-/* A state machine for detecting misuses of POSIX file descriptor APIs.\r
- Copyright (C) 2019-2022 Free Software Foundation, Inc.\r
- Contributed by Immad Mir <mir@sourceware.org>.\r
-\r
-This file is part of GCC.\r
-\r
-GCC is free software; you can redistribute it and/or modify it\r
-under the terms of the GNU General Public License as published by\r
-the Free Software Foundation; either version 3, or (at your option)\r
-any later version.\r
-\r
-GCC is distributed in the hope that it will be useful, but\r
-WITHOUT ANY WARRANTY; without even the implied warranty of\r
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\r
-General Public License for more details.\r
-\r
-You should have received a copy of the GNU General Public License\r
-along with GCC; see the file COPYING3. If not see\r
-<http://www.gnu.org/licenses/>. */\r
-\r
-#include "config.h"\r
-#include "system.h"\r
-#include "coretypes.h"\r
-#include "tree.h"\r
-#include "function.h"\r
-#include "basic-block.h"\r
-#include "gimple.h"\r
-#include "options.h"\r
-#include "diagnostic-path.h"\r
-#include "diagnostic-metadata.h"\r
-#include "function.h"\r
-#include "json.h"\r
-#include "analyzer/analyzer.h"\r
-#include "diagnostic-event-id.h"\r
-#include "analyzer/analyzer-logging.h"\r
-#include "analyzer/sm.h"\r
-#include "analyzer/pending-diagnostic.h"\r
-#include "analyzer/function-set.h"\r
-#include "analyzer/analyzer-selftests.h"\r
-#include "tristate.h"\r
-#include "selftest.h"\r
-#include "stringpool.h"\r
-#include "attribs.h"\r
-#include "analyzer/call-string.h"\r
-#include "analyzer/program-point.h"\r
-#include "analyzer/store.h"\r
-#include "analyzer/region-model.h"\r
-#include "bitmap.h"\r
-\r
-#if ENABLE_ANALYZER\r
-\r
-namespace ana {\r
-\r
-namespace {\r
-\r
-/* An enum for distinguishing between three different access modes. */\r
-\r
-enum access_mode\r
-{\r
- READ_WRITE,\r
- READ_ONLY,\r
- WRITE_ONLY\r
-};\r
-\r
-enum access_directions\r
-{\r
- DIRS_READ_WRITE,\r
- DIRS_READ,\r
- DIRS_WRITE\r
-};\r
-\r
-class fd_state_machine : public state_machine\r
-{\r
-public:\r
- fd_state_machine (logger *logger);\r
-\r
- bool\r
- inherited_state_p () const final override\r
- {\r
- return false;\r
- }\r
-\r
- state_machine::state_t\r
- get_default_state (const svalue *sval) const final override\r
- {\r
- if (tree cst = sval->maybe_get_constant ())\r
- {\r
- if (TREE_CODE (cst) == INTEGER_CST)\r
- {\r
- int val = TREE_INT_CST_LOW (cst);\r
- if (val >= 0)\r
- return m_constant_fd;\r
- else\r
- return m_invalid;\r
- }\r
- }\r
- return m_start;\r
- }\r
-\r
- bool on_stmt (sm_context *sm_ctxt, const supernode *node,\r
- const gimple *stmt) const final override;\r
-\r
- void on_condition (sm_context *sm_ctxt, const supernode *node,\r
- const gimple *stmt, const svalue *lhs, const tree_code op,\r
- const svalue *rhs) const final override;\r
-\r
- bool can_purge_p (state_t s) const final override;\r
- pending_diagnostic *on_leak (tree var) const final override;\r
-\r
- bool is_unchecked_fd_p (state_t s) const;\r
- bool is_valid_fd_p (state_t s) const;\r
- bool is_closed_fd_p (state_t s) const;\r
- bool is_constant_fd_p (state_t s) const;\r
- bool is_readonly_fd_p (state_t s) const;\r
- bool is_writeonly_fd_p (state_t s) const;\r
- enum access_mode get_access_mode_from_flag (int flag) const;\r
-\r
- /* State for a constant file descriptor (>= 0) */\r
- state_t m_constant_fd;\r
-\r
- /* States representing a file descriptor that hasn't yet been\r
- checked for validity after opening, for three different\r
- access modes. */\r
- state_t m_unchecked_read_write;\r
-\r
- state_t m_unchecked_read_only;\r
-\r
- state_t m_unchecked_write_only;\r
-\r
- /* States for representing a file descriptor that is known to be valid (>=\r
- 0), for three different access modes.*/\r
- state_t m_valid_read_write;\r
-\r
- state_t m_valid_read_only;\r
-\r
- state_t m_valid_write_only;\r
-\r
- /* State for a file descriptor that is known to be invalid (< 0). */\r
- state_t m_invalid;\r
-\r
- /* State for a file descriptor that has been closed.*/\r
- state_t m_closed;\r
-\r
- /* State for a file descriptor that we do not want to track anymore . */\r
- state_t m_stop;\r
-\r
-private:\r
- void on_open (sm_context *sm_ctxt, const supernode *node, const gimple *stmt,\r
- const gcall *call) const;\r
- void on_close (sm_context *sm_ctxt, const supernode *node, const gimple *stmt,\r
- const gcall *call) const;\r
- void on_read (sm_context *sm_ctxt, const supernode *node, const gimple *stmt,\r
- const gcall *call, const tree callee_fndecl) const;\r
- void on_write (sm_context *sm_ctxt, const supernode *node, const gimple *stmt,\r
- const gcall *call, const tree callee_fndecl) const;\r
- void check_for_open_fd (sm_context *sm_ctxt, const supernode *node,\r
- const gimple *stmt, const gcall *call,\r
- const tree callee_fndecl,\r
- enum access_directions access_fn) const;\r
-\r
- void make_valid_transitions_on_condition (sm_context *sm_ctxt,\r
- const supernode *node,\r
- const gimple *stmt,\r
- const svalue *lhs) const;\r
- void make_invalid_transitions_on_condition (sm_context *sm_ctxt,\r
- const supernode *node,\r
- const gimple *stmt,\r
- const svalue *lhs) const;\r
- void check_for_fd_attrs (sm_context *sm_ctxt, const supernode *node,\r
- const gimple *stmt, const gcall *call,\r
- const tree callee_fndecl, const char *attr_name,\r
- access_directions fd_attr_access_dir) const;\r
-};\r
-\r
-/* Base diagnostic class relative to fd_state_machine. */\r
-class fd_diagnostic : public pending_diagnostic\r
-{\r
-public:\r
- fd_diagnostic (const fd_state_machine &sm, tree arg) : m_sm (sm), m_arg (arg)\r
- {\r
- }\r
-\r
- bool\r
- subclass_equal_p (const pending_diagnostic &base_other) const override\r
- {\r
- return same_tree_p (m_arg, ((const fd_diagnostic &)base_other).m_arg);\r
- }\r
-\r
- label_text\r
- describe_state_change (const evdesc::state_change &change) override\r
- {\r
- if (change.m_old_state == m_sm.get_start_state ()\r
- && m_sm.is_unchecked_fd_p (change.m_new_state))\r
- {\r
- if (change.m_new_state == m_sm.m_unchecked_read_write)\r
- return change.formatted_print ("opened here as read-write");\r
-\r
- if (change.m_new_state == m_sm.m_unchecked_read_only)\r
- return change.formatted_print ("opened here as read-only");\r
-\r
- if (change.m_new_state == m_sm.m_unchecked_write_only)\r
- return change.formatted_print ("opened here as write-only");\r
- }\r
-\r
- if (change.m_new_state == m_sm.m_closed)\r
- return change.formatted_print ("closed here");\r
-\r
- if (m_sm.is_unchecked_fd_p (change.m_old_state)\r
- && m_sm.is_valid_fd_p (change.m_new_state))\r
- {\r
- if (change.m_expr)\r
- return change.formatted_print (\r
- "assuming %qE is a valid file descriptor (>= 0)", change.m_expr);\r
- else\r
- return change.formatted_print ("assuming a valid file descriptor");\r
- }\r
-\r
- if (m_sm.is_unchecked_fd_p (change.m_old_state)\r
- && change.m_new_state == m_sm.m_invalid)\r
- {\r
- if (change.m_expr)\r
- return change.formatted_print (\r
- "assuming %qE is an invalid file descriptor (< 0)",\r
- change.m_expr);\r
- else\r
- return change.formatted_print ("assuming an invalid file descriptor");\r
- }\r
-\r
- return label_text ();\r
- }\r
-\r
-protected:\r
- const fd_state_machine &m_sm;\r
- tree m_arg;\r
-};\r
-\r
-class fd_param_diagnostic : public fd_diagnostic\r
-{\r
-public:\r
