_type(expr
));
527 static int comes_from_skb_data(struct expression
*expr
)
529 expr
= strip_expr(expr
);
530 if (!expr
|| expr
->type
!= EXPR_PREOP
|| expr
->op
!= '*')
533 expr
= strip_expr(expr
->unop
);
536 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+')
537 expr
= strip_expr(expr
->left
);
539 return is_skb_data(expr
);
542 static int handle_get_user(struct expression
*expr
)
547 name
= get_macro_name(expr
->pos
);
548 if (!name
|| strcmp(name
, "get_user") != 0)
551 name
= expr_to_var(expr
->right
);
552 if (!name
|| (strcmp(name
, "__val_gu") != 0 && strcmp(name
, "__gu_val") != 0))
554 set_user_data(expr
->left
, new_state(get_type(expr
->left
)));
561 static bool state_is_new(struct expression
*expr
)
563 struct smatch_state
*state
;
565 state
= get_state_expr(my_id
, expr
);
566 if (estate_new(state
))
569 if (expr
->type
== EXPR_BINOP
) {
570 if (state_is_new(expr
->left
))
572 if (state_is_new(expr
->right
))
578 static struct range_list
*strip_negatives(struct range_list
*rl
)
580 sval_t min
= rl_min(rl
);
581 sval_t minus_one
= { .type
= rl_type(rl
), .value
= -1 };
582 sval_t over
= { .type
= rl_type(rl
), .value
= INT_MAX
+ 1ULL };
583 sval_t max
= sval_type_max(rl_type(rl
));
588 if (type_unsigned(rl_type(rl
)) && type_bits(rl_type(rl
)) > 31)
589 return remove_range(rl
, over
, max
);
591 return remove_range(rl
, min
, minus_one
);
594 static bool handle_op_assign(struct expression
*expr
)
596 struct expression
*binop_expr
;
597 struct smatch_state
*state
;
598 struct range_list
*rl
;
601 case SPECIAL_ADD_ASSIGN
:
602 case SPECIAL_SUB_ASSIGN
:
603 case SPECIAL_AND_ASSIGN
:
604 case SPECIAL_MOD_ASSIGN
:
605 case SPECIAL_SHL_ASSIGN
:
606 case SPECIAL_SHR_ASSIGN
:
607 case SPECIAL_OR_ASSIGN
:
608 case SPECIAL_XOR_ASSIGN
:
609 case SPECIAL_MUL_ASSIGN
:
610 case SPECIAL_DIV_ASSIGN
:
611 binop_expr
= binop_expression(expr
->left
,
612 op_remove_assign(expr
->op
),
614 if (!get_user_rl(binop_expr
, &rl
))
617 rl
= cast_rl(get_type(expr
->left
), rl
);
618 state
= alloc_estate_rl(rl
);
619 if (expr
->op
== SPECIAL_AND_ASSIGN
||
620 expr
->op
== SPECIAL_MOD_ASSIGN
||
621 user_rl_capped(binop_expr
))
622 estate_set_capped(state
);
623 if (user_rl_treat_untagged(expr
->left
))
624 estate_set_treat_untagged(state
);
625 if (state_is_new(binop_expr
))
626 estate_set_new(state
);
627 estate_set_assigned(state
);
628 set_user_data(expr
->left
, state
);
634 static void handle_derefed_pointers(struct expression
*expr
, bool is_new
)
636 expr
= strip_expr(expr
);
637 if (expr
->type
!= EXPR_PREOP
||
640 expr
= strip_expr(expr
->unop
);
641 set_points_to_user_data(expr
, is_new
);
644 static void match_assign(struct expression
*expr
)
646 struct symbol
*left_type
, *right_type
;
647 struct range_list
*rl
= NULL
;
648 static struct expression
*handled
;
649 struct smatch_state
*state
;
650 struct expression
*faked
;
651 bool is_capped
= false;
654 left_type
= get_type(expr
->left
);
655 if (left_type
== &void_ctype
)
658 faked
= get_faked_expression();
659 if (faked
&& faked
== ignore_clear
)
662 /* FIXME: handle fake array assignments frob(&user_array[x]); */
665 faked
->type
== EXPR_ASSIGNMENT
&&
666 points_to_user_data(faked
