xref: /netbsd-src/external/apache2/llvm/dist/clang/lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp (revision e038c9c4676b0f19b1b7dd08a940c6ed64a6d5ae)
17330f729Sjoerg //===--- PthreadLockChecker.cpp - Check for locking problems ---*- C++ -*--===//
27330f729Sjoerg //
37330f729Sjoerg // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
47330f729Sjoerg // See https://llvm.org/LICENSE.txt for license information.
57330f729Sjoerg // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
67330f729Sjoerg //
77330f729Sjoerg //===----------------------------------------------------------------------===//
87330f729Sjoerg //
9*e038c9c4Sjoerg // This file defines:
10*e038c9c4Sjoerg //  * PthreadLockChecker, a simple lock -> unlock checker.
11*e038c9c4Sjoerg //    Which also checks for XNU locks, which behave similarly enough to share
12*e038c9c4Sjoerg //    code.
13*e038c9c4Sjoerg //  * FuchsiaLocksChecker, which is also rather similar.
14*e038c9c4Sjoerg //  * C11LockChecker which also closely follows Pthread semantics.
15*e038c9c4Sjoerg //
16*e038c9c4Sjoerg //  TODO: Path notes.
177330f729Sjoerg //
187330f729Sjoerg //===----------------------------------------------------------------------===//
197330f729Sjoerg 
207330f729Sjoerg #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
217330f729Sjoerg #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
227330f729Sjoerg #include "clang/StaticAnalyzer/Core/Checker.h"
237330f729Sjoerg #include "clang/StaticAnalyzer/Core/CheckerManager.h"
24*e038c9c4Sjoerg #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
257330f729Sjoerg #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
267330f729Sjoerg 
277330f729Sjoerg using namespace clang;
287330f729Sjoerg using namespace ento;
297330f729Sjoerg 
307330f729Sjoerg namespace {
317330f729Sjoerg 
327330f729Sjoerg struct LockState {
337330f729Sjoerg   enum Kind {
347330f729Sjoerg     Destroyed,
357330f729Sjoerg     Locked,
367330f729Sjoerg     Unlocked,
377330f729Sjoerg     UntouchedAndPossiblyDestroyed,
387330f729Sjoerg     UnlockedAndPossiblyDestroyed
397330f729Sjoerg   } K;
407330f729Sjoerg 
417330f729Sjoerg private:
LockState__anon1b665f7f0111::LockState427330f729Sjoerg   LockState(Kind K) : K(K) {}
437330f729Sjoerg 
447330f729Sjoerg public:
getLocked__anon1b665f7f0111::LockState457330f729Sjoerg   static LockState getLocked() { return LockState(Locked); }
getUnlocked__anon1b665f7f0111::LockState467330f729Sjoerg   static LockState getUnlocked() { return LockState(Unlocked); }
getDestroyed__anon1b665f7f0111::LockState477330f729Sjoerg   static LockState getDestroyed() { return LockState(Destroyed); }
getUntouchedAndPossiblyDestroyed__anon1b665f7f0111::LockState487330f729Sjoerg   static LockState getUntouchedAndPossiblyDestroyed() {
497330f729Sjoerg     return LockState(UntouchedAndPossiblyDestroyed);
507330f729Sjoerg   }
getUnlockedAndPossiblyDestroyed__anon1b665f7f0111::LockState517330f729Sjoerg   static LockState getUnlockedAndPossiblyDestroyed() {
527330f729Sjoerg     return LockState(UnlockedAndPossiblyDestroyed);
537330f729Sjoerg   }
547330f729Sjoerg 
operator ==__anon1b665f7f0111::LockState55*e038c9c4Sjoerg   bool operator==(const LockState &X) const { return K == X.K; }
567330f729Sjoerg 
isLocked__anon1b665f7f0111::LockState577330f729Sjoerg   bool isLocked() const { return K == Locked; }
isUnlocked__anon1b665f7f0111::LockState587330f729Sjoerg   bool isUnlocked() const { return K == Unlocked; }
isDestroyed__anon1b665f7f0111::LockState597330f729Sjoerg   bool isDestroyed() const { return K == Destroyed; }
isUntouchedAndPossiblyDestroyed__anon1b665f7f0111::LockState607330f729Sjoerg   bool isUntouchedAndPossiblyDestroyed() const {
617330f729Sjoerg     return K == UntouchedAndPossiblyDestroyed;
627330f729Sjoerg   }
isUnlockedAndPossiblyDestroyed__anon1b665f7f0111::LockState637330f729Sjoerg   bool isUnlockedAndPossiblyDestroyed() const {
647330f729Sjoerg     return K == UnlockedAndPossiblyDestroyed;
657330f729Sjoerg   }
667330f729Sjoerg 
Profile__anon1b665f7f0111::LockState67*e038c9c4Sjoerg   void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddInteger(K); }
687330f729Sjoerg };
697330f729Sjoerg 
70*e038c9c4Sjoerg class PthreadLockChecker : public Checker<check::PostCall, check::DeadSymbols,
71*e038c9c4Sjoerg                                           check::RegionChanges> {
727330f729Sjoerg public:
73*e038c9c4Sjoerg   enum LockingSemantics { NotApplicable = 0, PthreadSemantics, XNUSemantics };
74*e038c9c4Sjoerg   enum CheckerKind {
75*e038c9c4Sjoerg     CK_PthreadLockChecker,
76*e038c9c4Sjoerg     CK_FuchsiaLockChecker,
77*e038c9c4Sjoerg     CK_C11LockChecker,
78*e038c9c4Sjoerg     CK_NumCheckKinds
79*e038c9c4Sjoerg   };
80*e038c9c4Sjoerg   DefaultBool ChecksEnabled[CK_NumCheckKinds];
81*e038c9c4Sjoerg   CheckerNameRef CheckNames[CK_NumCheckKinds];
827330f729Sjoerg 
83*e038c9c4Sjoerg private:
84*e038c9c4Sjoerg   typedef void (PthreadLockChecker::*FnCheck)(const CallEvent &Call,
85*e038c9c4Sjoerg                                               CheckerContext &C,
86*e038c9c4Sjoerg                                               CheckerKind CheckKind) const;
87*e038c9c4Sjoerg   CallDescriptionMap<FnCheck> PThreadCallbacks = {
88*e038c9c4Sjoerg       // Init.
89*e038c9c4Sjoerg       {{"pthread_mutex_init", 2}, &PthreadLockChecker::InitAnyLock},
90*e038c9c4Sjoerg       // TODO: pthread_rwlock_init(2 arguments).
91*e038c9c4Sjoerg       // TODO: lck_mtx_init(3 arguments).
92*e038c9c4Sjoerg       // TODO: lck_mtx_alloc_init(2 arguments) => returns the mutex.
93*e038c9c4Sjoerg       // TODO: lck_rw_init(3 arguments).
94*e038c9c4Sjoerg       // TODO: lck_rw_alloc_init(2 arguments) => returns the mutex.
