clang/test/Analysis/fuchsia_handle.cpp

   1 // RUN: %clang_analyze_cc1 -analyzer-checker=core,fuchsia.HandleChecker -analyzer-output=text \
   2 // RUN:     -verify %s
   3
   4 typedef __typeof__(sizeof(int)) size_t;
   5 typedef int zx_status_t;
   6 typedef __typeof__(sizeof(int)) zx_handle_t;
   7 typedef unsigned int uint32_t;
   8 #define NULL ((void *)0)
   9 #define ZX_HANDLE_INVALID 0
  10
  11 #if defined(__clang__)
  12 #define ZX_HANDLE_ACQUIRE __attribute__((acquire_handle("Fuchsia")))
  13 #define ZX_HANDLE_RELEASE __attribute__((release_handle("Fuchsia")))
  14 #define ZX_HANDLE_USE __attribute__((use_handle("Fuchsia")))
  15 #define ZX_HANDLE_ACQUIRE_UNOWNED __attribute__((acquire_handle("FuchsiaUnowned")))
  16 #else
  17 #define ZX_HANDLE_ACQUIRE
  18 #define ZX_HANDLE_RELEASE
  19 #define ZX_HANDLE_USE
  20 #define ZX_HANDLE_ACQUIRE_UNOWNED
  21 #endif
  22
  23 zx_status_t zx_channel_create(
  24     uint32_t options,
  25     zx_handle_t *out0 ZX_HANDLE_ACQUIRE,
  26     zx_handle_t *out1 ZX_HANDLE_ACQUIRE);
  27
  28 zx_status_t zx_handle_close(
  29     zx_handle_t handle ZX_HANDLE_RELEASE);
  30
  31 ZX_HANDLE_ACQUIRE_UNOWNED
  32 zx_handle_t zx_process_self();
  33
  34 void zx_process_self_param(zx_handle_t *out ZX_HANDLE_ACQUIRE_UNOWNED);
  35
  36 ZX_HANDLE_ACQUIRE
  37 zx_handle_t return_handle();
  38
  39 void escape1(zx_handle_t *in);
  40 void escape2(zx_handle_t in);
  41 void (*escape3)(zx_handle_t) = escape2;
  42
  43 void use1(const zx_handle_t *in ZX_HANDLE_USE);
  44 void use2(zx_handle_t in ZX_HANDLE_USE);
  45
  46 void moreArgs(zx_handle_t, int, ...);
  47 void lessArgs(zx_handle_t, int a = 5);
  48
  49 // To test if argument indexes are OK for operator calls.
  50 struct MyType {
  51   ZX_HANDLE_ACQUIRE
  52   zx_handle_t operator+(zx_handle_t ZX_HANDLE_RELEASE replace);
  53 };
  54
  55 void checkUnownedHandle01() {
  56   zx_handle_t h0;
  57   h0 = zx_process_self(); // expected-note {{Function 'zx_process_self' returns an unowned handle}}
  58   zx_handle_close(h0);    // expected-warning {{Releasing an unowned handle}}
  59                           // expected-note@-1 {{Releasing an unowned handle}}
  60 }
  61
  62 void checkUnownedHandle02() {
  63   zx_handle_t h0;
  64   zx_process_self_param(&h0); // expected-note {{Unowned handle allocated through 1st parameter}}
  65   zx_handle_close(h0);        // expected-warning {{Releasing an unowned handle}}
  66                               // expected-note@-1 {{Releasing an unowned handle}}
  67 }
  68
  69 void checkInvalidHandle01() {
  70   zx_handle_t sa, sb;
  71   zx_channel_create(0, &sa, &sb);
  72   if (sa == ZX_HANDLE_INVALID)
  73     ;
  74   // Will we ever see a warning like below?
  75   // We eagerly replace the symbol with a constant and lose info...
