11f5207b7SJohn Levon /*
21f5207b7SJohn Levon * Copyright (C) 2011 Dan Carpenter.
31f5207b7SJohn Levon *
41f5207b7SJohn Levon * This program is free software; you can redistribute it and/or
51f5207b7SJohn Levon * modify it under the terms of the GNU General Public License
61f5207b7SJohn Levon * as published by the Free Software Foundation; either version 2
71f5207b7SJohn Levon * of the License, or (at your option) any later version.
81f5207b7SJohn Levon *
91f5207b7SJohn Levon * This program is distributed in the hope that it will be useful,
101f5207b7SJohn Levon * but WITHOUT ANY WARRANTY; without even the implied warranty of
111f5207b7SJohn Levon * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
121f5207b7SJohn Levon * GNU General Public License for more details.
131f5207b7SJohn Levon *
141f5207b7SJohn Levon * You should have received a copy of the GNU General Public License
151f5207b7SJohn Levon * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
161f5207b7SJohn Levon */
171f5207b7SJohn Levon
181f5207b7SJohn Levon /*
191f5207b7SJohn Levon * There are a couple checks that try to see if a variable
201f5207b7SJohn Levon * comes from the user. It would be better to unify them
211f5207b7SJohn Levon * into one place. Also it we should follow the data down
221f5207b7SJohn Levon * the call paths. Hence this file.
231f5207b7SJohn Levon */
241f5207b7SJohn Levon
251f5207b7SJohn Levon #include "smatch.h"
261f5207b7SJohn Levon #include "smatch_slist.h"
271f5207b7SJohn Levon #include "smatch_extra.h"
281f5207b7SJohn Levon
291f5207b7SJohn Levon static int my_id;
301f5207b7SJohn Levon static int my_call_id;
311f5207b7SJohn Levon
321f5207b7SJohn Levon STATE(called);
331f5207b7SJohn Levon static bool func_gets_user_data;
341f5207b7SJohn Levon
35efe51d0cSJohn Levon static const char *kstr_funcs[] = {
361f5207b7SJohn Levon "kstrtoull", "kstrtoll", "kstrtoul", "kstrtol", "kstrtouint",
371f5207b7SJohn Levon "kstrtoint", "kstrtou64", "kstrtos64", "kstrtou32", "kstrtos32",
381f5207b7SJohn Levon "kstrtou16", "kstrtos16", "kstrtou8", "kstrtos8", "kstrtoull_from_user"
391f5207b7SJohn Levon "kstrtoll_from_user", "kstrtoul_from_user", "kstrtol_from_user",
401f5207b7SJohn Levon "kstrtouint_from_user", "kstrtoint_from_user", "kstrtou16_from_user",
411f5207b7SJohn Levon "kstrtos16_from_user", "kstrtou8_from_user", "kstrtos8_from_user",
421f5207b7SJohn Levon "kstrtou64_from_user", "kstrtos64_from_user", "kstrtou32_from_user",
431f5207b7SJohn Levon "kstrtos32_from_user",
441f5207b7SJohn Levon };
451f5207b7SJohn Levon
461f5207b7SJohn Levon static const char *returns_user_data[] = {
471f5207b7SJohn Levon "simple_strtol", "simple_strtoll", "simple_strtoul", "simple_strtoull",
48efe51d0cSJohn Levon "kvm_register_read",
49efe51d0cSJohn Levon };
50efe51d0cSJohn Levon
51efe51d0cSJohn Levon static const char *returns_pointer_to_user_data[] = {
52efe51d0cSJohn Levon "nlmsg_data", "nla_data", "memdup_user", "kmap_atomic", "skb_network_header",
531f5207b7SJohn Levon };
541f5207b7SJohn Levon
551f5207b7SJohn Levon static void set_points_to_user_data(struct expression *expr);
561f5207b7SJohn Levon
571f5207b7SJohn Levon static struct stree *start_states;
581f5207b7SJohn Levon static struct stree_stack *saved_stack;
save_start_states(struct statement * stmt)591f5207b7SJohn Levon static void save_start_states(struct statement *stmt)
601f5207b7SJohn Levon {
611f5207b7SJohn Levon start_states = clone_stree(__get_cur_stree());
621f5207b7SJohn Levon }
631f5207b7SJohn Levon
free_start_states(void)641f5207b7SJohn Levon static void free_start_states(void)
651f5207b7SJohn Levon {
661f5207b7SJohn Levon free_stree(&start_states);
671f5207b7SJohn Levon }
681f5207b7SJohn Levon
match_save_states(struct expression * expr)691f5207b7SJohn Levon static void match_save_states(struct expression *expr)
701f5207b7SJohn Levon {
711f5207b7SJohn Levon push_stree(&saved_stack, start_states);
721f5207b7SJohn Levon start_states = NULL;
731f5207b7SJohn Levon }
741f5207b7SJohn Levon
match_restore_states(struct expression * expr)751f5207b7SJohn Levon static void match_restore_states(struct expression *expr)
761f5207b7SJohn Levon {
771f5207b7SJohn Levon free_stree(&start_states);
781f5207b7SJohn Levon start_states = pop_stree(&saved_stack);
791f5207b7SJohn Levon }
801f5207b7SJohn Levon
empty_state(struct sm_state * sm)811f5207b7SJohn Levon static struct smatch_state *empty_state(struct sm_state *sm)
821f5207b7SJohn Levon {
831f5207b7SJohn Levon return alloc_estate_empty();
841f5207b7SJohn Levon }
851f5207b7SJohn Levon
pre_merge_hook(struct sm_state * cur,struct sm_state * other)86c85f09ccSJohn Levon static void pre_merge_hook(struct sm_state *cur, struct sm_state *other)
871f5207b7SJohn Levon {
88c85f09ccSJohn Levon struct smatch_state *user = cur->state;
891f5207b7SJohn Levon struct smatch_state *extra;
90efe51d0cSJohn Levon struct smatch_state *state;
911f5207b7SJohn Levon struct range_list *rl;
921f5207b7SJohn Levon
93c85f09ccSJohn Levon extra = __get_state(SMATCH_EXTRA, cur->name, cur->sym);
94efe51d0cSJohn Levon if (!extra)
951f5207b7SJohn Levon return;
961f5207b7SJohn Levon rl = rl_intersection(estate_rl(user), estate_rl(extra));
97efe51d0cSJohn Levon state = alloc_estate_rl(clone_rl(rl));
98c85f09ccSJohn Levon if (estate_capped(user) || is_capped_var_sym(cur->name, cur->sym))
99efe51d0cSJohn Levon estate_set_capped(state);
100c85f09ccSJohn Levon if (estate_treat_untagged(user))
101c85f09ccSJohn Levon estate_set_treat_untagged(state);
102c85f09ccSJohn Levon set_state(my_id, cur->name, cur->sym, state);
1031f5207b7SJohn Levon }
1041f5207b7SJohn Levon
extra_nomod_hook(const char * name,struct symbol * sym,struct expression * expr,struct smatch_state * state)1051f5207b7SJohn Levon static void extra_nomod_hook(const char *name, struct symbol *sym, struct expression *expr, struct smatch_state *state)
1061f5207b7SJohn Levon {
107efe51d0cSJohn Levon struct smatch_state *user, *new;
1081f5207b7SJohn Levon struct range_list *rl;
1091f5207b7SJohn Levon
110efe51d0cSJohn Levon user = __get_state(my_id, name, sym);
1111f5207b7SJohn Levon if (!user)
1121f5207b7SJohn Levon return;
1131f5207b7SJohn Levon rl = rl_intersection(estate_rl(user), estate_rl(state));
1141f5207b7SJohn Levon if (rl_equiv(rl, estate_rl(user)))
1151f5207b7SJohn Levon return;
116efe51d0cSJohn Levon new = alloc_estate_rl(rl);
117efe51d0cSJohn Levon if (estate_capped(user))
118efe51d0cSJohn Levon estate_set_capped(new);
119c85f09ccSJohn Levon if (estate_treat_untagged(user))
120c85f09ccSJohn Levon estate_set_treat_untagged(new);
121efe51d0cSJohn Levon set_state(my_id, name, sym, new);
122efe51d0cSJohn Levon }
123efe51d0cSJohn Levon
binop_capped(struct expression * expr)124efe51d0cSJohn Levon static bool binop_capped(struct expression *expr)
125efe51d0cSJohn Levon {
126efe51d0cSJohn Levon struct range_list *left_rl;
127efe51d0cSJohn Levon int comparison;
128efe51d0cSJohn Levon
129efe51d0cSJohn Levon if (expr->op == '-' && get_user_rl(expr->left, &left_rl)) {
130efe51d0cSJohn Levon if (user_rl_capped(expr->left))
131efe51d0cSJohn Levon return true;
132efe51d0cSJohn Levon comparison = get_comparison(expr->left, expr->right);
133efe51d0cSJohn Levon if (comparison && show_special(comparison)[0] == '>')
134efe51d0cSJohn Levon return true;
135efe51d0cSJohn Levon return false;
136efe51d0cSJohn Levon }
137efe51d0cSJohn Levon
138efe51d0cSJohn Levon if (expr->op == '&' || expr->op == '%') {
139efe51d0cSJohn Levon if (is_capped(expr->left) || is_capped(expr->right))
140efe51d0cSJohn Levon return true;
141efe51d0cSJohn Levon if (user_rl_capped(expr->left) || user_rl_capped(expr->right))
142efe51d0cSJohn Levon return true;
143efe51d0cSJohn Levon return false;
144efe51d0cSJohn Levon }
145efe51d0cSJohn Levon
146efe51d0cSJohn Levon if (user_rl_capped(expr->left) &&
147efe51d0cSJohn Levon user_rl_capped(expr->right))
148efe51d0cSJohn Levon return true;
149efe51d0cSJohn Levon return false;
150efe51d0cSJohn Levon }
151efe51d0cSJohn Levon
user_rl_capped(struct expression * expr)152efe51d0cSJohn Levon bool user_rl_capped(struct expression *expr)
153efe51d0cSJohn Levon {
154efe51d0cSJohn Levon struct smatch_state *state;
155efe51d0cSJohn Levon struct range_list *rl;
156efe51d0cSJohn Levon sval_t sval;
157efe51d0cSJohn Levon
158efe51d0cSJohn Levon expr = strip_expr(expr);
159efe51d0cSJohn Levon if (!expr)
160efe51d0cSJohn Levon return false;
161efe51d0cSJohn Levon if (get_value(expr, &sval))
162efe51d0cSJohn Levon return true;
163efe51d0cSJohn Levon if (expr->type == EXPR_BINOP)
164efe51d0cSJohn Levon return binop_capped(expr);
165efe51d0cSJohn Levon if ((expr->type == EXPR_PREOP || expr->type == EXPR_POSTOP) &&
166efe51d0cSJohn Levon (expr->op == SPECIAL_INCREMENT || expr->op == SPECIAL_DECREMENT))
167efe51d0cSJohn Levon return user_rl_capped(expr->unop);
168efe51d0cSJohn Levon state = get_state_expr(my_id, expr);
169efe51d0cSJohn Levon if (state)
170efe51d0cSJohn Levon return estate_capped(state);
171efe51d0cSJohn Levon
172efe51d0cSJohn Levon if (get_user_rl(expr, &rl))
173efe51d0cSJohn Levon return false; /* uncapped user data */
174efe51d0cSJohn Levon
175efe51d0cSJohn Levon return true; /* not actually user data */
1761f5207b7SJohn Levon }
1771f5207b7SJohn Levon
user_rl_treat_untagged(struct expression * expr)178c85f09ccSJohn Levon bool user_rl_treat_untagged(struct expression *expr)
179c85f09ccSJohn Levon {