957330f729Sjoerg 
96*e038c9c4Sjoerg       // Acquire.
97*e038c9c4Sjoerg       {{"pthread_mutex_lock", 1}, &PthreadLockChecker::AcquirePthreadLock},
98*e038c9c4Sjoerg       {{"pthread_rwlock_rdlock", 1}, &PthreadLockChecker::AcquirePthreadLock},
99*e038c9c4Sjoerg       {{"pthread_rwlock_wrlock", 1}, &PthreadLockChecker::AcquirePthreadLock},
100*e038c9c4Sjoerg       {{"lck_mtx_lock", 1}, &PthreadLockChecker::AcquireXNULock},
101*e038c9c4Sjoerg       {{"lck_rw_lock_exclusive", 1}, &PthreadLockChecker::AcquireXNULock},
102*e038c9c4Sjoerg       {{"lck_rw_lock_shared", 1}, &PthreadLockChecker::AcquireXNULock},
103*e038c9c4Sjoerg 
104*e038c9c4Sjoerg       // Try.
105*e038c9c4Sjoerg       {{"pthread_mutex_trylock", 1}, &PthreadLockChecker::TryPthreadLock},
106*e038c9c4Sjoerg       {{"pthread_rwlock_tryrdlock", 1}, &PthreadLockChecker::TryPthreadLock},
107*e038c9c4Sjoerg       {{"pthread_rwlock_trywrlock", 1}, &PthreadLockChecker::TryPthreadLock},
108*e038c9c4Sjoerg       {{"lck_mtx_try_lock", 1}, &PthreadLockChecker::TryXNULock},
109*e038c9c4Sjoerg       {{"lck_rw_try_lock_exclusive", 1}, &PthreadLockChecker::TryXNULock},
110*e038c9c4Sjoerg       {{"lck_rw_try_lock_shared", 1}, &PthreadLockChecker::TryXNULock},
111*e038c9c4Sjoerg 
112*e038c9c4Sjoerg       // Release.
113*e038c9c4Sjoerg       {{"pthread_mutex_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
114*e038c9c4Sjoerg       {{"pthread_rwlock_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
115*e038c9c4Sjoerg       {{"lck_mtx_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
116*e038c9c4Sjoerg       {{"lck_rw_unlock_exclusive", 1}, &PthreadLockChecker::ReleaseAnyLock},
117*e038c9c4Sjoerg       {{"lck_rw_unlock_shared", 1}, &PthreadLockChecker::ReleaseAnyLock},
118*e038c9c4Sjoerg       {{"lck_rw_done", 1}, &PthreadLockChecker::ReleaseAnyLock},
119*e038c9c4Sjoerg 
120*e038c9c4Sjoerg       // Destroy.
121*e038c9c4Sjoerg       {{"pthread_mutex_destroy", 1}, &PthreadLockChecker::DestroyPthreadLock},
122*e038c9c4Sjoerg       {{"lck_mtx_destroy", 2}, &PthreadLockChecker::DestroyXNULock},
123*e038c9c4Sjoerg       // TODO: pthread_rwlock_destroy(1 argument).
124*e038c9c4Sjoerg       // TODO: lck_rw_destroy(2 arguments).
125*e038c9c4Sjoerg   };
126*e038c9c4Sjoerg 
127*e038c9c4Sjoerg   CallDescriptionMap<FnCheck> FuchsiaCallbacks = {
128*e038c9c4Sjoerg       // Init.
129*e038c9c4Sjoerg       {{"spin_lock_init", 1}, &PthreadLockChecker::InitAnyLock},
130*e038c9c4Sjoerg 
131*e038c9c4Sjoerg       // Acquire.
132*e038c9c4Sjoerg       {{"spin_lock", 1}, &PthreadLockChecker::AcquirePthreadLock},
133*e038c9c4Sjoerg       {{"spin_lock_save", 3}, &PthreadLockChecker::AcquirePthreadLock},
134*e038c9c4Sjoerg       {{"sync_mutex_lock", 1}, &PthreadLockChecker::AcquirePthreadLock},
135*e038c9c4Sjoerg       {{"sync_mutex_lock_with_waiter", 1},
136*e038c9c4Sjoerg        &PthreadLockChecker::AcquirePthreadLock},
137*e038c9c4Sjoerg 
138*e038c9c4Sjoerg       // Try.
139*e038c9c4Sjoerg       {{"spin_trylock", 1}, &PthreadLockChecker::TryFuchsiaLock},
140*e038c9c4Sjoerg       {{"sync_mutex_trylock", 1}, &PthreadLockChecker::TryFuchsiaLock},
141*e038c9c4Sjoerg       {{"sync_mutex_timedlock", 2}, &PthreadLockChecker::TryFuchsiaLock},
142*e038c9c4Sjoerg 
143*e038c9c4Sjoerg       // Release.
144*e038c9c4Sjoerg       {{"spin_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
145*e038c9c4Sjoerg       {{"spin_unlock_restore", 3}, &PthreadLockChecker::ReleaseAnyLock},
146*e038c9c4Sjoerg       {{"sync_mutex_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
147*e038c9c4Sjoerg   };
148*e038c9c4Sjoerg 
149*e038c9c4Sjoerg   CallDescriptionMap<FnCheck> C11Callbacks = {
150*e038c9c4Sjoerg       // Init.
151*e038c9c4Sjoerg       {{"mtx_init", 2}, &PthreadLockChecker::InitAnyLock},
152*e038c9c4Sjoerg 
153*e038c9c4Sjoerg       // Acquire.
154*e038c9c4Sjoerg       {{"mtx_lock", 1}, &PthreadLockChecker::AcquirePthreadLock},
155*e038c9c4Sjoerg 
156*e038c9c4Sjoerg       // Try.
157*e038c9c4Sjoerg       {{"mtx_trylock", 1}, &PthreadLockChecker::TryC11Lock},
158*e038c9c4Sjoerg       {{"mtx_timedlock", 2}, &PthreadLockChecker::TryC11Lock},
159*e038c9c4Sjoerg 
160*e038c9c4Sjoerg       // Release.
161*e038c9c4Sjoerg       {{"mtx_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
162*e038c9c4Sjoerg 
163*e038c9c4Sjoerg       // Destroy
164*e038c9c4Sjoerg       {{"mtx_destroy", 1}, &PthreadLockChecker::DestroyPthreadLock},
165*e038c9c4Sjoerg   };
166*e038c9c4Sjoerg 
1677330f729Sjoerg   ProgramStateRef resolvePossiblyDestroyedMutex(ProgramStateRef state,
1687330f729Sjoerg                                                 const MemRegion *lockR,
1697330f729Sjoerg                                                 const SymbolRef *sym) const;
170*e038c9c4Sjoerg   void reportBug(CheckerContext &C, std::unique_ptr<BugType> BT[],
171*e038c9c4Sjoerg                  const Expr *MtxExpr, CheckerKind CheckKind,
172*e038c9c4Sjoerg                  StringRef Desc) const;
173*e038c9c4Sjoerg 
174*e038c9c4Sjoerg   // Init.
