From patchwork Fri Dec 13 18:11:22 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 1209381 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=gcc.gnu.org (client-ip=209.132.180.131; helo=sourceware.org; envelope-from=gcc-patches-return-515963-incoming=patchwork.ozlabs.org@gcc.gnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=gcc.gnu.org header.i=@gcc.gnu.org header.b="b1RJK0pm"; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.b="TzS6Nwk3"; dkim-atps=neutral Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 47ZJym1XnRz9sPJ for ; Sat, 14 Dec 2019 05:26:23 +1100 (AEDT) DomainKey-Signature: a=rsa-sha1; c=nofws; d=gcc.gnu.org; h=list-id :list-unsubscribe:list-archive:list-post:list-help:sender:from :to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-type:content-transfer-encoding; q=dns; s= default; b=pKMUtRZd4G8brL+J7QbSm8A6T+SSv6c+3uDFeN1ydkqxfE1THBVOD c5Uf2niWP3fnFdquuNYVlPxWhlo3zr5/2skPwyeh1VfHznhQpB9QF0H9mAquGB1L qFNGUqv8chsaMRAVCr+8du7DnhaahwDC1J7LjwKpl/Y78vwreTXJ5Y= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=gcc.gnu.org; h=list-id :list-unsubscribe:list-archive:list-post:list-help:sender:from :to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-type:content-transfer-encoding; s=default; bh=KNMC284+lpu5QJJKbwvbqS8FErw=; b=b1RJK0pmUqQlH6cq7KZLB7d7vGnQ ya78GMJ8wAThhpbsQw7Yx0lcF7bwRafWbbPgNkRZgZot5ZIM+vwvQUco+cl0RqQw LU+Id25vutYgpxb0tpu8F2gZs2KJwxr7j/ukqNlhNmsBBc1AZwq3wMjdPnog2GIC TRerSRhBvNDp0p8= Received: (qmail 3574 invoked by alias); 13 Dec 2019 18:16:30 -0000 Mailing-List: contact gcc-patches-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Archive: List-Post: List-Help: Sender: gcc-patches-owner@gcc.gnu.org Delivered-To: mailing list gcc-patches@gcc.gnu.org Received: (qmail 114026 invoked by uid 89); 13 Dec 2019 18:14:06 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-23.1 required=5.0 tests=AWL, BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_SHORT, SPF_PASS autolearn=ham version=3.3.1 spammy= X-HELO: us-smtp-1.mimecast.com Received: from us-smtp-delivery-1.mimecast.com (HELO us-smtp-1.mimecast.com) (207.211.31.120) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Fri, 13 Dec 2019 18:14:03 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1576260841; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=IQDmwvpXJJJV4GDnL7sr0oy8iBrR+MTg6GPWIqTyfwY=; b=TzS6Nwk3m79al1c4dVZdcui8N3qT8tpXBqG7V0M/acqjI4Fwc4G1r3gqXRTQyBKlollsUm 8PY1m9MioE0VaheAA/RmnyuGa6c1y/vwzJT6ij5yqVpaT7qJDPPnjgVO0TgzxPZFKwtIzN PCV4ILDCur2jELNJIt0heTefSWWs/y8= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-244-NceMJ7I5NAGN7FwaiHdLPg-1; Fri, 13 Dec 2019 13:11:59 -0500 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id D31C3107ACC7 for ; Fri, 13 Dec 2019 18:11:58 +0000 (UTC) Received: from t470.redhat.com (ovpn-117-164.phx2.redhat.com [10.3.117.164]) by smtp.corp.redhat.com (Postfix) with ESMTP id 717D55C219; Fri, 13 Dec 2019 18:11:58 +0000 (UTC) From: David Malcolm To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [PATCH 33/45] analyzer: new file: sm-signal.cc Date: Fri, 13 Dec 2019 13:11:22 -0500 Message-Id: <20191213181134.1830-34-dmalcolm@redhat.com> In-Reply-To: <20191213181134.1830-1-dmalcolm@redhat.com> References: <20191213181134.1830-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-IsSubscribed: yes New in v4; part of: https://gcc.gnu.org/ml/gcc-patches/2019-12/msg00214.html with various fixups gcc/ChangeLog: * analyzer/sm-signal.cc: New file. --- gcc/analyzer/sm-signal.cc | 306 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 306 insertions(+) create mode 100644 gcc/analyzer/sm-signal.cc diff --git a/gcc/analyzer/sm-signal.cc b/gcc/analyzer/sm-signal.cc new file mode 100644 index 000000000000..e01ff30d9172 --- /dev/null +++ b/gcc/analyzer/sm-signal.cc @@ -0,0 +1,306 @@ +/* An experimental state machine, for tracking bad calls from within + signal handlers. + + Copyright (C) 2019 Free Software Foundation, Inc. + Contributed by David Malcolm . + +This file is part of GCC. + +GCC is free software; you can redistribute