1 // SPDX-License-Identifier: GPL-2.0-only 1 // SPDX-License-Identifier: GPL-2.0-only
2 /// 2 ///
3 /// Use kfree_sensitive, kvfree_sensitive rath 3 /// Use kfree_sensitive, kvfree_sensitive rather than memset or
4 /// memzero_explicit followed by kfree. 4 /// memzero_explicit followed by kfree.
5 /// 5 ///
6 // Confidence: High 6 // Confidence: High
7 // Copyright: (C) 2020 Denis Efremov ISPRAS 7 // Copyright: (C) 2020 Denis Efremov ISPRAS
8 // Options: --no-includes --include-headers 8 // Options: --no-includes --include-headers
9 // 9 //
10 // Keywords: kfree_sensitive, kvfree_sensitive 10 // Keywords: kfree_sensitive, kvfree_sensitive
11 // 11 //
12 12
13 virtual context 13 virtual context
14 virtual patch 14 virtual patch
15 virtual org 15 virtual org
16 virtual report 16 virtual report
17 17
18 @initialize:python@ 18 @initialize:python@
19 @@ 19 @@
20 # kmalloc_oob_in_memset uses memset to explici 20 # kmalloc_oob_in_memset uses memset to explicitly trigger out-of-bounds access
21 filter = frozenset(['kmalloc_oob_in_memset', 21 filter = frozenset(['kmalloc_oob_in_memset',
22 'kfree_sensitive', 'kvfree 22 'kfree_sensitive', 'kvfree_sensitive'])
23 23
24 def relevant(p): 24 def relevant(p):
25 return not (filter & {el.current_element f 25 return not (filter & {el.current_element for el in p})
26 26
27 @cond@ 27 @cond@
28 position ok; 28 position ok;
29 @@ 29 @@
30 30
31 if (...) 31 if (...)
32 \(memset@ok\|memzero_explicit@ok\)(...); 32 \(memset@ok\|memzero_explicit@ok\)(...);
33 33
34 @r depends on !patch forall@ 34 @r depends on !patch forall@
35 expression E; 35 expression E;
36 position p : script:python() { relevant(p) }; 36 position p : script:python() { relevant(p) };
37 position m != cond.ok; 37 position m != cond.ok;
38 type T; 38 type T;
39 @@ 39 @@
40 40
41 ( 41 (
42 * memset@m((T)E, 0, ...); 42 * memset@m((T)E, 0, ...);
43 | 43 |
44 * memzero_explicit@m((T)E, ...); 44 * memzero_explicit@m((T)E, ...);
45 ) 45 )
46 ... when != E 46 ... when != E
47 when strict 47 when strict
48 * \(kfree\|vfree\|kvfree\)(E)@p; 48 * \(kfree\|vfree\|kvfree\)(E)@p;
49 49
50 @rp_memzero depends on patch@ 50 @rp_memzero depends on patch@
51 expression E, size; 51 expression E, size;
52 position p : script:python() { relevant(p) }; 52 position p : script:python() { relevant(p) };
53 position m != cond.ok; 53 position m != cond.ok;
54 type T; 54 type T;
55 @@ 55 @@
56 56
57 - memzero_explicit@m((T)E, size); 57 - memzero_explicit@m((T)E, size);
58 ... when != E 58 ... when != E
59 when strict 59 when strict
60 ( 60 (
61 - kfree(E)@p; 61 - kfree(E)@p;
62 + kfree_sensitive(E); 62 + kfree_sensitive(E);
63 | 63 |
64 - \(vfree\|kvfree\)(E)@p; 64 - \(vfree\|kvfree\)(E)@p;
65 + kvfree_sensitive(E, size); 65 + kvfree_sensitive(E, size);
66 ) 66 )
67 67
68 @rp_memset depends on patch@ 68 @rp_memset depends on patch@
69 expression E, size; 69 expression E, size;
70 position p : script:python() { relevant(p) }; 70 position p : script:python() { relevant(p) };
71 position m != cond.ok; 71 position m != cond.ok;
72 type T; 72 type T;
73 @@ 73 @@
74 74
75 - memset@m((T)E, 0, size); 75 - memset@m((T)E, 0, size);
76 ... when != E 76 ... when != E
77 when strict 77 when strict
78 ( 78 (
79 - kfree(E)@p; 79 - kfree(E)@p;
80 + kfree_sensitive(E); 80 + kfree_sensitive(E);
81 | 81 |
82 - \(vfree\|kvfree\)(E)@p; 82 - \(vfree\|kvfree\)(E)@p;
83 + kvfree_sensitive(E, size); 83 + kvfree_sensitive(E, size);
84 ) 84 )
85 85
86 @script:python depends on report@ 86 @script:python depends on report@
87 p << r.p; 87 p << r.p;
88 m << r.m; 88 m << r.m;
89 @@ 89 @@
90 90
91 msg = "WARNING opportunity for kfree_sensitive 91 msg = "WARNING opportunity for kfree_sensitive/kvfree_sensitive (memset at line %s)"
92 coccilib.report.print_report(p[0], msg % (m[0] 92 coccilib.report.print_report(p[0], msg % (m[0].line))
93 93
94 @script:python depends on org@ 94 @script:python depends on org@
95 p << r.p; 95 p << r.p;
96 m << r.m; 96 m << r.m;
97 @@ 97 @@
98 98
99 msg = "WARNING opportunity for kfree_sensitive 99 msg = "WARNING opportunity for kfree_sensitive/kvfree_sensitive (memset at line %s)"
100 coccilib.org.print_todo(p[0], msg % (m[0].line 100 coccilib.org.print_todo(p[0], msg % (m[0].line))
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.