175*e038c9c4Sjoerg   void InitAnyLock(const CallEvent &Call, CheckerContext &C,
176*e038c9c4Sjoerg                    CheckerKind CheckKind) const;
177*e038c9c4Sjoerg   void InitLockAux(const CallEvent &Call, CheckerContext &C,
178*e038c9c4Sjoerg                    const Expr *MtxExpr, SVal MtxVal,
179*e038c9c4Sjoerg                    CheckerKind CheckKind) const;
180*e038c9c4Sjoerg 
181*e038c9c4Sjoerg   // Lock, Try-lock.
182*e038c9c4Sjoerg   void AcquirePthreadLock(const CallEvent &Call, CheckerContext &C,
183*e038c9c4Sjoerg                           CheckerKind CheckKind) const;
184*e038c9c4Sjoerg   void AcquireXNULock(const CallEvent &Call, CheckerContext &C,
185*e038c9c4Sjoerg                       CheckerKind CheckKind) const;
186*e038c9c4Sjoerg   void TryPthreadLock(const CallEvent &Call, CheckerContext &C,
187*e038c9c4Sjoerg                       CheckerKind CheckKind) const;
188*e038c9c4Sjoerg   void TryXNULock(const CallEvent &Call, CheckerContext &C,
189*e038c9c4Sjoerg                   CheckerKind CheckKind) const;
190*e038c9c4Sjoerg   void TryFuchsiaLock(const CallEvent &Call, CheckerContext &C,
191*e038c9c4Sjoerg                       CheckerKind CheckKind) const;
192*e038c9c4Sjoerg   void TryC11Lock(const CallEvent &Call, CheckerContext &C,
193*e038c9c4Sjoerg                   CheckerKind CheckKind) const;
194*e038c9c4Sjoerg   void AcquireLockAux(const CallEvent &Call, CheckerContext &C,
195*e038c9c4Sjoerg                       const Expr *MtxExpr, SVal MtxVal, bool IsTryLock,
196*e038c9c4Sjoerg                       LockingSemantics Semantics, CheckerKind CheckKind) const;
197*e038c9c4Sjoerg 
198*e038c9c4Sjoerg   // Release.
199*e038c9c4Sjoerg   void ReleaseAnyLock(const CallEvent &Call, CheckerContext &C,
200*e038c9c4Sjoerg                       CheckerKind CheckKind) const;
201*e038c9c4Sjoerg   void ReleaseLockAux(const CallEvent &Call, CheckerContext &C,
202*e038c9c4Sjoerg                       const Expr *MtxExpr, SVal MtxVal,
203*e038c9c4Sjoerg                       CheckerKind CheckKind) const;
204*e038c9c4Sjoerg 
205*e038c9c4Sjoerg   // Destroy.
206*e038c9c4Sjoerg   void DestroyPthreadLock(const CallEvent &Call, CheckerContext &C,
207*e038c9c4Sjoerg                           CheckerKind CheckKind) const;
208*e038c9c4Sjoerg   void DestroyXNULock(const CallEvent &Call, CheckerContext &C,
209*e038c9c4Sjoerg                       CheckerKind CheckKind) const;
210*e038c9c4Sjoerg   void DestroyLockAux(const CallEvent &Call, CheckerContext &C,
211*e038c9c4Sjoerg                       const Expr *MtxExpr, SVal MtxVal,
212*e038c9c4Sjoerg                       LockingSemantics Semantics, CheckerKind CheckKind) const;
213*e038c9c4Sjoerg 
214*e038c9c4Sjoerg public:
215*e038c9c4Sjoerg   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
216*e038c9c4Sjoerg   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
217*e038c9c4Sjoerg   ProgramStateRef
218*e038c9c4Sjoerg   checkRegionChanges(ProgramStateRef State, const InvalidatedSymbols *Symbols,
219*e038c9c4Sjoerg                      ArrayRef<const MemRegion *> ExplicitRegions,
220*e038c9c4Sjoerg                      ArrayRef<const MemRegion *> Regions,
221*e038c9c4Sjoerg                      const LocationContext *LCtx, const CallEvent *Call) const;
222*e038c9c4Sjoerg   void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
223*e038c9c4Sjoerg                   const char *Sep) const override;
224*e038c9c4Sjoerg 
225*e038c9c4Sjoerg private:
226*e038c9c4Sjoerg   mutable std::unique_ptr<BugType> BT_doublelock[CK_NumCheckKinds];
227*e038c9c4Sjoerg   mutable std::unique_ptr<BugType> BT_doubleunlock[CK_NumCheckKinds];
228*e038c9c4Sjoerg   mutable std::unique_ptr<BugType> BT_destroylock[CK_NumCheckKinds];
229*e038c9c4Sjoerg   mutable std::unique_ptr<BugType> BT_initlock[CK_NumCheckKinds];
230*e038c9c4Sjoerg   mutable std::unique_ptr<BugType> BT_lor[CK_NumCheckKinds];
231*e038c9c4Sjoerg 
initBugType(CheckerKind CheckKind) const232*e038c9c4Sjoerg   void initBugType(CheckerKind CheckKind) const {
233*e038c9c4Sjoerg     if (BT_doublelock[CheckKind])
234*e038c9c4Sjoerg       return;
235*e038c9c4Sjoerg     BT_doublelock[CheckKind].reset(
236*e038c9c4Sjoerg         new BugType{CheckNames[CheckKind], "Double locking", "Lock checker"});
237*e038c9c4Sjoerg     BT_doubleunlock[CheckKind].reset(
238*e038c9c4Sjoerg         new BugType{CheckNames[CheckKind], "Double unlocking", "Lock checker"});
239*e038c9c4Sjoerg     BT_destroylock[CheckKind].reset(new BugType{
240*e038c9c4Sjoerg         CheckNames[CheckKind], "Use destroyed lock", "Lock checker"});
241*e038c9c4Sjoerg     BT_initlock[CheckKind].reset(new BugType{
242*e038c9c4Sjoerg         CheckNames[CheckKind], "Init invalid lock", "Lock checker"});
243*e038c9c4Sjoerg     BT_lor[CheckKind].reset(new BugType{CheckNames[CheckKind],
244*e038c9c4Sjoerg                                         "Lock order reversal", "Lock checker"});
245*e038c9c4Sjoerg   }
2467330f729Sjoerg };
2477330f729Sjoerg } // end anonymous namespace
2487330f729Sjoerg 
2497330f729Sjoerg // A stack of locks for tracking lock-unlock order.
REGISTER_LIST_WITH_PROGRAMSTATE(LockSet,const MemRegion *)2507330f729Sjoerg REGISTER_LIST_WITH_PROGRAMSTATE(LockSet, const MemRegion *)
2517330f729Sjoerg 
2527330f729Sjoerg // An entry for tracking lock states.