it and/or modify it +under the terms of the GNU General Public License as published by +the Free Software Foundation; either version 3, or (at your option) +any later version. + +GCC is distributed in the hope that it will be useful, but +WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +General Public License for more details. + +You should have received a copy of the GNU General Public License +along with GCC; see the file COPYING3. If not see +. */ + +#include "config.h" +#include "system.h" +#include "coretypes.h" +#include "tree.h" +#include "function.h" +#include "basic-block.h" +#include "gimple.h" +#include "diagnostic-path.h" +#include "diagnostic-metadata.h" +#include "analyzer/analyzer.h" +#include "analyzer/checker-path.h" +#include "analyzer/exploded-graph.h" +#include "analyzer/pending-diagnostic.h" +#include "analyzer/sm.h" + +#if ENABLE_ANALYZER + +namespace { + +/* An experimental state machine, for tracking calls to async-signal-unsafe + functions from within signal handlers. */ + +class signal_state_machine : public state_machine +{ +public: + signal_state_machine (logger *logger); + + bool inherited_state_p () const FINAL OVERRIDE { return false; } + + bool on_stmt (sm_context *sm_ctxt, + const supernode *node, + const gimple *stmt) const FINAL OVERRIDE; + + void on_condition (sm_context *sm_ctxt, + const supernode *node, + const gimple *stmt, + tree lhs, + enum tree_code op, + tree rhs) const FINAL OVERRIDE; + + bool can_purge_p (state_t s) const FINAL OVERRIDE; + + /* These states are "global", rather than per-expression. */ + + /* Start state. */ + state_t m_start; + + /* State for when we're in a signal handler. */ + state_t m_in_signal_handler; + + /* Stop state. */ + state_t m_stop; +}; + +/* Concrete subclass for describing call to an async-signal-unsafe function + from a signal handler. */ + +class signal_unsafe_call + : public pending_diagnostic_subclass +{ +public: + signal_unsafe_call (const signal_state_machine &sm, const gcall *unsafe_call, + tree unsafe_fndecl) + : m_sm (sm), m_unsafe_call (unsafe_call), m_unsafe_fndecl (unsafe_fndecl) + { + gcc_assert (m_unsafe_fndecl); + } + + const char *get_kind () const FINAL OVERRIDE { return "signal_unsafe_call"; } + + bool operator== (const signal_unsafe_call &other) const + { + return m_unsafe_call == other.m_unsafe_call; + } + + bool emit (rich_location *rich_loc) FINAL OVERRIDE + { + diagnostic_metadata m; + /* CWE-479: Signal Handler Use of a Non-reentrant Function. */ + m.add_cwe (479); + return warning_at (rich_loc, m, + OPT_Wanalyzer_unsafe_call_within_signal_handler, + "call to %qD from within signal handler", + m_unsafe_fndecl); + } + + label_text describe_state_change (const evdesc::state_change &change) + FINAL OVERRIDE + { + if (change.is_global_p () + && change.m_new_state == m_sm.m_in_signal_handler) + { + function *handler + = change.m_event.m_dst_state.m_region_model->get_current_function (); + return change.formatted_print ("registering %qD as signal handler", + handler->decl); + } + return label_text (); + } + + label_text describe_final_event (const evdesc::final_event &ev) FINAL OVERRIDE + { + return ev.formatted_print ("call to %qD from within signal handler", + m_unsafe_fndecl); + } + +private: + const signal_state_machine &m_sm; + const gcall *m_unsafe_call; + tree m_unsafe_fndecl; +}; + +/* signal_state_machine's ctor. */ + +signal_state_machine::signal_state_machine (logger *logger) +: state_machine ("signal", logger) +{ + m_start = add_state ("start"); + m_in_signal_handler = add_state ("in_signal_handler"); + m_stop = add_state ("stop"); +} + +/* Update MODEL for edges that simulate HANDLER_FUN being called as + an signal-handler in response to a signal. */ + +static void +update_model_for_signal_handler (region_model *model, + function *handler_fun) +{ + /* Purge all state within MODEL. */ + *model = region_model (); + model->push_frame (handler_fun, NULL, NULL); +} + +/* Custom exploded_edge info: entry into a signal-handler. */ + +class signal_delivery_edge_info_t : public exploded_edge::custom_info_t +{ +public: + void print (pretty_printer *pp) FINAL OVERRIDE + { + pp_string (pp, "signal delivered"); + } + + void update_model (region_model *model, + const exploded_edge &eedge) FINAL OVERRIDE + { + update_model_for_signal_handler (model, eedge.m_dest->get_function ()); + } + + void add_events_to_path (checker_path *emission_path, + const exploded_edge &eedge ATTRIBUTE_UNUSED) + FINAL OVERRIDE + { + emission_path->add_event + (new custom_event (UNKNOWN_LOCATION, NULL_TREE, 0, + "later on," + " when the signal is delivered to the process")); + } +}; + +/* Concrete subclass of custom_transition for modeling registration of a + signal handler and the signal handler later being called. */ + +class register_signal_handler : public custom_transition +{ +public: + register_signal_handler (const signal_state_machine &sm, + tree fndecl) + : m_sm (sm), m_fndecl (fndecl) {} + + /* Model a signal-handler FNDECL being called at some later point + by injecting an edge to a new function-entry node with an empty + callstring, setting the 'in-signal-handler' global state + on the node. */ + void impl_transition (exploded_graph *eg, + exploded_node *src_enode, + int sm_idx) FINAL OVERRIDE + { + function *handler_fun = DECL_STRUCT_FUNCTION (m_fndecl); + if (!handler_fun) + return; + program_point entering_handler + = program_point::from_function_entry (eg->get_supergraph (), + handler_fun); + + program_state state_entering_handler (eg->get_ext_state ()); + update_model_for_signal_handler (state_entering_handler.m_region_model, + handler_fun); + state_entering_handler.m_checker_states[sm_idx]->set_global_state + (m_sm.m_in_signal_handler); + + exploded_node *dst_enode = eg->get_or_create_node (entering_handler, + state_entering_handler, + NULL); + if (dst_enode) + eg->add_edge (src_enode, dst_enode, NULL, state_change (), + new signal_delivery_edge_info_t ()); + } + + const signal_state_machine &m_sm; + tree m_fndecl; +}; + +/* Return true if CALL is known to be unsafe to call from a signal handler. */ + +static bool +signal_unsafe_p (tree callee_fndecl) +{ + // TODO: maintain a list of known unsafe functions + if (is_named_call_p (callee_fndecl, "fprintf")) + return true; + + return false; +} + +/* Implementation of state_machine::on_stmt vfunc for signal_state_machine. */ + +bool +signal_state_machine::on_stmt (sm_context *sm_ctxt, + const supernode *node, + const gimple *stmt) const +{ + const state_t global_state = sm_ctxt->get_global_state (); + if (global_state == m_start) + { + if (const gcall *call = dyn_cast (stmt)) + if (tree callee_fndecl = sm_ctxt->get_fndecl_for_call (call)) + if (is_named_call_p (callee_fndecl, "signal", call, 2)) + { + tree handler = gimple_call_arg (call, 1); + if (TREE_CODE (handler) == ADDR_EXPR + && TREE_CODE (TREE_OPERAND (handler, 0)) == FUNCTION_DECL) + { + tree fndecl = TREE_OPERAND (handler, 0); + register_signal_handler rsh (*this, fndecl); + sm_ctxt->on_custom_transition (&rsh); + } + } + } + else if (global_state == m_in_signal_handler) + { + if (const gcall *call = dyn_cast (stmt)) + if (tree callee_fndecl = sm_ctxt->get_fndecl_for_call (call)) + if (signal_unsafe_p (callee_fndecl)) + sm_ctxt->warn_for_state (node, stmt, NULL_TREE, m_in_signal_handler, + new signal_unsafe_call (*this, call, + callee_fndecl)); + } + + return false; +} + +/* Implementation of state_machine::on_condition vfunc for + signal_state_machine. */ + +void +signal_state_machine::on_condition (sm_context *sm_ctxt ATTRIBUTE_UNUSED, + const supernode *node ATTRIBUTE_UNUSED, + const gimple *stmt ATTRIBUTE_UNUSED, + tree lhs ATTRIBUTE_UNUSED, + enum tree_code op ATTRIBUTE_UNUSED, + tree rhs ATTRIBUTE_UNUSED) const +{ + // Empty +} + +bool +signal_state_machine::can_purge_p (state_t s ATTRIBUTE_UNUSED) const +{ + return true; +} + +} // anonymous namespace + +/* Internal interface to this file. */ + +state_machine * +make_signal_state_machine (logger *logger) +{ + return new signal_state_machine (logger); +} + +#endif /* #if ENABLE_ANALYZER */