- fd_param_diagnostic (const fd_state_machine &sm, tree arg, tree callee_fndecl,\r
- const char *attr_name, int arg_idx)\r
- : fd_diagnostic (sm, arg), m_callee_fndecl (callee_fndecl),\r
- m_attr_name (attr_name), m_arg_idx (arg_idx)\r
- {\r
- }\r
-\r
- fd_param_diagnostic (const fd_state_machine &sm, tree arg, tree callee_fndecl)\r
- : fd_diagnostic (sm, arg), m_callee_fndecl (callee_fndecl),\r
- m_attr_name (NULL), m_arg_idx (-1)\r
- {\r
- }\r
- \r
- bool\r
- subclass_equal_p (const pending_diagnostic &base_other) const override\r
- {\r
- const fd_param_diagnostic &sub_other\r
- = (const fd_param_diagnostic &)base_other;\r
- return (same_tree_p (m_arg, sub_other.m_arg)\r
- && same_tree_p (m_callee_fndecl, sub_other.m_callee_fndecl)\r
- && m_arg_idx == sub_other.m_arg_idx\r
- && ((m_attr_name)\r
- ? (strcmp (m_attr_name, sub_other.m_attr_name) == 0)\r
- : true));\r
- }\r
-\r
- void\r
- inform_filedescriptor_attribute (access_directions fd_dir)\r
- {\r
-\r
- if (m_attr_name)\r
- switch (fd_dir)\r
- {\r
- case DIRS_READ_WRITE:\r
- inform (DECL_SOURCE_LOCATION (m_callee_fndecl),\r
- "argument %d of %qD must be an open file descriptor, due to "\r
- "%<__attribute__((%s(%d)))%>",\r
- m_arg_idx + 1, m_callee_fndecl, m_attr_name, m_arg_idx + 1);\r
- break;\r
- case DIRS_WRITE:\r
- inform (DECL_SOURCE_LOCATION (m_callee_fndecl),\r
- "argument %d of %qD must be a readable file descriptor, due "\r
- "to %<__attribute__((%s(%d)))%>",\r
- m_arg_idx + 1, m_callee_fndecl, m_attr_name, m_arg_idx + 1);\r
- break;\r
- case DIRS_READ:\r
- inform (DECL_SOURCE_LOCATION (m_callee_fndecl),\r
- "argument %d of %qD must be a writable file descriptor, due "\r
- "to %<__attribute__((%s(%d)))%>",\r
- m_arg_idx + 1, m_callee_fndecl, m_attr_name, m_arg_idx + 1);\r
- break;\r
- }\r
- }\r
-\r
-protected:\r
- tree m_callee_fndecl;\r
- const char *m_attr_name;\r
- /* ARG_IDX is 0-based. */\r
- int m_arg_idx;\r
-};\r
-\r
-class fd_leak : public fd_diagnostic\r
-{\r
-public:\r
- fd_leak (const fd_state_machine &sm, tree arg) : fd_diagnostic (sm, arg) {}\r
-\r
- const char *\r
- get_kind () const final override\r
- {\r
- return "fd_leak";\r
- }\r
-\r
- int\r
- get_controlling_option () const final override\r
- {\r
- return OPT_Wanalyzer_fd_leak;\r
- }\r
-\r
- bool\r
- emit (rich_location *rich_loc) final override\r
- {\r
- /*CWE-775: Missing Release of File Descriptor or Handle after Effective\r
- Lifetime\r
- */\r
- diagnostic_metadata m;\r
- m.add_cwe (775);\r
- if (m_arg)\r
- return warning_meta (rich_loc, m, get_controlling_option (),\r
- "leak of file descriptor %qE", m_arg);\r
- else\r
- return warning_meta (rich_loc, m, get_controlling_option (),\r
- "leak of file descriptor");\r
- }\r
-\r
- label_text\r
- describe_state_change (const evdesc::state_change &change) final override\r
- {\r
- if (m_sm.is_unchecked_fd_p (change.m_new_state))\r
- {\r
- m_open_event = change.m_event_id;\r
- return label_text::borrow ("opened here");\r
- }\r
-\r
- return fd_diagnostic::describe_state_change (change);\r
- }\r
-\r
- label_text\r
- describe_final_event (const evdesc::final_event &ev) final override\r
- {\r
- if (m_open_event.known_p ())\r
- {\r
- if (ev.m_expr)\r
- return ev.formatted_print ("%qE leaks here; was opened at %@",\r
- ev.m_expr, &m_open_event);\r
- else\r
- return ev.formatted_print ("leaks here; was opened at %@",\r
- &m_open_event);\r
- }\r
- else\r
- {\r
- if (ev.m_expr)\r
- return ev.formatted_print ("%qE leaks here", ev.m_expr);\r
- else\r
- return ev.formatted_print ("leaks here");\r
- }\r
- }\r
-\r
-private:\r
- diagnostic_event_id_t m_open_event;\r
-};\r
-\r
-class fd_access_mode_mismatch : public fd_param_diagnostic\r
-{\r
-public:\r
- fd_access_mode_mismatch (const fd_state_machine &sm, tree arg,\r
- enum access_directions fd_dir,\r
- const tree callee_fndecl, const char *attr_name,\r
- int arg_idx)\r
- : fd_param_diagnostic (sm, arg, callee_fndecl, attr_name, arg_idx),\r
- m_fd_dir (fd_dir)\r
-\r
- {\r
- }\r
-\r
- fd_access_mode_mismatch (const fd_state_machine &sm, tree arg,\r
- enum access_directions fd_dir,\r
- const tree callee_fndecl)\r
- : fd_param_diagnostic (sm, arg, callee_fndecl), m_fd_dir (fd_dir)\r
- {\r
- }\r
- \r
- const char *\r
- get_kind () const final override\r
- {\r
- return "fd_access_mode_mismatch";\r
- }\r
-\r
- int\r
- get_controlling_option () const final override\r
- {\r
- return OPT_Wanalyzer_fd_access_mode_mismatch;\r
- }\r
-\r
- bool\r
- emit (rich_location *rich_loc) final override\r
- {\r
- bool warned;\r
- switch (m_fd_dir)\r
- {\r
- case DIRS_READ:\r
- warned = warning_at (rich_loc, get_controlling_option (),\r
- "%qE on read-only file descriptor %qE",\r
- m_callee_fndecl, m_arg);\r
- break;\r
- case DIRS_WRITE:\r
- warned = warning_at (rich_loc, get_controlling_option (),\r
- "%qE on write-only file descriptor %qE",\r
- m_callee_fndecl, m_arg);\r
- break;\r
- default:\r
- gcc_unreachable ();\r
- }\r
- if (warned)\r
- inform_filedescriptor_attribute (m_fd_dir);\r
- return warned;\r
- }\r
-\r
- label_text\r
- describe_final_event (const evdesc::final_event &ev) final override\r
- {\r
- switch (m_fd_dir)\r
- {\r
- case DIRS_READ:\r
- return ev.formatted_print ("%qE on read-only file descriptor %qE",\r
- m_callee_fndecl, m_arg);\r
- case DIRS_WRITE:\r
- return ev.formatted_print ("%qE on write-only file descriptor %qE",\r
- m_callee_fndecl, m_arg);\r
- default:\r
- gcc_unreachable ();\r
- }\r
- }\r
-\r
-private:\r
- enum access_directions m_fd_dir;\r
-};\r
-\r
-class fd_double_close : public fd_diagnostic\r
-{\r
-public:\r
- fd_double_close (const fd_state_machine &sm, tree arg) : fd_diagnostic (sm, arg)\r
- {\r
- }\r
-\r
- const char *\r
- get_kind () const final override\r
- {\r
- return "fd_double_close";\r
- }\r
-\r
- int\r
- get_controlling_option () const final override\r
- {\r
- return OPT_Wanalyzer_fd_double_close;\r
- }\r
- bool\r
- emit (rich_location *rich_loc) final override\r
- {\r
- diagnostic_metadata m;\r
- // CWE-1341: Multiple Releases of Same Resource or Handle\r
- m.add_cwe (1341);\r
- return warning_meta (rich_loc, m, get_controlling_option (),\r
- "double %<close%> of file descriptor %qE", m_arg);\r
- }\r
-\r
- label_text\r
- describe_state_change (const evdesc::state_change &change) override\r
- {\r
- if (m_sm.is_unchecked_fd_p (change.m_new_state))\r
- return label_text::borrow ("opened here");\r
-\r
- if (change.m_new_state == m_sm.m_closed)\r
- {\r
- m_first_close_event = change.m_event_id;\r
- return change.formatted_print ("first %qs here", "close");\r
- }\r
- return fd_diagnostic::describe_state_change (change);\r
- }\r
-\r
- label_text\r
- describe_final_event (const evdesc::final_event &ev) final override\r
- {\r
- if (m_first_close_event.known_p ())\r
- return ev.formatted_print ("second %qs here; first %qs was at %@",\r
- "close", "close", &m_first_close_event);\r
- return ev.formatted_print ("second %qs here", "close");\r
- }\r
-\r
-private:\r
- diagnostic_event_id_t m_first_close_event;\r
-};\r
-\r
-class fd_use_after_close : public fd_param_diagnostic\r
-{\r
-public:\r
- fd_use_after_close (const fd_state_machine &sm, tree arg,\r
- const tree callee_fndecl, const char *attr_name,\r
- int arg_idx)\r
- : fd_param_diagnostic (sm, arg, callee_fndecl, attr_name, arg_idx)\r
- {\r
- }\r
-\r
- fd_use_after_close (const fd_state_machine &sm, tree arg,\r
- const tree callee_fndecl)\r
- : fd_param_diagnostic (sm, arg, callee_fndecl)\r