2537330f729Sjoerg REGISTER_MAP_WITH_PROGRAMSTATE(LockMap, const MemRegion *, LockState)
2547330f729Sjoerg 
2557330f729Sjoerg // Return values for unresolved calls to pthread_mutex_destroy().
2567330f729Sjoerg REGISTER_MAP_WITH_PROGRAMSTATE(DestroyRetVal, const MemRegion *, SymbolRef)
2577330f729Sjoerg 
258*e038c9c4Sjoerg void PthreadLockChecker::checkPostCall(const CallEvent &Call,
2597330f729Sjoerg                                        CheckerContext &C) const {
260*e038c9c4Sjoerg   // An additional umbrella check that all functions modeled by this checker
261*e038c9c4Sjoerg   // are global C functions.
262*e038c9c4Sjoerg   // TODO: Maybe make this the default behavior of CallDescription
263*e038c9c4Sjoerg   // with exactly one identifier?
264*e038c9c4Sjoerg   // FIXME: Try to handle cases when the implementation was inlined rather
265*e038c9c4Sjoerg   // than just giving up.
266*e038c9c4Sjoerg   if (!Call.isGlobalCFunction() || C.wasInlined)
2677330f729Sjoerg     return;
2687330f729Sjoerg 
269*e038c9c4Sjoerg   if (const FnCheck *Callback = PThreadCallbacks.lookup(Call))
270*e038c9c4Sjoerg     (this->**Callback)(Call, C, CK_PthreadLockChecker);
271*e038c9c4Sjoerg   else if (const FnCheck *Callback = FuchsiaCallbacks.lookup(Call))
272*e038c9c4Sjoerg     (this->**Callback)(Call, C, CK_FuchsiaLockChecker);
273*e038c9c4Sjoerg   else if (const FnCheck *Callback = C11Callbacks.lookup(Call))
274*e038c9c4Sjoerg     (this->**Callback)(Call, C, CK_C11LockChecker);
2757330f729Sjoerg }
2767330f729Sjoerg 
2777330f729Sjoerg // When a lock is destroyed, in some semantics(like PthreadSemantics) we are not
2787330f729Sjoerg // sure if the destroy call has succeeded or failed, and the lock enters one of
2797330f729Sjoerg // the 'possibly destroyed' state. There is a short time frame for the
2807330f729Sjoerg // programmer to check the return value to see if the lock was successfully
2817330f729Sjoerg // destroyed. Before we model the next operation over that lock, we call this
2827330f729Sjoerg // function to see if the return value was checked by now and set the lock state
2837330f729Sjoerg // - either to destroyed state or back to its previous state.
2847330f729Sjoerg 
2857330f729Sjoerg // In PthreadSemantics, pthread_mutex_destroy() returns zero if the lock is
2867330f729Sjoerg // successfully destroyed and it returns a non-zero value otherwise.
resolvePossiblyDestroyedMutex(ProgramStateRef state,const MemRegion * lockR,const SymbolRef * sym) const2877330f729Sjoerg ProgramStateRef PthreadLockChecker::resolvePossiblyDestroyedMutex(
2887330f729Sjoerg     ProgramStateRef state, const MemRegion *lockR, const SymbolRef *sym) const {
2897330f729Sjoerg   const LockState *lstate = state->get<LockMap>(lockR);
2907330f729Sjoerg   // Existence in DestroyRetVal ensures existence in LockMap.
2917330f729Sjoerg   // Existence in Destroyed also ensures that the lock state for lockR is either
2927330f729Sjoerg   // UntouchedAndPossiblyDestroyed or UnlockedAndPossiblyDestroyed.
2937330f729Sjoerg   assert(lstate->isUntouchedAndPossiblyDestroyed() ||
2947330f729Sjoerg          lstate->isUnlockedAndPossiblyDestroyed());
2957330f729Sjoerg 
2967330f729Sjoerg   ConstraintManager &CMgr = state->getConstraintManager();
2977330f729Sjoerg   ConditionTruthVal retZero = CMgr.isNull(state, *sym);
2987330f729Sjoerg   if (retZero.isConstrainedFalse()) {
2997330f729Sjoerg     if (lstate->isUntouchedAndPossiblyDestroyed())
3007330f729Sjoerg       state = state->remove<LockMap>(lockR);
3017330f729Sjoerg     else if (lstate->isUnlockedAndPossiblyDestroyed())
3027330f729Sjoerg       state = state->set<LockMap>(lockR, LockState::getUnlocked());
3037330f729Sjoerg   } else
3047330f729Sjoerg     state = state->set<LockMap>(lockR, LockState::getDestroyed());
3057330f729Sjoerg 
3067330f729Sjoerg   // Removing the map entry (lockR, sym) from DestroyRetVal as the lock state is
3077330f729Sjoerg   // now resolved.
