Explore performing taint-tracking of writes to kernel addresses that came from userspace

[kees]

It should be possible to perform taint tracking of addresses (or any data, really) in the kernel to avoid flaws of the form:

copy_from_user(object, src, ...);
...
*no validation of object.address*
...
memcpy(object.address, something, ...);

We need better tooling to perform this kind of "taint tracking" within the kernel to better catch cases where validation is missing.

On the static analysis front:

• Using the __user annotation and the "address space" checks sparse does, but its application has been rather limited in scope.
• smatch is likely better suited to the job, using function-graph data-flow analysis.
• There's also CodeQL which might be able to construct queries that track where things end up in structs.

Better yet would be run-time analysis:

• DataFlowSanitizer would need to be ported to work in the kernel.