  76   use2(sa); // TODOexpected-warning {{Use of an invalid handle}}
  77   zx_handle_close(sb);
  78   zx_handle_close(sa);
  79 }
  80
  81 void checkInvalidHandle2() {
  82   zx_handle_t sa, sb;
  83   zx_channel_create(0, &sa, &sb);
  84   if (sb != ZX_HANDLE_INVALID)
  85     zx_handle_close(sb);
  86   if (sa != ZX_HANDLE_INVALID)
  87     zx_handle_close(sa);
  88 }
  89
  90 void handleDieBeforeErrorSymbol01() {
  91   zx_handle_t sa, sb;
  92   zx_status_t status = zx_channel_create(0, &sa, &sb);
  93   if (status < 0)
  94     return;
  95   __builtin_trap();
  96 }
  97
  98 void handleDieBeforeErrorSymbol02() {
  99   zx_handle_t sa, sb;
 100   zx_status_t status = zx_channel_create(0, &sa, &sb);
 101   // FIXME: There appears to be non-determinism in choosing
 102   // which handle to report.
 103   // expected-note-re@-3 {{Handle allocated through {{(2nd|3rd)}} parameter}}
 104   if (status == 0) { // expected-note {{Assuming 'status' is equal to 0}}
 105                      // expected-note@-1 {{Taking true branch}}
 106     return;          // expected-warning {{Potential leak of handle}}
 107                      // expected-note@-1 {{Potential leak of handle}}
 108   }
 109   __builtin_trap();
 110 }
 111
 112 void checkNoCrash01() {
 113   zx_handle_t sa, sb;
 114   zx_channel_create(0, &sa, &sb);
 115   moreArgs(sa, 1, 2, 3, 4, 5);
 116   lessArgs(sa);
 117   zx_handle_close(sa);
 118   zx_handle_close(sb);
 119 }
 120
 121 void checkNoLeak01() {
 122   zx_handle_t sa, sb;
 123   zx_channel_create(0, &sa, &sb);
 124   zx_handle_close(sa);
 125   zx_handle_close(sb);
 126 }
 127
 128 void checkNoLeak02() {
 129   zx_handle_t ay[2];
 130   zx_channel_create(0, &ay[0], &ay[1]);
 131   zx_handle_close(ay[0]);
 132   zx_handle_close(ay[1]);
 133 }
 134
 135 void checkNoLeak03() {
 136   zx_handle_t ay[2];
 137   zx_channel_create(0, &ay[0], &ay[1]);
 138   for (int i = 0; i < 2; i++)
 139     zx_handle_close(ay[i]);
 140 }
 141
 142 zx_handle_t checkNoLeak04() {
 143   zx_handle_t sa, sb;
 144   zx_channel_create(0, &sa, &sb);
 145   zx_handle_close(sa);
 146   return sb; // no warning
 147 }
 148
 149 zx_handle_t checkNoLeak05(zx_handle_t *out1) {
 150   zx_handle_t sa, sb;
 151   zx_channel_create(0, &sa, &sb);
 152   *out1 = sa;
 153   return sb; // no warning
 154 }
 155
 156 void checkNoLeak06() {
 157   zx_handle_t sa, sb;
 158   if (zx_channel_create(0, &sa, &sb))
 159     return;
 160   zx_handle_close(sa);
 161   zx_handle_close(sb);
 162 }
 163
 164 void checkLeak01(int tag) {
 165   zx_handle_t sa, sb;
 166   if (zx_channel_create(0, &sa, &sb)) // expected-note    {{Handle allocated through 2nd parameter}}
 167     return;                           // expected-note@-1 {{Assuming the condition is false}}
 168                                       // expected-note@-2 {{Taking false branch}}
 169   use1(&sa);
 170   if (tag) // expected-note {{Assuming 'tag' is 0}}
 171     zx_handle_close(sa);
 172   // expected-note@-2 {{Taking false branch}}
 173   use2(sb); // expected-warning {{Potential leak of handle}}
 174   // expected-note@-1 {{Potential leak of handle}}
 175   zx_handle_close(sb);
 176 }
 177
 178 void checkLeakFromReturn01(int tag) {
 179   zx_handle_t sa = return_handle(); // expected-note {{Function 'return_handle' returns an open handle}}
 180   (void)sa;
 181 } // expected-note {{Potential leak of handle}}
 182 // expected-warning@-1 {{Potential leak of handle}}
 183
 184 void checkReportLeakOnOnePath(int tag) {
 185   zx_handle_t sa, sb;