180c85f09ccSJohn Levon struct smatch_state *state;
181c85f09ccSJohn Levon struct range_list *rl;
182c85f09ccSJohn Levon sval_t sval;
183c85f09ccSJohn Levon
184c85f09ccSJohn Levon expr = strip_expr(expr);
185c85f09ccSJohn Levon if (!expr)
186c85f09ccSJohn Levon return false;
187c85f09ccSJohn Levon if (get_value(expr, &sval))
188c85f09ccSJohn Levon return true;
189c85f09ccSJohn Levon
190c85f09ccSJohn Levon state = get_state_expr(my_id, expr);
191c85f09ccSJohn Levon if (state)
192c85f09ccSJohn Levon return estate_treat_untagged(state);
193c85f09ccSJohn Levon
194c85f09ccSJohn Levon if (get_user_rl(expr, &rl))
195c85f09ccSJohn Levon return false; /* uncapped user data */
196c85f09ccSJohn Levon
197c85f09ccSJohn Levon return true; /* not actually user data */
198c85f09ccSJohn Levon }
199c85f09ccSJohn Levon
tag_inner_struct_members(struct expression * expr,struct symbol * member)2001f5207b7SJohn Levon static void tag_inner_struct_members(struct expression *expr, struct symbol *member)
2011f5207b7SJohn Levon {
2021f5207b7SJohn Levon struct expression *edge_member;
2031f5207b7SJohn Levon struct symbol *base = get_real_base_type(member);
2041f5207b7SJohn Levon struct symbol *tmp;
2051f5207b7SJohn Levon
2061f5207b7SJohn Levon if (member->ident)
2071f5207b7SJohn Levon expr = member_expression(expr, '.', member->ident);
2081f5207b7SJohn Levon
2091f5207b7SJohn Levon FOR_EACH_PTR(base->symbol_list, tmp) {
2101f5207b7SJohn Levon struct symbol *type;
2111f5207b7SJohn Levon
2121f5207b7SJohn Levon type = get_real_base_type(tmp);
2131f5207b7SJohn Levon if (!type)
2141f5207b7SJohn Levon continue;
2151f5207b7SJohn Levon
2161f5207b7SJohn Levon if (type->type == SYM_UNION || type->type == SYM_STRUCT) {
2171f5207b7SJohn Levon tag_inner_struct_members(expr, tmp);
2181f5207b7SJohn Levon continue;
2191f5207b7SJohn Levon }
2201f5207b7SJohn Levon
2211f5207b7SJohn Levon if (!tmp->ident)
2221f5207b7SJohn Levon continue;
2231f5207b7SJohn Levon
2241f5207b7SJohn Levon edge_member = member_expression(expr, '.', tmp->ident);
2251f5207b7SJohn Levon set_state_expr(my_id, edge_member, alloc_estate_whole(type));
2261f5207b7SJohn Levon } END_FOR_EACH_PTR(tmp);
2271f5207b7SJohn Levon }
2281f5207b7SJohn Levon
tag_struct_members(struct symbol * type,struct expression * expr)2291f5207b7SJohn Levon static void tag_struct_members(struct symbol *type, struct expression *expr)
2301f5207b7SJohn Levon {
2311f5207b7SJohn Levon struct symbol *tmp;
2321f5207b7SJohn Levon struct expression *member;
2331f5207b7SJohn Levon int op = '*';
2341f5207b7SJohn Levon
2351f5207b7SJohn Levon if (expr->type == EXPR_PREOP && expr->op == '&') {
2361f5207b7SJohn Levon expr = strip_expr(expr->unop);
2371f5207b7SJohn Levon op = '.';
2381f5207b7SJohn Levon }
2391f5207b7SJohn Levon
2401f5207b7SJohn Levon FOR_EACH_PTR(type->symbol_list, tmp) {
2411f5207b7SJohn Levon type = get_real_base_type(tmp);
2421f5207b7SJohn Levon if (!type)
2431f5207b7SJohn Levon continue;
2441f5207b7SJohn Levon
2451f5207b7SJohn Levon if (type->type == SYM_UNION || type->type == SYM_STRUCT) {
2461f5207b7SJohn Levon tag_inner_struct_members(expr, tmp);
2471f5207b7SJohn Levon continue;
2481f5207b7SJohn Levon }
2491f5207b7SJohn Levon
2501f5207b7SJohn Levon if (!tmp->ident)
2511f5207b7SJohn Levon continue;
2521f5207b7SJohn Levon
2531f5207b7SJohn Levon member = member_expression(expr, op, tmp->ident);
2541f5207b7SJohn Levon set_state_expr(my_id, member, alloc_estate_whole(get_type(member)));
2551f5207b7SJohn Levon
2561f5207b7SJohn Levon if (type->type == SYM_ARRAY)
2571f5207b7SJohn Levon set_points_to_user_data(member);
2581f5207b7SJohn Levon } END_FOR_EACH_PTR(tmp);
2591f5207b7SJohn Levon }
2601f5207b7SJohn Levon
tag_base_type(struct expression * expr)2611f5207b7SJohn Levon static void tag_base_type(struct expression *expr)
2621f5207b7SJohn Levon {
2631f5207b7SJohn Levon if (expr->type == EXPR_PREOP && expr->op == '&')
2641f5207b7SJohn Levon expr = strip_expr(expr->unop);
2651f5207b7SJohn Levon else
2661f5207b7SJohn Levon expr = deref_expression(expr);
2671f5207b7SJohn Levon set_state_expr(my_id, expr, alloc_estate_whole(get_type(expr)));
2681f5207b7SJohn Levon }
2691f5207b7SJohn Levon
tag_as_user_data(struct expression * expr)2701f5207b7SJohn Levon static void tag_as_user_data(struct expression *expr)
2711f5207b7SJohn Levon {
2721f5207b7SJohn Levon struct symbol *type;
2731f5207b7SJohn Levon
2741f5207b7SJohn Levon expr = strip_expr(expr);
2751f5207b7SJohn Levon
2761f5207b7SJohn Levon type = get_type(expr);
2771f5207b7SJohn Levon if (!type || type->type != SYM_PTR)
2781f5207b7SJohn Levon return;
2791f5207b7SJohn Levon type = get_real_base_type(type);
2801f5207b7SJohn Levon if (!type)
2811f5207b7SJohn Levon return;
2821f5207b7SJohn Levon if (type == &void_ctype) {
2831f5207b7SJohn Levon set_state_expr(my_id, deref_expression(expr), alloc_estate_whole(&ulong_ctype));
2841f5207b7SJohn Levon return;
2851f5207b7SJohn Levon }
2861f5207b7SJohn Levon if (type->type == SYM_BASETYPE)
2871f5207b7SJohn Levon tag_base_type(expr);
2881f5207b7SJohn Levon if (type->type == SYM_STRUCT || type->type == SYM_UNION) {
2891f5207b7SJohn Levon if (expr->type != EXPR_PREOP || expr->op != '&')
2901f5207b7SJohn Levon expr = deref_expression(expr);
2911f5207b7SJohn Levon else
2921f5207b7SJohn Levon set_state_expr(my_id, deref_expression(expr), alloc_estate_whole(&ulong_ctype));
2931f5207b7SJohn Levon tag_struct_members(type, expr);
2941f5207b7SJohn Levon }
2951f5207b7SJohn Levon }
2961f5207b7SJohn Levon
match_user_copy(const char * fn,struct expression * expr,void * _param)2971f5207b7SJohn Levon static void match_user_copy(const char *fn, struct expression *expr, void *_param)
2981f5207b7SJohn Levon {
2991f5207b7SJohn Levon int param = PTR_INT(_param);
3001f5207b7SJohn Levon struct expression *dest;
3011f5207b7SJohn Levon
3021f5207b7SJohn Levon func_gets_user_data = true;
3031f5207b7SJohn Levon
3041f5207b7SJohn Levon dest = get_argument_from_call_expr(expr->args, param);
3051f5207b7SJohn Levon dest = strip_expr(dest);
3061f5207b7SJohn Levon if (!dest)
3071f5207b7SJohn Levon return;
3081f5207b7SJohn Levon tag_as_user_data(dest);
3091f5207b7SJohn Levon }
3101f5207b7SJohn Levon
is_dev_attr_name(struct expression * expr)3111f5207b7SJohn Levon static int is_dev_attr_name(struct expression *expr)
3121f5207b7SJohn Levon {
3131f5207b7SJohn Levon char *name;
3141f5207b7SJohn Levon int ret = 0;
3151f5207b7SJohn Levon
3161f5207b7SJohn Levon name = expr_to_str(expr);
3171f5207b7SJohn Levon if (!name)
3181f5207b7SJohn Levon return 0;
3191f5207b7SJohn Levon if (strstr(name, "->attr.name"))
3201f5207b7SJohn Levon ret = 1;
3211f5207b7SJohn Levon free_string(name);
3221f5207b7SJohn Levon return ret;
3231f5207b7SJohn Levon }
3241f5207b7SJohn Levon
ends_in_n(struct expression * expr)3251f5207b7SJohn Levon static int ends_in_n(struct expression *expr)
3261f5207b7SJohn Levon {
3271f5207b7SJohn Levon struct string *str;
3281f5207b7SJohn Levon
3291f5207b7SJohn Levon if (!expr)
3301f5207b7SJohn Levon return 0;
3311f5207b7SJohn Levon if (expr->type != EXPR_STRING || !expr->string)
3321f5207b7SJohn Levon return 0;
3331f5207b7SJohn Levon
3341f5207b7SJohn Levon str = expr->string;
3351f5207b7SJohn Levon if (str->length < 3)
3361f5207b7SJohn Levon return 0;
3371f5207b7SJohn Levon
3381f5207b7SJohn Levon if (str->data[str->length - 3] == '%' &&
3391f5207b7SJohn Levon str->data[str->length - 2] == 'n')
3401f5207b7SJohn Levon return 1;
3411f5207b7SJohn Levon return 0;
3421f5207b7SJohn Levon }
3431f5207b7SJohn Levon
match_sscanf(const char * fn,struct expression * expr,void * unused)3441f5207b7SJohn Levon static void match_sscanf(const char *fn, struct expression *expr, void *unused)
3451f5207b7SJohn Levon {
3461f5207b7SJohn Levon struct expression *str, *format, *arg;
3471f5207b7SJohn Levon int i, last;
3481f5207b7SJohn Levon
3491f5207b7SJohn Levon func_gets_user_data = true;
3501f5207b7SJohn Levon
3511f5207b7SJohn Levon str = get_argument_from_call_expr(expr->args, 0);
3521f5207b7SJohn Levon if (is_dev_attr_name(str))
3531f5207b7SJohn Levon return;
3541f5207b7SJohn Levon
3551f5207b7SJohn Levon format = get_argument_from_call_expr(expr->args, 1);
3561f5207b7SJohn Levon if (is_dev_attr_name(format))
3571f5207b7SJohn Levon return;
3581f5207b7SJohn Levon
3591f5207b7SJohn Levon last = ptr_list_size((struct ptr_list *)expr->args) - 1;
3601f5207b7SJohn Levon
3611f5207b7SJohn Levon i = -1;
3621f5207b7SJohn Levon FOR_EACH_PTR(expr->args, arg) {
3631f5207b7SJohn Levon i++;
3641f5207b7SJohn Levon if (i < 2)
3651f5207b7SJohn Levon continue;
3661f5207b7SJohn Levon if (i == last && ends_in_n(format))
3671f5207b7SJohn Levon continue;
3681f5207b7SJohn Levon tag_as_user_data(arg);
3691f5207b7SJohn Levon } END_FOR_EACH_PTR(arg);
3701f5207b7SJohn Levon }
3711f5207b7SJohn Levon
is_skb_data(struct expression * expr)3721f5207b7SJohn Levon static int is_skb_data(struct expression *expr)
3731f5207b7SJohn Levon {
3741f5207b7SJohn Levon struct symbol *sym;
3751f5207b7SJohn Levon
3761f5207b7SJohn Levon if (!expr)
3771f5207b7SJohn Levon return 0;
3781f5207b7SJohn Levon
3791f5207b7SJohn Levon if (expr->type == EXPR_BINOP && expr->op == '+')
3801f5207b7SJohn Levon return is_skb_data(expr->left);
3811f5207b7SJohn Levon
3821f5207b7SJohn Levon expr = strip_expr(expr);
3831f5207b7SJohn Levon if (!expr)
3841f5207b7SJohn Levon return 0;
3851f5207b7SJohn Levon if (expr->type != EXPR_DEREF || expr->op != '.')
