1 /* An experimental state machine, for tracking bad calls from within
4 Copyright (C) 2019-2023 Free Software Foundation, Inc.
5 Contributed by David Malcolm <dmalcolm@redhat.com>.
7 This file is part of GCC.
9 GCC is free software; you can redistribute it and/or modify it
10 under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3, or (at your option)
14 GCC is distributed in the hope that it will be useful, but
15 WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with GCC; see the file COPYING3. If not see
21 <http://www.gnu.org/licenses/>. */
24 #define INCLUDE_MEMORY
26 #include "coretypes.h"
27 #include "make-unique.h"
30 #include "basic-block.h"
34 #include "diagnostic-path.h"
35 #include "diagnostic-metadata.h"
36 #include "analyzer/analyzer.h"
37 #include "diagnostic-event-id.h"
38 #include "analyzer/analyzer-logging.h"
39 #include "analyzer/sm.h"
40 #include "analyzer/pending-diagnostic.h"
42 #include "ordered-hash-map.h"
44 #include "analyzer/call-string.h"
45 #include "analyzer/program-point.h"
46 #include "analyzer/store.h"
47 #include "analyzer/region-model.h"
48 #include "analyzer/program-state.h"
49 #include "analyzer/checker-path.h"
51 #include "gimple-iterator.h"
53 #include "analyzer/supergraph.h"
54 #include "analyzer/diagnostic-manager.h"
55 #include "shortest-paths.h"
56 #include "analyzer/exploded-graph.h"
57 #include "analyzer/function-set.h"
58 #include "analyzer/analyzer-selftests.h"
66 /* An experimental state machine, for tracking calls to async-signal-unsafe
67 functions from within signal handlers. */
69 class signal_state_machine
: public state_machine
72 signal_state_machine (logger
*logger
);
74 bool inherited_state_p () const final override
{ return false; }
76 bool on_stmt (sm_context
*sm_ctxt
,
77 const supernode
*node
,
78 const gimple
*stmt
) const final override
;
80 bool can_purge_p (state_t s
) const final override
;
82 /* These states are "global", rather than per-expression. */
84 /* State for when we're in a signal handler. */
85 state_t m_in_signal_handler
;
91 /* Concrete subclass for describing call to an async-signal-unsafe function
92 from a signal handler. */
94 class signal_unsafe_call
95 : public pending_diagnostic_subclass
<signal_unsafe_call
>
98 signal_unsafe_call (const signal_state_machine
&sm
, const gcall
*unsafe_call
,
100 : m_sm (sm
), m_unsafe_call (unsafe_call
), m_unsafe_fndecl (unsafe_fndecl
)
102 gcc_assert (m_unsafe_fndecl
);
105 const char *get_kind () const final override
{ return "signal_unsafe_call"; }
107 bool operator== (const signal_unsafe_call
&other
) const
109 return m_unsafe_call
== other
.m_unsafe_call
;
112 int get_controlling_option () const final override
114 return OPT_Wanalyzer_unsafe_call_within_signal_handler
;
117 bool emit (rich_location
*rich_loc
, logger
*) final override
119 auto_diagnostic_group d
;
120 diagnostic_metadata m
;
121 /* CWE-479: Signal Handler Use of a Non-reentrant Function. */
123 if (warning_meta (rich_loc
, m
, get_controlling_option (),
124 "call to %qD from within signal handler",
127 /* If we know a possible alternative function, add a note
128 suggesting the replacement. */
129 if (const char *replacement
= get_replacement_fn ())
131 location_t note_loc
= gimple_location (m_unsafe_call
);
132 /* It would be nice to add a fixit, but the gimple call
133 location covers the whole call expression. It isn't
134 currently possible to cut this down to just the call
135 symbol. So the fixit would replace too much.
136 note_rich_loc.add_fixit_replace (replacement); */
138 "%qs is a possible signal-safe alternative for %qD",
139 replacement
, m_unsafe_fndecl
);
146 label_text
describe_state_change (const evdesc::state_change
&change
)
149 if (change
.is_global_p ()
150 && change
.m_new_state
== m_sm
.m_in_signal_handler
)
152 function
*handler
= change
.m_event
.get_dest_function ();
153 return change
.formatted_print ("registering %qD as signal handler",
156 return label_text ();
159 label_text
describe_final_event (const evdesc::final_event
&ev
) final override
161 return ev
.formatted_print ("call to %qD from within signal handler",
166 const signal_state_machine
&m_sm
;
167 const gcall
*m_unsafe_call
;
168 tree m_unsafe_fndecl
;
170 /* Returns a replacement function as text if it exists. Currently
171 only "exit" has a signal-safe replacement "_exit", which does
172 slightly less, but can be used in a signal handler. */
174 get_replacement_fn ()
176 gcc_assert (m_unsafe_fndecl
&& DECL_P (m_unsafe_fndecl
));
178 if (id_equal ("exit", DECL_NAME (m_unsafe_fndecl
)))
185 /* signal_state_machine's ctor. */
187 signal_state_machine::signal_state_machine (logger
*logger
)
188 : state_machine ("signal", logger
)
190 m_in_signal_handler
= add_state ("in_signal_handler");
191 m_stop
= add_state ("stop");