3087330f729Sjoerg   state = state->remove<DestroyRetVal>(lockR);
3097330f729Sjoerg   return state;
3107330f729Sjoerg }
3117330f729Sjoerg 
printState(raw_ostream & Out,ProgramStateRef State,const char * NL,const char * Sep) const3127330f729Sjoerg void PthreadLockChecker::printState(raw_ostream &Out, ProgramStateRef State,
3137330f729Sjoerg                                     const char *NL, const char *Sep) const {
3147330f729Sjoerg   LockMapTy LM = State->get<LockMap>();
3157330f729Sjoerg   if (!LM.isEmpty()) {
3167330f729Sjoerg     Out << Sep << "Mutex states:" << NL;
3177330f729Sjoerg     for (auto I : LM) {
3187330f729Sjoerg       I.first->dumpToStream(Out);
3197330f729Sjoerg       if (I.second.isLocked())
3207330f729Sjoerg         Out << ": locked";
3217330f729Sjoerg       else if (I.second.isUnlocked())
3227330f729Sjoerg         Out << ": unlocked";
3237330f729Sjoerg       else if (I.second.isDestroyed())
3247330f729Sjoerg         Out << ": destroyed";
3257330f729Sjoerg       else if (I.second.isUntouchedAndPossiblyDestroyed())
3267330f729Sjoerg         Out << ": not tracked, possibly destroyed";
3277330f729Sjoerg       else if (I.second.isUnlockedAndPossiblyDestroyed())
3287330f729Sjoerg         Out << ": unlocked, possibly destroyed";
3297330f729Sjoerg       Out << NL;
3307330f729Sjoerg     }
3317330f729Sjoerg   }
3327330f729Sjoerg 
3337330f729Sjoerg   LockSetTy LS = State->get<LockSet>();
3347330f729Sjoerg   if (!LS.isEmpty()) {
3357330f729Sjoerg     Out << Sep << "Mutex lock order:" << NL;
3367330f729Sjoerg     for (auto I : LS) {
3377330f729Sjoerg       I->dumpToStream(Out);
3387330f729Sjoerg       Out << NL;
3397330f729Sjoerg     }
3407330f729Sjoerg   }
3417330f729Sjoerg 
342*e038c9c4Sjoerg   DestroyRetValTy DRV = State->get<DestroyRetVal>();
343*e038c9c4Sjoerg   if (!DRV.isEmpty()) {
344*e038c9c4Sjoerg     Out << Sep << "Mutexes in unresolved possibly destroyed state:" << NL;
345*e038c9c4Sjoerg     for (auto I : DRV) {
346*e038c9c4Sjoerg       I.first->dumpToStream(Out);
347*e038c9c4Sjoerg       Out << ": ";
348*e038c9c4Sjoerg       I.second->dumpToStream(Out);
349*e038c9c4Sjoerg       Out << NL;
350*e038c9c4Sjoerg     }
351*e038c9c4Sjoerg   }
3527330f729Sjoerg }
3537330f729Sjoerg 
AcquirePthreadLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const354*e038c9c4Sjoerg void PthreadLockChecker::AcquirePthreadLock(const CallEvent &Call,
355*e038c9c4Sjoerg                                             CheckerContext &C,
356*e038c9c4Sjoerg                                             CheckerKind CheckKind) const {
357*e038c9c4Sjoerg   AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), false,
358*e038c9c4Sjoerg                  PthreadSemantics, CheckKind);
359*e038c9c4Sjoerg }
3607330f729Sjoerg 
AcquireXNULock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const361*e038c9c4Sjoerg void PthreadLockChecker::AcquireXNULock(const CallEvent &Call,
362*e038c9c4Sjoerg                                         CheckerContext &C,
363*e038c9c4Sjoerg                                         CheckerKind CheckKind) const {
364*e038c9c4Sjoerg   AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), false,
365*e038c9c4Sjoerg                  XNUSemantics, CheckKind);
366*e038c9c4Sjoerg }
367*e038c9c4Sjoerg 
TryPthreadLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const368*e038c9c4Sjoerg void PthreadLockChecker::TryPthreadLock(const CallEvent &Call,
369*e038c9c4Sjoerg                                         CheckerContext &C,
370*e038c9c4Sjoerg                                         CheckerKind CheckKind) const {
371*e038c9c4Sjoerg   AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), true,
372*e038c9c4Sjoerg                  PthreadSemantics, CheckKind);
373*e038c9c4Sjoerg }
374*e038c9c4Sjoerg 
TryXNULock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const375*e038c9c4Sjoerg void PthreadLockChecker::TryXNULock(const CallEvent &Call, CheckerContext &C,
376*e038c9c4Sjoerg                                     CheckerKind CheckKind) const {
377*e038c9c4Sjoerg   AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), true,
378*e038c9c4Sjoerg                  PthreadSemantics, CheckKind);
379*e038c9c4Sjoerg }
380*e038c9c4Sjoerg 
TryFuchsiaLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const381*e038c9c4Sjoerg void PthreadLockChecker::TryFuchsiaLock(const CallEvent &Call,
382*e038c9c4Sjoerg                                         CheckerContext &C,
383*e038c9c4Sjoerg                                         CheckerKind CheckKind) const {
384*e038c9c4Sjoerg   AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), true,
385*e038c9c4Sjoerg                  PthreadSemantics, CheckKind);
386*e038c9c4Sjoerg }
387*e038c9c4Sjoerg 
TryC11Lock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const388*e038c9c4Sjoerg void PthreadLockChecker::TryC11Lock(const CallEvent &Call, CheckerContext &C,
389*e038c9c4Sjoerg                                     CheckerKind CheckKind) const {
390*e038c9c4Sjoerg   AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), true,
391*e038c9c4Sjoerg                  PthreadSemantics, CheckKind);
392*e038c9c4Sjoerg }
393*e038c9c4Sjoerg 
AcquireLockAux(const CallEvent & Call,CheckerContext & C,const Expr * MtxExpr,SVal MtxVal,bool IsTryLock,enum LockingSemantics Semantics,CheckerKind CheckKind) const394*e038c9c4Sjoerg void PthreadLockChecker::AcquireLockAux(const CallEvent &Call,
395*e038c9c4Sjoerg                                         CheckerContext &C, const Expr *MtxExpr,
396*e038c9c4Sjoerg                                         SVal MtxVal, bool IsTryLock,
397*e038c9c4Sjoerg                                         enum LockingSemantics Semantics,
398*e038c9c4Sjoerg                                         CheckerKind CheckKind) const {
399*e038c9c4Sjoerg   if (!ChecksEnabled[CheckKind])
400*e038c9c4Sjoerg     return;
401*e038c9c4Sjoerg 
402*e038c9c4Sjoerg   const MemRegion *lockR = MtxVal.getAsRegion();
4037330f729Sjoerg   if (!lockR)
4047330f729Sjoerg     return;
4057330f729Sjoerg 
4067330f729Sjoerg   ProgramStateRef state = C.getState();
4077330f729Sjoerg   const SymbolRef *sym = state->get<DestroyRetVal>(lockR);
4087330f729Sjoerg   if (sym)
4097330f729Sjoerg     state = resolvePossiblyDestroyedMutex(state, lockR, sym);
4107330f729Sjoerg 
4117330f729Sjoerg   if (const LockState *LState = state->get<LockMap>(lockR)) {
4127330f729Sjoerg     if (LState->isLocked()) {
413*e038c9c4Sjoerg       reportBug(C, BT_doublelock, MtxExpr, CheckKind,
414*e038c9c4Sjoerg                 "This lock has already been acquired");
4157330f729Sjoerg       return;
4167330f729Sjoerg     } else if (LState->isDestroyed()) {
417*e038c9c4Sjoerg       reportBug(C, BT_destroylock, MtxExpr, CheckKind,
418*e038c9c4Sjoerg                 "This lock has already been destroyed");
4197330f729Sjoerg       return;
4207330f729Sjoerg     }
4217330f729Sjoerg   }
4227330f729Sjoerg 
4237330f729Sjoerg   ProgramStateRef lockSucc = state;
424*e038c9c4Sjoerg   if (IsTryLock) {
4257330f729Sjoerg     // Bifurcate the state, and allow a mode where the lock acquisition fails.
426*e038c9c4Sjoerg     SVal RetVal = Call.getReturnValue();
427*e038c9c4Sjoerg     if (auto DefinedRetVal = RetVal.getAs<DefinedSVal>()) {
4287330f729Sjoerg       ProgramStateRef lockFail;
429*e038c9c4Sjoerg       switch (Semantics) {
4307330f729Sjoerg       case PthreadSemantics:
431*e038c9c4Sjoerg         std::tie(lockFail, lockSucc) = state->assume(*DefinedRetVal);
4327330f729Sjoerg         break;
4337330f729Sjoerg       case XNUSemantics:
434*e038c9c4Sjoerg         std::tie(lockSucc, lockFail) = state->assume(*DefinedRetVal);
4357330f729Sjoerg         break;
4367330f729Sjoerg       default:
4377330f729Sjoerg         llvm_unreachable("Unknown tryLock locking semantics");
4387330f729Sjoerg       }
4397330f729Sjoerg       assert(lockFail && lockSucc);
4407330f729Sjoerg       C.addTransition(lockFail);
441*e038c9c4Sjoerg     }
442*e038c9c4Sjoerg     // We might want to handle the case when the mutex lock function was inlined
443*e038c9c4Sjoerg     // and returned an Unknown or Undefined value.