3861f5207b7SJohn Levon return 0;
3871f5207b7SJohn Levon
3881f5207b7SJohn Levon if (!expr->member)
3891f5207b7SJohn Levon return 0;
3901f5207b7SJohn Levon if (strcmp(expr->member->name, "data") != 0)
3911f5207b7SJohn Levon return 0;
3921f5207b7SJohn Levon
3931f5207b7SJohn Levon sym = expr_to_sym(expr->deref);
3941f5207b7SJohn Levon if (!sym)
3951f5207b7SJohn Levon return 0;
3961f5207b7SJohn Levon sym = get_real_base_type(sym);
3971f5207b7SJohn Levon if (!sym || sym->type != SYM_PTR)
3981f5207b7SJohn Levon return 0;
3991f5207b7SJohn Levon sym = get_real_base_type(sym);
4001f5207b7SJohn Levon if (!sym || sym->type != SYM_STRUCT || !sym->ident)
4011f5207b7SJohn Levon return 0;
4021f5207b7SJohn Levon if (strcmp(sym->ident->name, "sk_buff") != 0)
4031f5207b7SJohn Levon return 0;
4041f5207b7SJohn Levon
4051f5207b7SJohn Levon return 1;
4061f5207b7SJohn Levon }
4071f5207b7SJohn Levon
is_points_to_user_data_fn(struct expression * expr)408efe51d0cSJohn Levon static bool is_points_to_user_data_fn(struct expression *expr)
409efe51d0cSJohn Levon {
410efe51d0cSJohn Levon int i;
411efe51d0cSJohn Levon
412efe51d0cSJohn Levon expr = strip_expr(expr);
413efe51d0cSJohn Levon if (expr->type != EXPR_CALL || expr->fn->type != EXPR_SYMBOL ||
414efe51d0cSJohn Levon !expr->fn->symbol)
415efe51d0cSJohn Levon return false;
416efe51d0cSJohn Levon expr = expr->fn;
417efe51d0cSJohn Levon for (i = 0; i < ARRAY_SIZE(returns_pointer_to_user_data); i++) {
418efe51d0cSJohn Levon if (sym_name_is(returns_pointer_to_user_data[i], expr))
419efe51d0cSJohn Levon return true;
420efe51d0cSJohn Levon }
421efe51d0cSJohn Levon return false;
422efe51d0cSJohn Levon }
423efe51d0cSJohn Levon
get_rl_from_function(struct expression * expr,struct range_list ** rl)4241f5207b7SJohn Levon static int get_rl_from_function(struct expression *expr, struct range_list **rl)
4251f5207b7SJohn Levon {
4261f5207b7SJohn Levon int i;
4271f5207b7SJohn Levon
4281f5207b7SJohn Levon if (expr->type != EXPR_CALL || expr->fn->type != EXPR_SYMBOL ||
4291f5207b7SJohn Levon !expr->fn->symbol_name || !expr->fn->symbol_name->name)
4301f5207b7SJohn Levon return 0;
4311f5207b7SJohn Levon
4321f5207b7SJohn Levon for (i = 0; i < ARRAY_SIZE(returns_user_data); i++) {
4331f5207b7SJohn Levon if (strcmp(expr->fn->symbol_name->name, returns_user_data[i]) == 0) {
4341f5207b7SJohn Levon *rl = alloc_whole_rl(get_type(expr));
4351f5207b7SJohn Levon return 1;
4361f5207b7SJohn Levon }
4371f5207b7SJohn Levon }
4381f5207b7SJohn Levon return 0;
4391f5207b7SJohn Levon }
4401f5207b7SJohn Levon
points_to_user_data(struct expression * expr)4411f5207b7SJohn Levon int points_to_user_data(struct expression *expr)
4421f5207b7SJohn Levon {
4431f5207b7SJohn Levon struct smatch_state *state;
4441f5207b7SJohn Levon struct range_list *rl;
4451f5207b7SJohn Levon char buf[256];
4461f5207b7SJohn Levon struct symbol *sym;
4471f5207b7SJohn Levon char *name;
4481f5207b7SJohn Levon int ret = 0;
4491f5207b7SJohn Levon
4501f5207b7SJohn Levon expr = strip_expr(expr);
4511f5207b7SJohn Levon if (!expr)
4521f5207b7SJohn Levon return 0;
4531f5207b7SJohn Levon if (is_skb_data(expr))
4541f5207b7SJohn Levon return 1;
455efe51d0cSJohn Levon if (is_points_to_user_data_fn(expr))
456efe51d0cSJohn Levon return 1;
4571f5207b7SJohn Levon if (get_rl_from_function(expr, &rl))
4581f5207b7SJohn Levon return 1;
4591f5207b7SJohn Levon
4601f5207b7SJohn Levon if (expr->type == EXPR_BINOP && expr->op == '+') {
4611f5207b7SJohn Levon if (points_to_user_data(expr->left))
4621f5207b7SJohn Levon return 1;
4631f5207b7SJohn Levon if (points_to_user_data(expr->right))
4641f5207b7SJohn Levon return 1;
4651f5207b7SJohn Levon return 0;
4661f5207b7SJohn Levon }
4671f5207b7SJohn Levon
4681f5207b7SJohn Levon name = expr_to_var_sym(expr, &sym);
4691f5207b7SJohn Levon if (!name || !sym)
4701f5207b7SJohn Levon goto free;
4711f5207b7SJohn Levon snprintf(buf, sizeof(buf), "*%s", name);
472efe51d0cSJohn Levon state = __get_state(my_id, buf, sym);
4731f5207b7SJohn Levon if (state && estate_rl(state))
4741f5207b7SJohn Levon ret = 1;
4751f5207b7SJohn Levon free:
4761f5207b7SJohn Levon free_string(name);
4771f5207b7SJohn Levon return ret;
4781f5207b7SJohn Levon }
4791f5207b7SJohn Levon
set_points_to_user_data(struct expression * expr)4801f5207b7SJohn Levon static void set_points_to_user_data(struct expression *expr)
4811f5207b7SJohn Levon {
4821f5207b7SJohn Levon char *name;
4831f5207b7SJohn Levon struct symbol *sym;
4841f5207b7SJohn Levon char buf[256];
485efe51d0cSJohn Levon struct symbol *type;
4861f5207b7SJohn Levon
4871f5207b7SJohn Levon name = expr_to_var_sym(expr, &sym);
4881f5207b7SJohn Levon if (!name || !sym)
4891f5207b7SJohn Levon goto free;
4901f5207b7SJohn Levon snprintf(buf, sizeof(buf), "*%s", name);
491efe51d0cSJohn Levon type = get_type(expr);
492efe51d0cSJohn Levon if (type && type->type == SYM_PTR)
493efe51d0cSJohn Levon type = get_real_base_type(type);
494efe51d0cSJohn Levon if (!type || type->type != SYM_BASETYPE)
495efe51d0cSJohn Levon type = &llong_ctype;
496efe51d0cSJohn Levon set_state(my_id, buf, sym, alloc_estate_whole(type));
4971f5207b7SJohn Levon free:
4981f5207b7SJohn Levon free_string(name);
4991f5207b7SJohn Levon }
5001f5207b7SJohn Levon
comes_from_skb_data(struct expression * expr)5011f5207b7SJohn Levon static int comes_from_skb_data(struct expression *expr)
5021f5207b7SJohn Levon {
5031f5207b7SJohn Levon expr = strip_expr(expr);
5041f5207b7SJohn Levon if (!expr || expr->type != EXPR_PREOP || expr->op != '*')
5051f5207b7SJohn Levon return 0;
5061f5207b7SJohn Levon
5071f5207b7SJohn Levon expr = strip_expr(expr->unop);
5081f5207b7SJohn Levon if (!expr)
5091f5207b7SJohn Levon return 0;
5101f5207b7SJohn Levon if (expr->type == EXPR_BINOP && expr->op == '+')
5111f5207b7SJohn Levon expr = strip_expr(expr->left);
5121f5207b7SJohn Levon
5131f5207b7SJohn Levon return is_skb_data(expr);
5141f5207b7SJohn Levon }
5151f5207b7SJohn Levon
handle_struct_assignment(struct expression * expr)5161f5207b7SJohn Levon static int handle_struct_assignment(struct expression *expr)
5171f5207b7SJohn Levon {
5181f5207b7SJohn Levon struct expression *right;
5191f5207b7SJohn Levon struct symbol *left_type, *right_type;
5201f5207b7SJohn Levon
5211f5207b7SJohn Levon left_type = get_type(expr->left);
5221f5207b7SJohn Levon if (!left_type || left_type->type != SYM_PTR)
5231f5207b7SJohn Levon return 0;
5241f5207b7SJohn Levon left_type = get_real_base_type(left_type);
5251f5207b7SJohn Levon if (!left_type)
5261f5207b7SJohn Levon return 0;
5271f5207b7SJohn Levon if (left_type->type != SYM_STRUCT &&
5281f5207b7SJohn Levon left_type->type != SYM_UNION)
5291f5207b7SJohn Levon return 0;
5301f5207b7SJohn Levon
5311f5207b7SJohn Levon /*
5321f5207b7SJohn Levon * Ignore struct to struct assignments because for those we look at the
5331f5207b7SJohn Levon * individual members.
5341f5207b7SJohn Levon */
5351f5207b7SJohn Levon right = strip_expr(expr->right);
5361f5207b7SJohn Levon right_type = get_type(right);
5371f5207b7SJohn Levon if (!right_type || right_type->type != SYM_PTR)
5381f5207b7SJohn Levon return 0;
5391f5207b7SJohn Levon
5401f5207b7SJohn Levon /* If we are assigning struct members then normally that is handled
5411f5207b7SJohn Levon * by fake assignments, however if we cast one struct to a different
5421f5207b7SJohn Levon * of struct then we handle that here.
