clang 17.0.0git
StackAddrEscapeChecker.cpp
Go to the documentation of this file.
1//=== StackAddrEscapeChecker.cpp ----------------------------------*- C++ -*--//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines stack address leak checker, which checks if an invalid
10// stack address is stored into a global or heap location. See CERT DCL30-C.
11//
12//===----------------------------------------------------------------------===//
13
14#include "clang/AST/ExprCXX.h"
23#include "llvm/ADT/SmallString.h"
24#include "llvm/Support/raw_ostream.h"
25using namespace clang;
26using namespace ento;
27
28namespace {
29class StackAddrEscapeChecker
30 : public Checker<check::PreCall, check::PreStmt<ReturnStmt>,
31 check::EndFunction> {
32 mutable IdentifierInfo *dispatch_semaphore_tII;
33 mutable std::unique_ptr<BuiltinBug> BT_stackleak;
34 mutable std::unique_ptr<BuiltinBug> BT_returnstack;
35 mutable std::unique_ptr<BuiltinBug> BT_capturedstackasync;
36 mutable std::unique_ptr<BuiltinBug> BT_capturedstackret;
37
38public:
39 enum CheckKind {
40 CK_StackAddrEscapeChecker,
41 CK_StackAddrAsyncEscapeChecker,
42 CK_NumCheckKinds
43 };
44
45 bool ChecksEnabled[CK_NumCheckKinds] = {false};
46 CheckerNameRef CheckNames[CK_NumCheckKinds];
47
48 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
49 void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
50 void checkEndFunction(const ReturnStmt *RS, CheckerContext &Ctx) const;
51
52private:
53 void checkReturnedBlockCaptures(const BlockDataRegion &B,
54 CheckerContext &C) const;
55 void checkAsyncExecutedBlockCaptures(const BlockDataRegion &B,
56 CheckerContext &C) const;
57 void EmitStackError(CheckerContext &C, const MemRegion *R,
58 const Expr *RetE) const;
59 bool isSemaphoreCaptured(const BlockDecl &B) const;
60 static SourceRange genName(raw_ostream &os, const MemRegion *R,
61 ASTContext &Ctx);
63 getCapturedStackRegions(const BlockDataRegion &B, CheckerContext &C);
64 static bool isNotInCurrentFrame(const MemRegion *R, CheckerContext &C);
65};
66} // namespace
67
68SourceRange StackAddrEscapeChecker::genName(raw_ostream &os, const MemRegion *R,
69 ASTContext &Ctx) {
70 // Get the base region, stripping away fields and elements.
71 R = R->getBaseRegion();
74 os << "Address of ";
75
76 // Check if the region is a compound literal.
77 if (const auto *CR = dyn_cast<CompoundLiteralRegion>(R)) {
78 const CompoundLiteralExpr *CL = CR->getLiteralExpr();
79 os << "stack memory associated with a compound literal "
80 "declared on line "
81 << SM.getExpansionLineNumber(CL->getBeginLoc()) << " returned to caller";
82 range = CL->getSourceRange();
83 } else if (const auto *AR = dyn_cast<AllocaRegion>(R)) {
84 const Expr *ARE = AR->getExpr();
85 SourceLocation L = ARE->getBeginLoc();
86 range = ARE->getSourceRange();
87 os << "stack memory allocated by call to alloca() on line "
88 << SM.getExpansionLineNumber(L);
89 } else if (const auto *BR = dyn_cast<BlockDataRegion>(R)) {
90 const BlockDecl *BD = BR->getCodeRegion()->getDecl();
92 range = BD->getSourceRange();
93 os << "stack-allocated block declared on line "
94 << SM.getExpansionLineNumber(L);
95 } else if (const auto *VR = dyn_cast<VarRegion>(R)) {
96 os << "stack memory associated with local variable '" << VR->getString()
97 << '\'';
