clang/lib/StaticAnalyzer/Checkers/VforkChecker.cpp

   1 //===- VforkChecker.cpp -------- Vfork usage checks --------------*- C++ -*-==//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 //  This file defines vfork checker which checks for dangerous uses of vfork.
  10 //  Vforked process shares memory (including stack) with parent so it's
  11 //  range of actions is significantly limited: can't write variables,
  12 //  can't call functions not in the allowed list, etc. For more details, see
  13 //  http://man7.org/linux/man-pages/man2/vfork.2.html
  14 //
  15 //  This checker checks for prohibited constructs in vforked process.
  16 //  The state transition diagram:
  17 //  PARENT ---(vfork() == 0)--> CHILD
  18 //                                   |
  19 //                                   --(*p = ...)--> bug
  20 //                                   |
  21 //                                   --foo()--> bug
  22 //                                   |
  23 //                                   --return--> bug
  24 //
  25 //===----------------------------------------------------------------------===//
  26
  27 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
  28 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
  29 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  30 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
  31 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
  32 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
  33 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
  34 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
  35 #include "clang/StaticAnalyzer/Core/Checker.h"
  36 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
  37 #include "clang/AST/ParentMap.h"
  38 #include <optional>
  39
  40 using namespace clang;
  41 using namespace ento;
  42
  43 namespace {
  44
  45 class VforkChecker : public Checker<check::PreCall, check::PostCall,
  46                                     check::Bind, check::PreStmt<ReturnStmt>> {
  47   mutable std::unique_ptr<BugType> BT;
  48   mutable llvm::SmallSet<const IdentifierInfo *, 10> VforkAllowlist;
  49   mutable const IdentifierInfo *II_vfork = nullptr;
  50
  51   static bool isChildProcess(const ProgramStateRef State);
  52
  53   bool isVforkCall(const Decl *D, CheckerContext &C) const;
  54   bool isCallExplicitelyAllowed(const IdentifierInfo *II,
  55                                 CheckerContext &C) const;
  56
  57   void reportBug(const char *What, CheckerContext &C,
  58                  const char *Details = nullptr) const;
  59
  60 public:
  61   VforkChecker() = default;
  62
  63   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
  64   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
  65   void checkBind(SVal L, SVal V, const Stmt *S, CheckerContext &C) const;
  66   void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
  67 };
  68
  69 } // end anonymous namespace
  70
  71 // This trait holds region of variable that is assigned with vfork's
  72 // return value (this is the only region child is allowed to write).
  73 // VFORK_RESULT_INVALID means that we are in parent process.
  74 // VFORK_RESULT_NONE means that vfork's return value hasn't been assigned.
  75 // Other values point to valid regions.
  76 REGISTER_TRAIT_WITH_PROGRAMSTATE(VforkResultRegion, const void *)
  77 #define VFORK_RESULT_INVALID 0
  78 #define VFORK_RESULT_NONE ((void *)(uintptr_t)1)
  79
  80 bool VforkChecker::isChildProcess(const ProgramStateRef State) {
  81   return State->get<VforkResultRegion>() != VFORK_RESULT_INVALID;
  82 }
  83
  84 bool VforkChecker::isVforkCall(const Decl *D, CheckerContext &C) const {
  85   auto FD = dyn_cast_or_null<FunctionDecl>(D);
  86   if (!FD || !C.isCLibraryFunction(FD))
  87     return false;
  88
  89   if (!II_vfork) {
  90     ASTContext &AC = C.getASTContext();
  91     II_vfork = &AC.Idents.get("vfork");
  92   }
  93
  94   return FD->getIdentifier() == II_vfork;
  95 }
  96
  97 // Returns true iff ok to call function after successful vfork.
  98 bool VforkChecker::isCallExplicitelyAllowed(const IdentifierInfo *II,
  99                                             CheckerContext &C) const {
 100   if (VforkAllowlist.empty()) {
 101     // According to manpage.