5431f5207b7SJohn Levon */
5441f5207b7SJohn Levon right_type = get_real_base_type(right_type);
5451f5207b7SJohn Levon if (right_type == left_type)
5461f5207b7SJohn Levon return 0;
5471f5207b7SJohn Levon
5481f5207b7SJohn Levon if (!points_to_user_data(right))
5491f5207b7SJohn Levon return 0;
5501f5207b7SJohn Levon
5511f5207b7SJohn Levon tag_as_user_data(expr->left);
5521f5207b7SJohn Levon return 1;
5531f5207b7SJohn Levon }
5541f5207b7SJohn Levon
handle_get_user(struct expression * expr)5551f5207b7SJohn Levon static int handle_get_user(struct expression *expr)
5561f5207b7SJohn Levon {
5571f5207b7SJohn Levon char *name;
5581f5207b7SJohn Levon int ret = 0;
5591f5207b7SJohn Levon
5601f5207b7SJohn Levon name = get_macro_name(expr->pos);
5611f5207b7SJohn Levon if (!name || strcmp(name, "get_user") != 0)
5621f5207b7SJohn Levon return 0;
5631f5207b7SJohn Levon
5641f5207b7SJohn Levon name = expr_to_var(expr->right);
565c85f09ccSJohn Levon if (!name || (strcmp(name, "__val_gu") != 0 && strcmp(name, "__gu_val") != 0))
5661f5207b7SJohn Levon goto free;
5671f5207b7SJohn Levon set_state_expr(my_id, expr->left, alloc_estate_whole(get_type(expr->left)));
5681f5207b7SJohn Levon ret = 1;
5691f5207b7SJohn Levon free:
5701f5207b7SJohn Levon free_string(name);
5711f5207b7SJohn Levon return ret;
5721f5207b7SJohn Levon }
5731f5207b7SJohn Levon
handle_op_assign(struct expression * expr)574efe51d0cSJohn Levon static bool handle_op_assign(struct expression *expr)
575efe51d0cSJohn Levon {
576efe51d0cSJohn Levon struct expression *binop_expr;
577efe51d0cSJohn Levon struct smatch_state *state;
578efe51d0cSJohn Levon struct range_list *rl;
579efe51d0cSJohn Levon
580efe51d0cSJohn Levon switch (expr->op) {
581efe51d0cSJohn Levon case SPECIAL_ADD_ASSIGN:
582efe51d0cSJohn Levon case SPECIAL_SUB_ASSIGN:
583efe51d0cSJohn Levon case SPECIAL_AND_ASSIGN:
584efe51d0cSJohn Levon case SPECIAL_MOD_ASSIGN:
585efe51d0cSJohn Levon case SPECIAL_SHL_ASSIGN:
586efe51d0cSJohn Levon case SPECIAL_SHR_ASSIGN:
587efe51d0cSJohn Levon case SPECIAL_OR_ASSIGN:
588efe51d0cSJohn Levon case SPECIAL_XOR_ASSIGN:
589efe51d0cSJohn Levon case SPECIAL_MUL_ASSIGN:
590efe51d0cSJohn Levon case SPECIAL_DIV_ASSIGN:
591efe51d0cSJohn Levon binop_expr = binop_expression(expr->left,
592efe51d0cSJohn Levon op_remove_assign(expr->op),
593efe51d0cSJohn Levon expr->right);
594efe51d0cSJohn Levon if (!get_user_rl(binop_expr, &rl))
595efe51d0cSJohn Levon return true;
596efe51d0cSJohn Levon
597efe51d0cSJohn Levon rl = cast_rl(get_type(expr->left), rl);
598efe51d0cSJohn Levon state = alloc_estate_rl(rl);
599efe51d0cSJohn Levon if (user_rl_capped(binop_expr))
600efe51d0cSJohn Levon estate_set_capped(state);
601c85f09ccSJohn Levon if (user_rl_treat_untagged(expr->left))
602c85f09ccSJohn Levon estate_set_treat_untagged(state);
603efe51d0cSJohn Levon set_state_expr(my_id, expr->left, state);
604efe51d0cSJohn Levon return true;
605efe51d0cSJohn Levon }
606efe51d0cSJohn Levon return false;
607efe51d0cSJohn Levon }
608efe51d0cSJohn Levon
match_assign(struct expression * expr)6091f5207b7SJohn Levon static void match_assign(struct expression *expr)
6101f5207b7SJohn Levon {
6111f5207b7SJohn Levon struct range_list *rl;
612efe51d0cSJohn Levon static struct expression *handled;
613efe51d0cSJohn Levon struct smatch_state *state;
614efe51d0cSJohn Levon struct expression *faked;
6151f5207b7SJohn Levon
616efe51d0cSJohn Levon faked = get_faked_expression();
617efe51d0cSJohn Levon if (faked && faked == handled)
618efe51d0cSJohn Levon return;
6191f5207b7SJohn Levon if (is_fake_call(expr->right))
6201f5207b7SJohn Levon goto clear_old_state;
6211f5207b7SJohn Levon if (handle_get_user(expr))
6221f5207b7SJohn Levon return;
623efe51d0cSJohn Levon if (points_to_user_data(expr->right)) {
624efe51d0cSJohn Levon handled = expr;
6251f5207b7SJohn Levon set_points_to_user_data(expr->left);
626efe51d0cSJohn Levon }
6271f5207b7SJohn Levon if (handle_struct_assignment(expr))
6281f5207b7SJohn Levon return;
6291f5207b7SJohn Levon
630efe51d0cSJohn Levon if (handle_op_assign(expr))
631efe51d0cSJohn Levon return;
632efe51d0cSJohn Levon if (expr->op != '=')
633efe51d0cSJohn Levon goto clear_old_state;
634efe51d0cSJohn Levon
635efe51d0cSJohn Levon /* Handled by DB code */
636efe51d0cSJohn Levon if (expr->right->type == EXPR_CALL || __in_fake_parameter_assign)
637efe51d0cSJohn Levon return;
638efe51d0cSJohn Levon
6391f5207b7SJohn Levon if (!get_user_rl(expr->right, &rl))
6401f5207b7SJohn Levon goto clear_old_state;
6411f5207b7SJohn Levon
6421f5207b7SJohn Levon rl = cast_rl(get_type(expr->left), rl);
643efe51d0cSJohn Levon state = alloc_estate_rl(rl);
644c85f09ccSJohn Levon
645efe51d0cSJohn Levon if (user_rl_capped(expr->right))
646efe51d0cSJohn Levon estate_set_capped(state);
647c85f09ccSJohn Levon if (user_rl_treat_untagged(expr->right))
648c85f09ccSJohn Levon estate_set_treat_untagged(state);
649efe51d0cSJohn Levon set_state_expr(my_id, expr->left, state);
6501f5207b7SJohn Levon
6511f5207b7SJohn Levon return;
6521f5207b7SJohn Levon
6531f5207b7SJohn Levon clear_old_state:
6541f5207b7SJohn Levon if (get_state_expr(my_id, expr->left))
6551f5207b7SJohn Levon set_state_expr(my_id, expr->left, alloc_estate_empty());
6561f5207b7SJohn Levon }
6571f5207b7SJohn Levon
handle_eq_noteq(struct expression * expr)6581f5207b7SJohn Levon static void handle_eq_noteq(struct expression *expr)
6591f5207b7SJohn Levon {
6601f5207b7SJohn Levon struct smatch_state *left_orig, *right_orig;
6611f5207b7SJohn Levon
6621f5207b7SJohn Levon left_orig = get_state_expr(my_id, expr->left);
6631f5207b7SJohn Levon right_orig = get_state_expr(my_id, expr->right);
6641f5207b7SJohn Levon
6651f5207b7SJohn Levon if (!left_orig && !right_orig)
6661f5207b7SJohn Levon return;
6671f5207b7SJohn Levon if (left_orig && right_orig)
6681f5207b7SJohn Levon return;
6691f5207b7SJohn Levon
6701f5207b7SJohn Levon if (left_orig) {
6711f5207b7SJohn Levon set_true_false_states_expr(my_id, expr->left,
6721f5207b7SJohn Levon expr->op == SPECIAL_EQUAL ? alloc_estate_empty() : NULL,
6731f5207b7SJohn Levon expr->op == SPECIAL_EQUAL ? NULL : alloc_estate_empty());
6741f5207b7SJohn Levon } else {
6751f5207b7SJohn Levon set_true_false_states_expr(my_id, expr->right,
6761f5207b7SJohn Levon expr->op == SPECIAL_EQUAL ? alloc_estate_empty() : NULL,
6771f5207b7SJohn Levon expr->op == SPECIAL_EQUAL ? NULL : alloc_estate_empty());
6781f5207b7SJohn Levon }
6791f5207b7SJohn Levon }
6801f5207b7SJohn Levon
strip_negatives(struct range_list * rl)681efe51d0cSJohn Levon static struct range_list *strip_negatives(struct range_list *rl)
6821f5207b7SJohn Levon {
683efe51d0cSJohn Levon sval_t min = rl_min(rl);
684*eb44bcc7SJohn Levon sval_t minus_one;
685*eb44bcc7SJohn Levon sval_t over;
686efe51d0cSJohn Levon sval_t max = sval_type_max(rl_type(rl));
687efe51d0cSJohn Levon
688*eb44bcc7SJohn Levon minus_one.type = rl_type(rl);
689*eb44bcc7SJohn Levon minus_one.value = -1;
690*eb44bcc7SJohn Levon over.type = rl_type(rl);
691*eb44bcc7SJohn Levon over.value = INT_MAX + 1ULL;
692*eb44bcc7SJohn Levon
693efe51d0cSJohn Levon if (!rl)
694efe51d0cSJohn Levon return NULL;
695efe51d0cSJohn Levon
696efe51d0cSJohn Levon if (type_unsigned(rl_type(rl)) && type_bits(rl_type(rl)) > 31)
697efe51d0cSJohn Levon return remove_range(rl, over, max);
698efe51d0cSJohn Levon
699efe51d0cSJohn Levon return remove_range(rl, min, minus_one);
700efe51d0cSJohn Levon }
701efe51d0cSJohn Levon
handle_compare(struct expression * expr)702efe51d0cSJohn Levon static void handle_compare(struct expression *expr)
703efe51d0cSJohn Levon {
704efe51d0cSJohn Levon struct expression *left, *right;
705efe51d0cSJohn Levon struct range_list *left_rl = NULL;
706efe51d0cSJohn Levon struct range_list *right_rl = NULL;
707efe51d0cSJohn Levon struct range_list *user_rl;
708efe51d0cSJohn Levon struct smatch_state *capped_state;
709efe51d0cSJohn Levon struct smatch_state *left_true = NULL;
710efe51d0cSJohn Levon struct smatch_state *left_false = NULL;
711efe51d0cSJohn Levon struct smatch_state *right_true = NULL;
712efe51d0cSJohn Levon struct smatch_state *right_false = NULL;
7131f5207b7SJohn Levon struct symbol *type;
714efe51d0cSJohn Levon sval_t sval;
715efe51d0cSJohn Levon
716efe51d0cSJohn Levon left = strip_expr(expr->left);
717efe51d0cSJohn Levon right = strip_expr(expr->right);
718efe51d0cSJohn Levon
719efe51d0cSJohn Levon while (left->type == EXPR_ASSIGNMENT)
720efe51d0cSJohn Levon left = strip_expr(left->left);
7211f5207b7SJohn Levon
7221f5207b7SJohn Levon /*
723efe51d0cSJohn Levon * Conditions are mostly handled by smatch_extra.c, but there are some
724efe51d0cSJohn Levon * times where the exact values are not known so we can't do that.
725efe51d0cSJohn Levon *
726efe51d0cSJohn Levon * Normally, we might consider using smatch_capped.c to supliment smatch
727efe51d0cSJohn Levon * extra but that doesn't work when we merge unknown uncapped kernel
728efe51d0cSJohn Levon * data with unknown capped user data. The result is uncapped user
729efe51d0cSJohn Levon * data. We need to keep it separate and say that the user data is
730efe51d0cSJohn Levon * capped. In the past, I would have marked this as just regular
731efe51d0cSJohn Levon * kernel data (not user data) but we can't do that these days because
732efe51d0cSJohn Levon * we need to track user data for Spectre.
733efe51d0cSJohn Levon *
734efe51d0cSJohn Levon * The other situation which we have to handle is when we do have an
735efe51d0cSJohn Levon * int and we compare against an unknown unsigned kernel variable. In
736efe51d0cSJohn Levon * that situation we assume that the kernel data is less than INT_MAX.
737efe51d0cSJohn Levon * Otherwise then we get all sorts of array underflow false positives.