 186   if (zx_channel_create(0, &sa, &sb)) // expected-note {{Handle allocated through 2nd parameter}}
 187     return;                           // expected-note@-1 {{Assuming the condition is false}}
 188                                       // expected-note@-2 {{Taking false branch}}
 189   zx_handle_close(sb);
 190   switch (tag) { // expected-note {{Control jumps to the 'default' case at line}}
 191   case 0:
 192     use2(sa);
 193     return;
 194   case 1:
 195     use2(sa);
 196     return;
 197   case 2:
 198     use2(sa);
 199     return;
 200   case 3:
 201     use2(sa);
 202     return;
 203   case 4:
 204     use2(sa);
 205     return;
 206   default:
 207     use2(sa);
 208     return; // expected-warning {{Potential leak of handle}}
 209             // expected-note@-1 {{Potential leak of handle}}
 210   }
 211 }
 212
 213 void checkDoubleRelease01(int tag) {
 214   zx_handle_t sa, sb;
 215   zx_channel_create(0, &sa, &sb);
 216   // expected-note@-1 {{Handle allocated through 2nd parameter}}
 217   if (tag)               // expected-note {{Assuming 'tag' is not equal to 0}}
 218     zx_handle_close(sa); // expected-note {{Handle released through 1st parameter}}
 219   // expected-note@-2 {{Taking true branch}}
 220   zx_handle_close(sa); // expected-warning {{Releasing a previously released handle}}
 221   // expected-note@-1 {{Releasing a previously released handle}}
 222   zx_handle_close(sb);
 223 }
 224
 225 void checkUseAfterFree01(int tag) {
 226   zx_handle_t sa, sb;
 227   zx_channel_create(0, &sa, &sb);
 228   // expected-note@-1 {{Handle allocated through 2nd parameter}}
 229   // expected-note@-2 {{Handle allocated through 3rd parameter}}
 230   // expected-note@+2 {{Taking true branch}}
 231   // expected-note@+1 {{Taking false branch}}
 232   if (tag) {
 233     // expected-note@-1 {{Assuming 'tag' is not equal to 0}}
 234     zx_handle_close(sa); // expected-note {{Handle released through 1st parameter}}
 235     use1(&sa);           // expected-warning {{Using a previously released handle}}
 236     // expected-note@-1 {{Using a previously released handle}}
 237   }
 238   // expected-note@-6 {{Assuming 'tag' is 0}}
 239   zx_handle_close(sb); // expected-note {{Handle released through 1st parameter}}
 240   use2(sb);            // expected-warning {{Using a previously released handle}}
 241   // expected-note@-1 {{Using a previously released handle}}
 242 }
 243
 244 void checkMemberOperatorIndices() {
 245   zx_handle_t sa, sb, sc;
 246   zx_channel_create(0, &sa, &sb);
 247   zx_handle_close(sb);
 248   MyType t;
 249   sc = t + sa;
 250   zx_handle_close(sc);
 251 }
 252
 253 struct HandleStruct {
 254   zx_handle_t h;
 255 };
 256
 257 void close_handle_struct(HandleStruct hs ZX_HANDLE_RELEASE);
 258
 259 void use_handle_struct(HandleStruct hs ZX_HANDLE_USE);
 260
 261 void checkHandleInStructureUseAfterFree() {
 262   zx_handle_t sa, sb;
 263   zx_channel_create(0, &sa, &sb); // expected-note {{Handle allocated through 3rd parameter}}
 264   HandleStruct hs;
 265   hs.h = sb;
 266   use_handle_struct(hs);
 267   close_handle_struct(hs); // expected-note {{Handle released through 1st parameter}}
 268   zx_handle_close(sa);
 269
 270   use2(sb); // expected-warning {{Using a previously released handle}}
 271   // expected-note@-1 {{Using a previously released handle}}
 272 }
 273
 274 void checkHandleInStructureUseAfterFree2() {
 275   zx_handle_t sa, sb;
 276   zx_channel_create(0, &sa, &sb); // expected-note {{Handle allocated through 3rd parameter}}
 277   HandleStruct hs;
