17330f729Sjoerg //===--- PthreadLockChecker.cpp - Check for locking problems ---*- C++ -*--===//
27330f729Sjoerg //
37330f729Sjoerg // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
47330f729Sjoerg // See https://llvm.org/LICENSE.txt for license information.
57330f729Sjoerg // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
67330f729Sjoerg //
77330f729Sjoerg //===----------------------------------------------------------------------===//
87330f729Sjoerg //
9*e038c9c4Sjoerg // This file defines:
10*e038c9c4Sjoerg // * PthreadLockChecker, a simple lock -> unlock checker.
11*e038c9c4Sjoerg // Which also checks for XNU locks, which behave similarly enough to share
12*e038c9c4Sjoerg // code.
13*e038c9c4Sjoerg // * FuchsiaLocksChecker, which is also rather similar.
14*e038c9c4Sjoerg // * C11LockChecker which also closely follows Pthread semantics.
15*e038c9c4Sjoerg //
16*e038c9c4Sjoerg // TODO: Path notes.
177330f729Sjoerg //
187330f729Sjoerg //===----------------------------------------------------------------------===//
197330f729Sjoerg
207330f729Sjoerg #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
217330f729Sjoerg #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
227330f729Sjoerg #include "clang/StaticAnalyzer/Core/Checker.h"
237330f729Sjoerg #include "clang/StaticAnalyzer/Core/CheckerManager.h"
24*e038c9c4Sjoerg #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
257330f729Sjoerg #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
267330f729Sjoerg
277330f729Sjoerg using namespace clang;
287330f729Sjoerg using namespace ento;
297330f729Sjoerg
307330f729Sjoerg namespace {
317330f729Sjoerg
327330f729Sjoerg struct LockState {
337330f729Sjoerg enum Kind {
347330f729Sjoerg Destroyed,
357330f729Sjoerg Locked,
367330f729Sjoerg Unlocked,
377330f729Sjoerg UntouchedAndPossiblyDestroyed,
387330f729Sjoerg UnlockedAndPossiblyDestroyed
397330f729Sjoerg } K;
407330f729Sjoerg
417330f729Sjoerg private:
LockState__anon1b665f7f0111::LockState427330f729Sjoerg LockState(Kind K) : K(K) {}
437330f729Sjoerg
447330f729Sjoerg public:
getLocked__anon1b665f7f0111::LockState457330f729Sjoerg static LockState getLocked() { return LockState(Locked); }
getUnlocked__anon1b665f7f0111::LockState467330f729Sjoerg static LockState getUnlocked() { return LockState(Unlocked); }
getDestroyed__anon1b665f7f0111::LockState477330f729Sjoerg static LockState getDestroyed() { return LockState(Destroyed); }
getUntouchedAndPossiblyDestroyed__anon1b665f7f0111::LockState487330f729Sjoerg static LockState getUntouchedAndPossiblyDestroyed() {
497330f729Sjoerg return LockState(UntouchedAndPossiblyDestroyed);
507330f729Sjoerg }
getUnlockedAndPossiblyDestroyed__anon1b665f7f0111::LockState517330f729Sjoerg static LockState getUnlockedAndPossiblyDestroyed() {
527330f729Sjoerg return LockState(UnlockedAndPossiblyDestroyed);
537330f729Sjoerg }
547330f729Sjoerg
operator ==__anon1b665f7f0111::LockState55*e038c9c4Sjoerg bool operator==(const LockState &X) const { return K == X.K; }
567330f729Sjoerg
isLocked__anon1b665f7f0111::LockState577330f729Sjoerg bool isLocked() const { return K == Locked; }
isUnlocked__anon1b665f7f0111::LockState587330f729Sjoerg bool isUnlocked() const { return K == Unlocked; }
isDestroyed__anon1b665f7f0111::LockState597330f729Sjoerg bool isDestroyed() const { return K == Destroyed; }
isUntouchedAndPossiblyDestroyed__anon1b665f7f0111::LockState607330f729Sjoerg bool isUntouchedAndPossiblyDestroyed() const {
617330f729Sjoerg return K == UntouchedAndPossiblyDestroyed;
627330f729Sjoerg }
isUnlockedAndPossiblyDestroyed__anon1b665f7f0111::LockState637330f729Sjoerg bool isUnlockedAndPossiblyDestroyed() const {
647330f729Sjoerg return K == UnlockedAndPossiblyDestroyed;
657330f729Sjoerg }
667330f729Sjoerg
Profile__anon1b665f7f0111::LockState67*e038c9c4Sjoerg void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddInteger(K); }
687330f729Sjoerg };
697330f729Sjoerg
70*e038c9c4Sjoerg class PthreadLockChecker : public Checker<check::PostCall, check::DeadSymbols,
71*e038c9c4Sjoerg check::RegionChanges> {
727330f729Sjoerg public:
73*e038c9c4Sjoerg enum LockingSemantics { NotApplicable = 0, PthreadSemantics, XNUSemantics };
74*e038c9c4Sjoerg enum CheckerKind {
75*e038c9c4Sjoerg CK_PthreadLockChecker,
76*e038c9c4Sjoerg CK_FuchsiaLockChecker,
77*e038c9c4Sjoerg CK_C11LockChecker,
78*e038c9c4Sjoerg CK_NumCheckKinds
79*e038c9c4Sjoerg };
80*e038c9c4Sjoerg DefaultBool ChecksEnabled[CK_NumCheckKinds];
81*e038c9c4Sjoerg CheckerNameRef CheckNames[CK_NumCheckKinds];
827330f729Sjoerg
83*e038c9c4Sjoerg private:
84*e038c9c4Sjoerg typedef void (PthreadLockChecker::*FnCheck)(const CallEvent &Call,
85*e038c9c4Sjoerg CheckerContext &C,
86*e038c9c4Sjoerg CheckerKind CheckKind) const;
87*e038c9c4Sjoerg CallDescriptionMap<FnCheck> PThreadCallbacks = {
88*e038c9c4Sjoerg // Init.
89*e038c9c4Sjoerg {{"pthread_mutex_init", 2}, &PthreadLockChecker::InitAnyLock},
90*e038c9c4Sjoerg // TODO: pthread_rwlock_init(2 arguments).
91*e038c9c4Sjoerg // TODO: lck_mtx_init(3 arguments).
92*e038c9c4Sjoerg // TODO: lck_mtx_alloc_init(2 arguments) => returns the mutex.
93*e038c9c4Sjoerg // TODO: lck_rw_init(3 arguments).
94*e038c9c4Sjoerg // TODO: lck_rw_alloc_init(2 arguments) => returns the mutex.
957330f729Sjoerg
96*e038c9c4Sjoerg // Acquire.