98 range = VR->getDecl()->getSourceRange();
99 } else if (const auto *TOR = dyn_cast<CXXTempObjectRegion>(R)) {
100 QualType Ty = TOR->getValueType().getLocalUnqualifiedType();
101 os << "stack memory associated with temporary object of type '";
102 Ty.print(os, Ctx.getPrintingPolicy());
103 os << "'";
104 range = TOR->getExpr()->getSourceRange();
105 } else {
106 llvm_unreachable("Invalid region in ReturnStackAddressChecker.");
107 }
108
109 return range;
110}
111
112bool StackAddrEscapeChecker::isNotInCurrentFrame(const MemRegion *R,
113 CheckerContext &C) {
114 const StackSpaceRegion *S = cast<StackSpaceRegion>(R->getMemorySpace());
115 return S->getStackFrame() != C.getStackFrame();
116}
117
118bool StackAddrEscapeChecker::isSemaphoreCaptured(const BlockDecl &B) const {
119 if (!dispatch_semaphore_tII)
120 dispatch_semaphore_tII = &B.getASTContext().Idents.get("dispatch_semaphore_t");
121 for (const auto &C : B.captures()) {
122 const auto *T = C.getVariable()->getType()->getAs<TypedefType>();
123 if (T && T->getDecl()->getIdentifier() == dispatch_semaphore_tII)
124 return true;
125 }
126 return false;
127}
128
130StackAddrEscapeChecker::getCapturedStackRegions(const BlockDataRegion &B,
131 CheckerContext &C) {
135 for (; I != E; ++I) {
136 SVal Val = C.getState()->getSVal(I.getCapturedRegion());
137 const MemRegion *Region = Val.getAsRegion();
138 if (Region && isa<StackSpaceRegion>(Region->getMemorySpace()))
139 Regions.push_back(Region);
140 }
141 return Regions;
142}
143
144void StackAddrEscapeChecker::EmitStackError(CheckerContext &C,
145 const MemRegion *R,
146 const Expr *RetE) const {
147 ExplodedNode *N = C.generateNonFatalErrorNode();
148 if (!N)
149 return;
150 if (!BT_returnstack)
151 BT_returnstack = std::make_unique<BuiltinBug>(
152 CheckNames[CK_StackAddrEscapeChecker],
153 "Return of address to stack-allocated memory");
154 // Generate a report for this bug.
156 llvm::raw_svector_ostream os(buf);
157 SourceRange range = genName(os, R, C.getASTContext());
158 os << " returned to caller";
159 auto report =
160 std::make_unique<PathSensitiveBugReport>(*BT_returnstack, os.str(), N);
161 report->addRange(RetE->getSourceRange());
162 if (range.isValid())
163 report->addRange(range);
164 C.emitReport(std::move(report));
165}
166
167void StackAddrEscapeChecker::checkAsyncExecutedBlockCaptures(
168 const BlockDataRegion &B, CheckerContext &C) const {
169 // There is a not-too-uncommon idiom
170 // where a block passed to dispatch_async captures a semaphore
171 // and then the thread (which called dispatch_async) is blocked on waiting
172 // for the completion of the execution of the block
173 // via dispatch_semaphore_wait. To avoid false-positives (for now)
174 // we ignore all the blocks which have captured
175 // a variable of the type "dispatch_semaphore_t".
176 if (isSemaphoreCaptured(*B.getDecl()))
177 return;
178 for (const MemRegion *Region : getCapturedStackRegions(B, C)) {
179 // The block passed to dispatch_async may capture another block
180 // created on the stack. However, there is no leak in this situaton,
181 // no matter if ARC or no ARC is enabled:
182 // dispatch_async copies the passed "outer" block (via Block_copy)
183 // and if the block has captured another "inner" block,
184 // the "inner" block will be copied as well.
