1 /* An experimental state machine, for tracking bad calls from within
4 Copyright (C) 2019-2020 Free Software Foundation, Inc.
5 Contributed by David Malcolm <dmalcolm@redhat.com>.
7 This file is part of GCC.
9 GCC is free software; you can redistribute it and/or modify it
10 under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3, or (at your option)
14 GCC is distributed in the hope that it will be useful, but
15 WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with GCC; see the file COPYING3. If not see
21 <http://www.gnu.org/licenses/>. */
25 #include "coretypes.h"
28 #include "basic-block.h"
32 #include "diagnostic-path.h"
33 #include "diagnostic-metadata.h"
36 #include "analyzer/analyzer.h"
37 #include "diagnostic-event-id.h"
38 #include "analyzer/analyzer-logging.h"
39 #include "analyzer/sm.h"
40 #include "analyzer/pending-diagnostic.h"
43 #include "ordered-hash-map.h"
45 #include "analyzer/call-string.h"
46 #include "analyzer/program-point.h"
47 #include "analyzer/store.h"
48 #include "analyzer/region-model.h"
49 #include "analyzer/program-state.h"
50 #include "analyzer/checker-path.h"
53 #include "gimple-iterator.h"
55 #include "analyzer/supergraph.h"
56 #include "alloc-pool.h"
57 #include "fibonacci_heap.h"
58 #include "analyzer/diagnostic-manager.h"
59 #include "shortest-paths.h"
60 #include "analyzer/exploded-graph.h"
61 #include "analyzer/function-set.h"
62 #include "analyzer/analyzer-selftests.h"
70 /* An experimental state machine, for tracking calls to async-signal-unsafe
71 functions from within signal handlers. */
73 class signal_state_machine
: public state_machine
76 signal_state_machine (logger
*logger
);
78 bool inherited_state_p () const FINAL OVERRIDE
{ return false; }
80 bool on_stmt (sm_context
*sm_ctxt
,
81 const supernode
*node
,
82 const gimple
*stmt
) const FINAL OVERRIDE
;
84 void on_condition (sm_context
*sm_ctxt
,
85 const supernode
*node
,
89 tree rhs
) const FINAL OVERRIDE
;
91 bool can_purge_p (state_t s
) const FINAL OVERRIDE
;
93 /* These states are "global", rather than per-expression. */
95 /* State for when we're in a signal handler. */
96 state_t m_in_signal_handler
;
102 /* Concrete subclass for describing call to an async-signal-unsafe function
103 from a signal handler. */
105 class signal_unsafe_call
106 : public pending_diagnostic_subclass
<signal_unsafe_call
>
109 signal_unsafe_call (const signal_state_machine
&sm
, const gcall
*unsafe_call
,
111 : m_sm (sm
), m_unsafe_call (unsafe_call
), m_unsafe_fndecl (unsafe_fndecl
)
113 gcc_assert (m_unsafe_fndecl
);
116 const char *get_kind () const FINAL OVERRIDE
{ return "signal_unsafe_call"; }
118 bool operator== (const signal_unsafe_call
&other
) const
120 return m_unsafe_call
== other
.m_unsafe_call
;
123 bool emit (rich_location
*rich_loc
) FINAL OVERRIDE
125 auto_diagnostic_group d
;
126 diagnostic_metadata m
;
127 /* CWE-479: Signal Handler Use of a Non-reentrant Function. */
129 if (warning_meta (rich_loc
, m
,
130 OPT_Wanalyzer_unsafe_call_within_signal_handler
,
131 "call to %qD from within signal handler",
134 /* If we know a possible alternative function, add a note
135 suggesting the replacement. */
136 if (const char *replacement
= get_replacement_fn ())
138 location_t note_loc
= gimple_location (m_unsafe_call
);
139 /* It would be nice to add a fixit, but the gimple call
140 location covers the whole call expression. It isn't
141 currently possible to cut this down to just the call
142 symbol. So the fixit would replace too much.
143 note_rich_loc.add_fixit_replace (replacement); */
145 "%qs is a possible signal-safe alternative for %qD",
146 replacement
, m_unsafe_fndecl
);
153 label_text
describe_state_change (const evdesc::state_change
&change
)
156 if (change
.is_global_p ()
157 && change
.m_new_state
== m_sm
.m_in_signal_handler
)
159 function
*handler
= change
.m_event
.get_dest_function ();
160 return change
.formatted_print ("registering %qD as signal handler",
163 return label_text ();
166 label_text
describe_final_event (const evdesc::final_event
&ev
) FINAL OVERRIDE
168 return ev
.formatted_print ("call to %qD from within signal handler",
173 const signal_state_machine
&m_sm
;
174 const gcall
*m_unsafe_call
;
175 tree m_unsafe_fndecl
;
177 /* Returns a replacement function as text if it exists. Currently
178 only "exit" has a signal-safe replacement "_exit", which does
179 slightly less, but can be used in a signal handler. */
181 get_replacement_fn ()
183 gcc_assert (m_unsafe_fndecl
&& DECL_P (m_unsafe_fndecl
));
185 if (id_equal ("exit", DECL_NAME (m_unsafe_fndecl
)))
192 /* signal_state_machine's ctor. */
194 signal_state_machine::signal_state_machine (logger
*logger
)
195 : state_machine ("signal", logger
)
197 m_in_signal_handler
= add_state ("in_signal_handler");
198 m_stop
= add_state ("stop");
201 /* Update MODEL for edges that simulate HANDLER_FUN being called as