- {\r
- }\r
-\r
- const char *\r
- get_kind () const final override\r
- {\r
- return "fd_use_after_close";\r
- }\r
-\r
- int\r
- get_controlling_option () const final override\r
- {\r
- return OPT_Wanalyzer_fd_use_after_close;\r
- }\r
-\r
- bool\r
- emit (rich_location *rich_loc) final override\r
- {\r
- bool warned;\r
- warned = warning_at (rich_loc, get_controlling_option (),\r
- "%qE on closed file descriptor %qE", m_callee_fndecl,\r
- m_arg);\r
- if (warned)\r
- inform_filedescriptor_attribute (DIRS_READ_WRITE);\r
- return warned;\r
- }\r
-\r
- label_text\r
- describe_state_change (const evdesc::state_change &change) override\r
- {\r
- if (m_sm.is_unchecked_fd_p (change.m_new_state))\r
- return label_text::borrow ("opened here");\r
-\r
- if (change.m_new_state == m_sm.m_closed)\r
- {\r
- m_first_close_event = change.m_event_id;\r
- return change.formatted_print ("closed here");\r
- }\r
-\r
- return fd_diagnostic::describe_state_change (change);\r
- }\r
-\r
- label_text\r
- describe_final_event (const evdesc::final_event &ev) final override\r
- {\r
- if (m_first_close_event.known_p ())\r
- return ev.formatted_print (\r
- "%qE on closed file descriptor %qE; %qs was at %@", m_callee_fndecl,\r
- m_arg, "close", &m_first_close_event);\r
- else\r
- return ev.formatted_print ("%qE on closed file descriptor %qE",\r
- m_callee_fndecl, m_arg);\r
- }\r
-\r
-private:\r
- diagnostic_event_id_t m_first_close_event;\r
-};\r
-\r
-class fd_use_without_check : public fd_param_diagnostic\r
-{\r
-public:\r
- fd_use_without_check (const fd_state_machine &sm, tree arg,\r
- const tree callee_fndecl, const char *attr_name,\r
- int arg_idx)\r
- : fd_param_diagnostic (sm, arg, callee_fndecl, attr_name, arg_idx)\r
- {\r
- }\r
-\r
- fd_use_without_check (const fd_state_machine &sm, tree arg,\r
- const tree callee_fndecl)\r
- : fd_param_diagnostic (sm, arg, callee_fndecl)\r
- {\r
- }\r
-\r
- const char *\r
- get_kind () const final override\r
- {\r
- return "fd_use_without_check";\r
- }\r
-\r
- int\r
- get_controlling_option () const final override\r
- {\r
- return OPT_Wanalyzer_fd_use_without_check;\r
- }\r
-\r
- bool\r
- emit (rich_location *rich_loc) final override\r
- {\r
- bool warned;\r
- warned = warning_at (rich_loc, get_controlling_option (),\r
- "%qE on possibly invalid file descriptor %qE",\r
- m_callee_fndecl, m_arg);\r
- if (warned)\r
- inform_filedescriptor_attribute (DIRS_READ_WRITE);\r
- return warned;\r
- }\r
-\r
- label_text\r
- describe_state_change (const evdesc::state_change &change) override\r
- {\r
- if (m_sm.is_unchecked_fd_p (change.m_new_state))\r
- {\r
- m_first_open_event = change.m_event_id;\r
- return label_text::borrow ("opened here");\r
- }\r
-\r
- return fd_diagnostic::describe_state_change (change);\r
- }\r
-\r
- label_text\r
- describe_final_event (const evdesc::final_event &ev) final override\r
- {\r
- if (m_first_open_event.known_p ())\r
- return ev.formatted_print (\r
- "%qE could be invalid: unchecked value from %@", m_arg,\r
- &m_first_open_event);\r
- else\r
- return ev.formatted_print ("%qE could be invalid", m_arg);\r
- }\r
-\r
-private:\r
- diagnostic_event_id_t m_first_open_event; \r
-};\r
-\r
-fd_state_machine::fd_state_machine (logger *logger)\r
- : state_machine ("file-descriptor", logger),\r
- m_constant_fd (add_state ("fd-constant")),\r
- m_unchecked_read_write (add_state ("fd-unchecked-read-write")),\r
- m_unchecked_read_only (add_state ("fd-unchecked-read-only")),\r
- m_unchecked_write_only (add_state ("fd-unchecked-write-only")),\r
- m_valid_read_write (add_state ("fd-valid-read-write")),\r
- m_valid_read_only (add_state ("fd-valid-read-only")),\r
- m_valid_write_only (add_state ("fd-valid-write-only")),\r
- m_invalid (add_state ("fd-invalid")),\r
- m_closed (add_state ("fd-closed")),\r
- m_stop (add_state ("fd-stop"))\r
-{\r
-}\r
-\r
-bool\r
-fd_state_machine::is_unchecked_fd_p (state_t s) const\r
-{\r
- return (s == m_unchecked_read_write\r
- || s == m_unchecked_read_only\r
- || s == m_unchecked_write_only);\r
-}\r
-\r
-bool\r
-fd_state_machine::is_valid_fd_p (state_t s) const\r
-{\r
- return (s == m_valid_read_write\r
- || s == m_valid_read_only\r
- || s == m_valid_write_only);\r
-}\r
-\r
-enum access_mode\r
-fd_state_machine::get_access_mode_from_flag (int flag) const\r
-{\r
- /* FIXME: this code assumes the access modes on the host and\r
- target are the same, which in practice might not be the case. */\r
-\r
- if ((flag & O_ACCMODE) == O_RDONLY)\r
- {\r
- return READ_ONLY;\r
- }\r
- else if ((flag & O_ACCMODE) == O_WRONLY)\r
- {\r
- return WRITE_ONLY;\r
- }\r
- return READ_WRITE;\r
-}\r
-\r
-bool\r
-fd_state_machine::is_readonly_fd_p (state_t state) const\r
-{\r
- return (state == m_unchecked_read_only || state == m_valid_read_only);\r
-}\r
-\r
-bool\r
-fd_state_machine::is_writeonly_fd_p (state_t state) const\r
-{\r
- return (state == m_unchecked_write_only || state == m_valid_write_only);\r
-}\r
-\r
-bool\r
-fd_state_machine::is_closed_fd_p (state_t state) const\r
-{\r
- return (state == m_closed);\r
-}\r
-\r
-bool\r
-fd_state_machine::is_constant_fd_p (state_t state) const\r
-{\r
- return (state == m_constant_fd);\r
-}\r
-\r
-bool\r
-fd_state_machine::on_stmt (sm_context *sm_ctxt, const supernode *node,\r
- const gimple *stmt) const\r
-{\r
- if (const gcall *call = dyn_cast<const gcall *> (stmt))\r
- if (tree callee_fndecl = sm_ctxt->get_fndecl_for_call (call))\r
- {\r
- if (is_named_call_p (callee_fndecl, "open", call, 2))\r
- {\r
- on_open (sm_ctxt, node, stmt, call);\r
- return true;\r
- } // "open"\r
-\r
- if (is_named_call_p (callee_fndecl, "close", call, 1))\r
- {\r
- on_close (sm_ctxt, node, stmt, call);\r
- return true;\r
- } // "close"\r
-\r
- if (is_named_call_p (callee_fndecl, "write", call, 3))\r
- {\r
- on_write (sm_ctxt, node, stmt, call, callee_fndecl);\r
- return true;\r
- } // "write"\r
-\r
- if (is_named_call_p (callee_fndecl, "read", call, 3))\r
- {\r
- on_read (sm_ctxt, node, stmt, call, callee_fndecl);\r
- return true;\r
- } // "read"\r
-\r
- \r
- {\r
- // Handle __attribute__((fd_arg))\r
-\r
- check_for_fd_attrs (sm_ctxt, node, stmt, call, callee_fndecl,\r
- "fd_arg", DIRS_READ_WRITE);\r
-\r
- // Handle __attribute__((fd_arg_read))\r
-\r
- check_for_fd_attrs (sm_ctxt, node, stmt, call, callee_fndecl,\r
- "fd_arg_read", DIRS_READ);\r
-\r
- // Handle __attribute__((fd_arg_write))\r
-\r
- check_for_fd_attrs (sm_ctxt, node, stmt, call, callee_fndecl,\r
- "fd_arg_write", DIRS_WRITE);\r
- } \r
- }\r
-\r
- return false;\r
-}\r
-\r
-void\r
-fd_state_machine::check_for_fd_attrs (\r
- sm_context *sm_ctxt, const supernode *node, const gimple *stmt,\r
- const gcall *call, const tree callee_fndecl, const char *attr_name,\r
- access_directions fd_attr_access_dir) const\r
-{\r
-\r
- tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (callee_fndecl));\r
- attrs = lookup_attribute (attr_name, attrs);\r
- if (!attrs)\r
- return;\r
-\r
- if (!TREE_VALUE (attrs))\r
- return;\r
-\r
- auto_bitmap argmap;\r
-\r
- for (tree idx = TREE_VALUE (attrs); idx; idx = TREE_CHAIN (idx))\r
- {\r
- unsigned int val = TREE_INT_CST_LOW (TREE_VALUE (idx)) - 1;\r
- bitmap_set_bit (argmap, val);\r
- }\r
- if (bitmap_empty_p (argmap))\r
- return;\r
-\r
- for (unsigned arg_idx = 0; arg_idx < gimple_call_num_args (call); arg_idx++)\r
- {\r
- tree arg = gimple_call_arg (call, arg_idx);\r
- tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);\r
- state_t state = sm_ctxt->get_state (stmt, arg);\r
- bool bit_set = bitmap_bit_p (argmap, arg_idx);\r
- if (TREE_CODE (TREE_TYPE (arg)) != INTEGER_TYPE)\r
- continue;\r
- if (bit_set) // Check if arg_idx is marked by any of the file descriptor\r
- // attributes\r
- {\r
-\r
- if (is_closed_fd_p (state))\r
- {\r
-\r
- sm_ctxt->warn (node, stmt, arg,\r
- new fd_use_after_close (*this, diag_arg,\r
- callee_fndecl, attr_name,\r
- arg_idx));\r
- continue;\r
- }\r
-\r
- if (!(is_valid_fd_p (state) || (state == m_stop)))\r
- {\r
- if (!is_constant_fd_p (state))\r
- sm_ctxt->warn (node, stmt, arg,\r
- new fd_use_without_check (*this, diag_arg,\r
- callee_fndecl, attr_name,\r
- arg_idx));\r
- }\r
-\r
- switch (fd_attr_access_dir)\r
- {\r
- case DIRS_READ_WRITE:\r
- break;\r
- case DIRS_READ:\r
-\r
- if (is_writeonly_fd_p (state))\r
- {\r
- sm_ctxt->warn (\r
- node, stmt, arg,\r
- new fd_access_mode_mismatch (*this, diag_arg, DIRS_WRITE,\r
- callee_fndecl, attr_name, arg_idx));\r
- }\r
-\r
- break;\r
- case DIRS_WRITE:\r
-\r
- if (is_readonly_fd_p (state))\r
- {\r
- sm_ctxt->warn (\r
- node, stmt, arg,\r
- new fd_access_mode_mismatch (*this, diag_arg, DIRS_READ,\r
- callee_fndecl, attr_name, arg_idx));\r
- }\r
-\r
- break;\r
- }\r
- }\r
- }\r
-}\r
-\r
-\r
-void\r
-fd_state_machine::on_open (sm_context *sm_ctxt, const supernode *node,\r
- const gimple *stmt, const gcall *call) const\r
-{\r
- tree lhs = gimple_call_lhs (call);\r
- if (lhs)\r
- {\r
- tree arg = gimple_call_arg (call, 1);\r
- if (TREE_CODE (arg) == INTEGER_CST)\r
- {\r
- int flag = TREE_INT_CST_LOW (arg);\r
- enum access_mode mode = get_access_mode_from_flag (flag);\r
-\r
- switch (mode)\r
- {\r
- case READ_ONLY:\r
- sm_ctxt->on_transition (node, stmt, lhs, m_start,\r
- m_unchecked_read_only);\r
- break;\r
- case WRITE_ONLY:\r
- sm_ctxt->on_transition (node, stmt, lhs, m_start,\r
- m_unchecked_write_only);\r
- break;\r
- default:\r
- sm_ctxt->on_transition (node, stmt, lhs, m_start,\r
- m_unchecked_read_write);\r
- }\r
- }\r
- }\r
- else\r
- {\r
- sm_ctxt->warn (node, stmt, NULL_TREE, new fd_leak (*this, NULL_TREE));\r
- }\r
-}\r
-\r
-void\r
-fd_state_machine::on_close (sm_context *sm_ctxt, const supernode *node,\r
- const gimple *stmt, const gcall *call) const\r
-{\r
- tree arg = gimple_call_arg (call, 0);\r
- state_t state = sm_ctxt->get_state (stmt, arg);\r
- tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);\r
-\r
- sm_ctxt->on_transition (node, stmt, arg, m_start, m_closed);\r
- sm_ctxt->on_transition (node, stmt, arg, m_unchecked_read_write, m_closed);\r
- sm_ctxt->on_transition (node, stmt, arg, m_unchecked_read_only, m_closed);\r
- sm_ctxt->on_transition (node, stmt, arg, m_unchecked_write_only, m_closed);\r
- sm_ctxt->on_transition (node, stmt, arg, m_valid_read_write, m_closed);\r
- sm_ctxt->on_transition (node, stmt, arg, m_valid_read_only, m_closed);\r
- sm_ctxt->on_transition (node, stmt, arg, m_valid_write_only, m_closed);\r
- sm_ctxt->on_transition (node, stmt, arg, m_constant_fd, m_closed);\r
-\r
- if (is_closed_fd_p (state))\r
- {\r
- sm_ctxt->warn (node, stmt, arg, new fd_double_close (*this, diag_arg));\r
- sm_ctxt->set_next_state (stmt, arg, m_stop);\r
- }\r
-}\r
-void\r
-fd_state_machine::on_read (sm_context *sm_ctxt, const supernode *node,\r
- const gimple *stmt, const gcall *call,\r
- const tree callee_fndecl) const\r
-{\r
- check_for_open_fd (sm_ctxt, node, stmt, call, callee_fndecl, DIRS_READ);\r
-}\r
-void\r
-fd_state_machine::on_write (sm_context *sm_ctxt, const supernode *node,\r
- const gimple *stmt, const gcall *call,\r
- const tree callee_fndecl) const\r
-{\r
- check_for_open_fd (sm_ctxt, node, stmt, call, callee_fndecl, DIRS_WRITE);\r
-}\r
-\r
-void\r
-fd_state_machine::check_for_open_fd (\r
- sm_context *sm_ctxt, const supernode *node, const gimple *stmt,\r
- const gcall *call, const tree callee_fndecl,\r
- enum access_directions callee_fndecl_dir) const\r
-{\r
- tree arg = gimple_call_arg (call, 0);\r
- tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);\r
- state_t state = sm_ctxt->get_state (stmt, arg);\r
-\r
- if (is_closed_fd_p (state))\r
- {\r
- sm_ctxt->warn (node, stmt, arg,\r
- new fd_use_after_close (*this, diag_arg, callee_fndecl));\r
- }\r
-\r
- else\r
- {\r
- if (!(is_valid_fd_p (state) || (state == m_stop)))\r
- {\r
- if (!is_constant_fd_p (state))\r
- sm_ctxt->warn (\r
- node, stmt, arg,\r
- new fd_use_without_check (*this, diag_arg, callee_fndecl));\r
- }\r
- switch (callee_fndecl_dir)\r
- {\r
- case DIRS_READ:\r
- if (is_writeonly_fd_p (state))\r
- {\r
- tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);\r
- sm_ctxt->warn (node, stmt, arg,\r
- new fd_access_mode_mismatch (\r
- *this, diag_arg, DIRS_WRITE, callee_fndecl));\r
- }\r
-\r
- break;\r
- case DIRS_WRITE:\r
-\r
- if (is_readonly_fd_p (state))\r
- {\r
- tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);\r
- sm_ctxt->warn (node, stmt, arg,\r
- new fd_access_mode_mismatch (\r
- *this, diag_arg, DIRS_READ, callee_fndecl));\r
- }\r
- break;\r
- default:\r
- gcc_unreachable ();\r
- }\r
- }\r
-}\r
-\r
-void\r
-fd_state_machine::on_condition (sm_context *sm_ctxt, const supernode *node,\r
- const gimple *stmt, const svalue *lhs,\r
- enum tree_code op, const svalue *rhs) const\r
-{\r
- if (tree cst = rhs->maybe_get_constant ())\r
- {\r
- if (TREE_CODE (cst) == INTEGER_CST)\r
- {\r
- int val = TREE_INT_CST_LOW (cst);\r
- if (val == -1)\r
- {\r
- if (op == NE_EXPR)\r
- make_valid_transitions_on_condition (sm_ctxt, node, stmt, lhs);\r
-\r
- else if (op == EQ_EXPR)\r
- make_invalid_transitions_on_condition (sm_ctxt, node, stmt,\r
- lhs);\r
- }\r
- }\r
- }\r
-\r
- if (rhs->all_zeroes_p ())\r
- {\r
- if (op == GE_EXPR)\r
- make_valid_transitions_on_condition (sm_ctxt, node, stmt, lhs);\r
- else if (op == LT_EXPR)\r
- make_invalid_transitions_on_condition (sm_ctxt, node, stmt, lhs);\r
- }\r
-}\r
-\r
-void\r
-fd_state_machine::make_valid_transitions_on_condition (sm_context *sm_ctxt,\r
- const supernode *node,\r
- const gimple *stmt,\r
- const svalue *lhs) const\r
-{\r
- sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_read_write,\r
- m_valid_read_write);\r
- sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_read_only,\r
- m_valid_read_only);\r
- sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_write_only,\r
- m_valid_write_only);\r
-}\r
-\r
-void\r
-fd_state_machine::make_invalid_transitions_on_condition (\r
- sm_context *sm_ctxt, const supernode *node, const gimple *stmt,\r
- const svalue *lhs) const\r
-{\r
- sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_read_write, m_invalid);\r
- sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_read_only, m_invalid);\r
- sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_write_only, m_invalid);\r
-}\r
-\r
-bool\r
-fd_state_machine::can_purge_p (state_t s) const\r
-{\r
- if (is_unchecked_fd_p (s) || is_valid_fd_p (s))\r
- return false;\r
- else\r
- return true;\r
-}\r
-\r
-pending_diagnostic *\r
-fd_state_machine::on_leak (tree var) const\r
-{\r
- return new fd_leak (*this, var);\r
-}\r
-} // namespace\r
-\r
-state_machine *\r
-make_fd_state_machine (logger *logger)\r
-{\r
- return new fd_state_machine (logger);\r
-}\r
-} // namespace ana\r
-\r
-#endif // ENABLE_ANALYZER
\ No newline at end of file
+/* A state machine for detecting misuses of POSIX file descriptor APIs.