 278   hs.h = sb;
 279   use_handle_struct(hs);
 280   zx_handle_close(sb); // expected-note {{Handle released through 1st parameter}}
 281   zx_handle_close(sa);
 282
 283   use_handle_struct(hs); // expected-warning {{Using a previously released handle}}
 284   // expected-note@-1 {{Using a previously released handle}}
 285 }
 286
 287 void checkHandleInStructureLeak() {
 288   zx_handle_t sa, sb;
 289   zx_channel_create(0, &sa, &sb); // expected-note {{Handle allocated through 3rd parameter}}
 290   HandleStruct hs;
 291   hs.h = sb;
 292   zx_handle_close(sa); // expected-warning {{Potential leak of handle}}
 293   // expected-note@-1 {{Potential leak of handle}}
 294 }
 295
 296 struct HandlePtrStruct {
 297   zx_handle_t *h;
 298 };
 299
 300 void close_handle_struct(HandlePtrStruct hs ZX_HANDLE_RELEASE);
 301
 302 void use_handle_struct(HandlePtrStruct hs ZX_HANDLE_USE);
 303
 304 void checkHandlePtrInStructureUseAfterFree() {
 305   zx_handle_t sa, sb;
 306   zx_channel_create(0, &sa, &sb);
 307   HandlePtrStruct hs;
 308   hs.h = &sb;
 309   use_handle_struct(hs);
 310   close_handle_struct(hs); // expected-note {{Handle released through 1st parameter}}
 311   zx_handle_close(sa);
 312
 313   use2(sb); // expected-warning {{Using a previously released handle}}
 314   // expected-note@-1 {{Using a previously released handle}}
 315 }
 316
 317 void checkHandlePtrInStructureUseAfterFree2() {
 318   zx_handle_t sa, sb;
 319   zx_channel_create(0, &sa, &sb);
 320   HandlePtrStruct hs;
 321   hs.h = &sb;
 322   use_handle_struct(hs);
 323   zx_handle_close(sb); // expected-note {{Handle released through 1st parameter}}
 324   zx_handle_close(sa);
 325
 326   use_handle_struct(hs); // expected-warning {{Using a previously released handle}}
 327   // expected-note@-1 {{Using a previously released handle}}
 328 }
 329
 330 void checkHandlePtrInStructureLeak() {
 331   zx_handle_t sa, sb;
 332   zx_channel_create(0, &sa, &sb); // expected-note {{Handle allocated through 3rd parameter}}
 333   HandlePtrStruct hs;
 334   hs.h = &sb;
 335   zx_handle_close(sa); // expected-warning {{Potential leak of handle}}
 336   // expected-note@-1 {{Potential leak of handle}}
 337 }
 338
 339 // Assume this function's declaration that has the release annotation is in one
 340 // header file while its implementation is in another file. We have to annotate
 341 // the declaration because it might be used outside the TU.
 342 // We also want to make sure it is okay to call the function within the same TU.
 343 zx_status_t test_release_handle(zx_handle_t handle ZX_HANDLE_RELEASE) {
 344   return zx_handle_close(handle);
 345 }
 346
 347 void checkReleaseImplementedFunc() {
 348   zx_handle_t a, b;
 349   zx_channel_create(0, &a, &b);
 350   zx_handle_close(a);
 351   test_release_handle(b);
 352 }
 353
 354 void use_handle(zx_handle_t handle) {
 355   // Do nothing.
 356 }
 357
 358 void test_call_by_value() {
 359   zx_handle_t a, b;
 360   zx_channel_create(0, &a, &b);
 361   zx_handle_close(a);
 362   use_handle(b);
 363   zx_handle_close(b);
 364 }
 365
 366 void test_call_by_value_leak() {
 367   zx_handle_t a, b;
 368   zx_channel_create(0, &a, &b); // expected-note {{Handle allocated through 3rd parameter}}
 369   zx_handle_close(a);
 370   // Here we are passing handle b as integer value to a function that could be
 371   // analyzed by the analyzer, thus the handle should not be considered escaped.
 372   // After the function 'use_handle', handle b is still tracked and should be
 373   // reported leaked.