7381f5207b7SJohn Levon *
7391f5207b7SJohn Levon */
7401f5207b7SJohn Levon
741efe51d0cSJohn Levon /* Handled in smatch_extra.c */
742efe51d0cSJohn Levon if (get_implied_value(left, &sval) ||
743efe51d0cSJohn Levon get_implied_value(right, &sval))
7441f5207b7SJohn Levon return;
7451f5207b7SJohn Levon
746efe51d0cSJohn Levon get_user_rl(left, &left_rl);
747efe51d0cSJohn Levon get_user_rl(right, &right_rl);
748efe51d0cSJohn Levon
749efe51d0cSJohn Levon /* nothing to do */
750efe51d0cSJohn Levon if (!left_rl && !right_rl)
7511f5207b7SJohn Levon return;
752efe51d0cSJohn Levon /* if both sides are user data that's not a good limit */
753efe51d0cSJohn Levon if (left_rl && right_rl)
7541f5207b7SJohn Levon return;
7551f5207b7SJohn Levon
756efe51d0cSJohn Levon if (left_rl)
757efe51d0cSJohn Levon user_rl = left_rl;
758efe51d0cSJohn Levon else
759efe51d0cSJohn Levon user_rl = right_rl;
760efe51d0cSJohn Levon
761efe51d0cSJohn Levon type = get_type(expr);
762efe51d0cSJohn Levon if (type_unsigned(type))
763efe51d0cSJohn Levon user_rl = strip_negatives(user_rl);
764efe51d0cSJohn Levon capped_state = alloc_estate_rl(user_rl);
765efe51d0cSJohn Levon estate_set_capped(capped_state);
7661f5207b7SJohn Levon
7671f5207b7SJohn Levon switch (expr->op) {
7681f5207b7SJohn Levon case '<':
7691f5207b7SJohn Levon case SPECIAL_UNSIGNED_LT:
7701f5207b7SJohn Levon case SPECIAL_LTE:
7711f5207b7SJohn Levon case SPECIAL_UNSIGNED_LTE:
772efe51d0cSJohn Levon if (left_rl)
773efe51d0cSJohn Levon left_true = capped_state;
774efe51d0cSJohn Levon else
775efe51d0cSJohn Levon right_false = capped_state;
7761f5207b7SJohn Levon break;
7771f5207b7SJohn Levon case '>':
7781f5207b7SJohn Levon case SPECIAL_UNSIGNED_GT:
7791f5207b7SJohn Levon case SPECIAL_GTE:
7801f5207b7SJohn Levon case SPECIAL_UNSIGNED_GTE:
781efe51d0cSJohn Levon if (left_rl)
782efe51d0cSJohn Levon left_false = capped_state;
783efe51d0cSJohn Levon else
784efe51d0cSJohn Levon right_true = capped_state;
7851f5207b7SJohn Levon break;
7861f5207b7SJohn Levon }
787efe51d0cSJohn Levon
788efe51d0cSJohn Levon set_true_false_states_expr(my_id, left, left_true, left_false);
789efe51d0cSJohn Levon set_true_false_states_expr(my_id, right, right_true, right_false);
7901f5207b7SJohn Levon }
7911f5207b7SJohn Levon
match_condition(struct expression * expr)7921f5207b7SJohn Levon static void match_condition(struct expression *expr)
7931f5207b7SJohn Levon {
7941f5207b7SJohn Levon if (expr->type != EXPR_COMPARE)
7951f5207b7SJohn Levon return;
7961f5207b7SJohn Levon
7971f5207b7SJohn Levon if (expr->op == SPECIAL_EQUAL ||
7981f5207b7SJohn Levon expr->op == SPECIAL_NOTEQUAL) {
7991f5207b7SJohn Levon handle_eq_noteq(expr);
8001f5207b7SJohn Levon return;
8011f5207b7SJohn Levon }
8021f5207b7SJohn Levon
803efe51d0cSJohn Levon handle_compare(expr);
8041f5207b7SJohn Levon }
8051f5207b7SJohn Levon
match_user_assign_function(const char * fn,struct expression * expr,void * unused)8061f5207b7SJohn Levon static void match_user_assign_function(const char *fn, struct expression *expr, void *unused)
8071f5207b7SJohn Levon {
8081f5207b7SJohn Levon tag_as_user_data(expr->left);
8091f5207b7SJohn Levon set_points_to_user_data(expr->left);
8101f5207b7SJohn Levon }
8111f5207b7SJohn Levon
match_returns_user_rl(const char * fn,struct expression * expr,void * unused)8121f5207b7SJohn Levon static void match_returns_user_rl(const char *fn, struct expression *expr, void *unused)
8131f5207b7SJohn Levon {
8141f5207b7SJohn Levon func_gets_user_data = true;
8151f5207b7SJohn Levon }
8161f5207b7SJohn Levon
get_user_macro_rl(struct expression * expr,struct range_list ** rl)8171f5207b7SJohn Levon static int get_user_macro_rl(struct expression *expr, struct range_list **rl)
8181f5207b7SJohn Levon {
8191f5207b7SJohn Levon struct expression *parent;
8201f5207b7SJohn Levon char *macro;
8211f5207b7SJohn Levon
8221f5207b7SJohn Levon if (!expr)
8231f5207b7SJohn Levon return 0;
8241f5207b7SJohn Levon
8251f5207b7SJohn Levon macro = get_macro_name(expr->pos);
8261f5207b7SJohn Levon if (!macro)
8271f5207b7SJohn Levon return 0;
8281f5207b7SJohn Levon
8291f5207b7SJohn Levon /* handle ntohl(foo[i]) where "i" is trusted */
8301f5207b7SJohn Levon parent = expr_get_parent_expr(expr);
8311f5207b7SJohn Levon while (parent && parent->type != EXPR_BINOP)
8321f5207b7SJohn Levon parent = expr_get_parent_expr(parent);
8331f5207b7SJohn Levon if (parent && parent->type == EXPR_BINOP) {
8341f5207b7SJohn Levon char *parent_macro = get_macro_name(parent->pos);
8351f5207b7SJohn Levon
8361f5207b7SJohn Levon if (parent_macro && strcmp(macro, parent_macro) == 0)
8371f5207b7SJohn Levon return 0;
8381f5207b7SJohn Levon }
8391f5207b7SJohn Levon
8401f5207b7SJohn Levon if (strcmp(macro, "ntohl") == 0) {
8411f5207b7SJohn Levon *rl = alloc_whole_rl(&uint_ctype);
8421f5207b7SJohn Levon return 1;
8431f5207b7SJohn Levon }
8441f5207b7SJohn Levon if (strcmp(macro, "ntohs") == 0) {
8451f5207b7SJohn Levon *rl = alloc_whole_rl(&ushort_ctype);
8461f5207b7SJohn Levon return 1;
8471f5207b7SJohn Levon }
8481f5207b7SJohn Levon return 0;
8491f5207b7SJohn Levon }
8501f5207b7SJohn Levon
has_user_data(struct symbol * sym)8511f5207b7SJohn Levon static int has_user_data(struct symbol *sym)
8521f5207b7SJohn Levon {
8531f5207b7SJohn Levon struct sm_state *tmp;
8541f5207b7SJohn Levon
8551f5207b7SJohn Levon FOR_EACH_MY_SM(my_id, __get_cur_stree(), tmp) {
8561f5207b7SJohn Levon if (tmp->sym == sym)
8571f5207b7SJohn Levon return 1;
8581f5207b7SJohn Levon } END_FOR_EACH_SM(tmp);
8591f5207b7SJohn Levon return 0;
8601f5207b7SJohn Levon }
8611f5207b7SJohn Levon
we_pass_user_data(struct expression * call)8621f5207b7SJohn Levon static int we_pass_user_data(struct expression *call)
8631f5207b7SJohn Levon {
8641f5207b7SJohn Levon struct expression *arg;
8651f5207b7SJohn Levon struct symbol *sym;
8661f5207b7SJohn Levon
8671f5207b7SJohn Levon FOR_EACH_PTR(call->args, arg) {
8681f5207b7SJohn Levon sym = expr_to_sym(arg);
8691f5207b7SJohn Levon if (!sym)
8701f5207b7SJohn Levon continue;
8711f5207b7SJohn Levon if (has_user_data(sym))
8721f5207b7SJohn Levon return 1;
8731f5207b7SJohn Levon } END_FOR_EACH_PTR(arg);
8741f5207b7SJohn Levon
8751f5207b7SJohn Levon return 0;
8761f5207b7SJohn Levon }
8771f5207b7SJohn Levon
db_returned_user_rl(struct expression * call,struct range_list ** rl)8781f5207b7SJohn Levon static int db_returned_user_rl(struct expression *call, struct range_list **rl)
8791f5207b7SJohn Levon {
880efe51d0cSJohn Levon struct smatch_state *state;
881efe51d0cSJohn Levon char buf[48];
8821f5207b7SJohn Levon
8831f5207b7SJohn Levon if (is_fake_call(call))
8841f5207b7SJohn Levon return 0;
885efe51d0cSJohn Levon snprintf(buf, sizeof(buf), "return %p", call);
886efe51d0cSJohn Levon state = get_state(my_id, buf, NULL);
887efe51d0cSJohn Levon if (!state || !estate_rl(state))
888efe51d0cSJohn Levon return 0;
889efe51d0cSJohn Levon *rl = estate_rl(state);
890efe51d0cSJohn Levon return 1;
8911f5207b7SJohn Levon }
8921f5207b7SJohn Levon
get_user_stree(void)8931f5207b7SJohn Levon struct stree *get_user_stree(void)
8941f5207b7SJohn Levon {
8951f5207b7SJohn Levon return get_all_states_stree(my_id);
8961f5207b7SJohn Levon }
8971f5207b7SJohn Levon
8981f5207b7SJohn Levon static int user_data_flag;
8991f5207b7SJohn Levon static int no_user_data_flag;
var_user_rl(struct expression * expr)900efe51d0cSJohn Levon struct range_list *var_user_rl(struct expression *expr)
9011f5207b7SJohn Levon {
9021f5207b7SJohn Levon struct smatch_state *state;
9031f5207b7SJohn Levon struct range_list *rl;
9041f5207b7SJohn Levon struct range_list *absolute_rl;
9051f5207b7SJohn Levon
906efe51d0cSJohn Levon if (expr->type == EXPR_PREOP && expr->op == '&') {
907efe51d0cSJohn Levon no_user_data_flag = 1;
908efe51d0cSJohn Levon return NULL;
909efe51d0cSJohn Levon }
910efe51d0cSJohn Levon
9111f5207b7SJohn Levon if (expr->type == EXPR_BINOP && expr->op == '%') {
9121f5207b7SJohn Levon struct range_list *left, *right;
9131f5207b7SJohn Levon
9141f5207b7SJohn Levon if (!get_user_rl(expr->right, &right))
9151f5207b7SJohn Levon return NULL;
9161f5207b7SJohn Levon get_absolute_rl(expr->left, &left);
9171f5207b7SJohn Levon rl = rl_binop(left, '%', right);
9181f5207b7SJohn Levon goto found;
9191f5207b7SJohn Levon }
9201f5207b7SJohn Levon
921efe51d0cSJohn Levon if (expr->type == EXPR_BINOP && expr->op == '/') {
9221f5207b7SJohn Levon struct range_list *left = NULL;
9231f5207b7SJohn Levon struct range_list *right = NULL;
9241f5207b7SJohn Levon struct range_list *abs_right;
9251f5207b7SJohn Levon
9261f5207b7SJohn Levon /*
9271f5207b7SJohn Levon * The specific bug I'm dealing with is:
9281f5207b7SJohn Levon *
9291f5207b7SJohn Levon * foo = capped_user / unknown;
9301f5207b7SJohn Levon *
9311f5207b7SJohn Levon * Instead of just saying foo is now entirely user_rl we should
9321f5207b7SJohn Levon * probably say instead that it is not at all user data.