+ Copyright (C) 2019-2022 Free Software Foundation, Inc.
+ Contributed by Immad Mir <mir@sourceware.org>.
+
+This file is part of GCC.
+
+GCC is free software; you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 3, or (at your option)
+any later version.
+
+GCC is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GCC; see the file COPYING3. If not see
+<http://www.gnu.org/licenses/>. */
+
+#include "config.h"
+#include "system.h"
+#include "coretypes.h"
+#include "tree.h"
+#include "function.h"
+#include "basic-block.h"
+#include "gimple.h"
+#include "options.h"
+#include "diagnostic-path.h"
+#include "diagnostic-metadata.h"
+#include "function.h"
+#include "json.h"
+#include "analyzer/analyzer.h"
+#include "diagnostic-event-id.h"
+#include "analyzer/analyzer-logging.h"
+#include "analyzer/sm.h"
+#include "analyzer/pending-diagnostic.h"
+#include "analyzer/function-set.h"
+#include "analyzer/analyzer-selftests.h"
+#include "tristate.h"
+#include "selftest.h"
+#include "stringpool.h"
+#include "attribs.h"
+#include "analyzer/call-string.h"
+#include "analyzer/program-point.h"
+#include "analyzer/store.h"
+#include "analyzer/region-model.h"
+#include "bitmap.h"
+
+#if ENABLE_ANALYZER
+
+namespace ana {
+
+namespace {
+
+/* An enum for distinguishing between three different access modes. */
+
+enum access_mode
+{
+ READ_WRITE,
+ READ_ONLY,
+ WRITE_ONLY
+};
+
+enum access_directions
+{
+ DIRS_READ_WRITE,
+ DIRS_READ,
+ DIRS_WRITE
+};
+
+class fd_state_machine : public state_machine
+{
+public:
+ fd_state_machine (logger *logger);
+
+ bool
+ inherited_state_p () const final override
+ {
+ return false;
+ }
+
+ state_machine::state_t
+ get_default_state (const svalue *sval) const final override
+ {
+ if (tree cst = sval->maybe_get_constant ())
+ {
+ if (TREE_CODE (cst) == INTEGER_CST)
+ {
+ int val = TREE_INT_CST_LOW (cst);
+ if (val >= 0)
+ return m_constant_fd;
+ else
+ return m_invalid;
+ }
+ }
+ return m_start;
+ }
+
+ bool on_stmt (sm_context *sm_ctxt, const supernode *node,
+ const gimple *stmt) const final override;
+
+ void on_condition (sm_context *sm_ctxt, const supernode *node,
+ const gimple *stmt, const svalue *lhs, const tree_code op,
+ const svalue *rhs) const final override;
+
+ bool can_purge_p (state_t s) const final override;
+ pending_diagnostic *on_leak (tree var) const final override;
+
+ bool is_unchecked_fd_p (state_t s) const;
+ bool is_valid_fd_p (state_t s) const;
+ bool is_closed_fd_p (state_t s) const;
+ bool is_constant_fd_p (state_t s) const;
+ bool is_readonly_fd_p (state_t s) const;
+ bool is_writeonly_fd_p (state_t s) const;
+ enum access_mode get_access_mode_from_flag (int flag) const;
+
+ /* State for a constant file descriptor (>= 0) */
+ state_t m_constant_fd;
+
+ /* States representing a file descriptor that hasn't yet been
+ checked for validity after opening, for three different
+ access modes. */
+ state_t m_unchecked_read_write;
+
+ state_t m_unchecked_read_only;
+
+ state_t m_unchecked_write_only;
+
+ /* States for representing a file descriptor that is known to be valid (>=
+ 0), for three different access modes. */
+ state_t m_valid_read_write;
+
+ state_t m_valid_read_only;
+
+ state_t m_valid_write_only;
+
+ /* State for a file descriptor that is known to be invalid (< 0). */
+ state_t m_invalid;
+
+ /* State for a file descriptor that has been closed. */
+ state_t m_closed;
+
+ /* State for a file descriptor that we do not want to track anymore . */
+ state_t m_stop;
+
+private:
+ void on_open (sm_context *sm_ctxt, const supernode *node, const gimple *stmt,
+ const gcall *call) const;
+ void on_close (sm_context *sm_ctxt, const supernode *node, const gimple *stmt,
+ const gcall *call) const;
+ void on_read (sm_context *sm_ctxt, const supernode *node, const gimple *stmt,
+ const gcall *call, const tree callee_fndecl) const;
+ void on_write (sm_context *sm_ctxt, const supernode *node, const gimple *stmt,
+ const gcall *call, const tree callee_fndecl) const;
+ void check_for_open_fd (sm_context *sm_ctxt, const supernode *node,
+ const gimple *stmt, const gcall *call,
+ const tree callee_fndecl,
+ enum access_directions access_fn) const;
+
+ void make_valid_transitions_on_condition (sm_context *sm_ctxt,
+ const supernode *node,
+ const gimple *stmt,
+ const svalue *lhs) const;
+ void make_invalid_transitions_on_condition (sm_context *sm_ctxt,
+ const supernode *node,
+ const gimple *stmt,
+ const svalue *lhs) const;
+ void check_for_fd_attrs (sm_context *sm_ctxt, const supernode *node,
+ const gimple *stmt, const gcall *call,
+ const tree callee_fndecl, const char *attr_name,
+ access_directions fd_attr_access_dir) const;
+};
+
+/* Base diagnostic class relative to fd_state_machine. */
+class fd_diagnostic : public pending_diagnostic
+{
+public:
+ fd_diagnostic (const fd_state_machine &sm, tree arg) : m_sm (sm), m_arg (arg)
+ {
+ }
+
+ bool
+ subclass_equal_p (const pending_diagnostic &base_other) const override
+ {
+ return same_tree_p (m_arg, ((const fd_diagnostic &)base_other).m_arg);
+ }
+
+ label_text
+ describe_state_change (const evdesc::state_change &change) override
+ {
+ if (change.m_old_state == m_sm.get_start_state ()
+ && m_sm.is_unchecked_fd_p (change.m_new_state))
+ {
+ if (change.m_new_state == m_sm.m_unchecked_read_write)
+ return change.formatted_print ("opened here as read-write");
+
+ if (change.m_new_state == m_sm.m_unchecked_read_only)
+ return change.formatted_print ("opened here as read-only");
+
+ if (change.m_new_state == m_sm.m_unchecked_write_only)
+ return change.formatted_print ("opened here as write-only");
+ }
+
+ if (change.m_new_state == m_sm.m_closed)
+ return change.formatted_print ("closed here");
+
+ if (m_sm.is_unchecked_fd_p (change.m_old_state)
+ && m_sm.is_valid_fd_p (change.m_new_state))
+ {
+ if (change.m_expr)
+ return change.formatted_print (
+ "assuming %qE is a valid file descriptor (>= 0)", change.m_expr);
+ else
+ return change.formatted_print ("assuming a valid file descriptor");
+ }
+
+ if (m_sm.is_unchecked_fd_p (change.m_old_state)
+ && change.m_new_state == m_sm.m_invalid)
+ {
+ if (change.m_expr)
+ return change.formatted_print (
+ "assuming %qE is an invalid file descriptor (< 0)",
+ change.m_expr);
+ else
+ return change.formatted_print ("assuming an invalid file descriptor");
+ }
+
+ return label_text ();
+ }
+
+protected:
+ const fd_state_machine &m_sm;
+ tree m_arg;
+};
+
+class fd_param_diagnostic : public fd_diagnostic
+{
+public:
+ fd_param_diagnostic (const fd_state_machine &sm, tree arg, tree callee_fndecl,
+ const char *attr_name, int arg_idx)
+ : fd_diagnostic (sm, arg), m_callee_fndecl (callee_fndecl),
+ m_attr_name (attr_name), m_arg_idx (arg_idx)
+ {
+ }
+