185 if (isa<BlockDataRegion>(Region))
186 continue;
187 ExplodedNode *N = C.generateNonFatalErrorNode();
188 if (!N)
189 continue;
190 if (!BT_capturedstackasync)
191 BT_capturedstackasync = std::make_unique<BuiltinBug>(
192 CheckNames[CK_StackAddrAsyncEscapeChecker],
193 "Address of stack-allocated memory is captured");
195 llvm::raw_svector_ostream Out(Buf);
196 SourceRange Range = genName(Out, Region, C.getASTContext());
197 Out << " is captured by an asynchronously-executed block";
198 auto Report = std::make_unique<PathSensitiveBugReport>(
199 *BT_capturedstackasync, Out.str(), N);
200 if (Range.isValid())
201 Report->addRange(Range);
202 C.emitReport(std::move(Report));
203 }
204}
205
206void StackAddrEscapeChecker::checkReturnedBlockCaptures(
207 const BlockDataRegion &B, CheckerContext &C) const {
208 for (const MemRegion *Region : getCapturedStackRegions(B, C)) {
209 if (isNotInCurrentFrame(Region, C))
210 continue;
211 ExplodedNode *N = C.generateNonFatalErrorNode();
212 if (!N)
213 continue;
214 if (!BT_capturedstackret)
215 BT_capturedstackret = std::make_unique<BuiltinBug>(
216 CheckNames[CK_StackAddrEscapeChecker],
217 "Address of stack-allocated memory is captured");
219 llvm::raw_svector_ostream Out(Buf);
220 SourceRange Range = genName(Out, Region, C.getASTContext());
221 Out << " is captured by a returned block";
222 auto Report = std::make_unique<PathSensitiveBugReport>(*BT_capturedstackret,
223 Out.str(), N);
224 if (Range.isValid())
225 Report->addRange(Range);
226 C.emitReport(std::move(Report));
227 }
228}
229
230void StackAddrEscapeChecker::checkPreCall(const CallEvent &Call,
231 CheckerContext &C) const {
232 if (!ChecksEnabled[CK_StackAddrAsyncEscapeChecker])
233 return;
234 if (!Call.isGlobalCFunction("dispatch_after") &&
235 !Call.isGlobalCFunction("dispatch_async"))
236 return;
237 for (unsigned Idx = 0, NumArgs = Call.getNumArgs(); Idx < NumArgs; ++Idx) {
238 if (const BlockDataRegion *B = dyn_cast_or_null<BlockDataRegion>(
239 Call.getArgSVal(Idx).getAsRegion()))
240 checkAsyncExecutedBlockCaptures(*B, C);
241 }
242}
243
244void StackAddrEscapeChecker::checkPreStmt(const ReturnStmt *RS,
245 CheckerContext &C) const {
246 if (!ChecksEnabled[CK_StackAddrEscapeChecker])
247 return;
248
249 const Expr *RetE = RS->getRetValue();
250 if (!RetE)
251 return;
252 RetE = RetE->IgnoreParens();
253
254 SVal V = C.getSVal(RetE);
255 const MemRegion *R = V.getAsRegion();
256 if (!R)
257 return;
258
259 if (const BlockDataRegion *B = dyn_cast<BlockDataRegion>(R))
260 checkReturnedBlockCaptures(*B, C);
261
262 if (!isa<StackSpaceRegion>(R->getMemorySpace()) || isNotInCurrentFrame(R, C))
263 return;
264
265 // Returning a record by value is fine. (In this case, the returned
266 // expression will be a copy-constructor, possibly wrapped in an
267 // ExprWithCleanups node.)
268 if (const ExprWithCleanups *Cleanup = dyn_cast<ExprWithCleanups>(RetE))
269 RetE = Cleanup->getSubExpr();
270 if (isa<CXXConstructExpr>(RetE) && RetE->getType()->isRecordType())
271 return;
272
273 // The CK_CopyAndAutoreleaseBlockObject cast causes the block to be copied
274 // so the stack address is not escaping here.
275 if (const auto *ICE = dyn_cast<ImplicitCastExpr>(RetE)) {
276 if (isa<BlockDataRegion>(R) &&
277 ICE->getCastKind() == CK_CopyAndAutoreleaseBlockObject) {
278 return;
279 }
280 }
281
282 EmitStackError(C, R, RetE);
283}
284
285void StackAddrEscapeChecker::checkEndFunction(const ReturnStmt *RS,
286 CheckerContext &Ctx) const {
287 if (!ChecksEnabled[CK_StackAddrEscapeChecker])
288 return;
289
290 ProgramStateRef State = Ctx.getState();
291
292 // Iterate over all bindings to global variables and see if it contains
293 // a memory region in the stack space.
294 class CallBack : public StoreManager::BindingsHandler {
295 private:
297 const StackFrameContext *PoppedFrame;
298
299 /// Look for stack variables referring to popped stack variables.
300 /// Returns true only if it found some dangling stack variables
301 /// referred by an other stack variable from different stack frame.