97*e038c9c4Sjoerg {{"pthread_mutex_lock", 1}, &PthreadLockChecker::AcquirePthreadLock},
98*e038c9c4Sjoerg {{"pthread_rwlock_rdlock", 1}, &PthreadLockChecker::AcquirePthreadLock},
99*e038c9c4Sjoerg {{"pthread_rwlock_wrlock", 1}, &PthreadLockChecker::AcquirePthreadLock},
100*e038c9c4Sjoerg {{"lck_mtx_lock", 1}, &PthreadLockChecker::AcquireXNULock},
101*e038c9c4Sjoerg {{"lck_rw_lock_exclusive", 1}, &PthreadLockChecker::AcquireXNULock},
102*e038c9c4Sjoerg {{"lck_rw_lock_shared", 1}, &PthreadLockChecker::AcquireXNULock},
103*e038c9c4Sjoerg
104*e038c9c4Sjoerg // Try.
105*e038c9c4Sjoerg {{"pthread_mutex_trylock", 1}, &PthreadLockChecker::TryPthreadLock},
106*e038c9c4Sjoerg {{"pthread_rwlock_tryrdlock", 1}, &PthreadLockChecker::TryPthreadLock},
107*e038c9c4Sjoerg {{"pthread_rwlock_trywrlock", 1}, &PthreadLockChecker::TryPthreadLock},
108*e038c9c4Sjoerg {{"lck_mtx_try_lock", 1}, &PthreadLockChecker::TryXNULock},
109*e038c9c4Sjoerg {{"lck_rw_try_lock_exclusive", 1}, &PthreadLockChecker::TryXNULock},
110*e038c9c4Sjoerg {{"lck_rw_try_lock_shared", 1}, &PthreadLockChecker::TryXNULock},
111*e038c9c4Sjoerg
112*e038c9c4Sjoerg // Release.
113*e038c9c4Sjoerg {{"pthread_mutex_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
114*e038c9c4Sjoerg {{"pthread_rwlock_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
115*e038c9c4Sjoerg {{"lck_mtx_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
116*e038c9c4Sjoerg {{"lck_rw_unlock_exclusive", 1}, &PthreadLockChecker::ReleaseAnyLock},
117*e038c9c4Sjoerg {{"lck_rw_unlock_shared", 1}, &PthreadLockChecker::ReleaseAnyLock},
118*e038c9c4Sjoerg {{"lck_rw_done", 1}, &PthreadLockChecker::ReleaseAnyLock},
119*e038c9c4Sjoerg
120*e038c9c4Sjoerg // Destroy.
121*e038c9c4Sjoerg {{"pthread_mutex_destroy", 1}, &PthreadLockChecker::DestroyPthreadLock},
122*e038c9c4Sjoerg {{"lck_mtx_destroy", 2}, &PthreadLockChecker::DestroyXNULock},
123*e038c9c4Sjoerg // TODO: pthread_rwlock_destroy(1 argument).
124*e038c9c4Sjoerg // TODO: lck_rw_destroy(2 arguments).
125*e038c9c4Sjoerg };
126*e038c9c4Sjoerg
127*e038c9c4Sjoerg CallDescriptionMap<FnCheck> FuchsiaCallbacks = {
128*e038c9c4Sjoerg // Init.
129*e038c9c4Sjoerg {{"spin_lock_init", 1}, &PthreadLockChecker::InitAnyLock},
130*e038c9c4Sjoerg
131*e038c9c4Sjoerg // Acquire.
132*e038c9c4Sjoerg {{"spin_lock", 1}, &PthreadLockChecker::AcquirePthreadLock},
133*e038c9c4Sjoerg {{"spin_lock_save", 3}, &PthreadLockChecker::AcquirePthreadLock},
134*e038c9c4Sjoerg {{"sync_mutex_lock", 1}, &PthreadLockChecker::AcquirePthreadLock},
135*e038c9c4Sjoerg {{"sync_mutex_lock_with_waiter", 1},
136*e038c9c4Sjoerg &PthreadLockChecker::AcquirePthreadLock},
137*e038c9c4Sjoerg
138*e038c9c4Sjoerg // Try.
139*e038c9c4Sjoerg {{"spin_trylock", 1}, &PthreadLockChecker::TryFuchsiaLock},
140*e038c9c4Sjoerg {{"sync_mutex_trylock", 1}, &PthreadLockChecker::TryFuchsiaLock},
141*e038c9c4Sjoerg {{"sync_mutex_timedlock", 2}, &PthreadLockChecker::TryFuchsiaLock},
142*e038c9c4Sjoerg
143*e038c9c4Sjoerg // Release.
144*e038c9c4Sjoerg {{"spin_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
145*e038c9c4Sjoerg {{"spin_unlock_restore", 3}, &PthreadLockChecker::ReleaseAnyLock},
146*e038c9c4Sjoerg {{"sync_mutex_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
147*e038c9c4Sjoerg };
148*e038c9c4Sjoerg
149*e038c9c4Sjoerg CallDescriptionMap<FnCheck> C11Callbacks = {
150*e038c9c4Sjoerg // Init.
151*e038c9c4Sjoerg {{"mtx_init", 2}, &PthreadLockChecker::InitAnyLock},
152*e038c9c4Sjoerg
153*e038c9c4Sjoerg // Acquire.
154*e038c9c4Sjoerg {{"mtx_lock", 1}, &PthreadLockChecker::AcquirePthreadLock},
155*e038c9c4Sjoerg
156*e038c9c4Sjoerg // Try.
157*e038c9c4Sjoerg {{"mtx_trylock", 1}, &PthreadLockChecker::TryC11Lock},
158*e038c9c4Sjoerg {{"mtx_timedlock", 2}, &PthreadLockChecker::TryC11Lock},
159*e038c9c4Sjoerg
160*e038c9c4Sjoerg // Release.
161*e038c9c4Sjoerg {{"mtx_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
162*e038c9c4Sjoerg
163*e038c9c4Sjoerg // Destroy
164*e038c9c4Sjoerg {{"mtx_destroy", 1}, &PthreadLockChecker::DestroyPthreadLock},
165*e038c9c4Sjoerg };
166*e038c9c4Sjoerg
1677330f729Sjoerg ProgramStateRef resolvePossiblyDestroyedMutex(ProgramStateRef state,
1687330f729Sjoerg const MemRegion *lockR,
1697330f729Sjoerg const SymbolRef *sym) const;
170*e038c9c4Sjoerg void reportBug(CheckerContext &C, std::unique_ptr<BugType> BT[],
171*e038c9c4Sjoerg const Expr *MtxExpr, CheckerKind CheckKind,
172*e038c9c4Sjoerg StringRef Desc) const;
173*e038c9c4Sjoerg
174*e038c9c4Sjoerg // Init.