->right
)) {
667 if (is_skb_data(faked
->right
))
668 func_gets_user_data
= true;
669 rl
= alloc_whole_rl(get_type(expr
->left
));
674 if (faked
&& faked
== handled
)
676 if (is_fake_call(expr
->right
))
677 goto clear_old_state
;
678 if (handle_get_user(expr
))
680 if (points_to_user_data(expr
->right
) &&
681 is_struct_ptr(get_type(expr
->left
))) {
683 // This should be handled by smatch_points_to_user_data.c
684 // set_points_to_user_data(expr->left);
687 if (handle_op_assign(expr
))
690 goto clear_old_state
;
692 /* Handled by DB code */
693 if (expr
->right
->type
== EXPR_CALL
)
697 disable_type_val_lookups();
698 get_user_rl(expr
->right
, &rl
);
700 enable_type_val_lookups();
702 goto clear_old_state
;
704 is_capped
= user_rl_capped(expr
->right
);
705 is_new
= state_is_new(expr
->right
);
708 right_type
= get_type(expr
->right
);
709 if (type_is_ptr(left_type
)) {
710 if (right_type
&& right_type
->type
== SYM_ARRAY
)
711 set_points_to_user_data(expr
->left
, is_new
);
715 rl
= cast_rl(left_type
, rl
);
716 if (is_capped
&& type_unsigned(right_type
) && type_signed(left_type
))
717 rl
= strip_negatives(rl
);
718 state
= alloc_estate_rl(rl
);
720 estate_set_new(state
);
722 estate_set_capped(state
);
723 if (user_rl_treat_untagged(expr
->right
))
724 estate_set_treat_untagged(state
);
725 estate_set_assigned(state
);
727 set_user_data(expr
->left
, state
);
728 handle_derefed_pointers(expr
->left
, is_new
);
734 * HACK ALERT!!! This should be at the start of the function. The
735 * the problem is that handling "pointer = array;" assignments is
736 * handled in this function instead of in kernel_points_to_user_data.c.
738 if (type_is_ptr(left_type
))
741 if (get_state_expr(my_id
, expr
->left
))
742 set_user_data(expr
->left
, alloc_estate_empty());
745 static void handle_eq_noteq(struct expression
*expr
)
747 struct smatch_state
*left_orig
, *right_orig
;
749 left_orig
= get_state_expr(my_id
, expr
->left
);
750 right_orig
= get_state_expr(my_id
, expr
->right
);
752 if (!left_orig
&& !right_orig
)
754 if (left_orig
&& right_orig
)
758 set_true_false_states_expr(my_id
, expr
->left
,
759 expr
->op
== SPECIAL_EQUAL
? alloc_estate_empty() : NULL
,
760 expr
->op
== SPECIAL_EQUAL
? NULL
: alloc_estate_empty());
762 set_true_false_states_expr(my_id
, expr
->right
,
763 expr
->op
== SPECIAL_EQUAL
? alloc_estate_empty() : NULL
,
764 expr
->op
== SPECIAL_EQUAL
? NULL
: alloc_estate_empty());
768 static void handle_compare(struct expression
*expr
)
770 struct expression
*left
, *right
;
771 struct range_list
*left_rl
= NULL
;
772 struct range_list
*right_rl
= NULL
;
773 struct range_list
*user_rl
;
774 struct smatch_state
*capped_state
;
775 struct smatch_state
*left_true
= NULL
;
776 struct smatch_state
*left_false
= NULL
;
777 struct smatch_state
*right_true
= NULL
;
778 struct smatch_state
*right_false
= NULL
;
782 left
= strip_expr(expr
->left
);
783 right
= strip_expr(expr
->right
);
785 while (left
->type
== EXPR_ASSIGNMENT
)
786 left
= strip_expr(left
->left
);
789 * Conditions are mostly handled by smatch_extra.c, but there are some
790 * times where the exact values are not known so we can't do that.
