diff options
author | David Malcolm <dmalcolm@redhat.com> | 2022-11-15 13:53:42 -0500 |
---|---|---|
committer | David Malcolm <dmalcolm@redhat.com> | 2022-11-15 13:53:42 -0500 |
commit | 86a90006864840c2e222d46ead551850caba184b (patch) | |
tree | dbd40ec5eead9974edb997d246a79036eed69d31 /gcc/doc/invoke.texi | |
parent | d8aba860b34203621586df8c5a6756b18c2a0c32 (diff) |
analyzer: add warnings relating to sockets [PR106140]
This patch generalizes the analyzer's file descriptor state machine
so that it tracks the states of sockets.
It adds two new warnings relating to misuses of socket APIs:
* -Wanalyzer-fd-phase-mismatch (e.g. calling 'accept' on a socket
before calling 'listen' on it)
* -Wanalyzer-fd-type-mismatch (e.g. using a stream socket operation
on a datagram socket)
gcc/analyzer/ChangeLog:
PR analyzer/106140
* analyzer-language.cc (on_finish_translation_unit): Stash named
constants "SOCK_STREAM" and "SOCK_DGRAM".
* analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
(Wanalyzer-fd-type-mismatch): New.
* engine.cc (impl_region_model_context::get_state_map_by_name):
Add "out_sm_context" param. Allow out_sm_idx to be NULL.
* exploded-graph.h
(impl_region_model_context::get_state_map_by_name):
Add "out_sm_context" param.
* region-model-impl-calls.cc (region_model::impl_call_accept): New.
(region_model::impl_call_bind): New.
(region_model::impl_call_connect): New.
(region_model::impl_call_listen): New.
(region_model::impl_call_socket): New.
* region-model.cc (region_model::on_call_pre): Special-case
"bind".
(region_model::on_call_post): Special-case "accept", "bind",
"connect", "listen", and "socket".
* region-model.h (region_model::impl_call_accept): New decl.
(region_model::impl_call_bind): New decl.
(region_model::impl_call_connect): New decl.
(region_model::impl_call_listen): New decl.
(region_model::impl_call_socket): New decl.
(region_model::on_socket): New decl.
(region_model::on_bind): New decl.
(region_model::on_listen): New decl.
(region_model::on_accept): New decl.
(region_model::on_connect): New decl.
(region_model::add_constraint): Make public.
(region_model::check_for_poison): Make public.
(region_model_context::get_state_map_by_name): Add out_sm_context param.
(region_model_context::get_fd_map): Likewise.
(region_model_context::get_malloc_map): Likewise.
(region_model_context::get_taint_map): Likewise.
(noop_region_model_context::get_state_map_by_name): Likewise.
(region_model_context_decorator::get_state_map_by_name): Likewise.
* sm-fd.cc: Include "analyzer/supergraph.h" and
"analyzer/analyzer-language.h".
(enum expected_phase): New enum.
(fd_state_machine::m_new_datagram_socket): New.
(fd_state_machine::m_new_stream_socket): New.
(fd_state_machine::m_new_unknown_socket): New.
(fd_state_machine::m_bound_datagram_socket): New.
(fd_state_machine::m_bound_stream_socket): New.
(fd_state_machine::m_bound_unknown_socket): New.
(fd_state_machine::m_listening_stream_socket): New.
(fd_state_machine::m_m_connected_stream_socket): New.
(fd_state_machine::m_SOCK_STREAM): New.
(fd_state_machine::m_SOCK_DGRAM): New.
(fd_diagnostic::describe_state_change): Handle socket states.
(fd_diagnostic::get_meaning_for_state_change): Likewise.
(class fd_phase_mismatch): New.
(enum expected_type): New enum.
(class fd_type_mismatch): New.
(fd_state_machine::fd_state_machine): Initialize new states and
stashed named constants.
(fd_state_machine::is_socket_fd_p): New.
(fd_state_machine::is_datagram_socket_fd_p): New.
(fd_state_machine::is_stream_socket_fd_p): New.
(fd_state_machine::on_close): Handle the socket states.
(fd_state_machine::check_for_open_fd): Complain about fncalls on
sockets in the wrong phase. Support socket FDs.
(add_constraint_ge_zero): New.
(fd_state_machine::get_state_for_socket_type): New.
(fd_state_machine::on_socket): New.
(fd_state_machine::check_for_socket_fd): New.
(fd_state_machine::check_for_new_socket_fd): New.
(fd_state_machine::on_bind): New.
(fd_state_machine::on_listen): New.
(fd_state_machine::on_accept): New.
(fd_state_machine::on_connect): New.
(fd_state_machine::can_purge_p): Don't purge socket values.
(get_fd_state): New.
(region_model::mark_as_valid_fd): Use get_fd_state.
(region_model::on_socket): New.
(region_model::on_bind): New.
(region_model::on_listen): New.
(region_model::on_accept): New.
(region_model::on_connect): New.