+ fd_param_diagnostic (const fd_state_machine &sm, tree arg, tree callee_fndecl)
+ : fd_diagnostic (sm, arg), m_callee_fndecl (callee_fndecl),
+ m_attr_name (NULL), m_arg_idx (-1)
+ {
+ }
+
+ bool
+ subclass_equal_p (const pending_diagnostic &base_other) const override
+ {
+ const fd_param_diagnostic &sub_other
+ = (const fd_param_diagnostic &)base_other;
+ return (same_tree_p (m_arg, sub_other.m_arg)
+ && same_tree_p (m_callee_fndecl, sub_other.m_callee_fndecl)
+ && m_arg_idx == sub_other.m_arg_idx
+ && ((m_attr_name)
+ ? (strcmp (m_attr_name, sub_other.m_attr_name) == 0)
+ : true));
+ }
+
+ void
+ inform_filedescriptor_attribute (access_directions fd_dir)
+ {
+
+ if (m_attr_name)
+ switch (fd_dir)
+ {
+ case DIRS_READ_WRITE:
+ inform (DECL_SOURCE_LOCATION (m_callee_fndecl),
+ "argument %d of %qD must be an open file descriptor, due to "
+ "%<__attribute__((%s(%d)))%>",
+ m_arg_idx + 1, m_callee_fndecl, m_attr_name, m_arg_idx + 1);
+ break;
+ case DIRS_WRITE:
+ inform (DECL_SOURCE_LOCATION (m_callee_fndecl),
+ "argument %d of %qD must be a readable file descriptor, due "
+ "to %<__attribute__((%s(%d)))%>",
+ m_arg_idx + 1, m_callee_fndecl, m_attr_name, m_arg_idx + 1);
+ break;
+ case DIRS_READ:
+ inform (DECL_SOURCE_LOCATION (m_callee_fndecl),
+ "argument %d of %qD must be a writable file descriptor, due "
+ "to %<__attribute__((%s(%d)))%>",
+ m_arg_idx + 1, m_callee_fndecl, m_attr_name, m_arg_idx + 1);
+ break;
+ }
+ }
+
+protected:
+ tree m_callee_fndecl;
+ const char *m_attr_name;
+ /* ARG_IDX is 0-based. */
+ int m_arg_idx;
+};
+
+class fd_leak : public fd_diagnostic
+{
+public:
+ fd_leak (const fd_state_machine &sm, tree arg) : fd_diagnostic (sm, arg) {}
+
+ const char *
+ get_kind () const final override
+ {
+ return "fd_leak";
+ }
+
+ int
+ get_controlling_option () const final override
+ {
+ return OPT_Wanalyzer_fd_leak;
+ }
+
+ bool
+ emit (rich_location *rich_loc) final override
+ {
+ /*CWE-775: Missing Release of File Descriptor or Handle after Effective
+ Lifetime
+ */
+ diagnostic_metadata m;
+ m.add_cwe (775);
+ if (m_arg)
+ return warning_meta (rich_loc, m, get_controlling_option (),
+ "leak of file descriptor %qE", m_arg);
+ else
+ return warning_meta (rich_loc, m, get_controlling_option (),
+ "leak of file descriptor");
+ }
+
+ label_text
+ describe_state_change (const evdesc::state_change &change) final override
+ {
+ if (m_sm.is_unchecked_fd_p (change.m_new_state))
+ {
+ m_open_event = change.m_event_id;
+ return label_text::borrow ("opened here");
+ }
+
+ return fd_diagnostic::describe_state_change (change);
+ }
+
+ label_text
+ describe_final_event (const evdesc::final_event &ev) final override
+ {
+ if (m_open_event.known_p ())
+ {
+ if (ev.m_expr)
+ return ev.formatted_print ("%qE leaks here; was opened at %@",
+ ev.m_expr, &m_open_event);
+ else
+ return ev.formatted_print ("leaks here; was opened at %@",
+ &m_open_event);
+ }
+ else
+ {
+ if (ev.m_expr)
+ return ev.formatted_print ("%qE leaks here", ev.m_expr);
+ else
+ return ev.formatted_print ("leaks here");
+ }
+ }
+
+private:
+ diagnostic_event_id_t m_open_event;
+};
+
+class fd_access_mode_mismatch : public fd_param_diagnostic
+{
+public:
+ fd_access_mode_mismatch (const fd_state_machine &sm, tree arg,
+ enum access_directions fd_dir,
+ const tree callee_fndecl, const char *attr_name,
+ int arg_idx)
+ : fd_param_diagnostic (sm, arg, callee_fndecl, attr_name, arg_idx),
+ m_fd_dir (fd_dir)
+
+ {
+ }
+
+ fd_access_mode_mismatch (const fd_state_machine &sm, tree arg,
+ enum access_directions fd_dir,
+ const tree callee_fndecl)
+ : fd_param_diagnostic (sm, arg, callee_fndecl), m_fd_dir (fd_dir)
+ {
+ }
+
+ const char *
+ get_kind () const final override
+ {
+ return "fd_access_mode_mismatch";
+ }
+
+ int
+ get_controlling_option () const final override
+ {
+ return OPT_Wanalyzer_fd_access_mode_mismatch;
+ }
+
+ bool
+ emit (rich_location *rich_loc) final override
+ {
+ bool warned;
+ switch (m_fd_dir)
+ {
+ case DIRS_READ:
+ warned = warning_at (rich_loc, get_controlling_option (),
+ "%qE on read-only file descriptor %qE",
+ m_callee_fndecl, m_arg);
+ break;
+ case DIRS_WRITE:
+ warned = warning_at (rich_loc, get_controlling_option (),
+ "%qE on write-only file descriptor %qE",
+ m_callee_fndecl, m_arg);
+ break;
+ default:
+ gcc_unreachable ();
+ }
+ if (warned)
+ inform_filedescriptor_attribute (m_fd_dir);
+ return warned;
+ }
+
+ label_text
+ describe_final_event (const evdesc::final_event &ev) final override
+ {
+ switch (m_fd_dir)
+ {
+ case DIRS_READ:
+ return ev.formatted_print ("%qE on read-only file descriptor %qE",
+ m_callee_fndecl, m_arg);
+ case DIRS_WRITE:
+ return ev.formatted_print ("%qE on write-only file descriptor %qE",
+ m_callee_fndecl, m_arg);
+ default:
+ gcc_unreachable ();
+ }
+ }
+
+private:
+ enum access_directions m_fd_dir;
+};
+
+class fd_double_close : public fd_diagnostic
+{
+public:
+ fd_double_close (const fd_state_machine &sm, tree arg) : fd_diagnostic (sm, arg)
+ {
+ }
+
+ const char *
+ get_kind () const final override
+ {
+ return "fd_double_close";
+ }
+
+ int
+ get_controlling_option () const final override
+ {
+ return OPT_Wanalyzer_fd_double_close;
+ }
+ bool
+ emit (rich_location *rich_loc) final override
+ {
+ diagnostic_metadata m;
+ // CWE-1341: Multiple Releases of Same Resource or Handle
+ m.add_cwe (1341);
+ return warning_meta (rich_loc, m, get_controlling_option (),
+ "double %<close%> of file descriptor %qE", m_arg);
+ }
+
+ label_text
+ describe_state_change (const evdesc::state_change &change) override
+ {
+ if (m_sm.is_unchecked_fd_p (change.m_new_state))
+ return label_text::borrow ("opened here");
+
+ if (change.m_new_state == m_sm.m_closed)
+ {
+ m_first_close_event = change.m_event_id;
+ return change.formatted_print ("first %qs here", "close");
+ }
+ return fd_diagnostic::describe_state_change (change);
+ }
+
+ label_text
+ describe_final_event (const evdesc::final_event &ev) final override
+ {
+ if (m_first_close_event.known_p ())
+ return ev.formatted_print ("second %qs here; first %qs was at %@",
+ "close", "close", &m_first_close_event);
+ return ev.formatted_print ("second %qs here", "close");
+ }
+
+private:
+ diagnostic_event_id_t m_first_close_event;
+};
+
+class fd_use_after_close : public fd_param_diagnostic
+{
+public:
+ fd_use_after_close (const fd_state_machine &sm, tree arg,
+ const tree callee_fndecl, const char *attr_name,
+ int arg_idx)
+ : fd_param_diagnostic (sm, arg, callee_fndecl, attr_name, arg_idx)
+ {
+ }
+
+ fd_use_after_close (const fd_state_machine &sm, tree arg,
+ const tree callee_fndecl)
+ : fd_param_diagnostic (sm, arg, callee_fndecl)
+ {
+ }
+
+ const char *
+ get_kind () const final override
+ {
+ return "fd_use_after_close";
+ }
+
+ int
+ get_controlling_option () const final override