792 * Normally, we might consider using smatch_capped.c to supliment smatch
793 * extra but that doesn't work when we merge unknown uncapped kernel
794 * data with unknown capped user data. The result is uncapped user
795 * data. We need to keep it separate and say that the user data is
796 * capped. In the past, I would have marked this as just regular
797 * kernel data (not user data) but we can't do that these days because
798 * we need to track user data for Spectre.
800 * The other situation which we have to handle is when we do have an
801 * int and we compare against an unknown unsigned kernel variable. In
802 * that situation we assume that the kernel data is less than INT_MAX.
803 * Otherwise then we get all sorts of array underflow false positives.
807 /* Handled in smatch_extra.c */
808 if (get_implied_value(left
, &sval
) ||
809 get_implied_value(right
, &sval
))
812 get_user_rl(left
, &left_rl
);
813 get_user_rl(right
, &right_rl
);
816 if (!left_rl
&& !right_rl
)
818 /* if both sides are user data that's not a good limit */
819 if (left_rl
&& right_rl
)
827 type
= get_type(expr
);
828 if (type_unsigned(type
))
829 user_rl
= strip_negatives(user_rl
);
830 capped_state
= alloc_estate_rl(user_rl
);
831 estate_set_capped(capped_state
);
835 case SPECIAL_UNSIGNED_LT
:
837 case SPECIAL_UNSIGNED_LTE
:
839 left_true
= capped_state
;
841 right_false
= capped_state
;
844 case SPECIAL_UNSIGNED_GT
:
846 case SPECIAL_UNSIGNED_GTE
:
848 left_false
= capped_state
;
850 right_true
= capped_state
;
854 set_true_false_states_expr(my_id
, left
, left_true
, left_false
);
855 set_true_false_states_expr(my_id
, right
, right_true
, right_false
);
858 static void match_condition(struct expression
*expr
)
860 if (expr
->type
!= EXPR_COMPARE
)
863 if (expr
->op
== SPECIAL_EQUAL
||
864 expr
->op
== SPECIAL_NOTEQUAL
) {
865 handle_eq_noteq(expr
);
869 handle_compare(expr
);
872 static void match_returns_user_rl(const char *fn
, struct expression
*expr
, void *unused
)
874 func_gets_user_data
= true;
877 static int get_user_macro_rl(struct expression
*expr
, struct range_list
**rl
)
879 struct expression
*parent
;
885 macro
= get_macro_name(expr
->pos
);
889 /* handle ntohl(foo[i]) where "i" is trusted */
890 parent
= expr_get_parent_expr(expr
);
891 while (parent
&& parent
->type
!= EXPR_BINOP
)
892 parent
= expr_get_parent_expr(parent
);
893 if (parent
&& parent
->type
== EXPR_BINOP
) {
894 char *parent_macro
= get_macro_name(parent
->pos
);
896 if (parent_macro
&& strcmp(macro
, parent_macro
) == 0)
900 if (strcmp(macro
, "ntohl") == 0) {
901 *rl
= alloc_whole_rl(&uint_ctype
);
904 if (strcmp(macro
, "ntohs") == 0) {
905 *rl
= alloc_whole_rl(&ushort_ctype
);
911 static int has_user_data(struct symbol
*sym
)
913 struct sm_state
*tmp
;
915 FOR_EACH_MY_SM(my_id
, __get_cur_stree(), tmp
) {
918 } END_FOR_EACH_SM(tmp
);
922 bool we_pass_user_data(struct expression
*call
)
924 struct expression
*arg
;
927 FOR_EACH_PTR(call
->args
, arg
) {
928 if (points_to_user_data(arg
))
930 sym
= expr_to_sym(arg
);
933 if (has_user_data(sym
))
935 } END_FOR_EACH_PTR(arg
);
940 // TODO: faked_assign this should already be handled
941 static int db_returned_user_rl(struct expression
*call
, struct range_list
**rl
)
943 struct smatch_state
*state
;
946 if (is_fake_call(call
))
948 snprintf(buf
, sizeof(buf
), "return %p", call
);
949 state
= get_state(my_id
, buf
, NULL
);
950 if (!state
|| !estate_rl(state
))
952 *rl
= estate_rl(state