175*e038c9c4Sjoerg void InitAnyLock(const CallEvent &Call, CheckerContext &C,
176*e038c9c4Sjoerg CheckerKind CheckKind) const;
177*e038c9c4Sjoerg void InitLockAux(const CallEvent &Call, CheckerContext &C,
178*e038c9c4Sjoerg const Expr *MtxExpr, SVal MtxVal,
179*e038c9c4Sjoerg CheckerKind CheckKind) const;
180*e038c9c4Sjoerg
181*e038c9c4Sjoerg // Lock, Try-lock.
182*e038c9c4Sjoerg void AcquirePthreadLock(const CallEvent &Call, CheckerContext &C,
183*e038c9c4Sjoerg CheckerKind CheckKind) const;
184*e038c9c4Sjoerg void AcquireXNULock(const CallEvent &Call, CheckerContext &C,
185*e038c9c4Sjoerg CheckerKind CheckKind) const;
186*e038c9c4Sjoerg void TryPthreadLock(const CallEvent &Call, CheckerContext &C,
187*e038c9c4Sjoerg CheckerKind CheckKind) const;
188*e038c9c4Sjoerg void TryXNULock(const CallEvent &Call, CheckerContext &C,
189*e038c9c4Sjoerg CheckerKind CheckKind) const;
190*e038c9c4Sjoerg void TryFuchsiaLock(const CallEvent &Call, CheckerContext &C,
191*e038c9c4Sjoerg CheckerKind CheckKind) const;
192*e038c9c4Sjoerg void TryC11Lock(const CallEvent &Call, CheckerContext &C,
193*e038c9c4Sjoerg CheckerKind CheckKind) const;
194*e038c9c4Sjoerg void AcquireLockAux(const CallEvent &Call, CheckerContext &C,
195*e038c9c4Sjoerg const Expr *MtxExpr, SVal MtxVal, bool IsTryLock,
196*e038c9c4Sjoerg LockingSemantics Semantics, CheckerKind CheckKind) const;
197*e038c9c4Sjoerg
198*e038c9c4Sjoerg // Release.
199*e038c9c4Sjoerg void ReleaseAnyLock(const CallEvent &Call, CheckerContext &C,
200*e038c9c4Sjoerg CheckerKind CheckKind) const;
201*e038c9c4Sjoerg void ReleaseLockAux(const CallEvent &Call, CheckerContext &C,
202*e038c9c4Sjoerg const Expr *MtxExpr, SVal MtxVal,
203*e038c9c4Sjoerg CheckerKind CheckKind) const;
204*e038c9c4Sjoerg
205*e038c9c4Sjoerg // Destroy.
206*e038c9c4Sjoerg void DestroyPthreadLock(const CallEvent &Call, CheckerContext &C,
207*e038c9c4Sjoerg CheckerKind CheckKind) const;
208*e038c9c4Sjoerg void DestroyXNULock(const CallEvent &Call, CheckerContext &C,
209*e038c9c4Sjoerg CheckerKind CheckKind) const;
210*e038c9c4Sjoerg void DestroyLockAux(const CallEvent &Call, CheckerContext &C,
211*e038c9c4Sjoerg const Expr *MtxExpr, SVal MtxVal,
212*e038c9c4Sjoerg LockingSemantics Semantics, CheckerKind CheckKind) const;
213*e038c9c4Sjoerg
214*e038c9c4Sjoerg public:
215*e038c9c4Sjoerg void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
216*e038c9c4Sjoerg void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
217*e038c9c4Sjoerg ProgramStateRef
218*e038c9c4Sjoerg checkRegionChanges(ProgramStateRef State, const InvalidatedSymbols *Symbols,
219*e038c9c4Sjoerg ArrayRef<const MemRegion *> ExplicitRegions,
220*e038c9c4Sjoerg ArrayRef<const MemRegion *> Regions,
221*e038c9c4Sjoerg const LocationContext *LCtx, const CallEvent *Call) const;
222*e038c9c4Sjoerg void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
223*e038c9c4Sjoerg const char *Sep) const override;
224*e038c9c4Sjoerg
225*e038c9c4Sjoerg private:
226*e038c9c4Sjoerg mutable std::unique_ptr<BugType> BT_doublelock[CK_NumCheckKinds];
227*e038c9c4Sjoerg mutable std::unique_ptr<BugType> BT_doubleunlock[CK_NumCheckKinds];
228*e038c9c4Sjoerg mutable std::unique_ptr<BugType> BT_destroylock[CK_NumCheckKinds];
229*e038c9c4Sjoerg mutable std::unique_ptr<BugType> BT_initlock[CK_NumCheckKinds];
230*e038c9c4Sjoerg mutable std::unique_ptr<BugType> BT_lor[CK_NumCheckKinds];
231*e038c9c4Sjoerg
initBugType(CheckerKind CheckKind) const232*e038c9c4Sjoerg void initBugType(CheckerKind CheckKind) const {
233*e038c9c4Sjoerg if (BT_doublelock[CheckKind])
234*e038c9c4Sjoerg return;
235*e038c9c4Sjoerg BT_doublelock[CheckKind].reset(
236*e038c9c4Sjoerg new BugType{CheckNames[CheckKind], "Double locking", "Lock checker"});
237*e038c9c4Sjoerg BT_doubleunlock[CheckKind].reset(
238*e038c9c4Sjoerg new BugType{CheckNames[CheckKind], "Double unlocking", "Lock checker"});
239*e038c9c4Sjoerg BT_destroylock[CheckKind].reset(new BugType{
240*e038c9c4Sjoerg CheckNames[CheckKind], "Use destroyed lock", "Lock checker"});
241*e038c9c4Sjoerg BT_initlock[CheckKind].reset(new BugType{
242*e038c9c4Sjoerg CheckNames[CheckKind], "Init invalid lock", "Lock checker"});
243*e038c9c4Sjoerg BT_lor[CheckKind].reset(new BugType{CheckNames[CheckKind],
244*e038c9c4Sjoerg "Lock order reversal", "Lock checker"});
245*e038c9c4Sjoerg }
2467330f729Sjoerg };
2477330f729Sjoerg } // end anonymous namespace
2487330f729Sjoerg
2497330f729Sjoerg // A stack of locks for tracking lock-unlock order.
REGISTER_LIST_WITH_PROGRAMSTATE(LockSet,const MemRegion *)2507330f729Sjoerg REGISTER_LIST_WITH_PROGRAMSTATE(LockSet, const MemRegion *)
2517330f729Sjoerg
2527330f729Sjoerg // An entry for tracking lock states.