9331f5207b7SJohn Levon *
9341f5207b7SJohn Levon */
9351f5207b7SJohn Levon
9361f5207b7SJohn Levon get_user_rl(expr->left, &left);
9371f5207b7SJohn Levon get_user_rl(expr->right, &right);
9381f5207b7SJohn Levon get_absolute_rl(expr->right, &abs_right);
9391f5207b7SJohn Levon
9401f5207b7SJohn Levon if (left && !right) {
9411f5207b7SJohn Levon rl = rl_binop(left, '/', abs_right);
9421f5207b7SJohn Levon if (sval_cmp(rl_max(left), rl_max(rl)) < 0)
9431f5207b7SJohn Levon no_user_data_flag = 1;
9441f5207b7SJohn Levon }
9451f5207b7SJohn Levon
9461f5207b7SJohn Levon return NULL;
9471f5207b7SJohn Levon }
9481f5207b7SJohn Levon
9491f5207b7SJohn Levon if (get_rl_from_function(expr, &rl))
9501f5207b7SJohn Levon goto found;
9511f5207b7SJohn Levon
9521f5207b7SJohn Levon if (get_user_macro_rl(expr, &rl))
9531f5207b7SJohn Levon goto found;
9541f5207b7SJohn Levon
9551f5207b7SJohn Levon if (comes_from_skb_data(expr)) {
9561f5207b7SJohn Levon rl = alloc_whole_rl(get_type(expr));
9571f5207b7SJohn Levon goto found;
9581f5207b7SJohn Levon }
9591f5207b7SJohn Levon
9601f5207b7SJohn Levon state = get_state_expr(my_id, expr);
9611f5207b7SJohn Levon if (state && estate_rl(state)) {
9621f5207b7SJohn Levon rl = estate_rl(state);
9631f5207b7SJohn Levon goto found;
9641f5207b7SJohn Levon }
9651f5207b7SJohn Levon
9661f5207b7SJohn Levon if (expr->type == EXPR_CALL && db_returned_user_rl(expr, &rl))
9671f5207b7SJohn Levon goto found;
9681f5207b7SJohn Levon
9691f5207b7SJohn Levon if (is_array(expr)) {
9701f5207b7SJohn Levon struct expression *array = get_array_base(expr);
9711f5207b7SJohn Levon
9721f5207b7SJohn Levon if (!get_state_expr(my_id, array)) {
9731f5207b7SJohn Levon no_user_data_flag = 1;
9741f5207b7SJohn Levon return NULL;
9751f5207b7SJohn Levon }
9761f5207b7SJohn Levon }
9771f5207b7SJohn Levon
9781f5207b7SJohn Levon if (expr->type == EXPR_PREOP && expr->op == '*' &&
9791f5207b7SJohn Levon is_user_rl(expr->unop)) {
9801f5207b7SJohn Levon rl = var_to_absolute_rl(expr);
9811f5207b7SJohn Levon goto found;
9821f5207b7SJohn Levon }
9831f5207b7SJohn Levon
9841f5207b7SJohn Levon return NULL;
9851f5207b7SJohn Levon found:
9861f5207b7SJohn Levon user_data_flag = 1;
9871f5207b7SJohn Levon absolute_rl = var_to_absolute_rl(expr);
9881f5207b7SJohn Levon return clone_rl(rl_intersection(rl, absolute_rl));
9891f5207b7SJohn Levon }
9901f5207b7SJohn Levon
is_ptr_subtract(struct expression * expr)991efe51d0cSJohn Levon static bool is_ptr_subtract(struct expression *expr)
992efe51d0cSJohn Levon {
993efe51d0cSJohn Levon expr = strip_expr(expr);
994efe51d0cSJohn Levon if (!expr)
995efe51d0cSJohn Levon return false;
996efe51d0cSJohn Levon if (expr->type == EXPR_BINOP && expr->op == '-' &&
997efe51d0cSJohn Levon type_is_ptr(get_type(expr->left))) {
998efe51d0cSJohn Levon return true;
999efe51d0cSJohn Levon }
1000efe51d0cSJohn Levon return false;
1001efe51d0cSJohn Levon }
1002efe51d0cSJohn Levon
get_user_rl(struct expression * expr,struct range_list ** rl)10031f5207b7SJohn Levon int get_user_rl(struct expression *expr, struct range_list **rl)
10041f5207b7SJohn Levon {
1005efe51d0cSJohn Levon if (is_ptr_subtract(expr))
1006efe51d0cSJohn Levon return 0;
1007efe51d0cSJohn Levon
10081f5207b7SJohn Levon user_data_flag = 0;
10091f5207b7SJohn Levon no_user_data_flag = 0;
10101f5207b7SJohn Levon custom_get_absolute_rl(expr, &var_user_rl, rl);
10111f5207b7SJohn Levon if (!user_data_flag || no_user_data_flag)
10121f5207b7SJohn Levon *rl = NULL;
10131f5207b7SJohn Levon
10141f5207b7SJohn Levon return !!*rl;
10151f5207b7SJohn Levon }
10161f5207b7SJohn Levon
is_user_rl(struct expression * expr)10171f5207b7SJohn Levon int is_user_rl(struct expression *expr)
10181f5207b7SJohn Levon {
10191f5207b7SJohn Levon struct range_list *tmp;
10201f5207b7SJohn Levon
1021efe51d0cSJohn Levon return !!get_user_rl(expr, &tmp);
10221f5207b7SJohn Levon }
10231f5207b7SJohn Levon
get_user_rl_var_sym(const char * name,struct symbol * sym,struct range_list ** rl)10241f5207b7SJohn Levon int get_user_rl_var_sym(const char *name, struct symbol *sym, struct range_list **rl)
10251f5207b7SJohn Levon {
10261f5207b7SJohn Levon struct smatch_state *state;
10271f5207b7SJohn Levon
10281f5207b7SJohn Levon state = get_state(my_id, name, sym);
10291f5207b7SJohn Levon if (state && estate_rl(state)) {
10301f5207b7SJohn Levon *rl = estate_rl(state);
10311f5207b7SJohn Levon return 1;
10321f5207b7SJohn Levon }
10331f5207b7SJohn Levon return 0;
10341f5207b7SJohn Levon }
10351f5207b7SJohn Levon
get_user_rl_str(struct expression * expr,struct symbol * type)1036efe51d0cSJohn Levon static char *get_user_rl_str(struct expression *expr, struct symbol *type)
10371f5207b7SJohn Levon {
10381f5207b7SJohn Levon struct range_list *rl;
1039efe51d0cSJohn Levon static char buf[64];
1040efe51d0cSJohn Levon
1041efe51d0cSJohn Levon if (!get_user_rl(expr, &rl))
1042efe51d0cSJohn Levon return NULL;
1043efe51d0cSJohn Levon rl = cast_rl(type, rl);
1044c85f09ccSJohn Levon snprintf(buf, sizeof(buf), "%s%s%s",
1045c85f09ccSJohn Levon show_rl(rl),
1046c85f09ccSJohn Levon user_rl_capped(expr) ? "[c]" : "",
1047c85f09ccSJohn Levon user_rl_treat_untagged(expr) ? "[u]" : "");
1048efe51d0cSJohn Levon return buf;
1049efe51d0cSJohn Levon }
1050efe51d0cSJohn Levon
match_call_info(struct expression * expr)1051efe51d0cSJohn Levon static void match_call_info(struct expression *expr)
1052efe51d0cSJohn Levon {
10531f5207b7SJohn Levon struct expression *arg;
10541f5207b7SJohn Levon struct symbol *type;
1055efe51d0cSJohn Levon char *str;
1056efe51d0cSJohn Levon int i;
10571f5207b7SJohn Levon
10581f5207b7SJohn Levon i = -1;
10591f5207b7SJohn Levon FOR_EACH_PTR(expr->args, arg) {
10601f5207b7SJohn Levon i++;
10611f5207b7SJohn Levon type = get_arg_type(expr->fn, i);
1062efe51d0cSJohn Levon str = get_user_rl_str(arg, type);
1063efe51d0cSJohn Levon if (!str)
10641f5207b7SJohn Levon continue;
10651f5207b7SJohn Levon
1066efe51d0cSJohn Levon sql_insert_caller_info(expr, USER_DATA, i, "$", str);
10671f5207b7SJohn Levon } END_FOR_EACH_PTR(arg);
10681f5207b7SJohn Levon }
10691f5207b7SJohn Levon
struct_member_callback(struct expression * call,int param,char * printed_name,struct sm_state * sm)10701f5207b7SJohn Levon static void struct_member_callback(struct expression *call, int param, char *printed_name, struct sm_state *sm)
10711f5207b7SJohn Levon {
10721f5207b7SJohn Levon struct smatch_state *state;
10731f5207b7SJohn Levon struct range_list *rl;
10741f5207b7SJohn Levon struct symbol *type;
1075efe51d0cSJohn Levon char buf[64];
10761f5207b7SJohn Levon
10771f5207b7SJohn Levon /*
10781f5207b7SJohn Levon * Smatch uses a hack where if we get an unsigned long we say it's
10791f5207b7SJohn Levon * both user data and it points to user data. But if we pass it to a
10801f5207b7SJohn Levon * function which takes an int, then it's just user data. There's not
10811f5207b7SJohn Levon * enough bytes for it to be a pointer.
10821f5207b7SJohn Levon *
10831f5207b7SJohn Levon */
10841f5207b7SJohn Levon type = get_arg_type(call->fn, param);
10851f5207b7SJohn Levon if (type && type_bits(type) < type_bits(&ptr_ctype))
10861f5207b7SJohn Levon return;
10871f5207b7SJohn Levon
10881f5207b7SJohn Levon if (strcmp(sm->state->name, "") == 0)
10891f5207b7SJohn Levon return;
10901f5207b7SJohn Levon
10911f5207b7SJohn Levon if (strcmp(printed_name, "*$") == 0 &&
10921f5207b7SJohn Levon is_struct_ptr(sm->sym))
10931f5207b7SJohn Levon return;
10941f5207b7SJohn Levon
1095efe51d0cSJohn Levon state = __get_state(SMATCH_EXTRA, sm->name, sm->sym);
10961f5207b7SJohn Levon if (!state || !estate_rl(state))
10971f5207b7SJohn Levon rl = estate_rl(sm->state);
10981f5207b7SJohn Levon else
10991f5207b7SJohn Levon rl = rl_intersection(estate_rl(sm->state), estate_rl(state));
11001f5207b7SJohn Levon
1101efe51d0cSJohn Levon if (!rl)
1102efe51d0cSJohn Levon return;
1103efe51d0cSJohn Levon
1104c85f09ccSJohn Levon snprintf(buf, sizeof(buf), "%s%s%s", show_rl(rl),
1105c85f09ccSJohn Levon estate_capped(sm->state) ? "[c]" : "",
1106c85f09ccSJohn Levon estate_treat_untagged(sm->state) ? "[u]" : "");
1107efe51d0cSJohn Levon sql_insert_caller_info(call, USER_DATA, param, printed_name, buf);
1108efe51d0cSJohn Levon }
1109efe51d0cSJohn Levon
db_param_set(struct expression * expr,int param,char * key,char * value)1110efe51d0cSJohn Levon static void db_param_set(struct expression *expr, int param, char *key, char *value)
1111efe51d0cSJohn Levon {
1112efe51d0cSJohn Levon struct expression *arg;
1113efe51d0cSJohn Levon char *name;
1114efe51d0cSJohn Levon struct symbol *sym;
1115efe51d0cSJohn Levon struct smatch_state *state;
1116efe51d0cSJohn Levon
1117efe51d0cSJohn Levon while (expr->type == EXPR_ASSIGNMENT)
1118efe51d0cSJohn Levon expr = strip_expr(expr->right);
1119efe51d0cSJohn Levon if (expr->type != EXPR_CALL)
1120efe51d0cSJohn Levon return;
1121efe51d0cSJohn Levon
1122efe51d0cSJohn Levon arg = get_argument_from_call_expr(expr->args, param);
1123efe51d0cSJohn Levon if (!arg)
1124efe51d0cSJohn Levon return;
1125efe51d0cSJohn Levon name = get_variable_from_key(arg, key, &sym);
1126efe51d0cSJohn Levon if (!name || !sym)
1127efe51d0cSJohn Levon goto free;
1128efe51d0cSJohn Levon
1129efe51d0cSJohn Levon state = get_state(my_id, name, sym);
1130efe51d0cSJohn Levon if (!state)
1131efe51d0cSJohn Levon goto free;
1132efe51d0cSJohn Levon
1133efe51d0cSJohn Levon set_state(my_id, name, sym, alloc_estate_empty());
1134efe51d0cSJohn Levon free:
1135efe51d0cSJohn Levon free_string(name);
1136efe51d0cSJohn Levon }
1137efe51d0cSJohn Levon
param_data_capped(const char * value)1138efe51d0cSJohn Levon static bool param_data_capped(const char *value)
1139efe51d0cSJohn Levon {
1140efe51d0cSJohn Levon if (strstr(value, ",c") || strstr(value, "[c"))
1141efe51d0cSJohn Levon return true;
1142efe51d0cSJohn Levon return false;
11431f5207b7SJohn Levon }
11441f5207b7SJohn Levon
param_data_treat_untagged(const char * value)1145c85f09ccSJohn Levon static bool param_data_treat_untagged(const char *value)
1146c85f09ccSJohn Levon {
1147c85f09ccSJohn Levon if (strstr(value, ",u") || strstr(value, "[u"))
1148c85f09ccSJohn Levon return true;
1149c85f09ccSJohn Levon return false;
1150c85f09ccSJohn Levon }
1151c85f09ccSJohn Levon
set_param_user_data(const char * name,struct symbol * sym,char * key,char * value)11521f5207b7SJohn Levon static void set_param_user_data(const char *name, struct symbol *sym, char *key, char *value)
11531f5207b7SJohn Levon {
11541f5207b7SJohn Levon struct range_list *rl = NULL;
11551f5207b7SJohn Levon struct smatch_state *state;
1156efe51d0cSJohn Levon struct expression *expr;
11571f5207b7SJohn Levon struct symbol *type;
11581f5207b7SJohn Levon char fullname[256];
1159efe51d0cSJohn Levon char *key_orig = key;
1160efe51d0cSJohn Levon bool add_star = false;
11611f5207b7SJohn Levon
1162efe51d0cSJohn Levon if (strcmp(key, "**$") == 0) {
1163efe51d0cSJohn Levon snprintf(fullname, sizeof(fullname), "**%s", name);
1164efe51d0cSJohn Levon } else {
1165efe51d0cSJohn Levon if (key[0] == '*') {
1166efe51d0cSJohn Levon add_star = true;
1167efe51d0cSJohn Levon key++;
1168efe51d0cSJohn Levon }
11691f5207b7SJohn Levon
1170efe51d0cSJohn Levon snprintf(fullname, 256, "%s%s%s", add_star ? "*" : "", name, key + 1);
1171efe51d0cSJohn Levon }
11721f5207b7SJohn Levon
1173efe51d0cSJohn Levon expr = symbol_expression(sym);
1174efe51d0cSJohn Levon type = get_member_type_from_key(expr, key_orig);
11751f5207b7SJohn Levon
1176efe51d0cSJohn Levon /*
1177efe51d0cSJohn Levon * Say this function takes a struct ponter but the caller passes
1178efe51d0cSJohn Levon * this_function(skb->data). We have two options, we could pass *$
1179efe51d0cSJohn Levon * as user data or we could pass foo->bar, foo->baz as user data.