* sm-fd.dot: Update to reflect sm-fd.cc changes.
gcc/ChangeLog:
PR analyzer/106140
* doc/invoke.texi (Static Analyzer Options): Add
-Wanalyzer-fd-phase-mismatch and -Wanalyzer-fd-type-mismatch. Add
"socket", "bind", "listen", "accept", and "connect" to the list of
functions known to the analyzer.
gcc/testsuite/ChangeLog:
PR analyzer/106140
* gcc.dg/analyzer/fd-accept.c: New test.
* gcc.dg/analyzer/fd-bind.c: New test.
* gcc.dg/analyzer/fd-connect.c: New test.
* gcc.dg/analyzer/fd-datagram-socket.c: New test.
* gcc.dg/analyzer/fd-glibc-byte-stream-connection-server.c: New test.
* gcc.dg/analyzer/fd-glibc-byte-stream-socket.c: New test.
* gcc.dg/analyzer/fd-glibc-datagram-client.c: New test.
* gcc.dg/analyzer/fd-glibc-datagram-socket.c: New test.
* gcc.dg/analyzer/fd-glibc-make_named_socket.h: New test.
* gcc.dg/analyzer/fd-listen.c: New test.
* gcc.dg/analyzer/fd-manpage-getaddrinfo-client.c: New test.
* gcc.dg/analyzer/fd-mappage-getaddrinfo-server.c: New test.
* gcc.dg/analyzer/fd-socket-meaning.c: New test.
* gcc.dg/analyzer/fd-socket-misuse.c: New test.
* gcc.dg/analyzer/fd-stream-socket-active-open.c: New test.
* gcc.dg/analyzer/fd-stream-socket-passive-open.c: New test.
* gcc.dg/analyzer/fd-stream-socket.c: New test.
* gcc.dg/analyzer/fd-symbolic-socket.c: New test.
* gcc.dg/analyzer/pr104369-1.c: Add -Wno-analyzer-too-complex and
-Wno-analyzer-fd-leak to options.
* gcc.dg/analyzer/pr104369-2.c: Add -Wno-analyzer-fd-leak to
options.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
Diffstat (limited to 'gcc/doc/invoke.texi')
-rw-r--r-- | gcc/doc/invoke.texi | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi index 9d733948bdb..057439a004c 100644 --- a/gcc/doc/invoke.texi +++ b/gcc/doc/invoke.texi @@ -453,6 +453,8 @@ Objective-C and Objective-C++ Dialects}. -Wno-analyzer-fd-access-mode-mismatch @gol -Wno-analyzer-fd-double-close @gol -Wno-analyzer-fd-leak @gol +-Wno-analyzer-fd-phase-mismatch @gol +-Wno-analyzer-fd-type-mismatch @gol -Wno-analyzer-fd-use-after-close @gol -Wno-analyzer-fd-use-without-check @gol -Wno-analyzer-file-leak @gol @@ -9899,6 +9901,8 @@ Enabling this option effectively enables the following warnings: -Wanalyzer-fd-access-mode-mismatch @gol -Wanalyzer-fd-double-close @gol -Wanalyzer-fd-leak @gol +-Wanalyzer-fd-phase-mismatch @gol +-Wanalyzer-fd-type-mismatch @gol -Wanalyzer-fd-use-after-close @gol -Wanalyzer-fd-use-without-check @gol -Wanalyzer-file-leak @gol @@ -10077,6 +10081,33 @@ open file descriptor is leaked. See @uref{https://cwe.mitre.org/data/definitions/775.html, CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime}. +@item -Wno-analyzer-fd-phase-mismatch +@opindex Wanalyzer-fd-phase-mismatch +@opindex Wno-analyzer-fd-phase-mismatch +This warning requires @option{-fanalyzer}, which enables it; use +@option{-Wno-analyzer-fd-phase-mismatch} +to disable it. + +This diagnostic warns for paths through code in which an operation is +attempted in the wrong phase of a file descriptor's lifetime. +For example, it will warn on attempts to call @code{accept} on a stream +socket that has not yet had @code{listen} successfully called on it. + +See @uref{https://cwe.mitre.org/data/definitions/666.html, CWE-666: Operation on Resource in Wrong Phase of Lifetime}. + +@item -Wno-analyzer-fd-type-mismatch +@opindex Wanalyzer-fd-type-mismatch +@opindex Wno-analyzer-fd-type-mismatch +This warning requires @option{-fanalyzer}, which enables it; use +@option{-Wno-analyzer-fd-type-mismatch} +to disable it. + +This diagnostic warns for paths through code in which an +operation is attempted on the wrong type of file descriptor. +For example, it will warn on attempts to use socket operations +on a file descriptor obtained via @code{open}, or when attempting +to use a stream socket operation on a datagram socket. + @item -Wno-analyzer-fd-use-after-close @opindex Wanalyzer-fd-use-after-close @opindex Wno-analyzer-fd-use-after-close @@ -10616,6 +10647,7 @@ of the following functions for working with file descriptors: @item @code{pipe}, and @code{pipe2} @item @code{read} @item @code{write} +@item @code{socket}, @code{bind}, @code{listen}, @code{accept}, and @code{connect} @end itemize of the following functions for working with @code{<stdio.h>} streams: |