2537330f729Sjoerg REGISTER_MAP_WITH_PROGRAMSTATE(LockMap, const MemRegion *, LockState)
2547330f729Sjoerg
2557330f729Sjoerg // Return values for unresolved calls to pthread_mutex_destroy().
2567330f729Sjoerg REGISTER_MAP_WITH_PROGRAMSTATE(DestroyRetVal, const MemRegion *, SymbolRef)
2577330f729Sjoerg
258*e038c9c4Sjoerg void PthreadLockChecker::checkPostCall(const CallEvent &Call,
2597330f729Sjoerg CheckerContext &C) const {
260*e038c9c4Sjoerg // An additional umbrella check that all functions modeled by this checker
261*e038c9c4Sjoerg // are global C functions.
262*e038c9c4Sjoerg // TODO: Maybe make this the default behavior of CallDescription
263*e038c9c4Sjoerg // with exactly one identifier?
264*e038c9c4Sjoerg // FIXME: Try to handle cases when the implementation was inlined rather
265*e038c9c4Sjoerg // than just giving up.
266*e038c9c4Sjoerg if (!Call.isGlobalCFunction() || C.wasInlined)
2677330f729Sjoerg return;
2687330f729Sjoerg
269*e038c9c4Sjoerg if (const FnCheck *Callback = PThreadCallbacks.lookup(Call))
270*e038c9c4Sjoerg (this->**Callback)(Call, C, CK_PthreadLockChecker);
271*e038c9c4Sjoerg else if (const FnCheck *Callback = FuchsiaCallbacks.lookup(Call))
272*e038c9c4Sjoerg (this->**Callback)(Call, C, CK_FuchsiaLockChecker);
273*e038c9c4Sjoerg else if (const FnCheck *Callback = C11Callbacks.lookup(Call))
274*e038c9c4Sjoerg (this->**Callback)(Call, C, CK_C11LockChecker);
2757330f729Sjoerg }
2767330f729Sjoerg
2777330f729Sjoerg // When a lock is destroyed, in some semantics(like PthreadSemantics) we are not
2787330f729Sjoerg // sure if the destroy call has succeeded or failed, and the lock enters one of
2797330f729Sjoerg // the 'possibly destroyed' state. There is a short time frame for the
2807330f729Sjoerg // programmer to check the return value to see if the lock was successfully
2817330f729Sjoerg // destroyed. Before we model the next operation over that lock, we call this
2827330f729Sjoerg // function to see if the return value was checked by now and set the lock state
2837330f729Sjoerg // - either to destroyed state or back to its previous state.
2847330f729Sjoerg
2857330f729Sjoerg // In PthreadSemantics, pthread_mutex_destroy() returns zero if the lock is
2867330f729Sjoerg // successfully destroyed and it returns a non-zero value otherwise.
resolvePossiblyDestroyedMutex(ProgramStateRef state,const MemRegion * lockR,const SymbolRef * sym) const2877330f729Sjoerg ProgramStateRef PthreadLockChecker::resolvePossiblyDestroyedMutex(
2887330f729Sjoerg ProgramStateRef state, const MemRegion *lockR, const SymbolRef *sym) const {
2897330f729Sjoerg const LockState *lstate = state->get<LockMap>(lockR);
2907330f729Sjoerg // Existence in DestroyRetVal ensures existence in LockMap.
2917330f729Sjoerg // Existence in Destroyed also ensures that the lock state for lockR is either
2927330f729Sjoerg // UntouchedAndPossiblyDestroyed or UnlockedAndPossiblyDestroyed.
2937330f729Sjoerg assert(lstate->isUntouchedAndPossiblyDestroyed() ||
2947330f729Sjoerg lstate->isUnlockedAndPossiblyDestroyed());
2957330f729Sjoerg
2967330f729Sjoerg ConstraintManager &CMgr = state->getConstraintManager();
2977330f729Sjoerg ConditionTruthVal retZero = CMgr.isNull(state, *sym);
2987330f729Sjoerg if (retZero.isConstrainedFalse()) {
2997330f729Sjoerg if (lstate->isUntouchedAndPossiblyDestroyed())
3007330f729Sjoerg state = state->remove<LockMap>(lockR);
3017330f729Sjoerg else if (lstate->isUnlockedAndPossiblyDestroyed())
3027330f729Sjoerg state = state->set<LockMap>(lockR, LockState::getUnlocked());
3037330f729Sjoerg } else
3047330f729Sjoerg state = state->set<LockMap>(lockR, LockState::getDestroyed());
3057330f729Sjoerg
3067330f729Sjoerg // Removing the map entry (lockR, sym) from DestroyRetVal as the lock state is
3077330f729Sjoerg // now resolved.
