clang  14.0.0git
StackAddrEscapeChecker.cpp
Go to the documentation of this file.
1 //=== StackAddrEscapeChecker.cpp ----------------------------------*- C++ -*--//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines stack address leak checker, which checks if an invalid
10 // stack address is stored into a global or heap location. See CERT DCL30-C.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "clang/AST/ExprCXX.h"
23 #include "llvm/ADT/SmallString.h"
24 #include "llvm/Support/raw_ostream.h"
25 using namespace clang;
26 using namespace ento;
27 
28 namespace {
29 class StackAddrEscapeChecker
30  : public Checker<check::PreCall, check::PreStmt<ReturnStmt>,
31  check::EndFunction> {
32  mutable IdentifierInfo *dispatch_semaphore_tII;
33  mutable std::unique_ptr<BuiltinBug> BT_stackleak;
34  mutable std::unique_ptr<BuiltinBug> BT_returnstack;
35  mutable std::unique_ptr<BuiltinBug> BT_capturedstackasync;
36  mutable std::unique_ptr<BuiltinBug> BT_capturedstackret;
37 
38 public:
39  enum CheckKind {
40  CK_StackAddrEscapeChecker,
41  CK_StackAddrAsyncEscapeChecker,
42  CK_NumCheckKinds
43  };
44 
45  DefaultBool ChecksEnabled[CK_NumCheckKinds];
46  CheckerNameRef CheckNames[CK_NumCheckKinds];
47 
48  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
49  void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
50  void checkEndFunction(const ReturnStmt *RS, CheckerContext &Ctx) const;
51 
52 private:
53  void checkReturnedBlockCaptures(const BlockDataRegion &B,
54  CheckerContext &C) const;
55  void checkAsyncExecutedBlockCaptures(const BlockDataRegion &B,
56  CheckerContext &C) const;
57  void EmitStackError(CheckerContext &C, const MemRegion *R,
58  const Expr *RetE) const;
59  bool isSemaphoreCaptured(const BlockDecl &B) const;
60  static SourceRange genName(raw_ostream &os, const MemRegion *R,
61  ASTContext &Ctx);
63  getCapturedStackRegions(const BlockDataRegion &B, CheckerContext &C);
64  static bool isArcManagedBlock(const MemRegion *R, CheckerContext &C);
65  static bool isNotInCurrentFrame(const MemRegion *R, CheckerContext &C);
66 };
67 } // namespace
68 
69 SourceRange StackAddrEscapeChecker::genName(raw_ostream &os, const MemRegion *R,
70  ASTContext &Ctx) {
71  // Get the base region, stripping away fields and elements.
72  R = R->getBaseRegion();
75  os << "Address of ";
76 
77  // Check if the region is a compound literal.