 102     const char *ids[] = {
 103       "_Exit",
 104       "_exit",
 105       "execl",
 106       "execle",
 107       "execlp",
 108       "execv",
 109       "execve",
 110       "execvp",
 111       "execvpe",
 112       nullptr
 113     };
 114
 115     ASTContext &AC = C.getASTContext();
 116     for (const char **id = ids; *id; ++id)
 117       VforkAllowlist.insert(&AC.Idents.get(*id));
 118   }
 119
 120   return VforkAllowlist.count(II);
 121 }
 122
 123 void VforkChecker::reportBug(const char *What, CheckerContext &C,
 124                              const char *Details) const {
 125   if (ExplodedNode *N = C.generateErrorNode(C.getState())) {
 126     if (!BT)
 127       BT.reset(new BugType(this, "Dangerous construct in a vforked process"));
 128
 129     SmallString<256> buf;
 130     llvm::raw_svector_ostream os(buf);
 131
 132     os << What << " is prohibited after a successful vfork";
 133
 134     if (Details)
 135       os << "; " << Details;
 136
 137     auto Report = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
 138     // TODO: mark vfork call in BugReportVisitor
 139     C.emitReport(std::move(Report));
 140   }
 141 }
 142
 143 // Detect calls to vfork and split execution appropriately.
 144 void VforkChecker::checkPostCall(const CallEvent &Call,
 145                                  CheckerContext &C) const {
 146   // We can't call vfork in child so don't bother
 147   // (corresponding warning has already been emitted in checkPreCall).
 148   ProgramStateRef State = C.getState();
 149   if (isChildProcess(State))
 150     return;
 151
 152   if (!isVforkCall(Call.getDecl(), C))
 153     return;
 154
 155   // Get return value of vfork.
 156   SVal VforkRetVal = Call.getReturnValue();
 157   std::optional<DefinedOrUnknownSVal> DVal =
 158       VforkRetVal.getAs<DefinedOrUnknownSVal>();
 159   if (!DVal)
 160     return;
 161
 162   // Get assigned variable.
 163   const ParentMap &PM = C.getLocationContext()->getParentMap();
 164   const Stmt *P = PM.getParentIgnoreParenCasts(Call.getOriginExpr());
 165   const VarDecl *LhsDecl;
 166   std::tie(LhsDecl, std::ignore) = parseAssignment(P);
 167
 168   // Get assigned memory region.
 169   MemRegionManager &M = C.getStoreManager().getRegionManager();
 170   const MemRegion *LhsDeclReg =
 171     LhsDecl
 172       ? M.getVarRegion(LhsDecl, C.getLocationContext())
 173       : (const MemRegion *)VFORK_RESULT_NONE;
 174
 175   // Parent branch gets nonzero return value (according to manpage).
 176   ProgramStateRef ParentState, ChildState;
 177   std::tie(ParentState, ChildState) = C.getState()->assume(*DVal);
 178   C.addTransition(ParentState);
 179   ChildState = ChildState->set<VforkResultRegion>(LhsDeclReg);
 180   C.addTransition(ChildState);
 181 }
 182
 183 // Prohibit calls to functions in child process which are not explicitly
 184 // allowed.
 185 void VforkChecker::checkPreCall(const CallEvent &Call,
 186                                 CheckerContext &C) const {
 187   ProgramStateRef State = C.getState();
 188   if (isChildProcess(State) &&
 189       !isCallExplicitelyAllowed(Call.getCalleeIdentifier(), C))
 190     reportBug("This function call", C);
 191 }
 192
 193 // Prohibit writes in child process (except for vfork's lhs).
 194 void VforkChecker::checkBind(SVal L, SVal V, const Stmt *S,
 195                              CheckerContext &C) const {
 196   ProgramStateRef State = C.getState();
 197   if (!isChildProcess(State))
 198     return;
 199
 200   const MemRegion *VforkLhs =
 201     static_cast<const MemRegion *>(State->get<VforkResultRegion>());
 202   const MemRegion *MR = L.getAsRegion();
 203
 204   // Child is allowed to modify only vfork's lhs.
 205   if (!MR || MR == VforkLhs)
 206     return;
 207
 208   reportBug("This assignment", C);
 209 }
 210
 211 // Prohibit return from function in child process.
 212 void VforkChecker::checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const {
 213   ProgramStateRef State = C.getState();
 214   if (isChildProcess(State))
 215     reportBug("Return", C, "call _exit() instead");
 216 }
 217
 218 void ento::registerVforkChecker(CheckerManager &mgr) {
 219   mgr.registerChecker<VforkChecker>();
 220 }
 221
 222 bool ento::shouldRegisterVforkChecker(const CheckerManager &mgr) {
 223   return true;
 224 }