From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <smatch-owner@vger.kernel.org>
Received: from aserp2130.oracle.com ([141.146.126.79]:51910 "EHLO
        aserp2130.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S241436AbhELRPR (ORCPT
        <rfc822;smatch@vger.kernel.org>); Wed, 12 May 2021 13:15:17 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc
 : subject : message-id : references : mime-version : content-type :
 in-reply-to; s=corp-2020-01-29;
 bh=XTqQbFQeKY6B5Ctq5gpIaCivJnCFEmfAsrT0/euDKMQ=;
 b=U/GBcwVAMH58wuxpMgdyuSRqx7yM+tt94zUjshdb7//CEXKsUhPiNbmh8hj2NqjjrHaV
 Ym5673Tecg/3XqC4uz1C9rYDOOxxsFTPOx6tcPiQVFNVDFEnLyKuccp24XLigoA7iUIB
 5y8BcFylAju5BEx/zxBSy4t3W1SeddrJ48VCoBOJ0/EItZeKd3IB5qw2onPiUYMbKGGy
 nzmXd5EgebCzcbfjrxBVAke83TiLUPui95U6cJPP0lCzF5Bz4QrLWUw6YI3pIOOdA/qF
 36odyXVYR+y6T7Z8cqR2RcNJKzVQSUWGGFMELwqf3Oy3mvk/djaI9GiH45H9laU6aRia PA== 
Date: Wed, 12 May 2021 20:13:59 +0300
From: Dan Carpenter <dan.carpenter@oracle.com>
Subject: Re: Retrieving status of local variables
Message-ID: <20210512171358.GY1955@kadam>
References: <c9490a36-2d71-7181-762b-03295b9e6956@amazon.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <c9490a36-2d71-7181-762b-03295b9e6956@amazon.de>
List-ID: <smatch.vger.kernel.org>
To: Norbert Manthey <nmanthey@amazon.de>
Cc: smatch@vger.kernel.org

On Wed, May 12, 2021 at 05:15:06PM +0200, Norbert Manthey wrote:
> Dear all,
> 
> I would like to retrieve the information whether variables inside source
> files can be influenced from user land, e.g. to identify variables that
> store arguments to syscalls. Is there already a tool that offers this
> feature?
> 
> I understand that the 'smatch_data/db/smdb.py $func' tool can be used to
> trace calls to a function $func. Furthermore, 'smatch_data/db/smdb.py
> trace_param $func' allows to trace how function parameters are traced.
> However, both commands do not present the information I am looking for.
> I also did not find such labels in the tables of the created data base file.

Yes.  This is information is recorded in the DB.

$ smdb esas2r_read_vda | grep USER
drivers/scsi/esas2r/esas2r_ioctl.c | esas2r_ioctl_handler |      esas2r_read_vda |          USER_DATA |  3 |           count | s32min-s32max

The s32min-s32max is the range the user can set it to.  Smatch tracks
tagged pointers in ARM but I didn't write that code and don't remember
the details.  If the data is capped against an unknown value then there
would be a [c] "s32min-s32max[c]"

	if (foo < 100)
		<-- foo is "s32min-99[c]"

	if (foo < x)
		<-- foo is "s32min-s32max[c]"

There is also USER_PTR which records that an array holds user controlled
data.  There are a few different sources of user controlled information:
syscalls, kstrtoul(), sscanf(), copy_from_user(), kvm_register_read()
and skb->data.  I thought kmap() was in there, but I can't see it now.
memdup_user() uses copy_from_user() so it doesn't need to be hardcoded
in.

The code for this is in smatch_kernel_user_data.c and
smatch_points_to_user_data.c

You'll want to rebuild the cross function DB probably 5-7 times to build
out the call tree.

Let me know if you find any bugs in this because tracking user
controlled data is very important for me.  Subtraction is complicated to
handle properly so a lot of times at the end of subtraction Smatch will
just mark it as unknown but user controlled data.

regards,
dan carpenter