78  if (const auto *CR = dyn_cast<CompoundLiteralRegion>(R)) {
79  const CompoundLiteralExpr *CL = CR->getLiteralExpr();
80  os << "stack memory associated with a compound literal "
81  "declared on line "
82  << SM.getExpansionLineNumber(CL->getBeginLoc()) << " returned to caller";
83  range = CL->getSourceRange();
84  } else if (const auto *AR = dyn_cast<AllocaRegion>(R)) {
85  const Expr *ARE = AR->getExpr();
86  SourceLocation L = ARE->getBeginLoc();
87  range = ARE->getSourceRange();
88  os << "stack memory allocated by call to alloca() on line "
89  << SM.getExpansionLineNumber(L);
90  } else if (const auto *BR = dyn_cast<BlockDataRegion>(R)) {
91  const BlockDecl *BD = BR->getCodeRegion()->getDecl();
92  SourceLocation L = BD->getBeginLoc();
93  range = BD->getSourceRange();
94  os << "stack-allocated block declared on line "
95  << SM.getExpansionLineNumber(L);
96  } else if (const auto *VR = dyn_cast<VarRegion>(R)) {
97  os << "stack memory associated with local variable '" << VR->getString()
98  << '\'';
99  range = VR->getDecl()->getSourceRange();
100  } else if (const auto *TOR = dyn_cast<CXXTempObjectRegion>(R)) {
101  QualType Ty = TOR->getValueType().getLocalUnqualifiedType();
102  os << "stack memory associated with temporary object of type '";
103  Ty.print(os, Ctx.getPrintingPolicy());
104  os << "'";
105  range = TOR->getExpr()->getSourceRange();
106  } else {
107  llvm_unreachable("Invalid region in ReturnStackAddressChecker.");
108  }
109 
110  return range;
111 }
112 
113 bool StackAddrEscapeChecker::isArcManagedBlock(const MemRegion *R,
114  CheckerContext &C) {
115  assert(R && "MemRegion should not be null");
116  return C.getASTContext().getLangOpts().ObjCAutoRefCount &&
117  isa<BlockDataRegion>(R);
118 }
119 
120 bool StackAddrEscapeChecker::isNotInCurrentFrame(const MemRegion *R,
121  CheckerContext &C) {
122  const StackSpaceRegion *S = cast<StackSpaceRegion>(R->getMemorySpace());
123  return S->getStackFrame() != C.getStackFrame();
124 }
125 
126 bool StackAddrEscapeChecker::isSemaphoreCaptured(const BlockDecl &B) const {
127  if (!dispatch_semaphore_tII)
128  dispatch_semaphore_tII = &B.getASTContext().Idents.get("dispatch_semaphore_t");
129  for (const auto &C : B.captures()) {
130  const auto *T = C.getVariable()->getType()->getAs<TypedefType>();
131  if (T && T->getDecl()->getIdentifier() == dispatch_semaphore_tII)
132  return true;
133  }
134  return false;
135 }
136 
138 StackAddrEscapeChecker::getCapturedStackRegions(const BlockDataRegion &B,
139  CheckerContext &C) {
141  BlockDataRegion::referenced_vars_iterator I = B.referenced_vars_begin();
142  BlockDataRegion::referenced_vars_iterator E = B.referenced_vars_end();
143  for (; I != E; ++I) {
144  SVal Val = C.getState()->getSVal(I.getCapturedRegion());
145  const MemRegion *Region = Val.getAsRegion();
146  if (Region && isa<StackSpaceRegion>(Region->getMemorySpace()))
147  Regions.push_back(Region);
148  }
149  return Regions;
150 }
151 
152 void StackAddrEscapeChecker::EmitStackError(CheckerContext &C,
153  const MemRegion *R,
154  const Expr *RetE) const {
155  ExplodedNode *N = C.generateNonFatalErrorNode();
156  if (!N)
157  return;
158  if (!BT_returnstack)
159  BT_returnstack = std::make_unique<BuiltinBug>(
160  CheckNames[CK_StackAddrEscapeChecker],
161  "Return of address to stack-allocated memory");
162  // Generate a report for this bug.
163  SmallString<128> buf;
164  llvm::raw_svector_ostream os(buf);
165  SourceRange range = genName(os, R, C.getASTContext());
166  os << " returned to caller";
167  auto report =
168  std::make_unique<PathSensitiveBugReport>(*BT_returnstack, os.str(), N);
169  report->addRange(RetE->getSourceRange());
170  if (range.isValid())
171  report->addRange(range);
172  C.emitReport(std::move(report));
173 }
174 
175 void StackAddrEscapeChecker::checkAsyncExecutedBlockCaptures(
176  const BlockDataRegion &B, CheckerContext &C) const {
177  // There is a not-too-uncommon idiom
178  // where a block passed to dispatch_async captures a semaphore
179  // and then the thread (which called dispatch_async) is blocked on waiting
180  // for the completion of the execution of the block
181  // via dispatch_semaphore_wait. To avoid false-positives (for now)
182  // we ignore all the blocks which have captured
183  // a variable of the type "dispatch_semaphore_t".