3087330f729Sjoerg state = state->remove<DestroyRetVal>(lockR);
3097330f729Sjoerg return state;
3107330f729Sjoerg }
3117330f729Sjoerg
printState(raw_ostream & Out,ProgramStateRef State,const char * NL,const char * Sep) const3127330f729Sjoerg void PthreadLockChecker::printState(raw_ostream &Out, ProgramStateRef State,
3137330f729Sjoerg const char *NL, const char *Sep) const {
3147330f729Sjoerg LockMapTy LM = State->get<LockMap>();
3157330f729Sjoerg if (!LM.isEmpty()) {
3167330f729Sjoerg Out << Sep << "Mutex states:" << NL;
3177330f729Sjoerg for (auto I : LM) {
3187330f729Sjoerg I.first->dumpToStream(Out);
3197330f729Sjoerg if (I.second.isLocked())
3207330f729Sjoerg Out << ": locked";
3217330f729Sjoerg else if (I.second.isUnlocked())
3227330f729Sjoerg Out << ": unlocked";
3237330f729Sjoerg else if (I.second.isDestroyed())
3247330f729Sjoerg Out << ": destroyed";
3257330f729Sjoerg else if (I.second.isUntouchedAndPossiblyDestroyed())
3267330f729Sjoerg Out << ": not tracked, possibly destroyed";
3277330f729Sjoerg else if (I.second.isUnlockedAndPossiblyDestroyed())
3287330f729Sjoerg Out << ": unlocked, possibly destroyed";
3297330f729Sjoerg Out << NL;
3307330f729Sjoerg }
3317330f729Sjoerg }
3327330f729Sjoerg
3337330f729Sjoerg LockSetTy LS = State->get<LockSet>();
3347330f729Sjoerg if (!LS.isEmpty()) {
3357330f729Sjoerg Out << Sep << "Mutex lock order:" << NL;
3367330f729Sjoerg for (auto I : LS) {
3377330f729Sjoerg I->dumpToStream(Out);
3387330f729Sjoerg Out << NL;
3397330f729Sjoerg }
3407330f729Sjoerg }
3417330f729Sjoerg
342*e038c9c4Sjoerg DestroyRetValTy DRV = State->get<DestroyRetVal>();
343*e038c9c4Sjoerg if (!DRV.isEmpty()) {
344*e038c9c4Sjoerg Out << Sep << "Mutexes in unresolved possibly destroyed state:" << NL;
345*e038c9c4Sjoerg for (auto I : DRV) {
346*e038c9c4Sjoerg I.first->dumpToStream(Out);
347*e038c9c4Sjoerg Out << ": ";
348*e038c9c4Sjoerg I.second->dumpToStream(Out);
349*e038c9c4Sjoerg Out << NL;
350*e038c9c4Sjoerg }
351*e038c9c4Sjoerg }
3527330f729Sjoerg }
3537330f729Sjoerg
AcquirePthreadLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const354*e038c9c4Sjoerg void PthreadLockChecker::AcquirePthreadLock(const CallEvent &Call,
355*e038c9c4Sjoerg CheckerContext &C,
356*e038c9c4Sjoerg CheckerKind CheckKind) const {
357*e038c9c4Sjoerg AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), false,
358*e038c9c4Sjoerg PthreadSemantics, CheckKind);
359*e038c9c4Sjoerg }
3607330f729Sjoerg
AcquireXNULock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const361*e038c9c4Sjoerg void PthreadLockChecker::AcquireXNULock(const CallEvent &Call,
362*e038c9c4Sjoerg CheckerContext &C,
363*e038c9c4Sjoerg CheckerKind CheckKind) const {
364*e038c9c4Sjoerg AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), false,
365*e038c9c4Sjoerg XNUSemantics, CheckKind);
366*e038c9c4Sjoerg }
367*e038c9c4Sjoerg
TryPthreadLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const368*e038c9c4Sjoerg void PthreadLockChecker::TryPthreadLock(const CallEvent &Call,
369*e038c9c4Sjoerg CheckerContext &C,
370*e038c9c4Sjoerg CheckerKind CheckKind) const {
371*e038c9c4Sjoerg AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), true,
372*e038c9c4Sjoerg PthreadSemantics, CheckKind);
373*e038c9c4Sjoerg }
374*e038c9c4Sjoerg
TryXNULock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const375*e038c9c4Sjoerg void PthreadLockChecker::TryXNULock(const CallEvent &Call, CheckerContext &C,
376*e038c9c4Sjoerg CheckerKind CheckKind) const {
377*e038c9c4Sjoerg AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), true,
378*e038c9c4Sjoerg PthreadSemantics, CheckKind);
379*e038c9c4Sjoerg }
380*e038c9c4Sjoerg
TryFuchsiaLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const381*e038c9c4Sjoerg void PthreadLockChecker::TryFuchsiaLock(const CallEvent &Call,
382*e038c9c4Sjoerg CheckerContext &C,
383*e038c9c4Sjoerg CheckerKind CheckKind) const {
384*e038c9c4Sjoerg AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), true,
385*e038c9c4Sjoerg PthreadSemantics, CheckKind);
386*e038c9c4Sjoerg }
387*e038c9c4Sjoerg
TryC11Lock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const388*e038c9c4Sjoerg void PthreadLockChecker::TryC11Lock(const CallEvent &Call, CheckerContext &C,
389*e038c9c4Sjoerg CheckerKind CheckKind) const {
390*e038c9c4Sjoerg AcquireLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), true,
391*e038c9c4Sjoerg PthreadSemantics, CheckKind);
392*e038c9c4Sjoerg }
393*e038c9c4Sjoerg
AcquireLockAux(const CallEvent & Call,CheckerContext & C,const Expr * MtxExpr,SVal MtxVal,bool IsTryLock,enum LockingSemantics Semantics,CheckerKind CheckKind) const394*e038c9c4Sjoerg void PthreadLockChecker::AcquireLockAux(const CallEvent &Call,
395*e038c9c4Sjoerg CheckerContext &C, const Expr *MtxExpr,
396*e038c9c4Sjoerg SVal MtxVal, bool IsTryLock,
397*e038c9c4Sjoerg enum LockingSemantics Semantics,
398*e038c9c4Sjoerg CheckerKind CheckKind) const {
399*e038c9c4Sjoerg if (!ChecksEnabled[CheckKind])
400*e038c9c4Sjoerg return;
401*e038c9c4Sjoerg
402*e038c9c4Sjoerg const MemRegion *lockR = MtxVal.getAsRegion();
4037330f729Sjoerg if (!lockR)
4047330f729Sjoerg return;
4057330f729Sjoerg
4067330f729Sjoerg ProgramStateRef state = C.getState();
4077330f729Sjoerg const SymbolRef *sym = state->get<DestroyRetVal>(lockR);
4087330f729Sjoerg if (sym)
4097330f729Sjoerg state = resolvePossiblyDestroyedMutex(state, lockR, sym);
4107330f729Sjoerg
4117330f729Sjoerg if (const LockState *LState = state->get<LockMap>(lockR)) {
4127330f729Sjoerg if (LState->isLocked()) {
413*e038c9c4Sjoerg reportBug(C, BT_doublelock, MtxExpr, CheckKind,
414*e038c9c4Sjoerg "This lock has already been acquired");
4157330f729Sjoerg return;
4167330f729Sjoerg } else if (LState->isDestroyed()) {
417*e038c9c4Sjoerg reportBug(C, BT_destroylock, MtxExpr, CheckKind,
418*e038c9c4Sjoerg "This lock has already been destroyed");
4197330f729Sjoerg return;
4207330f729Sjoerg }
4217330f729Sjoerg }
4227330f729Sjoerg
4237330f729Sjoerg ProgramStateRef lockSucc = state;
424*e038c9c4Sjoerg if (IsTryLock) {
4257330f729Sjoerg // Bifurcate the state, and allow a mode where the lock acquisition fails.
426*e038c9c4Sjoerg SVal RetVal = Call.getReturnValue();
427*e038c9c4Sjoerg if (auto DefinedRetVal = RetVal.getAs<DefinedSVal>()) {
4287330f729Sjoerg ProgramStateRef lockFail;
429*e038c9c4Sjoerg switch (Semantics) {
4307330f729Sjoerg case PthreadSemantics:
431*e038c9c4Sjoerg std::tie(lockFail, lockSucc) = state->assume(*DefinedRetVal);
4327330f729Sjoerg break;
4337330f729Sjoerg case XNUSemantics:
434*e038c9c4Sjoerg std::tie(lockSucc, lockFail) = state->assume(*DefinedRetVal);
4357330f729Sjoerg break;
4367330f729Sjoerg default:
4377330f729Sjoerg llvm_unreachable("Unknown tryLock locking semantics");
4387330f729Sjoerg }
4397330f729Sjoerg assert(lockFail && lockSucc);
4407330f729Sjoerg C.addTransition(lockFail);
441*e038c9c4Sjoerg }
442*e038c9c4Sjoerg // We might want to handle the case when the mutex lock function was inlined
443*e038c9c4Sjoerg // and returned an Unknown or Undefined value.