1180efe51d0cSJohn Levon * The second option is easier to implement so we do that.
1181efe51d0cSJohn Levon *
1182efe51d0cSJohn Levon */
1183efe51d0cSJohn Levon if (strcmp(key_orig, "*$") == 0) {
1184efe51d0cSJohn Levon struct symbol *tmp = type;
1185efe51d0cSJohn Levon
1186efe51d0cSJohn Levon while (tmp && tmp->type == SYM_PTR)
1187efe51d0cSJohn Levon tmp = get_real_base_type(tmp);
1188efe51d0cSJohn Levon
1189efe51d0cSJohn Levon if (tmp && (tmp->type == SYM_STRUCT || tmp->type == SYM_UNION)) {
1190efe51d0cSJohn Levon tag_as_user_data(symbol_expression(sym));
1191efe51d0cSJohn Levon return;
1192efe51d0cSJohn Levon }
11931f5207b7SJohn Levon }
1194efe51d0cSJohn Levon
11951f5207b7SJohn Levon str_to_rl(type, value, &rl);
11961f5207b7SJohn Levon state = alloc_estate_rl(rl);
1197efe51d0cSJohn Levon if (param_data_capped(value) || is_capped(expr))
1198efe51d0cSJohn Levon estate_set_capped(state);
1199c85f09ccSJohn Levon if (param_data_treat_untagged(value) || sym->ctype.as == 5)
1200c85f09ccSJohn Levon estate_set_treat_untagged(state);
12011f5207b7SJohn Levon set_state(my_id, fullname, sym, state);
12021f5207b7SJohn Levon }
12031f5207b7SJohn Levon
set_called(const char * name,struct symbol * sym,char * key,char * value)12041f5207b7SJohn Levon static void set_called(const char *name, struct symbol *sym, char *key, char *value)
12051f5207b7SJohn Levon {
12061f5207b7SJohn Levon set_state(my_call_id, "this_function", NULL, &called);
12071f5207b7SJohn Levon }
12081f5207b7SJohn Levon
match_syscall_definition(struct symbol * sym)12091f5207b7SJohn Levon static void match_syscall_definition(struct symbol *sym)
12101f5207b7SJohn Levon {
12111f5207b7SJohn Levon struct symbol *arg;
12121f5207b7SJohn Levon char *macro;
12131f5207b7SJohn Levon char *name;
12141f5207b7SJohn Levon int is_syscall = 0;
12151f5207b7SJohn Levon
12161f5207b7SJohn Levon macro = get_macro_name(sym->pos);
12171f5207b7SJohn Levon if (macro &&
12181f5207b7SJohn Levon (strncmp("SYSCALL_DEFINE", macro, strlen("SYSCALL_DEFINE")) == 0 ||
12191f5207b7SJohn Levon strncmp("COMPAT_SYSCALL_DEFINE", macro, strlen("COMPAT_SYSCALL_DEFINE")) == 0))
12201f5207b7SJohn Levon is_syscall = 1;
12211f5207b7SJohn Levon
12221f5207b7SJohn Levon name = get_function();
12231f5207b7SJohn Levon if (!option_no_db && get_state(my_call_id, "this_function", NULL) != &called) {
12241f5207b7SJohn Levon if (name && strncmp(name, "sys_", 4) == 0)
12251f5207b7SJohn Levon is_syscall = 1;
12261f5207b7SJohn Levon }
12271f5207b7SJohn Levon
12281f5207b7SJohn Levon if (name && strncmp(name, "compat_sys_", 11) == 0)
12291f5207b7SJohn Levon is_syscall = 1;
12301f5207b7SJohn Levon
12311f5207b7SJohn Levon if (!is_syscall)
12321f5207b7SJohn Levon return;
12331f5207b7SJohn Levon
12341f5207b7SJohn Levon FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
12351f5207b7SJohn Levon set_state(my_id, arg->ident->name, arg, alloc_estate_whole(get_real_base_type(arg)));
12361f5207b7SJohn Levon } END_FOR_EACH_PTR(arg);
12371f5207b7SJohn Levon }
12381f5207b7SJohn Levon
store_user_data_return(struct expression * expr,char * key,char * value)1239efe51d0cSJohn Levon static void store_user_data_return(struct expression *expr, char *key, char *value)
1240efe51d0cSJohn Levon {
1241efe51d0cSJohn Levon struct range_list *rl;
1242efe51d0cSJohn Levon struct symbol *type;
1243efe51d0cSJohn Levon char buf[48];
1244efe51d0cSJohn Levon
1245efe51d0cSJohn Levon if (strcmp(key, "$") != 0)
1246efe51d0cSJohn Levon return;
1247efe51d0cSJohn Levon
1248efe51d0cSJohn Levon type = get_type(expr);
1249efe51d0cSJohn Levon snprintf(buf, sizeof(buf), "return %p", expr);
1250efe51d0cSJohn Levon call_results_to_rl(expr, type, value, &rl);
1251efe51d0cSJohn Levon
1252efe51d0cSJohn Levon set_state(my_id, buf, NULL, alloc_estate_rl(rl));
1253efe51d0cSJohn Levon }
1254efe51d0cSJohn Levon
set_to_user_data(struct expression * expr,char * key,char * value)12551f5207b7SJohn Levon static void set_to_user_data(struct expression *expr, char *key, char *value)
12561f5207b7SJohn Levon {
1257efe51d0cSJohn Levon struct smatch_state *state;
12581f5207b7SJohn Levon char *name;
12591f5207b7SJohn Levon struct symbol *sym;
12601f5207b7SJohn Levon struct symbol *type;
12611f5207b7SJohn Levon struct range_list *rl = NULL;
12621f5207b7SJohn Levon
12631f5207b7SJohn Levon type = get_member_type_from_key(expr, key);
12641f5207b7SJohn Levon name = get_variable_from_key(expr, key, &sym);
12651f5207b7SJohn Levon if (!name || !sym)
12661f5207b7SJohn Levon goto free;
12671f5207b7SJohn Levon
12681f5207b7SJohn Levon call_results_to_rl(expr, type, value, &rl);
12691f5207b7SJohn Levon
1270efe51d0cSJohn Levon state = alloc_estate_rl(rl);
1271efe51d0cSJohn Levon if (param_data_capped(value))
1272efe51d0cSJohn Levon estate_set_capped(state);
1273c85f09ccSJohn Levon if (param_data_treat_untagged(value))
1274c85f09ccSJohn Levon estate_set_treat_untagged(state);
1275efe51d0cSJohn Levon set_state(my_id, name, sym, state);
12761f5207b7SJohn Levon free:
12771f5207b7SJohn Levon free_string(name);
12781f5207b7SJohn Levon }
12791f5207b7SJohn Levon
returns_param_user_data(struct expression * expr,int param,char * key,char * value)12801f5207b7SJohn Levon static void returns_param_user_data(struct expression *expr, int param, char *key, char *value)
12811f5207b7SJohn Levon {
12821f5207b7SJohn Levon struct expression *arg;
12831f5207b7SJohn Levon struct expression *call;
12841f5207b7SJohn Levon
12851f5207b7SJohn Levon call = expr;
12861f5207b7SJohn Levon while (call->type == EXPR_ASSIGNMENT)
12871f5207b7SJohn Levon call = strip_expr(call->right);
12881f5207b7SJohn Levon if (call->type != EXPR_CALL)
12891f5207b7SJohn Levon return;
12901f5207b7SJohn Levon
12911f5207b7SJohn Levon if (!we_pass_user_data(call))
12921f5207b7SJohn Levon return;
12931f5207b7SJohn Levon
12941f5207b7SJohn Levon if (param == -1) {
1295efe51d0cSJohn Levon if (expr->type != EXPR_ASSIGNMENT) {
1296efe51d0cSJohn Levon store_user_data_return(expr, key, value);
12971f5207b7SJohn Levon return;
1298efe51d0cSJohn Levon }
12991f5207b7SJohn Levon set_to_user_data(expr->left, key, value);
13001f5207b7SJohn Levon return;
13011f5207b7SJohn Levon }
13021f5207b7SJohn Levon
13031f5207b7SJohn Levon arg = get_argument_from_call_expr(call->args, param);
13041f5207b7SJohn Levon if (!arg)
13051f5207b7SJohn Levon return;
13061f5207b7SJohn Levon set_to_user_data(arg, key, value);
13071f5207b7SJohn Levon }
13081f5207b7SJohn Levon
returns_param_user_data_set(struct expression * expr,int param,char * key,char * value)13091f5207b7SJohn Levon static void returns_param_user_data_set(struct expression *expr, int param, char *key, char *value)
13101f5207b7SJohn Levon {
13111f5207b7SJohn Levon struct expression *arg;
13121f5207b7SJohn Levon
13131f5207b7SJohn Levon func_gets_user_data = true;
13141f5207b7SJohn Levon
13151f5207b7SJohn Levon if (param == -1) {
1316efe51d0cSJohn Levon if (expr->type != EXPR_ASSIGNMENT) {
1317efe51d0cSJohn Levon store_user_data_return(expr, key, value);
13181f5207b7SJohn Levon return;
1319efe51d0cSJohn Levon }
13201f5207b7SJohn Levon if (strcmp(key, "*$") == 0) {
13211f5207b7SJohn Levon set_points_to_user_data(expr->left);
13221f5207b7SJohn Levon tag_as_user_data(expr->left);
13231f5207b7SJohn Levon } else {
13241f5207b7SJohn Levon set_to_user_data(expr->left, key, value);
13251f5207b7SJohn Levon }
13261f5207b7SJohn Levon return;
13271f5207b7SJohn Levon }
13281f5207b7SJohn Levon
13291f5207b7SJohn Levon while (expr->type == EXPR_ASSIGNMENT)
13301f5207b7SJohn Levon expr = strip_expr(expr->right);
13311f5207b7SJohn Levon if (expr->type != EXPR_CALL)
13321f5207b7SJohn Levon return;
13331f5207b7SJohn Levon
13341f5207b7SJohn Levon arg = get_argument_from_call_expr(expr->args, param);
13351f5207b7SJohn Levon if (!arg)
13361f5207b7SJohn Levon return;
13371f5207b7SJohn Levon set_to_user_data(arg, key, value);
13381f5207b7SJohn Levon }
13391f5207b7SJohn Levon
param_set_to_user_data(int return_id,char * return_ranges,struct expression * expr)13401f5207b7SJohn Levon static void param_set_to_user_data(int return_id, char *return_ranges, struct expression *expr)
13411f5207b7SJohn Levon {
13421f5207b7SJohn Levon struct sm_state *sm;
13431f5207b7SJohn Levon struct smatch_state *start_state;
13441f5207b7SJohn Levon struct range_list *rl;
13451f5207b7SJohn Levon int param;
13461f5207b7SJohn Levon char *return_str;
13471f5207b7SJohn Levon const char *param_name;
13481f5207b7SJohn Levon struct symbol *ret_sym;
13491f5207b7SJohn Levon bool return_found = false;
1350efe51d0cSJohn Levon bool pointed_at_found = false;
1351efe51d0cSJohn Levon char buf[64];
13521f5207b7SJohn Levon
13531f5207b7SJohn Levon expr = strip_expr(expr);
13541f5207b7SJohn Levon return_str = expr_to_str(expr);
13551f5207b7SJohn Levon ret_sym = expr_to_sym(expr);
13561f5207b7SJohn Levon
13571f5207b7SJohn Levon FOR_EACH_MY_SM(my_id, __get_cur_stree(), sm) {
13581f5207b7SJohn Levon param = get_param_num_from_sym(sm->sym);
13591f5207b7SJohn Levon if (param < 0)
13601f5207b7SJohn Levon continue;
13611f5207b7SJohn Levon
1362efe51d0cSJohn Levon if (!param_was_set_var_sym(sm->name, sm->sym))
1363efe51d0cSJohn Levon continue;
1364efe51d0cSJohn Levon
13651f5207b7SJohn Levon /* The logic here was that if we were passed in a user data then
13661f5207b7SJohn Levon * we don't record that. It's like the difference between
13671f5207b7SJohn Levon * param_filter and param_set. When I think about it, I'm not
13681f5207b7SJohn Levon * sure it actually works. It's probably harmless because we
13691f5207b7SJohn Levon * checked earlier that we're not returning a parameter...
