gcc/analyzer/sm-signal.cc

   1 /* An experimental state machine, for tracking bad calls from within
   2    signal handlers.
   3
   4    Copyright (C) 2019-2021 Free Software Foundation, Inc.
   5    Contributed by David Malcolm <dmalcolm@redhat.com>.
   6
   7 This file is part of GCC.
   8
   9 GCC is free software; you can redistribute it and/or modify it
  10 under the terms of the GNU General Public License as published by
  11 the Free Software Foundation; either version 3, or (at your option)
  12 any later version.
  13
  14 GCC is distributed in the hope that it will be useful, but
  15 WITHOUT ANY WARRANTY; without even the implied warranty of
  16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17 General Public License for more details.
  18
  19 You should have received a copy of the GNU General Public License
  20 along with GCC; see the file COPYING3.  If not see
  21 <http://www.gnu.org/licenses/>.  */
  22
  23 #include "config.h"
  24 #include "system.h"
  25 #include "coretypes.h"
  26 #include "tree.h"
  27 #include "function.h"
  28 #include "basic-block.h"
  29 #include "gimple.h"
  30 #include "options.h"
  31 #include "bitmap.h"
  32 #include "diagnostic-path.h"
  33 #include "diagnostic-metadata.h"
  34 #include "function.h"
  35 #include "json.h"
  36 #include "analyzer/analyzer.h"
  37 #include "diagnostic-event-id.h"
  38 #include "analyzer/analyzer-logging.h"
  39 #include "analyzer/sm.h"
  40 #include "analyzer/pending-diagnostic.h"
  41 #include "sbitmap.h"
  42 #include "tristate.h"
  43 #include "ordered-hash-map.h"
  44 #include "selftest.h"
  45 #include "analyzer/call-string.h"
  46 #include "analyzer/program-point.h"
  47 #include "analyzer/store.h"
  48 #include "analyzer/region-model.h"
  49 #include "analyzer/program-state.h"
  50 #include "analyzer/checker-path.h"
  51 #include "digraph.h"
  52 #include "cfg.h"
  53 #include "gimple-iterator.h"
  54 #include "cgraph.h"
  55 #include "analyzer/supergraph.h"
  56 #include "alloc-pool.h"
  57 #include "fibonacci_heap.h"
  58 #include "analyzer/diagnostic-manager.h"
  59 #include "shortest-paths.h"
  60 #include "analyzer/exploded-graph.h"
  61 #include "analyzer/function-set.h"
  62 #include "analyzer/analyzer-selftests.h"
  63
  64 #if ENABLE_ANALYZER
  65
  66 namespace ana {
  67
  68 namespace {
  69
  70 /* An experimental state machine, for tracking calls to async-signal-unsafe
  71    functions from within signal handlers.  */
  72
  73 class signal_state_machine : public state_machine
  74 {
  75 public:
  76   signal_state_machine (logger *logger);
  77
  78   bool inherited_state_p () const FINAL OVERRIDE { return false; }
  79
  80   bool on_stmt (sm_context *sm_ctxt,
  81                 const supernode *node,
  82                 const gimple *stmt) const FINAL OVERRIDE;
  83
  84   void on_condition (sm_context *sm_ctxt,
  85                      const supernode *node,
  86                      const gimple *stmt,
  87                      tree lhs,
  88                      enum tree_code op,
  89                      tree rhs) const FINAL OVERRIDE;
  90
  91   bool can_purge_p (state_t s) const FINAL OVERRIDE;
  92
  93   /* These states are "global", rather than per-expression.  */
  94
  95   /* State for when we're in a signal handler.  */
  96   state_t m_in_signal_handler;
  97
  98   /* Stop state.  */
  99   state_t m_stop;
 100 };
 101
 102 /* Concrete subclass for describing call to an async-signal-unsafe function
 103    from a signal handler.  */
 104
 105 class signal_unsafe_call
 106   : public pending_diagnostic_subclass<signal_unsafe_call>
 107 {
 108 public:
 109   signal_unsafe_call (const signal_state_machine &sm, const gcall *unsafe_call,
 110                       tree unsafe_fndecl)
 111   : m_sm (sm), m_unsafe_call (unsafe_call), m_unsafe_fndecl (unsafe_fndecl)
 112   {
 113     gcc_assert (m_unsafe_fndecl);
 114   }
 115
 116   const char *get_kind () const FINAL OVERRIDE { return "signal_unsafe_call"; }
 117
 118   bool operator== (const signal_unsafe_call &other) const
 119   {
 120     return m_unsafe_call == other.m_unsafe_call;
 121   }
 122
 123   bool emit (rich_location *rich_loc) FINAL OVERRIDE
 124   {
 125     auto_diagnostic_group d;
 126     diagnostic_metadata m;
 127     /* CWE-479: Signal Handler Use of a Non-reentrant Function.  */
 128     m.add_cwe (479);
 129     if (warning_meta (rich_loc, m,
 130                       OPT_Wanalyzer_unsafe_call_within_signal_handler,
 131                       "call to %qD from within signal handler",
 132                       m_unsafe_fndecl))
 133       {
 134         /* If we know a possible alternative function, add a note
 135            suggesting the replacement.  */
 136         if (const char *replacement = get_replacement_fn ())
 137           {
 138             location_t note_loc = gimple_location (m_unsafe_call);
 139             /* It would be nice to add a fixit, but the gimple call
 140                location covers the whole call expression.  It isn't
 141                currently possible to cut this down to just the call
 142                symbol.  So the fixit would replace too much.