);
956 struct stree
*get_user_stree(void)
958 return get_all_states_stree(my_id
);
961 static struct int_stack
*user_data_flags
, *no_user_data_flags
;
963 static void set_flag(struct int_stack
**stack
)
967 num
= pop_int(stack
);
969 push_int(stack
, num
);
972 struct range_list
*var_user_rl(struct expression
*expr
)
974 struct smatch_state
*state
;
975 struct range_list
*rl
;
976 struct range_list
*absolute_rl
;
978 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
979 set_flag(&no_user_data_flags
);
983 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '%') {
984 struct range_list
*left
, *right
;
986 if (!get_user_rl(expr
->right
, &right
))
988 get_absolute_rl(expr
->left
, &left
);
989 rl
= rl_binop(left
, '%', right
);
993 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '/') {
994 struct range_list
*left
= NULL
;
995 struct range_list
*right
= NULL
;
996 struct range_list
*abs_right
;
999 * The specific bug I'm dealing with is:
1001 * foo = capped_user / unknown;
1003 * Instead of just saying foo is now entirely user_rl we should
1004 * probably say instead that it is not at all user data.
1008 get_user_rl(expr
->left
, &left
);
1009 get_user_rl(expr
->right
, &right
);
1010 get_absolute_rl(expr
->right
, &abs_right
);
1012 if (left
&& !right
) {
1013 rl
= rl_binop(left
, '/', abs_right
);
1014 if (sval_cmp(rl_max(left
), rl_max(rl
)) < 0)
1015 set_flag(&no_user_data_flags
);
1021 if (get_rl_from_function(expr
, &rl
))
1024 if (get_user_macro_rl(expr
, &rl
))
1027 if (comes_from_skb_data(expr
)) {
1028 rl
= alloc_whole_rl(get_type(expr
));
1032 state
= get_state_expr(my_id
, expr
);
1033 if (state
&& estate_rl(state
)) {
1034 rl
= estate_rl(state
);
1038 if (expr
->type
== EXPR_CALL
&& db_returned_user_rl(expr
, &rl
))
1041 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '*' &&
1042 points_to_user_data(expr
->unop
)) {
1043 rl
= var_to_absolute_rl(expr
);
1047 if (is_array(expr
)) {
1048 struct expression
*array
= get_array_base(expr
);
1050 if (!get_state_expr(my_id
, array
)) {
1051 set_flag(&no_user_data_flags
);
1058 set_flag(&user_data_flags
);
1059 absolute_rl
= var_to_absolute_rl(expr
);
1060 return rl_intersection(rl
, absolute_rl
);
1063 static bool is_ptr_subtract(struct expression
*expr
)
1065 expr
= strip_expr(expr
);
1068 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '-' &&
1069 type_is_ptr(get_type(expr
->left
))) {
1075 int get_user_rl(struct expression
*expr
, struct range_list
**rl
)
1077 int user_data
, no_user_data
;
1079 if (is_ptr_subtract(expr
))
1082 push_int(&user_data_flags
, 0);
1083 push_int(&no_user_data_flags
, 0);
1085 custom_get_absolute_rl(expr
, &var_user_rl
, rl
);
1087 user_data
= pop_int(&user_data_flags
);
1088 no_user_data
= pop_int(&no_user_data_flags
);
1090 if (!user_data
|| no_user_data
)
1096 int is_user_rl(struct expression
*expr
)
1098 struct range_list
*tmp
;
1100 return get_user_rl(expr
, &tmp
) && tmp
;
1103 int get_user_rl_var_sym(const char *name
, struct symbol
*sym
, struct range_list
**rl
)
1105 struct smatch_state
*state
, *extra
;
1107 state
= get_state(my_id
, name
, sym
);
1108 if (!estate_rl(state
))
1110 *rl
= estate_rl(state
);
1112 extra
= get_state(SMATCH_EXTRA
, name
, sym
);
1113 if (estate_rl(extra
))
1114 *rl
= rl_intersection(estate_rl(state
), estate_rl(extra
));
1119 bool is_socket_stuff(struct symbol
*sym
)
1121 struct symbol
*type
;
1124 * Basically I never want to consider an skb or sk as user pointer.