+ {
+ return OPT_Wanalyzer_fd_use_after_close;
+ }
+
+ bool
+ emit (rich_location *rich_loc) final override
+ {
+ bool warned;
+ warned = warning_at (rich_loc, get_controlling_option (),
+ "%qE on closed file descriptor %qE", m_callee_fndecl,
+ m_arg);
+ if (warned)
+ inform_filedescriptor_attribute (DIRS_READ_WRITE);
+ return warned;
+ }
+
+ label_text
+ describe_state_change (const evdesc::state_change &change) override
+ {
+ if (m_sm.is_unchecked_fd_p (change.m_new_state))
+ return label_text::borrow ("opened here");
+
+ if (change.m_new_state == m_sm.m_closed)
+ {
+ m_first_close_event = change.m_event_id;
+ return change.formatted_print ("closed here");
+ }
+
+ return fd_diagnostic::describe_state_change (change);
+ }
+
+ label_text
+ describe_final_event (const evdesc::final_event &ev) final override
+ {
+ if (m_first_close_event.known_p ())
+ return ev.formatted_print (
+ "%qE on closed file descriptor %qE; %qs was at %@", m_callee_fndecl,
+ m_arg, "close", &m_first_close_event);
+ else
+ return ev.formatted_print ("%qE on closed file descriptor %qE",
+ m_callee_fndecl, m_arg);
+ }
+
+private:
+ diagnostic_event_id_t m_first_close_event;
+};
+
+class fd_use_without_check : public fd_param_diagnostic
+{
+public:
+ fd_use_without_check (const fd_state_machine &sm, tree arg,
+ const tree callee_fndecl, const char *attr_name,
+ int arg_idx)
+ : fd_param_diagnostic (sm, arg, callee_fndecl, attr_name, arg_idx)
+ {
+ }
+
+ fd_use_without_check (const fd_state_machine &sm, tree arg,
+ const tree callee_fndecl)
+ : fd_param_diagnostic (sm, arg, callee_fndecl)
+ {
+ }
+
+ const char *
+ get_kind () const final override
+ {
+ return "fd_use_without_check";
+ }
+
+ int
+ get_controlling_option () const final override
+ {
+ return OPT_Wanalyzer_fd_use_without_check;
+ }
+
+ bool
+ emit (rich_location *rich_loc) final override
+ {
+ bool warned;
+ warned = warning_at (rich_loc, get_controlling_option (),
+ "%qE on possibly invalid file descriptor %qE",
+ m_callee_fndecl, m_arg);
+ if (warned)
+ inform_filedescriptor_attribute (DIRS_READ_WRITE);
+ return warned;
+ }
+
+ label_text
+ describe_state_change (const evdesc::state_change &change) override
+ {
+ if (m_sm.is_unchecked_fd_p (change.m_new_state))
+ {
+ m_first_open_event = change.m_event_id;
+ return label_text::borrow ("opened here");
+ }
+
+ return fd_diagnostic::describe_state_change (change);
+ }
+
+ label_text
+ describe_final_event (const evdesc::final_event &ev) final override
+ {
+ if (m_first_open_event.known_p ())
+ return ev.formatted_print (
+ "%qE could be invalid: unchecked value from %@", m_arg,
+ &m_first_open_event);
+ else
+ return ev.formatted_print ("%qE could be invalid", m_arg);
+ }
+
+private:
+ diagnostic_event_id_t m_first_open_event;
+};
+
+fd_state_machine::fd_state_machine (logger *logger)
+ : state_machine ("file-descriptor", logger),
+ m_constant_fd (add_state ("fd-constant")),
+ m_unchecked_read_write (add_state ("fd-unchecked-read-write")),
+ m_unchecked_read_only (add_state ("fd-unchecked-read-only")),
+ m_unchecked_write_only (add_state ("fd-unchecked-write-only")),
+ m_valid_read_write (add_state ("fd-valid-read-write")),
+ m_valid_read_only (add_state ("fd-valid-read-only")),
+ m_valid_write_only (add_state ("fd-valid-write-only")),
+ m_invalid (add_state ("fd-invalid")),
+ m_closed (add_state ("fd-closed")),
+ m_stop (add_state ("fd-stop"))
+{
+}
+
+bool
+fd_state_machine::is_unchecked_fd_p (state_t s) const
+{
+ return (s == m_unchecked_read_write
+ || s == m_unchecked_read_only
+ || s == m_unchecked_write_only);
+}
+
+bool
+fd_state_machine::is_valid_fd_p (state_t s) const
+{
+ return (s == m_valid_read_write
+ || s == m_valid_read_only
+ || s == m_valid_write_only);
+}
+
+enum access_mode
+fd_state_machine::get_access_mode_from_flag (int flag) const
+{
+ /* FIXME: this code assumes the access modes on the host and
+ target are the same, which in practice might not be the case. */
+
+ if ((flag & O_ACCMODE) == O_RDONLY)
+ {
+ return READ_ONLY;
+ }
+ else if ((flag & O_ACCMODE) == O_WRONLY)
+ {
+ return WRITE_ONLY;
+ }
+ return READ_WRITE;
+}
+
+bool
+fd_state_machine::is_readonly_fd_p (state_t state) const
+{
+ return (state == m_unchecked_read_only || state == m_valid_read_only);
+}
+
+bool
+fd_state_machine::is_writeonly_fd_p (state_t state) const
+{
+ return (state == m_unchecked_write_only || state == m_valid_write_only);
+}
+
+bool
+fd_state_machine::is_closed_fd_p (state_t state) const
+{
+ return (state == m_closed);
+}
+
+bool
+fd_state_machine::is_constant_fd_p (state_t state) const
+{
+ return (state == m_constant_fd);
+}
+
+bool
+fd_state_machine::on_stmt (sm_context *sm_ctxt, const supernode *node,
+ const gimple *stmt) const
+{
+ if (const gcall *call = dyn_cast<const gcall *> (stmt))
+ if (tree callee_fndecl = sm_ctxt->get_fndecl_for_call (call))
+ {
+ if (is_named_call_p (callee_fndecl, "open", call, 2))
+ {
+ on_open (sm_ctxt, node, stmt, call);
+ return true;
+ } // "open"
+
+ if (is_named_call_p (callee_fndecl, "close", call, 1))
+ {
+ on_close (sm_ctxt, node, stmt, call);
+ return true;
+ } // "close"
+
+ if (is_named_call_p (callee_fndecl, "write", call, 3))
+ {
+ on_write (sm_ctxt, node, stmt, call, callee_fndecl);
+ return true;
+ } // "write"
+
+ if (is_named_call_p (callee_fndecl, "read", call, 3))
+ {
+ on_read (sm_ctxt, node, stmt, call, callee_fndecl);
+ return true;
+ } // "read"
+
+
+ {
+ // Handle __attribute__((fd_arg))
+
+ check_for_fd_attrs (sm_ctxt, node, stmt, call, callee_fndecl,
+ "fd_arg", DIRS_READ_WRITE);
+
+ // Handle __attribute__((fd_arg_read))
+
+ check_for_fd_attrs (sm_ctxt, node, stmt, call, callee_fndecl,
+ "fd_arg_read", DIRS_READ);
+
+ // Handle __attribute__((fd_arg_write))
+
+ check_for_fd_attrs (sm_ctxt, node, stmt, call, callee_fndecl,
+ "fd_arg_write", DIRS_WRITE);
+ }
+ }
+
+ return false;
+}
+
+void
+fd_state_machine::check_for_fd_attrs (
+ sm_context *sm_ctxt, const supernode *node, const gimple *stmt,
+ const gcall *call, const tree callee_fndecl, const char *attr_name,
+ access_directions fd_attr_access_dir) const
+{
+
+ tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (callee_fndecl));
+ attrs = lookup_attribute (attr_name, attrs);
+ if (!attrs)
+ return;
+
+ if (!TREE_VALUE (attrs))
+ return;
+
+ auto_bitmap argmap;
+
+ for (tree idx = TREE_VALUE (attrs); idx; idx = TREE_CHAIN (idx))
+ {
+ unsigned int val = TREE_INT_CST_LOW (TREE_VALUE (idx)) - 1;
+ bitmap_set_bit (argmap, val);
+ }
+ if (bitmap_empty_p (argmap))
+ return;
+
+ for (unsigned arg_idx = 0; arg_idx < gimple_call_num_args (call); arg_idx++)
+ {
+ tree arg = gimple_call_arg (call, arg_idx);
+ tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
+ state_t state = sm_ctxt->get_state (stmt, arg);