184  if (isSemaphoreCaptured(*B.getDecl()))
185  return;
186  for (const MemRegion *Region : getCapturedStackRegions(B, C)) {
187  // The block passed to dispatch_async may capture another block
188  // created on the stack. However, there is no leak in this situaton,
189  // no matter if ARC or no ARC is enabled:
190  // dispatch_async copies the passed "outer" block (via Block_copy)
191  // and if the block has captured another "inner" block,
192  // the "inner" block will be copied as well.
193  if (isa<BlockDataRegion>(Region))
194  continue;
195  ExplodedNode *N = C.generateNonFatalErrorNode();
196  if (!N)
197  continue;
198  if (!BT_capturedstackasync)
199  BT_capturedstackasync = std::make_unique<BuiltinBug>(
200  CheckNames[CK_StackAddrAsyncEscapeChecker],
201  "Address of stack-allocated memory is captured");
202  SmallString<128> Buf;
203  llvm::raw_svector_ostream Out(Buf);
204  SourceRange Range = genName(Out, Region, C.getASTContext());
205  Out << " is captured by an asynchronously-executed block";
206  auto Report = std::make_unique<PathSensitiveBugReport>(
207  *BT_capturedstackasync, Out.str(), N);
208  if (Range.isValid())
209  Report->addRange(Range);
210  C.emitReport(std::move(Report));
211  }
212 }
213 
214 void StackAddrEscapeChecker::checkReturnedBlockCaptures(
215  const BlockDataRegion &B, CheckerContext &C) const {
216  for (const MemRegion *Region : getCapturedStackRegions(B, C)) {
217  if (isArcManagedBlock(Region, C) || isNotInCurrentFrame(Region, C))
218  continue;
219  ExplodedNode *N = C.generateNonFatalErrorNode();
220  if (!N)
221  continue;
222  if (!BT_capturedstackret)
223  BT_capturedstackret = std::make_unique<BuiltinBug>(
224  CheckNames[CK_StackAddrEscapeChecker],
225  "Address of stack-allocated memory is captured");
226  SmallString<128> Buf;
227  llvm::raw_svector_ostream Out(Buf);
228  SourceRange Range = genName(Out, Region, C.getASTContext());
229  Out << " is captured by a returned block";
230  auto Report = std::make_unique<PathSensitiveBugReport>(*BT_capturedstackret,
231  Out.str(), N);
232  if (Range.isValid())
233  Report->addRange(Range);
234  C.emitReport(std::move(Report));
235  }
236 }
237 
238 void StackAddrEscapeChecker::checkPreCall(const CallEvent &Call,
239  CheckerContext &C) const {
240  if (!ChecksEnabled[CK_StackAddrAsyncEscapeChecker])
241  return;
242  if (!Call.isGlobalCFunction("dispatch_after") &&
243  !Call.isGlobalCFunction("dispatch_async"))
244  return;
245  for (unsigned Idx = 0, NumArgs = Call.getNumArgs(); Idx < NumArgs; ++Idx) {
246  if (const BlockDataRegion *B = dyn_cast_or_null<BlockDataRegion>(
247  Call.getArgSVal(Idx).getAsRegion()))
248  checkAsyncExecutedBlockCaptures(*B, C);
249  }
250 }
251 
252 void StackAddrEscapeChecker::checkPreStmt(const ReturnStmt *RS,
253  CheckerContext &C) const {
254  if (!ChecksEnabled[CK_StackAddrEscapeChecker])
255  return;
256 
257  const Expr *RetE = RS->getRetValue();
258  if (!RetE)
259  return;
260  RetE = RetE->IgnoreParens();
261 
262  SVal V = C.getSVal(RetE);
263  const MemRegion *R = V.getAsRegion();
264  if (!R)
265  return;
266 
267  if (const BlockDataRegion *B = dyn_cast<BlockDataRegion>(R))
268  checkReturnedBlockCaptures(*B, C);
269 
270  if (!isa<StackSpaceRegion>(R->getMemorySpace()) ||
271  isNotInCurrentFrame(R, C) || isArcManagedBlock(R, C))
272  return;
273 
274  // Returning a record by value is fine. (In this case, the returned
275  // expression will be a copy-constructor, possibly wrapped in an
276  // ExprWithCleanups node.)