1125 * The skb->data is already marked as a source of user data, and if
1126 * anything else is marked as user data it's almost certainly wrong.
1128 * Ideally, I would figure out where this bogus data is coming from,
1129 * but possibly it just was stuck in the database from previous updates
1130 * and can't get cleared out without deleting all user data. Things
1131 * like this gets stuck in the DB because of recursion.
1133 * I could make this a temporary hack, but I keep wanting to do it so
1134 * I'm just going to make it permanent. It either doesn't change
1135 * anything or it makes life better.
1138 type
= get_real_base_type(sym
);
1139 if (!type
|| type
->type
!= SYM_PTR
)
1141 type
= get_real_base_type(type
);
1142 if (!type
|| type
->type
!= SYM_STRUCT
|| !type
->ident
)
1145 if (strcmp(type
->ident
->name
, "sk_buff") == 0)
1147 if (strcmp(type
->ident
->name
, "sock") == 0)
1149 if (strcmp(type
->ident
->name
, "socket") == 0)
1155 static void return_info_callback(int return_id
, char *return_ranges
,
1156 struct expression
*returned_expr
,
1158 const char *printed_name
,
1159 struct sm_state
*sm
)
1161 struct smatch_state
*extra
;
1162 struct range_list
*rl
;
1165 if (is_socket_stuff(sm
->sym
))
1167 if (is_ignored_kernel_data(printed_name
))
1171 if (strcmp(printed_name
, "$") == 0)
1173 if (!estate_assigned(sm
->state
) &&
1174 !estate_new(sm
->state
))
1177 rl
= estate_rl(sm
->state
);
1180 extra
= get_state(SMATCH_EXTRA
, sm
->name
, sm
->sym
);
1181 if (estate_rl(extra
))
1182 rl
= rl_intersection(estate_rl(sm
->state
), estate_rl(extra
));
1186 snprintf(buf
, sizeof(buf
), "%s%s%s",
1188 estate_capped(sm
->state
) ? "[c]" : "",
1189 estate_treat_untagged(sm
->state
) ? "[u]" : "");
1190 sql_insert_return_states(return_id
, return_ranges
,
1191 estate_new(sm
->state
) ? USER_DATA_SET
: USER_DATA
,
1192 param
, printed_name
, buf
);
1195 static bool is_ignored_macro(struct position pos
)
1199 macro
= get_macro_name(pos
);
1202 if (strcmp(macro
, "v4l2_subdev_call") == 0)
1207 static void caller_info_callback(struct expression
*call
, int param
, char *printed_name
, struct sm_state
*sm
)
1209 struct smatch_state
*state
;
1210 struct range_list
*rl
;
1211 struct symbol
*type
;
1214 if (is_ignored_macro(call
->pos
))
1217 if (is_socket_stuff(sm
->sym
))
1219 if (is_ignored_kernel_data(printed_name
))
1223 * Smatch uses a hack where if we get an unsigned long we say it's
1224 * both user data and it points to user data. But if we pass it to a
1225 * function which takes an int, then it's just user data. There's not
1226 * enough bytes for it to be a pointer.
