1 /*
2 * Copyright (C) 2010 Dan Carpenter.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 #include "smatch.h"
19 #include "smatch_slist.h"
20
21 static int my_id;
22
23 STATE(alloced);
24 STATE(string);
25
my_get_variable(struct expression * expr,struct symbol ** sym)26 static char *my_get_variable(struct expression *expr, struct symbol **sym)
27 {
28 char *name;
29
30 name = expr_to_var_sym(expr, sym);
31 free_string(name);
32 if (!name || !*sym)
33 return NULL;
34
35 return (*sym)->ident->name;
36 }
37
match_kmalloc(const char * fn,struct expression * expr,void * unused)38 static void match_kmalloc(const char *fn, struct expression *expr, void *unused)
39 {
40 char *name;
41 struct symbol *sym;
42
43 name = my_get_variable(expr->left, &sym);
44 if (!name)
45 return;
46 set_state(my_id, name, sym, &alloced);
47 }
48
match_strcpy(const char * fn,struct expression * expr,void * unused)49 static void match_strcpy(const char *fn, struct expression *expr, void *unused)
50 {
51 struct expression *dest;
52 char *name;
53 struct symbol *sym;
54
55 dest = get_argument_from_call_expr(expr->args, 0);
56 name = my_get_variable(dest, &sym);
57 if (!name || !sym)
58 return;
59 if (!get_state(my_id, name, sym))
60 return;
61 set_state(my_id, name, sym, &string);
62 }
63
match_copy_to_user(const char * fn,struct expression * expr,void * unused)64 static void match_copy_to_user(const char *fn, struct expression *expr, void *unused)
65 {
66 struct expression *src;
67 char *name;
68 struct symbol *sym;
69 struct sm_state *sm;
70
71 src = get_argument_from_call_expr(expr->args, 1);
72 name = my_get_variable(src, &sym);
73 if (!name || !sym)
74 return;
75 sm = get_sm_state(my_id, name, sym);
76 if (!sm || !slist_has_state(sm->possible, &string))
77 return;
78 name = expr_to_var(src);
79 sm_warning("possible info leak '%s'", name);
80 free_string(name);
81 }
82
check_info_leak(int id)83 void check_info_leak(int id)
84 {
85 if (option_project != PROJ_KERNEL)
86 return;
87 my_id = id;
88 add_function_assign_hook("kmalloc", &match_kmalloc, NULL);
89 add_function_hook("strcpy", &match_strcpy, NULL);
90 add_function_hook("strlcpy", &match_strcpy, NULL);
91 add_function_hook("strlcat", &match_strcpy, NULL);
92 add_function_hook("strncpy", &match_strcpy, NULL);
93 add_function_hook("copy_to_user", &match_copy_to_user, NULL);
94 }
95