444*e038c9c4Sjoerg } else if (Semantics == PthreadSemantics) {
4457330f729Sjoerg // Assume that the return value was 0.
446*e038c9c4Sjoerg SVal RetVal = Call.getReturnValue();
447*e038c9c4Sjoerg if (auto DefinedRetVal = RetVal.getAs<DefinedSVal>()) {
448*e038c9c4Sjoerg // FIXME: If the lock function was inlined and returned true,
449*e038c9c4Sjoerg // we need to behave sanely - at least generate sink.
450*e038c9c4Sjoerg lockSucc = state->assume(*DefinedRetVal, false);
4517330f729Sjoerg assert(lockSucc);
452*e038c9c4Sjoerg }
453*e038c9c4Sjoerg // We might want to handle the case when the mutex lock function was inlined
454*e038c9c4Sjoerg // and returned an Unknown or Undefined value.
4557330f729Sjoerg } else {
4567330f729Sjoerg // XNU locking semantics return void on non-try locks
457*e038c9c4Sjoerg assert((Semantics == XNUSemantics) && "Unknown locking semantics");
4587330f729Sjoerg lockSucc = state;
4597330f729Sjoerg }
4607330f729Sjoerg
4617330f729Sjoerg // Record that the lock was acquired.
4627330f729Sjoerg lockSucc = lockSucc->add<LockSet>(lockR);
4637330f729Sjoerg lockSucc = lockSucc->set<LockMap>(lockR, LockState::getLocked());
4647330f729Sjoerg C.addTransition(lockSucc);
4657330f729Sjoerg }
4667330f729Sjoerg
ReleaseAnyLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const467*e038c9c4Sjoerg void PthreadLockChecker::ReleaseAnyLock(const CallEvent &Call,
468*e038c9c4Sjoerg CheckerContext &C,
469*e038c9c4Sjoerg CheckerKind CheckKind) const {
470*e038c9c4Sjoerg ReleaseLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), CheckKind);
471*e038c9c4Sjoerg }
4727330f729Sjoerg
ReleaseLockAux(const CallEvent & Call,CheckerContext & C,const Expr * MtxExpr,SVal MtxVal,CheckerKind CheckKind) const473*e038c9c4Sjoerg void PthreadLockChecker::ReleaseLockAux(const CallEvent &Call,
474*e038c9c4Sjoerg CheckerContext &C, const Expr *MtxExpr,
475*e038c9c4Sjoerg SVal MtxVal,
476*e038c9c4Sjoerg CheckerKind CheckKind) const {
477*e038c9c4Sjoerg if (!ChecksEnabled[CheckKind])
478*e038c9c4Sjoerg return;
479*e038c9c4Sjoerg
480*e038c9c4Sjoerg const MemRegion *lockR = MtxVal.getAsRegion();
4817330f729Sjoerg if (!lockR)
4827330f729Sjoerg return;
4837330f729Sjoerg
4847330f729Sjoerg ProgramStateRef state = C.getState();
4857330f729Sjoerg const SymbolRef *sym = state->get<DestroyRetVal>(lockR);
4867330f729Sjoerg if (sym)
4877330f729Sjoerg state = resolvePossiblyDestroyedMutex(state, lockR, sym);
4887330f729Sjoerg
4897330f729Sjoerg if (const LockState *LState = state->get<LockMap>(lockR)) {
4907330f729Sjoerg if (LState->isUnlocked()) {
491*e038c9c4Sjoerg reportBug(C, BT_doubleunlock, MtxExpr, CheckKind,
492*e038c9c4Sjoerg "This lock has already been unlocked");
4937330f729Sjoerg return;
4947330f729Sjoerg } else if (LState->isDestroyed()) {
495*e038c9c4Sjoerg reportBug(C, BT_destroylock, MtxExpr, CheckKind,
496*e038c9c4Sjoerg "This lock has already been destroyed");
4977330f729Sjoerg return;
4987330f729Sjoerg }
4997330f729Sjoerg }
5007330f729Sjoerg
5017330f729Sjoerg LockSetTy LS = state->get<LockSet>();
5027330f729Sjoerg
5037330f729Sjoerg if (!LS.isEmpty()) {
5047330f729Sjoerg const MemRegion *firstLockR = LS.getHead();
5057330f729Sjoerg if (firstLockR != lockR) {
506*e038c9c4Sjoerg reportBug(C, BT_lor, MtxExpr, CheckKind,
507*e038c9c4Sjoerg "This was not the most recently acquired lock. Possible lock "
508*e038c9c4Sjoerg "order reversal");
5097330f729Sjoerg return;
5107330f729Sjoerg }
5117330f729Sjoerg // Record that the lock was released.