 143                note_rich_loc.add_fixit_replace (replacement); */
 144             inform (note_loc,
 145                     "%qs is a possible signal-safe alternative for %qD",
 146                     replacement, m_unsafe_fndecl);
 147           }
 148         return true;
 149       }
 150     return false;
 151   }
 152
 153   label_text describe_state_change (const evdesc::state_change &change)
 154     FINAL OVERRIDE
 155   {
 156     if (change.is_global_p ()
 157         && change.m_new_state == m_sm.m_in_signal_handler)
 158       {
 159         function *handler = change.m_event.get_dest_function ();
 160         return change.formatted_print ("registering %qD as signal handler",
 161                                        handler->decl);
 162       }
 163     return label_text ();
 164   }
 165
 166   label_text describe_final_event (const evdesc::final_event &ev) FINAL OVERRIDE
 167   {
 168     return ev.formatted_print ("call to %qD from within signal handler",
 169                                m_unsafe_fndecl);
 170   }
 171
 172 private:
 173   const signal_state_machine &m_sm;
 174   const gcall *m_unsafe_call;
 175   tree m_unsafe_fndecl;
 176
 177   /* Returns a replacement function as text if it exists.  Currently
 178      only "exit" has a signal-safe replacement "_exit", which does
 179      slightly less, but can be used in a signal handler.  */
 180   const char *
 181   get_replacement_fn ()
 182   {
 183     gcc_assert (m_unsafe_fndecl && DECL_P (m_unsafe_fndecl));
 184
 185     if (id_equal ("exit", DECL_NAME (m_unsafe_fndecl)))
 186       return "_exit";
 187
 188     return NULL;
 189   }
 190 };
 191
 192 /* signal_state_machine's ctor.  */
 193
 194 signal_state_machine::signal_state_machine (logger *logger)
 195 : state_machine ("signal", logger)
 196 {
 197   m_in_signal_handler = add_state ("in_signal_handler");
 198   m_stop = add_state ("stop");
 199 }
 200
 201 /* Update MODEL for edges that simulate HANDLER_FUN being called as
 202    an signal-handler in response to a signal.  */
 203
 204 static void
 205 update_model_for_signal_handler (region_model *model,
 206                                  function *handler_fun)
 207 {
 208   gcc_assert (model);
 209   /* Purge all state within MODEL.  */
 210   *model = region_model (model->get_manager ());
 211   model->push_frame (handler_fun, NULL, NULL);
 212 }
 213
 214 /* Custom exploded_edge info: entry into a signal-handler.  */
 215
 216 class signal_delivery_edge_info_t : public exploded_edge::custom_info_t
 217 {
 218 public:
 219   void print (pretty_printer *pp) FINAL OVERRIDE
 220   {
 221     pp_string (pp, "signal delivered");
 222   }
 223
 224   json::object *to_json () const
 225   {
 226     json::object *custom_obj = new json::object ();
 227     return custom_obj;
 228   }
 229
 230   void update_model (region_model *model,
 231                      const exploded_edge &eedge) FINAL OVERRIDE
 232   {
 233     update_model_for_signal_handler (model, eedge.m_dest->get_function ());
 234   }
 235
 236   void add_events_to_path (checker_path *emission_path,
 237                            const exploded_edge &eedge ATTRIBUTE_UNUSED)
 238     FINAL OVERRIDE
 239   {
 240     emission_path->add_event
 241       (new custom_event (UNKNOWN_LOCATION, NULL_TREE, 0,
 242                          "later on,"
 243                          " when the signal is delivered to the process"));
 244   }
 245 };
 246
 247 /* Concrete subclass of custom_transition for modeling registration of a
 248    signal handler and the signal handler later being called.  */
 249
 250 class register_signal_handler : public custom_transition
 251 {
 252 public:
 253   register_signal_handler (const signal_state_machine &sm,
 254                            tree fndecl)
 255   : m_sm (sm), m_fndecl (fndecl) {}
 256
 257   /* Model a signal-handler FNDECL being called at some later point
 258      by injecting an edge to a new function-entry node with an empty
 259      callstring, setting the 'in-signal-handler' global state
 260      on the node.  */
 261   void impl_transition (exploded_graph *eg,
 262                         exploded_node *src_enode,
 263                         int sm_idx) FINAL OVERRIDE
 264   {
 265     function *handler_fun = DECL_STRUCT_FUNCTION (m_fndecl);
 266     if (!handler_fun)
 267       return;
 268     program_point entering_handler
 269       = program_point::from_function_entry (eg->get_supergraph (),
 270                                             handler_fun);
 271
 272     program_state state_entering_handler (eg->get_ext_state ());
 273     update_model_for_signal_handler (state_entering_handler.m_region_model,