444*e038c9c4Sjoerg   } else if (Semantics == PthreadSemantics) {
4457330f729Sjoerg     // Assume that the return value was 0.
446*e038c9c4Sjoerg     SVal RetVal = Call.getReturnValue();
447*e038c9c4Sjoerg     if (auto DefinedRetVal = RetVal.getAs<DefinedSVal>()) {
448*e038c9c4Sjoerg       // FIXME: If the lock function was inlined and returned true,
449*e038c9c4Sjoerg       // we need to behave sanely - at least generate sink.
450*e038c9c4Sjoerg       lockSucc = state->assume(*DefinedRetVal, false);
4517330f729Sjoerg       assert(lockSucc);
452*e038c9c4Sjoerg     }
453*e038c9c4Sjoerg     // We might want to handle the case when the mutex lock function was inlined
454*e038c9c4Sjoerg     // and returned an Unknown or Undefined value.
4557330f729Sjoerg   } else {
4567330f729Sjoerg     // XNU locking semantics return void on non-try locks
457*e038c9c4Sjoerg     assert((Semantics == XNUSemantics) && "Unknown locking semantics");
4587330f729Sjoerg     lockSucc = state;
4597330f729Sjoerg   }
4607330f729Sjoerg 
4617330f729Sjoerg   // Record that the lock was acquired.
4627330f729Sjoerg   lockSucc = lockSucc->add<LockSet>(lockR);
4637330f729Sjoerg   lockSucc = lockSucc->set<LockMap>(lockR, LockState::getLocked());
4647330f729Sjoerg   C.addTransition(lockSucc);
4657330f729Sjoerg }
4667330f729Sjoerg 
ReleaseAnyLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const467*e038c9c4Sjoerg void PthreadLockChecker::ReleaseAnyLock(const CallEvent &Call,
468*e038c9c4Sjoerg                                         CheckerContext &C,
469*e038c9c4Sjoerg                                         CheckerKind CheckKind) const {
470*e038c9c4Sjoerg   ReleaseLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), CheckKind);
471*e038c9c4Sjoerg }
4727330f729Sjoerg 
ReleaseLockAux(const CallEvent & Call,CheckerContext & C,const Expr * MtxExpr,SVal MtxVal,CheckerKind CheckKind) const473*e038c9c4Sjoerg void PthreadLockChecker::ReleaseLockAux(const CallEvent &Call,
474*e038c9c4Sjoerg                                         CheckerContext &C, const Expr *MtxExpr,
475*e038c9c4Sjoerg                                         SVal MtxVal,
476*e038c9c4Sjoerg                                         CheckerKind CheckKind) const {
477*e038c9c4Sjoerg   if (!ChecksEnabled[CheckKind])
478*e038c9c4Sjoerg     return;
479*e038c9c4Sjoerg 
480*e038c9c4Sjoerg   const MemRegion *lockR = MtxVal.getAsRegion();
4817330f729Sjoerg   if (!lockR)
4827330f729Sjoerg     return;
4837330f729Sjoerg 
4847330f729Sjoerg   ProgramStateRef state = C.getState();
4857330f729Sjoerg   const SymbolRef *sym = state->get<DestroyRetVal>(lockR);
4867330f729Sjoerg   if (sym)
4877330f729Sjoerg     state = resolvePossiblyDestroyedMutex(state, lockR, sym);
4887330f729Sjoerg 
4897330f729Sjoerg   if (const LockState *LState = state->get<LockMap>(lockR)) {
4907330f729Sjoerg     if (LState->isUnlocked()) {
491*e038c9c4Sjoerg       reportBug(C, BT_doubleunlock, MtxExpr, CheckKind,
492*e038c9c4Sjoerg                 "This lock has already been unlocked");
4937330f729Sjoerg       return;
4947330f729Sjoerg     } else if (LState->isDestroyed()) {
495*e038c9c4Sjoerg       reportBug(C, BT_destroylock, MtxExpr, CheckKind,
496*e038c9c4Sjoerg                 "This lock has already been destroyed");
4977330f729Sjoerg       return;
4987330f729Sjoerg     }
4997330f729Sjoerg   }
5007330f729Sjoerg 
5017330f729Sjoerg   LockSetTy LS = state->get<LockSet>();
5027330f729Sjoerg 
5037330f729Sjoerg   if (!LS.isEmpty()) {
5047330f729Sjoerg     const MemRegion *firstLockR = LS.getHead();
5057330f729Sjoerg     if (firstLockR != lockR) {
506*e038c9c4Sjoerg       reportBug(C, BT_lor, MtxExpr, CheckKind,
507*e038c9c4Sjoerg                 "This was not the most recently acquired lock. Possible lock "
508*e038c9c4Sjoerg                 "order reversal");
5097330f729Sjoerg       return;
5107330f729Sjoerg     }
5117330f729Sjoerg     // Record that the lock was released.