1229 type
= get_arg_type(call
->fn
, param
);
1230 if (strcmp(printed_name
, "$") != 0 && type
&& type_bits(type
) < type_bits(&ptr_ctype
))
1233 if (strcmp(sm
->state
->name
, "") == 0)
1236 state
= __get_state(SMATCH_EXTRA
, sm
->name
, sm
->sym
);
1237 if (!state
|| !estate_rl(state
))
1238 rl
= estate_rl(sm
->state
);
1240 rl
= rl_intersection(estate_rl(sm
->state
), estate_rl(state
));
1245 snprintf(buf
, sizeof(buf
), "%s%s%s", show_rl(rl
),
1246 estate_capped(sm
->state
) ? "[c]" : "",
1247 estate_treat_untagged(sm
->state
) ? "[u]" : "");
1248 sql_insert_caller_info(call
, USER_DATA
, param
, printed_name
, buf
);
1251 static void db_param_set(struct expression
*expr
, int param
, char *key
, char *value
)
1253 struct expression
*arg
;
1256 struct smatch_state
*state
;
1258 while (expr
->type
== EXPR_ASSIGNMENT
)
1259 expr
= strip_expr(expr
->right
);
1260 if (expr
->type
!= EXPR_CALL
)
1262 if (expr
== ignore_clear
)
1265 arg
= get_argument_from_call_expr(expr
->args
, param
);
1268 name
= get_variable_from_key(arg
, key
, &sym
);
1272 state
= get_state(my_id
, name
, sym
);
1276 set_state(my_id
, name
, sym
, alloc_estate_empty());
1281 static bool param_data_capped(const char *value
)
1283 if (strstr(value
, ",c") || strstr(value
, "[c"))
1288 static bool param_data_treat_untagged(const char *value
)
1290 if (strstr(value
, ",u") || strstr(value
, "[u"))
1295 static void set_param_user_data(const char *name
, struct symbol
*sym
, char *key
, char *value
)
1297 struct expression
*expr
;
1298 struct range_list
*rl
= NULL
;
1299 struct smatch_state
*state
;
1300 struct symbol
*type
;
1303 expr
= symbol_expression(sym
);
1304 fullname
= get_variable_from_key(expr
, key
, NULL
);
1308 type
= get_member_type_from_key(expr
, key
);
1309 if (type
&& type
->type
== SYM_STRUCT
)
1315 str_to_rl(type
, value
, &rl
);
1316 rl
= swap_mtag_seed(expr
, rl
);
1317 state
= alloc_estate_rl(rl
);
1318 if (param_data_capped(value
) || is_capped(expr
))
1319 estate_set_capped(state
);
1320 if (param_data_treat_untagged(value
) || sym
->ctype
.as
== 5)
1321 estate_set_treat_untagged(state
);
1322 set_state(my_id
, fullname
, sym
, state
);
1325 static void set_called(const char *name
, struct symbol
*sym
, char *key
, char *value
)
1327 set_state(my_call_id
, "this_function", NULL
, &called
);
1330 static void match_syscall_definition(struct symbol
*sym
)
1337 macro
= get_macro_name(sym
->pos
);
1339 (strncmp("SYSCALL_DEFINE", macro
, strlen("SYSCALL_DEFINE")) == 0 ||
1340 strncmp("COMPAT_SYSCALL_DEFINE", macro
, strlen("COMPAT_SYSCALL_DEFINE")) == 0))
1343 name
= get_function();
1344 if (!option_no_db
&& get_state(my_call_id
, "this_function", NULL
) != &called
) {
1345 if (name
&& strncmp(name
, "sys_", 4) == 0)
1349 if (name
&& strncmp(name
, "compat_sys_", 11) == 0)
1355 FOR_EACH_PTR(sym
->ctype
.base_type
->arguments
, arg
) {
1356 set_state(my_id
, arg
->ident
->name
, arg
, alloc_estate_whole(get_real_base_type(arg
)));
1357 } END_FOR_EACH_PTR(arg
