1 //===- VforkChecker.cpp -------- Vfork usage checks --------------*- C++ -*-==// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file defines vfork checker which checks for dangerous uses of vfork. 10 // Vforked process shares memory (including stack) with parent so it's 11 // range of actions is significantly limited: can't write variables, 12 // can't call functions not in the allowed list, etc. For more details, see 13 // http://man7.org/linux/man-pages/man2/vfork.2.html 14 // 15 // This checker checks for prohibited constructs in vforked process. 16 // The state transition diagram: 17 // PARENT ---(vfork() == 0)--> CHILD 18 // | 19 // --(*p = ...)--> bug 20 // | 21 // --foo()--> bug 22 // | 23 // --return--> bug 24 // 25 //===----------------------------------------------------------------------===// 26 27 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 28 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 29 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 30 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h" 31 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 32 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 33 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" 34 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 35 #include "clang/StaticAnalyzer/Core/Checker.h" 36 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 37 #include "clang/AST/ParentMap.h" 38 #include <optional> 39 40 using namespace clang; 41 using namespace ento; 42 43 namespace { 44 45 class VforkChecker : public Checker<check::PreCall, check::PostCall, 46 check::Bind, check::PreStmt<ReturnStmt>> { 47 mutable std::unique_ptr<BugType> BT; 48 mutable llvm::SmallSet<const IdentifierInfo *, 10> VforkAllowlist; 49 mutable const IdentifierInfo *II_vfork = nullptr; 50 51 static bool isChildProcess(const ProgramStateRef State); 52 53 bool isVforkCall(const Decl *D, CheckerContext &C) const; 54 bool isCallExplicitelyAllowed(const IdentifierInfo *II, 55 CheckerContext &C) const; 56 57 void reportBug(const char *What, CheckerContext &C, 58 const char *Details = nullptr) const; 59 60 public: 61 VforkChecker() = default; 62 63 void checkPreCall(const CallEvent &Call, CheckerContext &C) const; 64 void checkPostCall(const CallEvent &Call, CheckerContext &C) const; 65 void checkBind(SVal L, SVal V, const Stmt *S, CheckerContext &C) const; 66 void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const; 67 }; 68 69 } // end anonymous namespace 70 71 // This trait holds region of variable that is assigned with vfork's 72 // return value (this is the only region child is allowed to write). 73 // VFORK_RESULT_INVALID means that we are in parent process. 74 // VFORK_RESULT_NONE means that vfork's return value hasn't been assigned. 75 // Other values point to valid regions. 76 REGISTER_TRAIT_WITH_PROGRAMSTATE(VforkResultRegion, const void *) 77 #define VFORK_RESULT_INVALID 0 78 #define VFORK_RESULT_NONE ((void *)(uintptr_t)1) 79 80 bool VforkChecker::isChildProcess(const ProgramStateRef State) { 81 return State->get<VforkResultRegion>() != VFORK_RESULT_INVALID; 82 } 83 84 bool VforkChecker::isVforkCall(const Decl *D, CheckerContext &C) const { 85 auto FD = dyn_cast_or_null<FunctionDecl>(D); 86 if (!FD || !C.isCLibraryFunction(FD)) 87 return false; 88 89 if (!II_vfork) { 90 ASTContext &AC = C.getASTContext(); 91 II_vfork = &AC.Idents.get("vfork"); 92 } 93 94 return FD->getIdentifier() == II_vfork; 95 } 96 97 // Returns true iff ok to call function after successful vfork. 98 bool VforkChecker::isCallExplicitelyAllowed(const IdentifierInfo *II, 99 CheckerContext &C) const { 100 if (VforkAllowlist.empty()) { 101 // According to manpage. 