277  if (const ExprWithCleanups *Cleanup = dyn_cast<ExprWithCleanups>(RetE))
278  RetE = Cleanup->getSubExpr();
279  if (isa<CXXConstructExpr>(RetE) && RetE->getType()->isRecordType())
280  return;
281 
282  // The CK_CopyAndAutoreleaseBlockObject cast causes the block to be copied
283  // so the stack address is not escaping here.
284  if (const auto *ICE = dyn_cast<ImplicitCastExpr>(RetE)) {
285  if (isa<BlockDataRegion>(R) &&
286  ICE->getCastKind() == CK_CopyAndAutoreleaseBlockObject) {
287  return;
288  }
289  }
290 
291  EmitStackError(C, R, RetE);
292 }
293 
294 void StackAddrEscapeChecker::checkEndFunction(const ReturnStmt *RS,
295  CheckerContext &Ctx) const {
296  if (!ChecksEnabled[CK_StackAddrEscapeChecker])
297  return;
298 
299  ProgramStateRef State = Ctx.getState();
300 
301  // Iterate over all bindings to global variables and see if it contains
302  // a memory region in the stack space.
303  class CallBack : public StoreManager::BindingsHandler {
304  private:
305  CheckerContext &Ctx;
306  const StackFrameContext *PoppedFrame;
307 
308  /// Look for stack variables referring to popped stack variables.
309  /// Returns true only if it found some dangling stack variables
310  /// referred by an other stack variable from different stack frame.
311  bool checkForDanglingStackVariable(const MemRegion *Referrer,
312  const MemRegion *Referred) {
313  const auto *ReferrerMemSpace =
314  Referrer->getMemorySpace()->getAs<StackSpaceRegion>();
315  const auto *ReferredMemSpace =
316  Referred->getMemorySpace()->getAs<StackSpaceRegion>();
317 
318  if (!ReferrerMemSpace || !ReferredMemSpace)
319  return false;
320 
321  const auto *ReferrerFrame = ReferrerMemSpace->getStackFrame();
322  const auto *ReferredFrame = ReferredMemSpace->getStackFrame();
323 
324  if (ReferrerMemSpace && ReferredMemSpace) {
325  if (ReferredFrame == PoppedFrame &&
326  ReferrerFrame->isParentOf(PoppedFrame)) {
327  V.emplace_back(Referrer, Referred);
328  return true;
329  }
330  }
331  return false;
332  }
333 
334  public:
336 
337  CallBack(CheckerContext &CC) : Ctx(CC), PoppedFrame(CC.getStackFrame()) {}
338 
339  bool HandleBinding(StoreManager &SMgr, Store S, const MemRegion *Region,
340  SVal Val) override {
341  const MemRegion *VR = Val.getAsRegion();
342  if (!VR)
343  return true;
344 
345  if (checkForDanglingStackVariable(Region, VR))
346  return true;
347 
348  // Check the globals for the same.
349  if (!isa<GlobalsSpaceRegion>(Region->getMemorySpace()))
350  return true;
351  if (VR && VR->hasStackStorage() && !isArcManagedBlock(VR, Ctx) &&
352  !isNotInCurrentFrame(VR, Ctx))
353  V.emplace_back(Region, VR);
354  return true;
355  }
356  };
357 
358  CallBack Cb(Ctx);
359  State->getStateManager().getStoreManager().iterBindings(State->getStore(),
360  Cb);
361 
362  if (Cb.V.empty())
363  return;
364 
365  // Generate an error node.