 274                                      handler_fun);
 275     state_entering_handler.m_checker_states[sm_idx]->set_global_state
 276       (m_sm.m_in_signal_handler);
 277
 278     exploded_node *dst_enode = eg->get_or_create_node (entering_handler,
 279                                                        state_entering_handler,
 280                                                        src_enode);
 281     if (dst_enode)
 282       eg->add_edge (src_enode, dst_enode, NULL, /*state_change (),*/
 283                     new signal_delivery_edge_info_t ());
 284   }
 285
 286   const signal_state_machine &m_sm;
 287   tree m_fndecl;
 288 };
 289
 290 /* Get a set of functions that are known to be unsafe to call from an
 291    async signal handler.  */
 292
 293 static function_set
 294 get_async_signal_unsafe_fns ()
 295 {
 296   // TODO: populate this list more fully
 297   static const char * const async_signal_unsafe_fns[] = {
 298     /* This array must be kept sorted.  */
 299     "exit",
 300     "fprintf",
 301     "free",
 302     "malloc",
 303     "printf",
 304     "snprintf",
 305     "sprintf",
 306     "vfprintf",
 307     "vprintf",
 308     "vsnprintf",
 309     "vsprintf"
 310   };
 311   const size_t count
 312     = sizeof(async_signal_unsafe_fns) / sizeof (async_signal_unsafe_fns[0]);
 313   function_set fs (async_signal_unsafe_fns, count);
 314   return fs;
 315 }
 316
 317 /* Return true if FNDECL is known to be unsafe to call from a signal
 318    handler.  */
 319
 320 static bool
 321 signal_unsafe_p (tree fndecl)
 322 {
 323   function_set fs = get_async_signal_unsafe_fns ();
 324   return fs.contains_decl_p (fndecl);
 325 }
 326
 327 /* Implementation of state_machine::on_stmt vfunc for signal_state_machine.  */
 328
 329 bool
 330 signal_state_machine::on_stmt (sm_context *sm_ctxt,
 331                                const supernode *node,
 332                                const gimple *stmt) const
 333 {
 334   const state_t global_state = sm_ctxt->get_global_state ();
 335   if (global_state == m_start)
 336     {
 337       if (const gcall *call = dyn_cast <const gcall *> (stmt))
 338         if (tree callee_fndecl = sm_ctxt->get_fndecl_for_call (call))
 339           if (is_named_call_p (callee_fndecl, "signal", call, 2))
 340             {
 341               tree handler = gimple_call_arg (call, 1);
 342               if (TREE_CODE (handler) == ADDR_EXPR
 343                   && TREE_CODE (TREE_OPERAND (handler, 0)) == FUNCTION_DECL)
 344                 {
 345                   tree fndecl = TREE_OPERAND (handler, 0);
 346                   register_signal_handler rsh (*this, fndecl);
 347                   sm_ctxt->on_custom_transition (&rsh);
 348                 }
 349             }
 350     }
 351   else if (global_state == m_in_signal_handler)
 352     {
 353       if (const gcall *call = dyn_cast <const gcall *> (stmt))
 354         if (tree callee_fndecl = sm_ctxt->get_fndecl_for_call (call))
 355           if (signal_unsafe_p (callee_fndecl))
 356             if (sm_ctxt->get_global_state () == m_in_signal_handler)
 357               sm_ctxt->warn (node, stmt, NULL_TREE,
 358                              new signal_unsafe_call (*this, call,
 359                                                      callee_fndecl));
 360     }
 361
 362   return false;
 363 }
 364
 365 /* Implementation of state_machine::on_condition vfunc for
 366    signal_state_machine.  */
 367
 368 void
 369 signal_state_machine::on_condition (sm_context *sm_ctxt ATTRIBUTE_UNUSED,
 370                                     const supernode *node ATTRIBUTE_UNUSED,
 371                                     const gimple *stmt ATTRIBUTE_UNUSED,
 372                                     tree lhs ATTRIBUTE_UNUSED,
 373                                     enum tree_code op ATTRIBUTE_UNUSED,
 374                                     tree rhs ATTRIBUTE_UNUSED) const
 375 {
 376   // Empty
 377 }
 378
 379 bool
 380 signal_state_machine::can_purge_p (state_t s ATTRIBUTE_UNUSED) const
 381 {
 382   return true;
 383 }
 384
 385 } // anonymous namespace
 386
 387 /* Internal interface to this file. */
 388
 389 state_machine *
 390 make_signal_state_machine (logger *logger)
 391 {
 392   return new signal_state_machine (logger);
 393 }
 394
 395 #if CHECKING_P
 396
 397 namespace selftest {
 398
 399 /* Run all of the selftests within this file.  */
 400
 401 void
 402 analyzer_sm_signal_cc_tests ()
 403 {
 404   function_set fs = get_async_signal_unsafe_fns ();
 405   fs.assert_sorted ();
 406   fs.assert_sane ();
 407 }
 408
 409 } // namespace selftest
 410
 411 #endif /* CHECKING_P */
 412
 413 } // namespace ana
 414
 415 #endif /* #if ENABLE_ANALYZER */