194 /* Update MODEL for edges that simulate HANDLER_FUN being called as
195 an signal-handler in response to a signal. */
198 update_model_for_signal_handler (region_model
*model
,
199 function
*handler_fun
)
202 /* Purge all state within MODEL. */
203 *model
= region_model (model
->get_manager ());
204 model
->push_frame (handler_fun
, NULL
, NULL
);
207 /* Custom exploded_edge info: entry into a signal-handler. */
209 class signal_delivery_edge_info_t
: public custom_edge_info
212 void print (pretty_printer
*pp
) const final override
214 pp_string (pp
, "signal delivered");
217 json::object
*to_json () const
219 json::object
*custom_obj
= new json::object ();
223 bool update_model (region_model
*model
,
224 const exploded_edge
*eedge
,
225 region_model_context
*) const final override
228 update_model_for_signal_handler (model
, eedge
->m_dest
->get_function ());
232 void add_events_to_path (checker_path
*emission_path
,
233 const exploded_edge
&eedge ATTRIBUTE_UNUSED
)
236 emission_path
->add_event
237 (make_unique
<precanned_custom_event
>
238 (event_loc_info (UNKNOWN_LOCATION
, NULL_TREE
, 0),
240 " when the signal is delivered to the process"));
244 /* Concrete subclass of custom_transition for modeling registration of a
245 signal handler and the signal handler later being called. */
247 class register_signal_handler
: public custom_transition
250 register_signal_handler (const signal_state_machine
&sm
,
252 : m_sm (sm
), m_fndecl (fndecl
) {}
254 /* Model a signal-handler FNDECL being called at some later point
255 by injecting an edge to a new function-entry node with an empty
256 callstring, setting the 'in-signal-handler' global state
258 void impl_transition (exploded_graph
*eg
,
259 exploded_node
*src_enode
,
260 int sm_idx
) final override
262 function
*handler_fun
= DECL_STRUCT_FUNCTION (m_fndecl
);
265 const extrinsic_state
&ext_state
= eg
->get_ext_state ();
266 program_point entering_handler
267 = program_point::from_function_entry (*ext_state
.get_model_manager (),
268 eg
->get_supergraph (),
271 program_state
state_entering_handler (ext_state
);
272 update_model_for_signal_handler (state_entering_handler
.m_region_model
,
274 state_entering_handler
.m_checker_states
[sm_idx
]->set_global_state
275 (m_sm
.m_in_signal_handler
);
277 exploded_node
*dst_enode
= eg
->get_or_create_node (entering_handler
,
278 state_entering_handler
,
281 eg
->add_edge (src_enode
, dst_enode
, NULL
, /*state_change (),*/
282 true, /* assume does work */
283 make_unique
<signal_delivery_edge_info_t
> ());
286 const signal_state_machine
&m_sm
;
290 /* Get a set of functions that are known to be unsafe to call from an
291 async signal handler. */
294 get_async_signal_unsafe_fns ()
296 // TODO: populate this list more fully
297 static const char * const async_signal_unsafe_fns
[] = {
298 /* This array must be kept sorted. */
311 const size_t count
= ARRAY_SIZE (async_signal_unsafe_fns
);
312 function_set
fs (async_signal_unsafe_fns
, count
);
316 /* Return true if FNDECL is known to be unsafe to call from a signal
320 signal_unsafe_p (tree fndecl
)
322 function_set fs
= get_async_signal_unsafe_fns ();
323 return fs
.contains_decl_p (fndecl
);
326 /* Implementation of state_machine::on_stmt vfunc for signal_state_machine. */
329 signal_state_machine::on_stmt (sm_context
*sm_ctxt
,
330 const supernode
*node
,
331 const gimple
*stmt
) const
333 const state_t global_state
= sm_ctxt
->get_global_state ();
334 if (global_state
== m_start
)
336 if (const gcall
*call
= dyn_cast
<const gcall
*> (stmt
))
337 if (tree callee_fndecl
= sm_ctxt
->get_fndecl_for_call (call
))
338 if (is_named_call_p (callee_fndecl
, "signal", call
, 2))
340 tree handler
= gimple_call_arg (call
, 1);
341 if (TREE_CODE (handler
) == ADDR_EXPR
342 && TREE_CODE (TREE_OPERAND (handler
, 0)) == FUNCTION_DECL
)
344 tree fndecl
= TREE_OPERAND (handler
, 0);
345 register_signal_handler
rsh (*this, fndecl
);
346 sm_ctxt
->on_custom_transition (&rsh
);
350 else if (global_state
== m_in_signal_handler
)
352 if (const gcall
*call
= dyn_cast
<const gcall
*> (stmt
))
353 if (tree callee_fndecl
= sm_ctxt
->get_fndecl_for_call (call
))
354 if (signal_unsafe_p (callee_fndecl
))
355 if (sm_ctxt
->get_global_state () == m_in_signal_handler
)
356 sm_ctxt
->warn (node
, stmt
, NULL_TREE
,
357 make_unique
<signal_unsafe_call
>
358 (*this, call
, callee_fndecl
));
365 signal_state_machine::can_purge_p (state_t s ATTRIBUTE_UNUSED
) const
370 } // anonymous namespace
372 /* Internal interface to this file. */
375 make_signal_state_machine (logger
*logger
)
377 return new signal_state_machine (logger
);
384 /* Run all of the selftests within this file. */
387 analyzer_sm_signal_cc_tests ()
389 function_set fs
= get_async_signal_unsafe_fns ();
394 } // namespace selftest
396 #endif /* CHECKING_P */
400 #endif /* #if ENABLE_ANALYZER */