);
1363 static void store_user_data_return(struct expression
*expr
, char *key
, char *value
, bool is_new
)
1365 struct smatch_state
*state
;
1366 struct range_list
*rl
;
1367 struct symbol
*type
;
1373 type
= get_type(expr
);
1374 snprintf(buf
, sizeof(buf
), "return %p%s", expr
, key
+ 1);
1375 call_results_to_rl(expr
, type
, value
, &rl
);
1377 state
= alloc_estate_rl(rl
);
1379 estate_set_new(state
);
1381 set_state(my_id
, buf
, NULL
, state
);
1384 static void set_to_user_data(struct expression
*expr
, char *key
, char *value
, bool is_new
)
1386 struct smatch_state
*state
;
1389 struct symbol
*type
;
1390 struct range_list
*rl
= NULL
;
1392 type
= get_member_type_from_key(expr
, key
);
1393 name
= get_variable_from_key(expr
, key
, &sym
);
1397 call_results_to_rl(expr
, type
, value
, &rl
);
1399 state
= alloc_estate_rl(rl
);
1400 if (param_data_capped(value
))
1401 estate_set_capped(state
);
1402 if (param_data_treat_untagged(value
))
1403 estate_set_treat_untagged(state
);
1405 estate_set_new(state
);
1406 estate_set_assigned(state
);
1407 set_state(my_id
, name
, sym
, state
);
1412 static void returns_param_user_data(struct expression
*expr
, int param
, char *key
, char *value
)
1414 struct expression
*arg
;
1415 struct expression
*call
;
1418 while (call
->type
== EXPR_ASSIGNMENT
)
1419 call
= strip_expr(call
->right
);
1420 if (call
->type
!= EXPR_CALL
)
1423 if (!we_pass_user_data(call
))
1427 if (expr
->type
!= EXPR_ASSIGNMENT
) {
1428 // TODO: faked_assign this should all be handled as a fake assignment
1429 store_user_data_return(expr
, key
, value
, OLD
);
1432 set_to_user_data(expr
->left
, key
, value
, OLD
);
1436 arg
= get_argument_from_call_expr(call
->args
, param
);
1439 set_to_user_data(arg
, key
, value
, OLD
);
1442 static void returns_param_user_data_set(struct expression
*expr
, int param
, char *key
, char *value
)
1444 struct expression
*arg
;
1446 func_gets_user_data
= true;
1449 if (expr
->type
!= EXPR_ASSIGNMENT
) {
1450 store_user_data_return(expr
, key
, value
, NEW
);
1453 set_to_user_data(expr
->left
, key
, value
, NEW
);
1457 while (expr
->type
== EXPR_ASSIGNMENT
)
1458 expr
= strip_expr(expr
->right
);
1459 if (expr
->type
!= EXPR_CALL
)
1462 arg
= get_argument_from_call_expr(expr
->args
, param
);
1465 set_to_user_data(arg
, key
, value
, NEW
);
1468 static void set_param_key_user_data(struct expression
*expr
, const char *name
,
1469 struct symbol
*sym
, void *data
)
1471 struct expression
*arg
;
1472 struct symbol
*type
;
1474 func_gets_user_data
= true;
1475 arg
= gen_expression_from_name_sym(name
, sym
);
1476 type
= get_type(arg
);
1477 if (type_is_ptr(type
))
1478 tag_as_user_data(arg
);
1480 set_state_expr(my_id
, arg
, alloc_estate_whole(type
));
1483 static void match_capped(struct expression
*expr
, const char *name
, struct symbol
*sym
, void *info
)
1485 struct smatch_state
*state
, *new;
1487 state
= get_state(my_id
, name
, sym
);
1488 if (!state
|| estate_capped(state
))