302 bool checkForDanglingStackVariable(const MemRegion *Referrer,
303 const MemRegion *Referred) {
304 const auto *ReferrerMemSpace =
305 Referrer->getMemorySpace()->getAs<StackSpaceRegion>();
306 const auto *ReferredMemSpace =
307 Referred->getMemorySpace()->getAs<StackSpaceRegion>();
308
309 if (!ReferrerMemSpace || !ReferredMemSpace)
310 return false;
311
312 const auto *ReferrerFrame = ReferrerMemSpace->getStackFrame();
313 const auto *ReferredFrame = ReferredMemSpace->getStackFrame();
314
315 if (ReferrerMemSpace && ReferredMemSpace) {
316 if (ReferredFrame == PoppedFrame &&
317 ReferrerFrame->isParentOf(PoppedFrame)) {
318 V.emplace_back(Referrer, Referred);
319 return true;
320 }
321 }
322 return false;
323 }
324
325 public:
327
328 CallBack(CheckerContext &CC) : Ctx(CC), PoppedFrame(CC.getStackFrame()) {}
329
330 bool HandleBinding(StoreManager &SMgr, Store S, const MemRegion *Region,
331 SVal Val) override {
332 const MemRegion *VR = Val.getAsRegion();
333 if (!VR)
334 return true;
335
336 if (checkForDanglingStackVariable(Region, VR))
337 return true;
338
339 // Check the globals for the same.
340 if (!isa<GlobalsSpaceRegion>(Region->getMemorySpace()))
341 return true;
342 if (VR && VR->hasStackStorage() && !isNotInCurrentFrame(VR, Ctx))
343 V.emplace_back(Region, VR);
344 return true;
345 }
346 };
347
348 CallBack Cb(Ctx);
349 State->getStateManager().getStoreManager().iterBindings(State->getStore(),
350 Cb);
351
352 if (Cb.V.empty())
353 return;
354
355 // Generate an error node.
357 if (!N)
358 return;
359
360 if (!BT_stackleak)
361 BT_stackleak = std::make_unique<BuiltinBug>(
362 CheckNames[CK_StackAddrEscapeChecker],
363 "Stack address stored into global variable",
364 "Stack address was saved into a global variable. "
365 "This is dangerous because the address will become "
366 "invalid after returning from the function");
367
368 for (const auto &P : Cb.V) {
369 const MemRegion *Referrer = P.first;
370 const MemRegion *Referred = P.second;
371
372 // Generate a report for this bug.
373 const StringRef CommonSuffix =
374 "upon returning to the caller. This will be a dangling reference";
376 llvm::raw_svector_ostream Out(Buf);
377 const SourceRange Range = genName(Out, Referred, Ctx.getASTContext());
378
379 if (isa<CXXTempObjectRegion>(Referrer)) {
380 Out << " is still referred to by a temporary object on the stack "
381 << CommonSuffix;
382 auto Report =
383 std::make_unique<PathSensitiveBugReport>(*BT_stackleak, Out.str(), N);
384 Ctx.emitReport(std::move(Report));
385 return;
386 }
387
388 const StringRef ReferrerMemorySpace = [](const MemSpaceRegion *Space) {
389 if (isa<StaticGlobalSpaceRegion>(Space))
390 return "static";
391 if (isa<GlobalsSpaceRegion>(Space))
392 return "global";
393 assert(isa<StackSpaceRegion>(Space));
394 return "stack";
395 }(Referrer->getMemorySpace());
396
397 // This cast supposed to succeed.
398 const VarRegion *ReferrerVar = cast<VarRegion>(Referrer->getBaseRegion());
399 const std::string ReferrerVarName =
400 ReferrerVar->getDecl()->getDeclName().getAsString();
401
402 Out << " is still referred to by the " << ReferrerMemorySpace
403 << " variable '" << ReferrerVarName << "' " << CommonSuffix;
404 auto Report =
405 std::make_unique<PathSensitiveBugReport>(*BT_stackleak, Out.str(), N);
406 if (Range.isValid())
407 Report->addRange(Range);
408
409 Ctx.emitReport(std::move(Report));
410 }
411}
412
413void ento::registerStackAddrEscapeBase(CheckerManager &mgr) {
414 mgr.registerChecker<StackAddrEscapeChecker>();
415}
416
417bool ento::shouldRegisterStackAddrEscapeBase(const CheckerManager &mgr) {
418 return true;
419}
420
421#define REGISTER_CHECKER(name) \
422 void ento::register##name(CheckerManager &Mgr) { \
423 StackAddrEscapeChecker *Chk = Mgr.getChecker<StackAddrEscapeChecker>(); \
424 Chk->ChecksEnabled[StackAddrEscapeChecker::CK_##name] = true; \
425 Chk->CheckNames[StackAddrEscapeChecker::CK_##name] = \
426 Mgr.getCurrentCheckerName(); \
427 } \
428 \
429 bool ento::shouldRegister##name(const CheckerManager &mgr) { return true; }
430
431REGISTER_CHECKER(StackAddrEscapeChecker)
432REGISTER_CHECKER(StackAddrAsyncEscapeChecker)
#define V(N, I)
Definition: ASTContext.h:3217
StringRef P
#define SM(sm)
Definition: Cuda.cpp:78
Defines the clang::Expr interface and subclasses for C++ expressions.