102 const char *ids[] = { 103 "_Exit", 104 "_exit", 105 "execl", 106 "execle", 107 "execlp", 108 "execv", 109 "execve", 110 "execvp", 111 "execvpe", 112 nullptr 113 }; 114 115 ASTContext &AC = C.getASTContext(); 116 for (const char **id = ids; *id; ++id) 117 VforkAllowlist.insert(&AC.Idents.get(*id)); 118 } 119 120 return VforkAllowlist.count(II); 121 } 122 123 void VforkChecker::reportBug(const char *What, CheckerContext &C, 124 const char *Details) const { 125 if (ExplodedNode *N = C.generateErrorNode(C.getState())) { 126 if (!BT) 127 BT.reset(new BugType(this, "Dangerous construct in a vforked process")); 128 129 SmallString<256> buf; 130 llvm::raw_svector_ostream os(buf); 131 132 os << What << " is prohibited after a successful vfork"; 133 134 if (Details) 135 os << "; " << Details; 136 137 auto Report = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N); 138 // TODO: mark vfork call in BugReportVisitor 139 C.emitReport(std::move(Report)); 140 } 141 } 142 143 // Detect calls to vfork and split execution appropriately. 144 void VforkChecker::checkPostCall(const CallEvent &Call, 145 CheckerContext &C) const { 146 // We can't call vfork in child so don't bother 147 // (corresponding warning has already been emitted in checkPreCall). 148 ProgramStateRef State = C.getState(); 149 if (isChildProcess(State)) 150 return; 151 152 if (!isVforkCall(Call.getDecl(), C)) 153 return; 154 155 // Get return value of vfork. 156 SVal VforkRetVal = Call.getReturnValue(); 157 std::optional<DefinedOrUnknownSVal> DVal = 158 VforkRetVal.getAs<DefinedOrUnknownSVal>(); 159 if (!DVal) 160 return; 161 162 // Get assigned variable. 163 const ParentMap &PM = C.getLocationContext()->getParentMap(); 164 const Stmt *P = PM.getParentIgnoreParenCasts(Call.getOriginExpr()); 165 const VarDecl *LhsDecl; 166 std::tie(LhsDecl, std::ignore) = parseAssignment(P); 167 168 // Get assigned memory region. 169 MemRegionManager &M = C.getStoreManager().getRegionManager(); 170 const MemRegion *LhsDeclReg = 171 LhsDecl 172 ? M.getVarRegion(LhsDecl, C.getLocationContext()) 173 : (const MemRegion *)VFORK_RESULT_NONE; 174 175 // Parent branch gets nonzero return value (according to manpage). 176 ProgramStateRef ParentState, ChildState; 177 std::tie(ParentState, ChildState) = C.getState()->assume(*DVal); 178 C.addTransition(ParentState); 179 ChildState = ChildState->set<VforkResultRegion>(LhsDeclReg); 180 C.addTransition(ChildState); 181 } 182 183 // Prohibit calls to functions in child process which are not explicitly 184 // allowed. 185 void VforkChecker::checkPreCall(const CallEvent &Call, 186 CheckerContext &C) const { 187 ProgramStateRef State = C.getState(); 188 if (isChildProcess(State) && 189 !isCallExplicitelyAllowed(Call.getCalleeIdentifier(), C)) 190 reportBug("This function call", C); 191 } 192 193 // Prohibit writes in child process (except for vfork's lhs). 194 void VforkChecker::checkBind(SVal L, SVal V, const Stmt *S, 195 CheckerContext &C) const { 196 ProgramStateRef State = C.getState(); 197 if (!isChildProcess(State)) 198 return; 199 200 const MemRegion *VforkLhs = 201 static_cast<const MemRegion *>(State->get<VforkResultRegion>()); 202 const MemRegion *MR = L.getAsRegion(); 203 204 // Child is allowed to modify only vfork's lhs. 205 if (!MR || MR == VforkLhs) 206 return; 207 208 reportBug("This assignment", C); 209 } 210 211 // Prohibit return from function in child process. 212 void VforkChecker::checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const { 213 ProgramStateRef State = C.getState(); 214 if (isChildProcess(State)) 215 reportBug("Return", C, "call _exit() instead"); 216 } 217 218 void ento::registerVforkChecker(CheckerManager &mgr) { 219 mgr.registerChecker<VforkChecker>(); 220 } 221 222 bool ento::shouldRegisterVforkChecker(const CheckerManager &mgr) { 223 return true; 224 } 225