1 /* 2 * Copyright (C) 2010 Dan Carpenter. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 2 7 * of the License, or (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt 16 */ 17 18 #include "smatch.h" 19 #include "smatch_slist.h" 20 21 static int my_id; 22 23 STATE(alloced); 24 STATE(string); 25 26 static char *my_get_variable(struct expression *expr, struct symbol **sym) 27 { 28 char *name; 29 30 name = expr_to_var_sym(expr, sym); 31 free_string(name); 32 if (!name || !*sym) 33 return NULL; 34 35 return (*sym)->ident->name; 36 } 37 38 static void match_kmalloc(const char *fn, struct expression *expr, void *unused) 39 { 40 char *name; 41 struct symbol *sym; 42 43 name = my_get_variable(expr->left, &sym); 44 if (!name) 45 return; 46 set_state(my_id, name, sym, &alloced); 47 } 48 49 static void match_strcpy(const char *fn, struct expression *expr, void *unused) 50 { 51 struct expression *dest; 52 char *name; 53 struct symbol *sym; 54 55 dest = get_argument_from_call_expr(expr->args, 0); 56 name = my_get_variable(dest, &sym); 57 if (!name || !sym) 58 return; 59 if (!get_state(my_id, name, sym)) 60 return; 61 set_state(my_id, name, sym, &string); 62 } 63 64 static void match_copy_to_user(const char *fn, struct expression *expr, void *unused) 65 { 66 struct expression *src; 67 char *name; 68 struct symbol *sym; 69 struct sm_state *sm; 70 71 src = get_argument_from_call_expr(expr->args, 1); 72 name = my_get_variable(src, &sym); 73 if (!name || !sym) 74 return; 75 sm = get_sm_state(my_id, name, sym); 76 if (!sm || !slist_has_state(sm->possible, &string)) 77 return; 78 name = expr_to_var(src); 79 sm_warning("possible info leak '%s'", name); 80 free_string(name); 81 } 82 83 void check_info_leak(int id) 84 { 85 if (option_project != PROJ_KERNEL) 86 return; 87 my_id = id; 88 add_function_assign_hook("kmalloc", &match_kmalloc, NULL); 89 add_function_hook("strcpy", &match_strcpy, NULL); 90 add_function_hook("strlcpy", &match_strcpy, NULL); 91 add_function_hook("strlcat", &match_strcpy, NULL); 92 add_function_hook("strncpy", &match_strcpy, NULL); 93 add_function_hook("copy_to_user", &match_copy_to_user, NULL); 94 } 95