+ bool bit_set = bitmap_bit_p (argmap, arg_idx);
+ if (TREE_CODE (TREE_TYPE (arg)) != INTEGER_TYPE)
+ continue;
+ if (bit_set) // Check if arg_idx is marked by any of the file descriptor
+ // attributes
+ {
+
+ if (is_closed_fd_p (state))
+ {
+
+ sm_ctxt->warn (node, stmt, arg,
+ new fd_use_after_close (*this, diag_arg,
+ callee_fndecl, attr_name,
+ arg_idx));
+ continue;
+ }
+
+ if (!(is_valid_fd_p (state) || (state == m_stop)))
+ {
+ if (!is_constant_fd_p (state))
+ sm_ctxt->warn (node, stmt, arg,
+ new fd_use_without_check (*this, diag_arg,
+ callee_fndecl, attr_name,
+ arg_idx));
+ }
+
+ switch (fd_attr_access_dir)
+ {
+ case DIRS_READ_WRITE:
+ break;
+ case DIRS_READ:
+
+ if (is_writeonly_fd_p (state))
+ {
+ sm_ctxt->warn (
+ node, stmt, arg,
+ new fd_access_mode_mismatch (*this, diag_arg, DIRS_WRITE,
+ callee_fndecl, attr_name, arg_idx));
+ }
+
+ break;
+ case DIRS_WRITE:
+
+ if (is_readonly_fd_p (state))
+ {
+ sm_ctxt->warn (
+ node, stmt, arg,
+ new fd_access_mode_mismatch (*this, diag_arg, DIRS_READ,
+ callee_fndecl, attr_name, arg_idx));
+ }
+
+ break;
+ }
+ }
+ }
+}
+
+
+void
+fd_state_machine::on_open (sm_context *sm_ctxt, const supernode *node,
+ const gimple *stmt, const gcall *call) const
+{
+ tree lhs = gimple_call_lhs (call);
+ if (lhs)
+ {
+ tree arg = gimple_call_arg (call, 1);
+ if (TREE_CODE (arg) == INTEGER_CST)
+ {
+ int flag = TREE_INT_CST_LOW (arg);
+ enum access_mode mode = get_access_mode_from_flag (flag);
+
+ switch (mode)
+ {
+ case READ_ONLY:
+ sm_ctxt->on_transition (node, stmt, lhs, m_start,
+ m_unchecked_read_only);
+ break;
+ case WRITE_ONLY:
+ sm_ctxt->on_transition (node, stmt, lhs, m_start,
+ m_unchecked_write_only);
+ break;
+ default:
+ sm_ctxt->on_transition (node, stmt, lhs, m_start,
+ m_unchecked_read_write);
+ }
+ }
+ }
+ else
+ {
+ sm_ctxt->warn (node, stmt, NULL_TREE, new fd_leak (*this, NULL_TREE));
+ }
+}
+
+void
+fd_state_machine::on_close (sm_context *sm_ctxt, const supernode *node,
+ const gimple *stmt, const gcall *call) const
+{
+ tree arg = gimple_call_arg (call, 0);
+ state_t state = sm_ctxt->get_state (stmt, arg);
+ tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
+
+ sm_ctxt->on_transition (node, stmt, arg, m_start, m_closed);
+ sm_ctxt->on_transition (node, stmt, arg, m_unchecked_read_write, m_closed);
+ sm_ctxt->on_transition (node, stmt, arg, m_unchecked_read_only, m_closed);
+ sm_ctxt->on_transition (node, stmt, arg, m_unchecked_write_only, m_closed);
+ sm_ctxt->on_transition (node, stmt, arg, m_valid_read_write, m_closed);
+ sm_ctxt->on_transition (node, stmt, arg, m_valid_read_only, m_closed);
+ sm_ctxt->on_transition (node, stmt, arg, m_valid_write_only, m_closed);
+ sm_ctxt->on_transition (node, stmt, arg, m_constant_fd, m_closed);
+
+ if (is_closed_fd_p (state))
+ {
+ sm_ctxt->warn (node, stmt, arg, new fd_double_close (*this, diag_arg));
+ sm_ctxt->set_next_state (stmt, arg, m_stop);
+ }
+}
+void
+fd_state_machine::on_read (sm_context *sm_ctxt, const supernode *node,
+ const gimple *stmt, const gcall *call,
+ const tree callee_fndecl) const
+{
+ check_for_open_fd (sm_ctxt, node, stmt, call, callee_fndecl, DIRS_READ);
+}
+void
+fd_state_machine::on_write (sm_context *sm_ctxt, const supernode *node,
+ const gimple *stmt, const gcall *call,
+ const tree callee_fndecl) const
+{
+ check_for_open_fd (sm_ctxt, node, stmt, call, callee_fndecl, DIRS_WRITE);
+}
+
+void
+fd_state_machine::check_for_open_fd (
+ sm_context *sm_ctxt, const supernode *node, const gimple *stmt,
+ const gcall *call, const tree callee_fndecl,
+ enum access_directions callee_fndecl_dir) const
+{
+ tree arg = gimple_call_arg (call, 0);
+ tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
+ state_t state = sm_ctxt->get_state (stmt, arg);
+
+ if (is_closed_fd_p (state))
+ {
+ sm_ctxt->warn (node, stmt, arg,
+ new fd_use_after_close (*this, diag_arg, callee_fndecl));
+ }
+
+ else
+ {
+ if (!(is_valid_fd_p (state) || (state == m_stop)))
+ {
+ if (!is_constant_fd_p (state))
+ sm_ctxt->warn (
+ node, stmt, arg,
+ new fd_use_without_check (*this, diag_arg, callee_fndecl));
+ }
+ switch (callee_fndecl_dir)
+ {
+ case DIRS_READ:
+ if (is_writeonly_fd_p (state))
+ {
+ tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
+ sm_ctxt->warn (node, stmt, arg,
+ new fd_access_mode_mismatch (
+ *this, diag_arg, DIRS_WRITE, callee_fndecl));
+ }
+
+ break;
+ case DIRS_WRITE:
+
+ if (is_readonly_fd_p (state))
+ {
+ tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
+ sm_ctxt->warn (node, stmt, arg,
+ new fd_access_mode_mismatch (
+ *this, diag_arg, DIRS_READ, callee_fndecl));
+ }
+ break;
+ default:
+ gcc_unreachable ();
+ }
+ }
+}
+
+void
+fd_state_machine::on_condition (sm_context *sm_ctxt, const supernode *node,
+ const gimple *stmt, const svalue *lhs,
+ enum tree_code op, const svalue *rhs) const
+{
+ if (tree cst = rhs->maybe_get_constant ())
+ {
+ if (TREE_CODE (cst) == INTEGER_CST)
+ {
+ int val = TREE_INT_CST_LOW (cst);
+ if (val == -1)
+ {
+ if (op == NE_EXPR)
+ make_valid_transitions_on_condition (sm_ctxt, node, stmt, lhs);
+
+ else if (op == EQ_EXPR)
+ make_invalid_transitions_on_condition (sm_ctxt, node, stmt,
+ lhs);
+ }
+ }
+ }
+
+ if (rhs->all_zeroes_p ())
+ {
+ if (op == GE_EXPR)
+ make_valid_transitions_on_condition (sm_ctxt, node, stmt, lhs);
+ else if (op == LT_EXPR)
+ make_invalid_transitions_on_condition (sm_ctxt, node, stmt, lhs);
+ }
+}
+
+void
+fd_state_machine::make_valid_transitions_on_condition (sm_context *sm_ctxt,
+ const supernode *node,
+ const gimple *stmt,
+ const svalue *lhs) const
+{
+ sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_read_write,
+ m_valid_read_write);
+ sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_read_only,
+ m_valid_read_only);
+ sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_write_only,
+ m_valid_write_only);
+}
+
+void
+fd_state_machine::make_invalid_transitions_on_condition (
+ sm_context *sm_ctxt, const supernode *node, const gimple *stmt,
+ const svalue *lhs) const
+{
+ sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_read_write, m_invalid);
+ sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_read_only, m_invalid);
+ sm_ctxt->on_transition (node, stmt, lhs, m_unchecked_write_only, m_invalid);
+}
+
+bool
+fd_state_machine::can_purge_p (state_t s) const
+{
+ if (is_unchecked_fd_p (s) || is_valid_fd_p (s))
+ return false;
+ else
+ return true;
+}
+
+pending_diagnostic *
+fd_state_machine::on_leak (tree var) const
+{
+ return new fd_leak (*this, var);
+}
+} // namespace
+
+state_machine *
+make_fd_state_machine (logger *logger)
+{
+ return new fd_state_machine (logger);
+}
+} // namespace ana
+
+#endif // ENABLE_ANALYZER
projects / platform / upstream / gcc.git / commitdiff