5127330f729Sjoerg state = state->set<LockSet>(LS.getTail());
5137330f729Sjoerg }
5147330f729Sjoerg
5157330f729Sjoerg state = state->set<LockMap>(lockR, LockState::getUnlocked());
5167330f729Sjoerg C.addTransition(state);
5177330f729Sjoerg }
5187330f729Sjoerg
DestroyPthreadLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const519*e038c9c4Sjoerg void PthreadLockChecker::DestroyPthreadLock(const CallEvent &Call,
520*e038c9c4Sjoerg CheckerContext &C,
521*e038c9c4Sjoerg CheckerKind CheckKind) const {
522*e038c9c4Sjoerg DestroyLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0),
523*e038c9c4Sjoerg PthreadSemantics, CheckKind);
524*e038c9c4Sjoerg }
5257330f729Sjoerg
DestroyXNULock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const526*e038c9c4Sjoerg void PthreadLockChecker::DestroyXNULock(const CallEvent &Call,
527*e038c9c4Sjoerg CheckerContext &C,
528*e038c9c4Sjoerg CheckerKind CheckKind) const {
529*e038c9c4Sjoerg DestroyLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), XNUSemantics,
530*e038c9c4Sjoerg CheckKind);
531*e038c9c4Sjoerg }
532*e038c9c4Sjoerg
DestroyLockAux(const CallEvent & Call,CheckerContext & C,const Expr * MtxExpr,SVal MtxVal,enum LockingSemantics Semantics,CheckerKind CheckKind) const533*e038c9c4Sjoerg void PthreadLockChecker::DestroyLockAux(const CallEvent &Call,
534*e038c9c4Sjoerg CheckerContext &C, const Expr *MtxExpr,
535*e038c9c4Sjoerg SVal MtxVal,
536*e038c9c4Sjoerg enum LockingSemantics Semantics,
537*e038c9c4Sjoerg CheckerKind CheckKind) const {
538*e038c9c4Sjoerg if (!ChecksEnabled[CheckKind])
539*e038c9c4Sjoerg return;
540*e038c9c4Sjoerg
541*e038c9c4Sjoerg const MemRegion *LockR = MtxVal.getAsRegion();
5427330f729Sjoerg if (!LockR)
5437330f729Sjoerg return;
5447330f729Sjoerg
5457330f729Sjoerg ProgramStateRef State = C.getState();
5467330f729Sjoerg
5477330f729Sjoerg const SymbolRef *sym = State->get<DestroyRetVal>(LockR);
5487330f729Sjoerg if (sym)
5497330f729Sjoerg State = resolvePossiblyDestroyedMutex(State, LockR, sym);
5507330f729Sjoerg
5517330f729Sjoerg const LockState *LState = State->get<LockMap>(LockR);
5527330f729Sjoerg // Checking the return value of the destroy method only in the case of
5537330f729Sjoerg // PthreadSemantics
554*e038c9c4Sjoerg if (Semantics == PthreadSemantics) {
5557330f729Sjoerg if (!LState || LState->isUnlocked()) {
556*e038c9c4Sjoerg SymbolRef sym = Call.getReturnValue().getAsSymbol();
5577330f729Sjoerg if (!sym) {
5587330f729Sjoerg State = State->remove<LockMap>(LockR);
5597330f729Sjoerg C.addTransition(State);
5607330f729Sjoerg return;
5617330f729Sjoerg }
5627330f729Sjoerg State = State->set<DestroyRetVal>(LockR, sym);
5637330f729Sjoerg if (LState && LState->isUnlocked())
5647330f729Sjoerg State = State->set<LockMap>(
5657330f729Sjoerg LockR, LockState::getUnlockedAndPossiblyDestroyed());
5667330f729Sjoerg else
5677330f729Sjoerg State = State->set<LockMap>(
5687330f729Sjoerg LockR, LockState::getUntouchedAndPossiblyDestroyed());
5697330f729Sjoerg C.addTransition(State);
5707330f729Sjoerg return;
5717330f729Sjoerg }
5727330f729Sjoerg } else {
5737330f729Sjoerg if (!LState || LState->isUnlocked()) {
5747330f729Sjoerg State = State->set<LockMap>(LockR, LockState::getDestroyed());
5757330f729Sjoerg C.addTransition(State);
5767330f729Sjoerg return;
5777330f729Sjoerg }
5787330f729Sjoerg }
5797330f729Sjoerg
580*e038c9c4Sjoerg StringRef Message = LState->isLocked()
581*e038c9c4Sjoerg ? "This lock is still locked"
582*e038c9c4Sjoerg : "This lock has already been destroyed";
583*e038c9c4Sjoerg
584*e038c9c4Sjoerg reportBug(C, BT_destroylock, MtxExpr, CheckKind, Message);
5857330f729Sjoerg }
5867330f729Sjoerg
InitAnyLock(const CallEvent & Call,CheckerContext & C,CheckerKind CheckKind) const587*e038c9c4Sjoerg void PthreadLockChecker::InitAnyLock(const CallEvent &Call, CheckerContext &C,
588*e038c9c4Sjoerg CheckerKind CheckKind) const {
589*e038c9c4Sjoerg InitLockAux(Call, C, Call.getArgExpr(0), Call.getArgSVal(0), CheckKind);
590*e038c9c4Sjoerg }
591*e038c9c4Sjoerg
InitLockAux(const CallEvent & Call,CheckerContext & C,const Expr * MtxExpr,SVal MtxVal,CheckerKind CheckKind) const592*e038c9c4Sjoerg void PthreadLockChecker::InitLockAux(const CallEvent &Call, CheckerContext &C,
593*e038c9c4Sjoerg const Expr *MtxExpr, SVal MtxVal,
594*e038c9c4Sjoerg CheckerKind CheckKind) const {
595*e038c9c4Sjoerg if (!ChecksEnabled[CheckKind])
5967330f729Sjoerg return;
5977330f729Sjoerg
598*e038c9c4Sjoerg const MemRegion *LockR = MtxVal.getAsRegion();
5997330f729Sjoerg if (!LockR)
6007330f729Sjoerg return;
6017330f729Sjoerg
6027330f729Sjoerg ProgramStateRef State = C.getState();
6037330f729Sjoerg
6047330f729Sjoerg const SymbolRef *sym = State->get<DestroyRetVal>(LockR);
6057330f729Sjoerg if (sym)
6067330f729Sjoerg State = resolvePossiblyDestroyedMutex(State, LockR, sym);
6077330f729Sjoerg
6087330f729Sjoerg const struct LockState *LState = State->get<LockMap>(LockR);
6097330f729Sjoerg if (!LState || LState->isDestroyed()) {
6107330f729Sjoerg State = State->set<LockMap>(LockR, LockState::getUnlocked());
6117330f729Sjoerg C.addTransition(State);
6127330f729Sjoerg return;
6137330f729Sjoerg }
6147330f729Sjoerg
615*e038c9c4Sjoerg StringRef Message = LState->isLocked()
616*e038c9c4Sjoerg ? "This lock is still being held"
617*e038c9c4Sjoerg : "This lock has already been initialized";
6187330f729Sjoerg
619*e038c9c4Sjoerg reportBug(C, BT_initlock, MtxExpr, CheckKind, Message);
6207330f729Sjoerg }
6217330f729Sjoerg
reportBug(CheckerContext & C,std::unique_ptr<BugType> BT[],const Expr * MtxExpr,CheckerKind CheckKind,StringRef Desc) const622*e038c9c4Sjoerg void PthreadLockChecker::reportBug(CheckerContext &C,
623*e038c9c4Sjoerg std::unique_ptr<BugType> BT[],
624*e038c9c4Sjoerg const Expr *MtxExpr, CheckerKind CheckKind,
625*e038c9c4Sjoerg StringRef Desc) const {
6267330f729Sjoerg ExplodedNode *N = C.generateErrorNode();
6277330f729Sjoerg if (!N)
6287330f729Sjoerg return;
629*e038c9c4Sjoerg initBugType(CheckKind);
6307330f729Sjoerg auto Report =
631*e038c9c4Sjoerg std::make_unique<PathSensitiveBugReport>(*BT[CheckKind], Desc, N);
632*e038c9c4Sjoerg Report->addRange(MtxExpr->getSourceRange());
6337330f729Sjoerg C.emitReport(std::move(Report));
6347330f729Sjoerg }
6357330f729Sjoerg
checkDeadSymbols(SymbolReaper & SymReaper,CheckerContext & C) const6367330f729Sjoerg void PthreadLockChecker::checkDeadSymbols(SymbolReaper &SymReaper,
6377330f729Sjoerg CheckerContext &C) const {
6387330f729Sjoerg ProgramStateRef State = C.getState();
6397330f729Sjoerg
640*e038c9c4Sjoerg for (auto I : State->get<DestroyRetVal>()) {
641*e038c9c4Sjoerg // Once the return value symbol dies, no more checks can be performed
642*e038c9c4Sjoerg // against it. See if the return value was checked before this point.