5127330f729Sjoerg     state = state->set<LockSet>(LS.getTail());
5137330f729Sjoerg   }
5147330f729Sjoerg 
5157330f729Sjoerg   state = state->set<LockMap>(lockR, LockState::getUnlocked());
5167330f729Sjoerg   C.addTransition(state);
5177330f729Sjoerg }
5187330f729Sjoerg 
DestroyPthreadLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const519*e038c9c4Sjoerg void PthreadLockChecker::DestroyPthreadLock(const CallEvent &Call,
520*e038c9c4Sjoerg                                             CheckerContext &C,
521*e038c9c4Sjoerg                                             CheckerKind CheckKind) const {
522*e038c9c4Sjoerg   DestroyLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0),
523*e038c9c4Sjoerg                  PthreadSemantics, CheckKind);
524*e038c9c4Sjoerg }
5257330f729Sjoerg 
DestroyXNULock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const526*e038c9c4Sjoerg void PthreadLockChecker::DestroyXNULock(const CallEvent &Call,
527*e038c9c4Sjoerg                                         CheckerContext &C,
528*e038c9c4Sjoerg                                         CheckerKind CheckKind) const {
529*e038c9c4Sjoerg   DestroyLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), XNUSemantics,
530*e038c9c4Sjoerg                  CheckKind);
531*e038c9c4Sjoerg }
532*e038c9c4Sjoerg 
DestroyLockAux(const CallEvent & Call,CheckerContext & C,const Expr * MtxExpr,SVal MtxVal,enum LockingSemantics Semantics,CheckerKind CheckKind) const533*e038c9c4Sjoerg void PthreadLockChecker::DestroyLockAux(const CallEvent &Call,
534*e038c9c4Sjoerg                                         CheckerContext &C, const Expr *MtxExpr,
535*e038c9c4Sjoerg                                         SVal MtxVal,
536*e038c9c4Sjoerg                                         enum LockingSemantics Semantics,
537*e038c9c4Sjoerg                                         CheckerKind CheckKind) const {
538*e038c9c4Sjoerg   if (!ChecksEnabled[CheckKind])
539*e038c9c4Sjoerg     return;
540*e038c9c4Sjoerg 
541*e038c9c4Sjoerg   const MemRegion *LockR = MtxVal.getAsRegion();
5427330f729Sjoerg   if (!LockR)
5437330f729Sjoerg     return;
5447330f729Sjoerg 
5457330f729Sjoerg   ProgramStateRef State = C.getState();
5467330f729Sjoerg 
5477330f729Sjoerg   const SymbolRef *sym = State->get<DestroyRetVal>(LockR);
5487330f729Sjoerg   if (sym)
5497330f729Sjoerg     State = resolvePossiblyDestroyedMutex(State, LockR, sym);
5507330f729Sjoerg 
5517330f729Sjoerg   const LockState *LState = State->get<LockMap>(LockR);
5527330f729Sjoerg   // Checking the return value of the destroy method only in the case of
5537330f729Sjoerg   // PthreadSemantics
554*e038c9c4Sjoerg   if (Semantics == PthreadSemantics) {
5557330f729Sjoerg     if (!LState || LState->isUnlocked()) {
556*e038c9c4Sjoerg       SymbolRef sym = Call.getReturnValue().getAsSymbol();
5577330f729Sjoerg       if (!sym) {
5587330f729Sjoerg         State = State->remove<LockMap>(LockR);
5597330f729Sjoerg         C.addTransition(State);
5607330f729Sjoerg         return;
5617330f729Sjoerg       }
5627330f729Sjoerg       State = State->set<DestroyRetVal>(LockR, sym);
5637330f729Sjoerg       if (LState && LState->isUnlocked())
5647330f729Sjoerg         State = State->set<LockMap>(
5657330f729Sjoerg             LockR, LockState::getUnlockedAndPossiblyDestroyed());
5667330f729Sjoerg       else
5677330f729Sjoerg         State = State->set<LockMap>(
5687330f729Sjoerg             LockR, LockState::getUntouchedAndPossiblyDestroyed());
5697330f729Sjoerg       C.addTransition(State);
5707330f729Sjoerg       return;
5717330f729Sjoerg     }
5727330f729Sjoerg   } else {
5737330f729Sjoerg     if (!LState || LState->isUnlocked()) {
5747330f729Sjoerg       State = State->set<LockMap>(LockR, LockState::getDestroyed());
5757330f729Sjoerg       C.addTransition(State);
5767330f729Sjoerg       return;
5777330f729Sjoerg     }
5787330f729Sjoerg   }
5797330f729Sjoerg 
580*e038c9c4Sjoerg   StringRef Message = LState->isLocked()
581*e038c9c4Sjoerg                           ? "This lock is still locked"
582*e038c9c4Sjoerg                           : "This lock has already been destroyed";
583*e038c9c4Sjoerg 
584*e038c9c4Sjoerg   reportBug(C, BT_destroylock, MtxExpr, CheckKind, Message);
5857330f729Sjoerg }
5867330f729Sjoerg 
InitAnyLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const587*e038c9c4Sjoerg void PthreadLockChecker::InitAnyLock(const CallEvent &Call, CheckerContext &C,
588*e038c9c4Sjoerg                                      CheckerKind CheckKind) const {
589*e038c9c4Sjoerg   InitLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), CheckKind);
590*e038c9c4Sjoerg }
591*e038c9c4Sjoerg 
InitLockAux(const CallEvent & Call,CheckerContext & C,const Expr * MtxExpr,SVal MtxVal,CheckerKind CheckKind) const592*e038c9c4Sjoerg void PthreadLockChecker::InitLockAux(const CallEvent &Call, CheckerContext &C,
593*e038c9c4Sjoerg                                      const Expr *MtxExpr, SVal MtxVal,
594*e038c9c4Sjoerg                                      CheckerKind CheckKind) const {
595*e038c9c4Sjoerg   if (!ChecksEnabled[CheckKind])
5967330f729Sjoerg     return;
5977330f729Sjoerg 
598*e038c9c4Sjoerg   const MemRegion *LockR = MtxVal.getAsRegion();
5997330f729Sjoerg   if (!LockR)
6007330f729Sjoerg     return;
6017330f729Sjoerg 
6027330f729Sjoerg   ProgramStateRef State = C.getState();
6037330f729Sjoerg 
6047330f729Sjoerg   const SymbolRef *sym = State->get<DestroyRetVal>(LockR);
6057330f729Sjoerg   if (sym)
6067330f729Sjoerg     State = resolvePossiblyDestroyedMutex(State, LockR, sym);
6077330f729Sjoerg 
6087330f729Sjoerg   const struct LockState *LState = State->get<LockMap>(LockR);
6097330f729Sjoerg   if (!LState || LState->isDestroyed()) {
6107330f729Sjoerg     State = State->set<LockMap>(LockR, LockState::getUnlocked());
6117330f729Sjoerg     C.addTransition(State);
6127330f729Sjoerg     return;
6137330f729Sjoerg   }
6147330f729Sjoerg 
615*e038c9c4Sjoerg   StringRef Message = LState->isLocked()
616*e038c9c4Sjoerg                           ? "This lock is still being held"
617*e038c9c4Sjoerg                           : "This lock has already been initialized";
6187330f729Sjoerg 
619*e038c9c4Sjoerg   reportBug(C, BT_initlock, MtxExpr, CheckKind, Message);
6207330f729Sjoerg }
6217330f729Sjoerg 
reportBug(CheckerContext & C,std::unique_ptr<BugType> BT[],const Expr * MtxExpr,CheckerKind CheckKind,StringRef Desc) const622*e038c9c4Sjoerg void PthreadLockChecker::reportBug(CheckerContext &C,
623*e038c9c4Sjoerg                                    std::unique_ptr<BugType> BT[],
624*e038c9c4Sjoerg                                    const Expr *MtxExpr, CheckerKind CheckKind,
625*e038c9c4Sjoerg                                    StringRef Desc) const {
6267330f729Sjoerg   ExplodedNode *N = C.generateErrorNode();
6277330f729Sjoerg   if (!N)
6287330f729Sjoerg     return;
629*e038c9c4Sjoerg   initBugType(CheckKind);
6307330f729Sjoerg   auto Report =
631*e038c9c4Sjoerg       std::make_unique<PathSensitiveBugReport>(*BT[CheckKind], Desc, N);
632*e038c9c4Sjoerg   Report->addRange(MtxExpr->getSourceRange());
6337330f729Sjoerg   C.emitReport(std::move(Report));
6347330f729Sjoerg }
6357330f729Sjoerg 
checkDeadSymbols(SymbolReaper & SymReaper,CheckerContext & C) const6367330f729Sjoerg void PthreadLockChecker::checkDeadSymbols(SymbolReaper &SymReaper,
6377330f729Sjoerg                                           CheckerContext &C) const {
6387330f729Sjoerg   ProgramStateRef State = C.getState();
6397330f729Sjoerg 
640*e038c9c4Sjoerg   for (auto I : State->get<DestroyRetVal>()) {
641*e038c9c4Sjoerg     // Once the return value symbol dies, no more checks can be performed
642*e038c9c4Sjoerg     // against it. See if the return value was checked before this point.