366  ExplodedNode *N = Ctx.generateNonFatalErrorNode(State);
367  if (!N)
368  return;
369 
370  if (!BT_stackleak)
371  BT_stackleak = std::make_unique<BuiltinBug>(
372  CheckNames[CK_StackAddrEscapeChecker],
373  "Stack address stored into global variable",
374  "Stack address was saved into a global variable. "
375  "This is dangerous because the address will become "
376  "invalid after returning from the function");
377 
378  for (const auto &P : Cb.V) {
379  const MemRegion *Referrer = P.first;
380  const MemRegion *Referred = P.second;
381 
382  // Generate a report for this bug.
383  const StringRef CommonSuffix =
384  "upon returning to the caller. This will be a dangling reference";
385  SmallString<128> Buf;
386  llvm::raw_svector_ostream Out(Buf);
387  const SourceRange Range = genName(Out, Referred, Ctx.getASTContext());
388 
389  if (isa<CXXTempObjectRegion>(Referrer)) {
390  Out << " is still referred to by a temporary object on the stack "
391  << CommonSuffix;
392  auto Report =
393  std::make_unique<PathSensitiveBugReport>(*BT_stackleak, Out.str(), N);
394  Ctx.emitReport(std::move(Report));
395  return;
396  }
397 
398  const StringRef ReferrerMemorySpace = [](const MemSpaceRegion *Space) {
399  if (isa<StaticGlobalSpaceRegion>(Space))
400  return "static";
401  if (isa<GlobalsSpaceRegion>(Space))
402  return "global";
403  assert(isa<StackSpaceRegion>(Space));
404  return "stack";
405  }(Referrer->getMemorySpace());
406 
407  // This cast supposed to succeed.
408  const VarRegion *ReferrerVar = cast<VarRegion>(Referrer->getBaseRegion());
409  const std::string ReferrerVarName =
410  ReferrerVar->getDecl()->getDeclName().getAsString();
411 
412  Out << " is still referred to by the " << ReferrerMemorySpace
413  << " variable '" << ReferrerVarName << "' " << CommonSuffix;
414  auto Report =
415  std::make_unique<PathSensitiveBugReport>(*BT_stackleak, Out.str(), N);
416  if (Range.isValid())
417  Report->addRange(Range);
418 
419  Ctx.emitReport(std::move(Report));
420  }
421 }
422 
423 void ento::registerStackAddrEscapeBase(CheckerManager &mgr) {
424  mgr.registerChecker<StackAddrEscapeChecker>();
425 }
426 
427 bool ento::shouldRegisterStackAddrEscapeBase(const CheckerManager &mgr) {
428  return true;
429 }
430 
431 #define REGISTER_CHECKER(name) \
432  void ento::register##name(CheckerManager &Mgr) { \
433  StackAddrEscapeChecker *Chk = Mgr.getChecker<StackAddrEscapeChecker>(); \
434  Chk->ChecksEnabled[StackAddrEscapeChecker::CK_##name] = true; \
435  Chk->CheckNames[StackAddrEscapeChecker::CK_##name] = \
436  Mgr.getCurrentCheckerName(); \
437  } \
438  \
439  bool ento::shouldRegister##name(const CheckerManager &mgr) { return true; }
440 
441 REGISTER_CHECKER(StackAddrEscapeChecker)
442 REGISTER_CHECKER(StackAddrAsyncEscapeChecker)
clang::Type::isRecordType
bool isRecordType() const
Definition: Type.h:6762
clang::Decl::getASTContext
ASTContext & getASTContext() const LLVM_READONLY
Definition: DeclBase.cpp:414
clang::ReturnStmt::getRetValue
Expr * getRetValue()
Definition: Stmt.h:2793
clang::Decl::getBeginLoc
SourceLocation getBeginLoc() const LLVM_READONLY
Definition: DeclBase.h:422
clang::LocationContext::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: AnalysisDeclContext.cpp:463
clang::SourceRange
A trivial tuple used to represent a source range.