643*e038c9c4Sjoerg // This would remove the symbol from the map as well.
644*e038c9c4Sjoerg if (SymReaper.isDead(I.second))
645*e038c9c4Sjoerg State = resolvePossiblyDestroyedMutex(State, I.first, &I.second);
6467330f729Sjoerg }
647*e038c9c4Sjoerg
648*e038c9c4Sjoerg for (auto I : State->get<LockMap>()) {
649*e038c9c4Sjoerg // Stop tracking dead mutex regions as well.
650*e038c9c4Sjoerg if (!SymReaper.isLiveRegion(I.first)) {
651*e038c9c4Sjoerg State = State->remove<LockMap>(I.first);
652*e038c9c4Sjoerg State = State->remove<DestroyRetVal>(I.first);
653*e038c9c4Sjoerg }
654*e038c9c4Sjoerg }
655*e038c9c4Sjoerg
656*e038c9c4Sjoerg // TODO: We probably need to clean up the lock stack as well.
657*e038c9c4Sjoerg // It is tricky though: even if the mutex cannot be unlocked anymore,
658*e038c9c4Sjoerg // it can still participate in lock order reversal resolution.
659*e038c9c4Sjoerg
6607330f729Sjoerg C.addTransition(State);
6617330f729Sjoerg }
6627330f729Sjoerg
checkRegionChanges(ProgramStateRef State,const InvalidatedSymbols * Symbols,ArrayRef<const MemRegion * > ExplicitRegions,ArrayRef<const MemRegion * > Regions,const LocationContext * LCtx,const CallEvent * Call) const663*e038c9c4Sjoerg ProgramStateRef PthreadLockChecker::checkRegionChanges(
664*e038c9c4Sjoerg ProgramStateRef State, const InvalidatedSymbols *Symbols,
665*e038c9c4Sjoerg ArrayRef<const MemRegion *> ExplicitRegions,
666*e038c9c4Sjoerg ArrayRef<const MemRegion *> Regions, const LocationContext *LCtx,
667*e038c9c4Sjoerg const CallEvent *Call) const {
668*e038c9c4Sjoerg
669*e038c9c4Sjoerg bool IsLibraryFunction = false;
670*e038c9c4Sjoerg if (Call && Call->isGlobalCFunction()) {
671*e038c9c4Sjoerg // Avoid invalidating mutex state when a known supported function is called.
672*e038c9c4Sjoerg if (PThreadCallbacks.lookup(*Call) || FuchsiaCallbacks.lookup(*Call) ||
673*e038c9c4Sjoerg C11Callbacks.lookup(*Call))
674*e038c9c4Sjoerg return State;
675*e038c9c4Sjoerg
676*e038c9c4Sjoerg if (Call->isInSystemHeader())
677*e038c9c4Sjoerg IsLibraryFunction = true;
678*e038c9c4Sjoerg }
679*e038c9c4Sjoerg
680*e038c9c4Sjoerg for (auto R : Regions) {
681*e038c9c4Sjoerg // We assume that system library function wouldn't touch the mutex unless
682*e038c9c4Sjoerg // it takes the mutex explicitly as an argument.
683*e038c9c4Sjoerg // FIXME: This is a bit quadratic.
684*e038c9c4Sjoerg if (IsLibraryFunction &&
685*e038c9c4Sjoerg std::find(ExplicitRegions.begin(), ExplicitRegions.end(), R) ==
686*e038c9c4Sjoerg ExplicitRegions.end())
687*e038c9c4Sjoerg continue;
688*e038c9c4Sjoerg
689*e038c9c4Sjoerg State = State->remove<LockMap>(R);
690*e038c9c4Sjoerg State = State->remove<DestroyRetVal>(R);
691*e038c9c4Sjoerg
692*e038c9c4Sjoerg // TODO: We need to invalidate the lock stack as well. This is tricky
693*e038c9c4Sjoerg // to implement correctly and efficiently though, because the effects
694*e038c9c4Sjoerg // of mutex escapes on lock order may be fairly varied.
695*e038c9c4Sjoerg }
696*e038c9c4Sjoerg
697*e038c9c4Sjoerg return State;
698*e038c9c4Sjoerg }
699*e038c9c4Sjoerg
registerPthreadLockBase(CheckerManager & mgr)700*e038c9c4Sjoerg void ento::registerPthreadLockBase(CheckerManager &mgr) {
7017330f729Sjoerg mgr.registerChecker<PthreadLockChecker>();
7027330f729Sjoerg }
7037330f729Sjoerg
shouldRegisterPthreadLockBase(const CheckerManager & mgr)704*e038c9c4Sjoerg bool ento::shouldRegisterPthreadLockBase(const CheckerManager &mgr) { return true; }
705*e038c9c4Sjoerg
706*e038c9c4Sjoerg #define REGISTER_CHECKER(name) \
707*e038c9c4Sjoerg void ento::register##name(CheckerManager &mgr) { \
708*e038c9c4Sjoerg PthreadLockChecker *checker = mgr.getChecker<PthreadLockChecker>(); \
709*e038c9c4Sjoerg checker->ChecksEnabled[PthreadLockChecker::CK_##name] = true; \
710*e038c9c4Sjoerg checker->CheckNames[PthreadLockChecker::CK_##name] = \
711*e038c9c4Sjoerg mgr.getCurrentCheckerName(); \
712*e038c9c4Sjoerg } \
713*e038c9c4Sjoerg \
714*e038c9c4Sjoerg bool ento::shouldRegister##name(const CheckerManager &mgr) { return true; }
715*e038c9c4Sjoerg
716*e038c9c4Sjoerg REGISTER_CHECKER(PthreadLockChecker)
717*e038c9c4Sjoerg REGISTER_CHECKER(FuchsiaLockChecker)
718*e038c9c4Sjoerg REGISTER_CHECKER(C11LockChecker)
719