Defines the SourceManager interface.
#define REGISTER_CHECKER(name)
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:182
SourceManager & getSourceManager()
Definition: ASTContext.h:692
IdentifierTable & Idents
Definition: ASTContext.h:631
const clang::PrintingPolicy & getPrintingPolicy() const
Definition: ASTContext.h:684
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4334
ArrayRef< Capture > captures() const
Definition: Decl.h:4461
SourceRange getSourceRange() const override LLVM_READONLY
Source range that this declaration covers.
Definition: Decl.cpp:4965
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:3412
SourceLocation getBeginLoc() const LLVM_READONLY
Definition: Expr.h:3452
ASTContext & getASTContext() const LLVM_READONLY
Definition: DeclBase.cpp:428
SourceLocation getBeginLoc() const LLVM_READONLY
Definition: DeclBase.h:424
std::string getAsString() const
Retrieve the human-readable string for this name.
Represents an expression – generally a full-expression – that introduces cleanups to be run at the en...
Definition: ExprCXX.h:3420
This represents one expression.
Definition: Expr.h:110
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:3042
QualType getType() const
Definition: Expr.h:142
One of these records is kept for each identifier that is lexed.
IdentifierInfo & get(StringRef Name)
Return the identifier token info for the specified named identifier.
DeclarationName getDeclName() const
Get the actual, stored name of the declaration, which may be a special name.
Definition: Decl.h:313
A (possibly-)qualified type.
Definition: Type.h:736
void print(raw_ostream &OS, const PrintingPolicy &Policy, const Twine &PlaceHolder=Twine(), unsigned Indentation=0) const
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Definition: Stmt.h:2806
Expr * getRetValue()
Definition: Stmt.h:2837
Encodes a location in the source.
This class handles loading and caching of source files into memory.
A trivial tuple used to represent a source range.
It represents a stack frame of the call stack (based on CallEvent).
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:325
SourceLocation getBeginLoc() const LLVM_READONLY
Definition: Stmt.cpp:337
bool isRecordType() const
Definition: Type.h:7000
LLVM_ATTRIBUTE_RETURNS_NONNULL const VarRegion * getCapturedRegion() const
Definition: MemRegion.h:718
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:674
LLVM_ATTRIBUTE_RETURNS_NONNULL const BlockDecl * getDecl() const
Definition: MemRegion.h:704
referenced_vars_iterator referenced_vars_begin() const
Definition: MemRegion.cpp:1687
referenced_vars_iterator referenced_vars_end() const
Definition: MemRegion.cpp:1703
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:149
const ProgramStateRef & getState() const
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
This wrapper is used to ensure that only StringRefs originating from the CheckerRegistry are used as ...
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemSpaceRegion * getMemorySpace() const
Definition: MemRegion.cpp:1277
bool hasStackStorage() const
Definition: MemRegion.cpp:1289
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1307
const RegionTy * getAs() const
Definition: MemRegion.h:1337
MemSpaceRegion - A memory region that represents a "memory space"; for example, the set of global var...
Definition: MemRegion.h:204
A Range represents the closed range [from, to].
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:72
const MemRegion * getAsRegion() const
Definition: SVals.cpp:120
LLVM_ATTRIBUTE_RETURNS_NONNULL const StackFrameContext * getStackFrame() const
Definition: MemRegion.h:401
virtual bool HandleBinding(StoreManager &SMgr, Store store, const MemRegion *region, SVal val)=0
ASTContext & Ctx
Definition: Store.h:60
const VarDecl * getDecl() const override=0
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
Definition: StoreRef.h:27
bool Call(InterpState &S, CodePtr &PC, const Function *Func)
Definition: Interp.h:1493
RangeSelector range(RangeSelector Begin, RangeSelector End)
DEPRECATED. Use enclose.
Definition: RangeSelector.h:41
@ C
Languages that the frontend can parse and compile.