Definition: SourceLocation.h:212
string
string(SUBSTRING ${CMAKE_CURRENT_BINARY_DIR} 0 ${PATH_LIB_START} PATH_HEAD) string(SUBSTRING $
Definition: CMakeLists.txt:22
llvm::SmallVector
Definition: LLVM.h:38
clang::IdentifierTable::get
IdentifierInfo & get(StringRef Name)
Return the identifier token info for the specified named identifier.
Definition: IdentifierTable.h:592
clang::SourceLocation
Encodes a location in the source.
Definition: SourceLocation.h:88
clang::CompoundLiteralExpr::getBeginLoc
SourceLocation getBeginLoc() const LLVM_READONLY
Definition: Expr.h:3443
clang::Stmt::getSourceRange
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:324
clang::ento::ProgramStateRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Definition: ProgramState_Fwd.h:37
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:673
AttributeLangSupport::C
@ C
Definition: SemaDeclAttr.cpp:54
clang::BlockDecl::getSourceRange
SourceRange getSourceRange() const override LLVM_READONLY
Source range that this declaration covers.
Definition: Decl.cpp:4776
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:295
SourceManager.h
clang::index::SymbolRole::Call
@ Call
clang::ento::Store
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
Definition: StoreRef.h:27
clang::ASTContext::getSourceManager
SourceManager & getSourceManager()
Definition: ASTContext.h:695
clang::SourceManager
This class handles loading and caching of source files into memory.
Definition: SourceManager.h:626
clang::TypedefType
Definition: Type.h:4371
CallEvent.h
clang::BlockDecl::captures
ArrayRef< Capture > captures() const
Definition: Decl.h:4284
V
#define V(N, I)
Definition: ASTContext.h:3121
BuiltinCheckerRegistration.h
clang::BlockDecl
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4157
CheckerManager.h
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:212
llvm::SmallString< 128 >
clang::ExprWithCleanups
Represents an expression – generally a full-expression – that introduces cleanups to be run at the en...
Definition: ExprCXX.h:3342
ExprCXX.h
clang::transformer::EditKind::Range
@ Range
clang::CompoundLiteralExpr
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:3403
REGISTER_CHECKER
#define REGISTER_CHECKER(name)
Definition: StackAddrEscapeChecker.cpp:431
P
StringRef P
Definition: ASTMatchersInternal.cpp:563
BugType.h
clang::ASTContext::Idents
IdentifierTable & Idents
Definition: ASTContext.h:648
clang::ASTContext::getPrintingPolicy
const clang::PrintingPolicy & getPrintingPolicy() const
Definition: ASTContext.h:687
State
LineState State
Definition: UnwrappedLineFormatter.cpp:986
clang::IdentifierInfo
One of these records is kept for each identifier that is lexed.
Definition: IdentifierTable.h:84
CheckerContext.h
ProgramState.h
Checker.h
clang::Expr::IgnoreParens
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:2915
clang
Definition: CalledOnceCheck.h:17
clang::transformer::range
RangeSelector range(RangeSelector Begin, RangeSelector End)
DEPRECATED. Use enclose.
Definition: RangeSelector.h:41
clang::Expr::getType
QualType getType() const
Definition: Expr.h:141
clang::Stmt::getBeginLoc
SourceLocation getBeginLoc() const LLVM_READONLY
Definition: Stmt.cpp:336
clang::QualType::print
void print(raw_ostream &OS, const PrintingPolicy &Policy, const Twine &PlaceHolder=Twine(), unsigned Indentation=0) const
Definition: TypePrinter.cpp:2248
clang::Expr
This represents one expression.
Definition: Expr.h:109
SM
#define SM(sm)
Definition: Cuda.cpp:78
clang::ReturnStmt
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Definition: Stmt.h:2760