643*e038c9c4Sjoerg     // This would remove the symbol from the map as well.
644*e038c9c4Sjoerg     if (SymReaper.isDead(I.second))
645*e038c9c4Sjoerg       State = resolvePossiblyDestroyedMutex(State, I.first, &I.second);
6467330f729Sjoerg   }
647*e038c9c4Sjoerg 
648*e038c9c4Sjoerg   for (auto I : State->get<LockMap>()) {
649*e038c9c4Sjoerg     // Stop tracking dead mutex regions as well.
650*e038c9c4Sjoerg     if (!SymReaper.isLiveRegion(I.first)) {
651*e038c9c4Sjoerg       State = State->remove<LockMap>(I.first);
652*e038c9c4Sjoerg       State = State->remove<DestroyRetVal>(I.first);
653*e038c9c4Sjoerg     }
654*e038c9c4Sjoerg   }
655*e038c9c4Sjoerg 
656*e038c9c4Sjoerg   // TODO: We probably need to clean up the lock stack as well.
657*e038c9c4Sjoerg   // It is tricky though: even if the mutex cannot be unlocked anymore,
658*e038c9c4Sjoerg   // it can still participate in lock order reversal resolution.
659*e038c9c4Sjoerg 
6607330f729Sjoerg   C.addTransition(State);
6617330f729Sjoerg }
6627330f729Sjoerg 
checkRegionChanges(ProgramStateRef State,const InvalidatedSymbols * Symbols,ArrayRef<const MemRegion * > ExplicitRegions,ArrayRef<const MemRegion * > Regions,const LocationContext * LCtx,const CallEvent * Call) const663*e038c9c4Sjoerg ProgramStateRef PthreadLockChecker::checkRegionChanges(
664*e038c9c4Sjoerg     ProgramStateRef State, const InvalidatedSymbols *Symbols,
665*e038c9c4Sjoerg     ArrayRef<const MemRegion *> ExplicitRegions,
666*e038c9c4Sjoerg     ArrayRef<const MemRegion *> Regions, const LocationContext *LCtx,
667*e038c9c4Sjoerg     const CallEvent *Call) const {
668*e038c9c4Sjoerg 
669*e038c9c4Sjoerg   bool IsLibraryFunction = false;
670*e038c9c4Sjoerg   if (Call && Call->isGlobalCFunction()) {
671*e038c9c4Sjoerg     // Avoid invalidating mutex state when a known supported function is called.
672*e038c9c4Sjoerg     if (PThreadCallbacks.lookup(*Call) || FuchsiaCallbacks.lookup(*Call) ||
673*e038c9c4Sjoerg         C11Callbacks.lookup(*Call))
674*e038c9c4Sjoerg       return State;
675*e038c9c4Sjoerg 
676*e038c9c4Sjoerg     if (Call->isInSystemHeader())
677*e038c9c4Sjoerg       IsLibraryFunction = true;
678*e038c9c4Sjoerg   }
679*e038c9c4Sjoerg 
680*e038c9c4Sjoerg   for (auto R : Regions) {
681*e038c9c4Sjoerg     // We assume that system library function wouldn't touch the mutex unless
682*e038c9c4Sjoerg     // it takes the mutex explicitly as an argument.
683*e038c9c4Sjoerg     // FIXME: This is a bit quadratic.
684*e038c9c4Sjoerg     if (IsLibraryFunction &&
685*e038c9c4Sjoerg         std::find(ExplicitRegions.begin(), ExplicitRegions.end(), R) ==
686*e038c9c4Sjoerg             ExplicitRegions.end())
687*e038c9c4Sjoerg       continue;
688*e038c9c4Sjoerg 
689*e038c9c4Sjoerg     State = State->remove<LockMap>(R);
690*e038c9c4Sjoerg     State = State->remove<DestroyRetVal>(R);
691*e038c9c4Sjoerg 
692*e038c9c4Sjoerg     // TODO: We need to invalidate the lock stack as well. This is tricky
693*e038c9c4Sjoerg     // to implement correctly and efficiently though, because the effects
694*e038c9c4Sjoerg     // of mutex escapes on lock order may be fairly varied.
695*e038c9c4Sjoerg   }
696*e038c9c4Sjoerg 
697*e038c9c4Sjoerg   return State;
698*e038c9c4Sjoerg }
699*e038c9c4Sjoerg 
registerPthreadLockBase(CheckerManager & mgr)700*e038c9c4Sjoerg void ento::registerPthreadLockBase(CheckerManager &mgr) {
7017330f729Sjoerg   mgr.registerChecker<PthreadLockChecker>();
7027330f729Sjoerg }
7037330f729Sjoerg 
shouldRegisterPthreadLockBase(const CheckerManager & mgr)704*e038c9c4Sjoerg bool ento::shouldRegisterPthreadLockBase(const CheckerManager &mgr) { return true; }
705*e038c9c4Sjoerg 
706*e038c9c4Sjoerg #define REGISTER_CHECKER(name)                                                 \
707*e038c9c4Sjoerg   void ento::register##name(CheckerManager &mgr) {                             \
708*e038c9c4Sjoerg     PthreadLockChecker *checker = mgr.getChecker<PthreadLockChecker>();        \
709*e038c9c4Sjoerg     checker->ChecksEnabled[PthreadLockChecker::CK_##name] = true;              \
710*e038c9c4Sjoerg     checker->CheckNames[PthreadLockChecker::CK_##name] =                       \
711*e038c9c4Sjoerg         mgr.getCurrentCheckerName();                                           \
712*e038c9c4Sjoerg   }                                                                            \
713*e038c9c4Sjoerg                                                                                \
714*e038c9c4Sjoerg   bool ento::shouldRegister##name(const CheckerManager &mgr) { return true; }
715*e038c9c4Sjoerg 
716*e038c9c4Sjoerg REGISTER_CHECKER(PthreadLockChecker)
717*e038c9c4Sjoerg REGISTER_CHECKER(FuchsiaLockChecker)
718*e038c9c4Sjoerg REGISTER_CHECKER(C11LockChecker)
719