202 an signal-handler in response to a signal. */
205 update_model_for_signal_handler (region_model
*model
,
206 function
*handler_fun
)
209 /* Purge all state within MODEL. */
210 *model
= region_model (model
->get_manager ());
211 model
->push_frame (handler_fun
, NULL
, NULL
);
214 /* Custom exploded_edge info: entry into a signal-handler. */
216 class signal_delivery_edge_info_t
: public exploded_edge::custom_info_t
219 void print (pretty_printer
*pp
) FINAL OVERRIDE
221 pp_string (pp
, "signal delivered");
224 json::object
*to_json () const
226 json::object
*custom_obj
= new json::object ();
230 void update_model (region_model
*model
,
231 const exploded_edge
&eedge
) FINAL OVERRIDE
233 update_model_for_signal_handler (model
, eedge
.m_dest
->get_function ());
236 void add_events_to_path (checker_path
*emission_path
,
237 const exploded_edge
&eedge ATTRIBUTE_UNUSED
)
240 emission_path
->add_event
241 (new custom_event (UNKNOWN_LOCATION
, NULL_TREE
, 0,
243 " when the signal is delivered to the process"));
247 /* Concrete subclass of custom_transition for modeling registration of a
248 signal handler and the signal handler later being called. */
250 class register_signal_handler
: public custom_transition
253 register_signal_handler (const signal_state_machine
&sm
,
255 : m_sm (sm
), m_fndecl (fndecl
) {}
257 /* Model a signal-handler FNDECL being called at some later point
258 by injecting an edge to a new function-entry node with an empty
259 callstring, setting the 'in-signal-handler' global state
261 void impl_transition (exploded_graph
*eg
,
262 exploded_node
*src_enode
,
263 int sm_idx
) FINAL OVERRIDE
265 function
*handler_fun
= DECL_STRUCT_FUNCTION (m_fndecl
);
268 program_point entering_handler
269 = program_point::from_function_entry (eg
->get_supergraph (),
272 program_state
state_entering_handler (eg
->get_ext_state ());
273 update_model_for_signal_handler (state_entering_handler
.m_region_model
,
275 state_entering_handler
.m_checker_states
[sm_idx
]->set_global_state
276 (m_sm
.m_in_signal_handler
);
278 exploded_node
*dst_enode
= eg
->get_or_create_node (entering_handler
,
279 state_entering_handler
,
282 eg
->add_edge (src_enode
, dst_enode
, NULL
, /*state_change (),*/
283 new signal_delivery_edge_info_t ());
286 const signal_state_machine
&m_sm
;
290 /* Get a set of functions that are known to be unsafe to call from an
291 async signal handler. */
294 get_async_signal_unsafe_fns ()
296 // TODO: populate this list more fully
297 static const char * const async_signal_unsafe_fns
[] = {
298 /* This array must be kept sorted. */
312 = sizeof(async_signal_unsafe_fns
) / sizeof (async_signal_unsafe_fns
[0]);
313 function_set
fs (async_signal_unsafe_fns
, count
);
317 /* Return true if FNDECL is known to be unsafe to call from a signal
321 signal_unsafe_p (tree fndecl
)
323 function_set fs
= get_async_signal_unsafe_fns ();
324 return fs
.contains_decl_p (fndecl
);
327 /* Implementation of state_machine::on_stmt vfunc for signal_state_machine. */
330 signal_state_machine::on_stmt (sm_context
*sm_ctxt
,
331 const supernode
*node
,
332 const gimple
*stmt
) const
334 const state_t global_state
= sm_ctxt
->get_global_state ();
335 if (global_state
== m_start
)
337 if (const gcall
*call
= dyn_cast
<const gcall
*> (stmt
))
338 if (tree callee_fndecl
= sm_ctxt
->get_fndecl_for_call (call
))
339 if (is_named_call_p (callee_fndecl
, "signal", call
, 2))
341 tree handler
= gimple_call_arg (call
, 1);
342 if (TREE_CODE (handler
) == ADDR_EXPR
343 && TREE_CODE (TREE_OPERAND (handler
, 0)) == FUNCTION_DECL
)
345 tree fndecl
= TREE_OPERAND (handler
, 0);
346 register_signal_handler
rsh (*this, fndecl
);
347 sm_ctxt
->on_custom_transition (&rsh
);
351 else if (global_state
== m_in_signal_handler
)
353 if (const gcall
*call
= dyn_cast
<const gcall
*> (stmt
))
354 if (tree callee_fndecl
= sm_ctxt
->get_fndecl_for_call (call
))
355 if (signal_unsafe_p (callee_fndecl
))
356 if (sm_ctxt
->get_global_state () == m_in_signal_handler
)
357 sm_ctxt
->warn (node
, stmt
, NULL_TREE
,
358 new signal_unsafe_call (*this, call
,
365 /* Implementation of state_machine::on_condition vfunc for
366 signal_state_machine. */
369 signal_state_machine::on_condition (sm_context
*sm_ctxt ATTRIBUTE_UNUSED
,
370 const supernode
*node ATTRIBUTE_UNUSED
,
371 const gimple
*stmt ATTRIBUTE_UNUSED
,
372 tree lhs ATTRIBUTE_UNUSED
,
373 enum tree_code op ATTRIBUTE_UNUSED
,
374 tree rhs ATTRIBUTE_UNUSED
) const
380 signal_state_machine::can_purge_p (state_t s ATTRIBUTE_UNUSED
) const
385 } // anonymous namespace
387 /* Internal interface to this file. */
390 make_signal_state_machine (logger
*logger
)
392 return new signal_state_machine (logger
);
399 /* Run all of the selftests within this file. */
402 analyzer_sm_signal_cc_tests ()
404 function_set fs
= get_async_signal_unsafe_fns ();
409 } // namespace selftest
411 #endif /* CHECKING_P */
415 #endif /* #if ENABLE_ANALYZER */