1491 new = clone_estate(state
);
1492 estate_set_capped(new);
1494 set_state(my_id
, name
, sym
, new);
1497 static void match_function_def(struct symbol
*sym
)
1499 if (is_user_data_fn(sym
))
1500 func_gets_user_data
= true;
1503 void register_kernel_user_data(int id
)
1505 struct user_fn_info
*info
;
1510 if (option_project
!= PROJ_KERNEL
)
1513 set_dynamic_states(my_id
);
1515 add_function_data(&func_gets_user_data
);
1516 add_hook(&match_function_def
, FUNC_DEF_HOOK
);
1518 add_unmatched_state_hook(my_id
, &empty_state
);
1519 add_extra_nomod_hook(&extra_nomod_hook
);
1520 add_pre_merge_hook(my_id
, &pre_merge_hook
);
1521 add_merge_hook(my_id
, &merge_estates
);
1523 add_function_hook("copy_from_user", &match_user_copy
, INT_PTR(0));
1524 add_function_hook("__copy_from_user", &match_user_copy
, INT_PTR(0));
1525 add_function_hook("memcpy_fromiovec", &match_user_copy
, INT_PTR(0));
1526 for (i
= 0; i
< ARRAY_SIZE(kstr_funcs
); i
++)
1527 add_function_hook_late(kstr_funcs
[i
], &match_user_copy
, INT_PTR(2));
1528 add_function_hook("usb_control_msg", &match_user_copy
, INT_PTR(6));
1529 add_function_hook("kvm_read_guest_virt", &match_user_copy
, INT_PTR(2));
1530 add_function_hook("vpu_iface_receive_msg", &match_user_copy
, INT_PTR(1));
1531 add_function_hook("xdr_stream_decode_u32", &match_user_copy
, INT_PTR(1));
1533 for (i
= 0; i
< ARRAY_SIZE(returns_user_data
); i
++)
1534 add_function_hook(returns_user_data
[i
], &match_returns_user_rl
, NULL
);
1536 add_function_hook("sscanf", &match_sscanf
, NULL
);
1538 add_hook(&match_syscall_definition
, AFTER_DEF_HOOK
);
1540 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
1541 select_return_states_hook(PARAM_SET
, &db_param_set
);
1542 add_hook(&match_condition
, CONDITION_HOOK
);
1544 add_caller_info_callback(my_id
, caller_info_callback
);
1545 add_return_info_callback(my_id
, return_info_callback
);
1546 select_caller_info_hook(set_param_user_data
, USER_DATA
);
1547 select_return_states_hook(USER_DATA
, &returns_param_user_data
);
1548 select_return_states_hook(USER_DATA_SET
, &returns_param_user_data_set
);
1550 select_return_param_key(CAPPED_DATA
, &match_capped
);
1551 add_function_param_key_hook_late("memcpy", &match_capped
, 2, "$", NULL
);
1552 add_function_param_key_hook_late("_memcpy", &match_capped
, 2, "$", NULL
);
1553 add_function_param_key_hook_late("__memcpy", &match_capped
, 2, "$", NULL
);
1554 add_function_param_key_hook_late("memset", &match_capped
, 2, "$", NULL
);
1555 add_function_param_key_hook_late("_memset", &match_capped
, 2, "$", NULL
);
1556 add_function_param_key_hook_late("__memset", &match_capped
, 2, "$", NULL
);
1558 for (i
= 0; i
< ARRAY_SIZE(func_table
); i
++) {
1559 info
= &func_table
[i
];
1560 add_function_param_key_hook_late(info
->name
, &set_param_key_user_data
,
1561 info
->param
, info
->key
, info
);
1565 void register_kernel_user_data2(int id
)
1569 if (option_project
!= PROJ_KERNEL
)
1571 select_caller_info_hook(set_called
, INTERNAL
);