Hi @4B5F5F4B,

This is indeed an annoying issue. Finding the macro uses is easy (using MacroInvocation and the related classes), but associating the macro uses with a parameter is very difficult since macros don't fit nicely into the AST (as it's just text being expanded). So there's no good way to do it other than hacking it via locations. This is how I'd do it, I think:

import cpp

pragma[inline]
predicate isBefore(Location l1, Location l2) {
  l1.getFile() = l2.getFile() and
  (
    l1.getEndLine() < l2.getStartLine()
    or
    l1.getEndLine() = l2.getStartLine() and
    l1.getEndColumn() < l2.getStartColumn()
  )
}

predicate isUserParameter(Parameter p) {
  exists(MacroInvocation m |
    p =
      min(Parameter q, TypeMention tm |
        q.getType().stripType() = tm.getMentionedType() and
        m.getMacroName() = "__user" and
        isBefore(tm.getLocation(), m.getLocation()) and
        isBefore(m.getLocation(), q.getLocation())
      |
        q order by q.getIndex()
      )
  )
}

from Parameter p
where isUserParameter(p)
select p, "This parameter is annotated with '__user'."

The idea is that we want, given a parameter Foo* __user x, we want to find a use of the __user macro whose location is in between the type Foo* and the parameter name x.

Let's start by getting the location of the type Foo*: We can't do this in general, but if the type happens to be a user type (like a struct) we can use the TypeMention class to find a use of the type and its location.

Then we want to find the location of the parameter name. Luckily, this is easy. We can just use the location of the Parameter itself.

(Note that the Location class does come with an isBefore predicate, but for some reason that only compares line numbers and not column numbers. So it'll be slightly more robust if you use the predicate is supplied here.)

I hope that helps!

e predi

Hello @MathiasVP ,

First of all I should thank you for your reply and solution. I can't agree with you more that there is no good way other than hacking via Location, which is quite clearly demonstrated by your code. I'm inspired by your code a lot, thank you. But frankly speaking, too much Location comparison will make it incredibly slow for large codebase like Linux kernel :(
Maybe some speicific optimization is needed in the core engine in CodeQL, I'm looking forward to it:)

Thank you for your help again.

But frankly speaking, too much Location comparison will make it incredibly slow for large codebase like Linux kernel :(

I agree :( This solution is really pushing the limits of what you're meant to do with locations. It's not really the Location comparisons that make it slow - the query is optimized incorrectly (i.e., it's accumulating constraints in a non-optimal order) causing slow evaluation. It might be difficult to speed it up, but I'll see if I can do anything about it.

Unfortunately these queries do not match all __user macro indications in function parameters, due to TypeMention only covering user-defined types, per #13214.

For example it doesn't match on copy_from_user and copy_to_user, because these have void * built-in type with __user annotation:

include/linux/uaccess.h

static __always_inline unsigned long __must_check
copy_from_user(void *to, const void __user *from, unsigned long n)
{
	if (likely(check_copy_size(to, n, false)))
		n = _copy_from_user(to, from, n);
	return n;
}

static __always_inline unsigned long __must_check
copy_to_user(void __user *to, const void *from, unsigned long n)
{
	if (likely(check_copy_size(from, n, true)))
		n = _copy_to_user(to, from, n);
	return n;
}