 374   use_handle(b);
 375 } // expected-warning {{Potential leak of handle}}
 376 // expected-note@-1 {{Potential leak of handle}}
 377
 378 // RAII
 379
 380 template <typename T>
 381 struct HandleWrapper {
 382   ~HandleWrapper() { close(); }
 383   void close() {
 384     if (handle != ZX_HANDLE_INVALID)
 385       zx_handle_close(handle);
 386   }
 387   T *get_handle_address() { return &handle; }
 388
 389 private:
 390   T handle;
 391 };
 392
 393 void doNotWarnOnRAII() {
 394   HandleWrapper<zx_handle_t> w1;
 395   zx_handle_t sb;
 396   if (zx_channel_create(0, w1.get_handle_address(), &sb))
 397     return;
 398   zx_handle_close(sb);
 399 }
 400
 401 template <typename T>
 402 struct HandleWrapperUnkonwDtor {
 403   ~HandleWrapperUnkonwDtor();
 404   void close() {
 405     if (handle != ZX_HANDLE_INVALID)
 406       zx_handle_close(handle);
 407   }
 408   T *get_handle_address() { return &handle; }
 409
 410 private:
 411   T handle;
 412 };
 413
 414 void doNotWarnOnUnknownDtor() {
 415   HandleWrapperUnkonwDtor<zx_handle_t> w1;
 416   zx_handle_t sb;
 417   if (zx_channel_create(0, w1.get_handle_address(), &sb))
 418     return;
 419   zx_handle_close(sb);
 420 }
 421
 422 // Various escaping scenarios
 423
 424 zx_handle_t *get_handle_address();
 425
 426 void escape_store_to_escaped_region01() {
 427   zx_handle_t sb;
 428   if (zx_channel_create(0, get_handle_address(), &sb))
 429     return;
 430   zx_handle_close(sb);
 431 }
 432
 433 struct object {
 434   zx_handle_t *get_handle_address();
 435 };
 436
 437 void escape_store_to_escaped_region02(object &o) {
 438   zx_handle_t sb;
 439   // Same as above.
 440   if (zx_channel_create(0, o.get_handle_address(), &sb))
 441     return;
 442   zx_handle_close(sb);
 443 }
 444
 445 void escape_store_to_escaped_region03(object o) {
 446   zx_handle_t sb;
 447   // Should we consider the pointee of get_handle_address escaped?
 448   // Maybe we only should it consider escaped if o escapes?
 449   if (zx_channel_create(0, o.get_handle_address(), &sb))
 450     return;
 451   zx_handle_close(sb);
 452 }
 453
 454 void escape_through_call(int tag) {
 455   zx_handle_t sa, sb;
 456   if (zx_channel_create(0, &sa, &sb))
 457     return;
 458   escape1(&sa);
 459   if (tag)
 460     escape2(sb);
 461   else
 462     escape3(sb);
 463 }
 464
 465 struct have_handle {
 466   zx_handle_t h;
 467   zx_handle_t *hp;
 468 };
 469
 470 void escape_through_store01(have_handle *handle) {
 471   zx_handle_t sa;
 472   if (zx_channel_create(0, &sa, handle->hp))
 473     return;
 474   handle->h = sa;
 475 }
 476
 477 have_handle global;
 478 void escape_through_store02() {
 479   zx_handle_t sa;
 480   if (zx_channel_create(0, &sa, global.hp))
 481     return;
 482   global.h = sa;
 483 }
 484
 485 have_handle escape_through_store03() {
 486   zx_handle_t sa, sb;
 487   if (zx_channel_create(0, &sa, &sb))
 488     return {0, nullptr};
 489   zx_handle_close(sb);
 490   return {sa, nullptr};
 491 }
 492
 493 void escape_structs(have_handle *);
 494 void escape_transitively01() {
 495   zx_handle_t sa, sb;
 496   if (zx_channel_create(0, &sa, &sb))
 497     return;
 498   have_handle hs[2];
 499   hs[1] = {sa, &sb};
 500   escape_structs(hs);
 501 }
 502
 503 void escape_top_level_pointees(zx_handle_t *h) {
 504   zx_handle_t h2;
 505   if (zx_channel_create(0, h, &h2))
 506     return;
 507   zx_handle_close(h2);
 508 } // *h should be escaped here. Right?