13701f5207b7SJohn Levon * Let's mark this as a TODO.
13711f5207b7SJohn Levon */
13721f5207b7SJohn Levon start_state = get_state_stree(start_states, my_id, sm->name, sm->sym);
13731f5207b7SJohn Levon if (start_state && rl_equiv(estate_rl(sm->state), estate_rl(start_state)))
13741f5207b7SJohn Levon continue;
13751f5207b7SJohn Levon
13761f5207b7SJohn Levon param_name = get_param_name(sm);
13771f5207b7SJohn Levon if (!param_name)
13781f5207b7SJohn Levon continue;
13791f5207b7SJohn Levon if (strcmp(param_name, "$") == 0) /* The -1 param is handled after the loop */
13801f5207b7SJohn Levon continue;
13811f5207b7SJohn Levon
1382c85f09ccSJohn Levon snprintf(buf, sizeof(buf), "%s%s%s",
1383efe51d0cSJohn Levon show_rl(estate_rl(sm->state)),
1384c85f09ccSJohn Levon estate_capped(sm->state) ? "[c]" : "",
1385c85f09ccSJohn Levon estate_treat_untagged(sm->state) ? "[u]" : "");
13861f5207b7SJohn Levon sql_insert_return_states(return_id, return_ranges,
1387efe51d0cSJohn Levon func_gets_user_data ? USER_DATA_SET : USER_DATA,
1388efe51d0cSJohn Levon param, param_name, buf);
13891f5207b7SJohn Levon } END_FOR_EACH_SM(sm);
13901f5207b7SJohn Levon
1391efe51d0cSJohn Levon /* This if for "return foo;" where "foo->bar" is user data. */
13921f5207b7SJohn Levon FOR_EACH_MY_SM(my_id, __get_cur_stree(), sm) {
13931f5207b7SJohn Levon if (!ret_sym)
13941f5207b7SJohn Levon break;
13951f5207b7SJohn Levon if (ret_sym != sm->sym)
13961f5207b7SJohn Levon continue;
13971f5207b7SJohn Levon
13981f5207b7SJohn Levon param_name = state_name_to_param_name(sm->name, return_str);
13991f5207b7SJohn Levon if (!param_name)
14001f5207b7SJohn Levon continue;
14011f5207b7SJohn Levon if (strcmp(param_name, "$") == 0)
14021f5207b7SJohn Levon return_found = true;
1403efe51d0cSJohn Levon if (strcmp(param_name, "*$") == 0)
1404efe51d0cSJohn Levon pointed_at_found = true;
1405c85f09ccSJohn Levon snprintf(buf, sizeof(buf), "%s%s%s",
1406efe51d0cSJohn Levon show_rl(estate_rl(sm->state)),
1407c85f09ccSJohn Levon estate_capped(sm->state) ? "[c]" : "",
1408c85f09ccSJohn Levon estate_treat_untagged(sm->state) ? "[u]" : "");
14091f5207b7SJohn Levon sql_insert_return_states(return_id, return_ranges,
1410efe51d0cSJohn Levon func_gets_user_data ? USER_DATA_SET : USER_DATA,
1411efe51d0cSJohn Levon -1, param_name, buf);
14121f5207b7SJohn Levon } END_FOR_EACH_SM(sm);
14131f5207b7SJohn Levon
1414efe51d0cSJohn Levon /* This if for "return ntohl(foo);" */
14151f5207b7SJohn Levon if (!return_found && get_user_rl(expr, &rl)) {
1416c85f09ccSJohn Levon snprintf(buf, sizeof(buf), "%s%s%s",
1417c85f09ccSJohn Levon show_rl(rl),
1418c85f09ccSJohn Levon user_rl_capped(expr) ? "[c]" : "",
1419c85f09ccSJohn Levon user_rl_treat_untagged(expr) ? "[u]" : "");
14201f5207b7SJohn Levon sql_insert_return_states(return_id, return_ranges,
1421efe51d0cSJohn Levon func_gets_user_data ? USER_DATA_SET : USER_DATA,
1422efe51d0cSJohn Levon -1, "$", buf);
1423efe51d0cSJohn Levon }
1424efe51d0cSJohn Levon
1425efe51d0cSJohn Levon /*
1426efe51d0cSJohn Levon * This is to handle things like return skb->data where we don't set a
1427efe51d0cSJohn Levon * state for that.
1428efe51d0cSJohn Levon */
1429efe51d0cSJohn Levon if (!pointed_at_found && points_to_user_data(expr)) {
1430efe51d0cSJohn Levon sql_insert_return_states(return_id, return_ranges,
1431efe51d0cSJohn Levon (is_skb_data(expr) || func_gets_user_data) ?
1432efe51d0cSJohn Levon USER_DATA_SET : USER_DATA,
1433efe51d0cSJohn Levon -1, "*$", "s64min-s64max");
14341f5207b7SJohn Levon }
14351f5207b7SJohn Levon
14361f5207b7SJohn Levon free_string(return_str);
14371f5207b7SJohn Levon }
14381f5207b7SJohn Levon
returns_param_capped(struct expression * expr,int param,char * key,char * value)1439efe51d0cSJohn Levon static void returns_param_capped(struct expression *expr, int param, char *key, char *value)
1440efe51d0cSJohn Levon {
1441efe51d0cSJohn Levon struct smatch_state *state, *new;
1442efe51d0cSJohn Levon struct symbol *sym;
1443efe51d0cSJohn Levon char *name;
1444efe51d0cSJohn Levon
1445efe51d0cSJohn Levon name = return_state_to_var_sym(expr, param, key, &sym);
1446efe51d0cSJohn Levon if (!name || !sym)
1447efe51d0cSJohn Levon goto free;
1448efe51d0cSJohn Levon
1449efe51d0cSJohn Levon state = get_state(my_id, name, sym);
1450efe51d0cSJohn Levon if (!state || estate_capped(state))
1451efe51d0cSJohn Levon goto free;
1452efe51d0cSJohn Levon
1453efe51d0cSJohn Levon new = clone_estate(state);
1454efe51d0cSJohn Levon estate_set_capped(new);
1455efe51d0cSJohn Levon
1456efe51d0cSJohn Levon set_state(my_id, name, sym, new);
1457efe51d0cSJohn Levon free:
1458efe51d0cSJohn Levon free_string(name);
1459efe51d0cSJohn Levon }
1460efe51d0cSJohn Levon
14611f5207b7SJohn Levon static struct int_stack *gets_data_stack;
match_function_def(struct symbol * sym)14621f5207b7SJohn Levon static void match_function_def(struct symbol *sym)
14631f5207b7SJohn Levon {
14641f5207b7SJohn Levon func_gets_user_data = false;
14651f5207b7SJohn Levon }
14661f5207b7SJohn Levon
match_inline_start(struct expression * expr)14671f5207b7SJohn Levon static void match_inline_start(struct expression *expr)
14681f5207b7SJohn Levon {
14691f5207b7SJohn Levon push_int(&gets_data_stack, func_gets_user_data);
14701f5207b7SJohn Levon }
14711f5207b7SJohn Levon
match_inline_end(struct expression * expr)14721f5207b7SJohn Levon static void match_inline_end(struct expression *expr)
14731f5207b7SJohn Levon {
14741f5207b7SJohn Levon func_gets_user_data = pop_int(&gets_data_stack);
14751f5207b7SJohn Levon }
14761f5207b7SJohn Levon
register_kernel_user_data(int id)1477efe51d0cSJohn Levon void register_kernel_user_data(int id)
14781f5207b7SJohn Levon {
14791f5207b7SJohn Levon int i;
14801f5207b7SJohn Levon
14811f5207b7SJohn Levon my_id = id;
14821f5207b7SJohn Levon
14831f5207b7SJohn Levon if (option_project != PROJ_KERNEL)
14841f5207b7SJohn Levon return;
14851f5207b7SJohn Levon
1486efe51d0cSJohn Levon set_dynamic_states(my_id);
1487efe51d0cSJohn Levon
14881f5207b7SJohn Levon add_hook(&match_function_def, FUNC_DEF_HOOK);
14891f5207b7SJohn Levon add_hook(&match_inline_start, INLINE_FN_START);
14901f5207b7SJohn Levon add_hook(&match_inline_end, INLINE_FN_END);
14911f5207b7SJohn Levon
14921f5207b7SJohn Levon add_hook(&save_start_states, AFTER_DEF_HOOK);
14931f5207b7SJohn Levon add_hook(&free_start_states, AFTER_FUNC_HOOK);
14941f5207b7SJohn Levon add_hook(&match_save_states, INLINE_FN_START);
14951f5207b7SJohn Levon add_hook(&match_restore_states, INLINE_FN_END);
14961f5207b7SJohn Levon
14971f5207b7SJohn Levon add_unmatched_state_hook(my_id, &empty_state);
14981f5207b7SJohn Levon add_extra_nomod_hook(&extra_nomod_hook);
14991f5207b7SJohn Levon add_pre_merge_hook(my_id, &pre_merge_hook);
15001f5207b7SJohn Levon add_merge_hook(my_id, &merge_estates);
15011f5207b7SJohn Levon
15021f5207b7SJohn Levon add_function_hook("copy_from_user", &match_user_copy, INT_PTR(0));
15031f5207b7SJohn Levon add_function_hook("__copy_from_user", &match_user_copy, INT_PTR(0));
15041f5207b7SJohn Levon add_function_hook("memcpy_fromiovec", &match_user_copy, INT_PTR(0));
15051f5207b7SJohn Levon for (i = 0; i < ARRAY_SIZE(kstr_funcs); i++)
15061f5207b7SJohn Levon add_function_hook(kstr_funcs[i], &match_user_copy, INT_PTR(2));
15071f5207b7SJohn Levon add_function_hook("usb_control_msg", &match_user_copy, INT_PTR(6));
15081f5207b7SJohn Levon
15091f5207b7SJohn Levon for (i = 0; i < ARRAY_SIZE(returns_user_data); i++) {
15101f5207b7SJohn Levon add_function_assign_hook(returns_user_data[i], &match_user_assign_function, NULL);
15111f5207b7SJohn Levon add_function_hook(returns_user_data[i], &match_returns_user_rl, NULL);
15121f5207b7SJohn Levon }
15131f5207b7SJohn Levon
15141f5207b7SJohn Levon add_function_hook("sscanf", &match_sscanf, NULL);
15151f5207b7SJohn Levon
15161f5207b7SJohn Levon add_hook(&match_syscall_definition, AFTER_DEF_HOOK);
15171f5207b7SJohn Levon
15181f5207b7SJohn Levon add_hook(&match_assign, ASSIGNMENT_HOOK);
1519efe51d0cSJohn Levon select_return_states_hook(PARAM_SET, &db_param_set);
15201f5207b7SJohn Levon add_hook(&match_condition, CONDITION_HOOK);
15211f5207b7SJohn Levon
15221f5207b7SJohn Levon add_hook(&match_call_info, FUNCTION_CALL_HOOK);
15231f5207b7SJohn Levon add_member_info_callback(my_id, struct_member_callback);
1524efe51d0cSJohn Levon select_caller_info_hook(set_param_user_data, USER_DATA);
1525efe51d0cSJohn Levon select_return_states_hook(USER_DATA, &returns_param_user_data);
1526efe51d0cSJohn Levon select_return_states_hook(USER_DATA_SET, &returns_param_user_data_set);
1527efe51d0cSJohn Levon select_return_states_hook(CAPPED_DATA, &returns_param_capped);
15281f5207b7SJohn Levon add_split_return_callback(¶m_set_to_user_data);
15291f5207b7SJohn Levon }
15301f5207b7SJohn Levon
register_kernel_user_data2(int id)1531efe51d0cSJohn Levon void register_kernel_user_data2(int id)
15321f5207b7SJohn Levon {
15331f5207b7SJohn Levon my_call_id = id;
15341f5207b7SJohn Levon
15351f5207b7SJohn Levon if (option_project != PROJ_KERNEL)
15361f5207b7SJohn Levon return;
15371f5207b7SJohn Levon select_caller_info_hook(set_called, INTERNAL);
15381f5207b7SJohn Levon }
1539c85f09ccSJohn Levon
1540