1 //===- VforkChecker.cpp -------- Vfork usage checks --------------*- C++ -*-==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines vfork checker which checks for dangerous uses of vfork.
10 // Vforked process shares memory (including stack) with parent so it's
11 // range of actions is significantly limited: can't write variables,
12 // can't call functions not in the allowed list, etc. For more details, see
13 // http://man7.org/linux/man-pages/man2/vfork.2.html
14 //
15 // This checker checks for prohibited constructs in vforked process.
16 // The state transition diagram:
17 // PARENT ---(vfork() == 0)--> CHILD
18 // |
19 // --(*p = ...)--> bug
20 // |
21 // --foo()--> bug
22 // |
23 // --return--> bug
24 //
25 //===----------------------------------------------------------------------===//
26
27 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
28 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
29 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
30 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
31 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
32 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
33 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
34 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
35 #include "clang/StaticAnalyzer/Core/Checker.h"
36 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
37 #include "clang/AST/ParentMap.h"
38 #include <optional>
39
40 using namespace clang;
41 using namespace ento;
42
43 namespace {
44
45 class VforkChecker : public Checker<check::PreCall, check::PostCall,
46 check::Bind, check::PreStmt<ReturnStmt>> {
47 mutable std::unique_ptr<BuiltinBug> BT;
48 mutable llvm::SmallSet<const IdentifierInfo *, 10> VforkAllowlist;
49 mutable const IdentifierInfo *II_vfork;
50
51 static bool isChildProcess(const ProgramStateRef State);
52
53 bool isVforkCall(const Decl *D, CheckerContext &C) const;
54 bool isCallExplicitelyAllowed(const IdentifierInfo *II,
55 CheckerContext &C) const;
56
57 void reportBug(const char *What, CheckerContext &C,
58 const char *Details = nullptr) const;
59
60 public:
VforkChecker()61 VforkChecker() : II_vfork(nullptr) {}
62
63 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
64 void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
65 void checkBind(SVal L, SVal V, const Stmt *S, CheckerContext &C) const;
66 void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
67 };
68
69 } // end anonymous namespace
70
71 // This trait holds region of variable that is assigned with vfork's
72 // return value (this is the only region child is allowed to write).
73 // VFORK_RESULT_INVALID means that we are in parent process.
74 // VFORK_RESULT_NONE means that vfork's return value hasn't been assigned.
75 // Other values point to valid regions.
REGISTER_TRAIT_WITH_PROGRAMSTATE(VforkResultRegion,const void *)76 REGISTER_TRAIT_WITH_PROGRAMSTATE(VforkResultRegion, const void *)
77 #define VFORK_RESULT_INVALID 0
78 #define VFORK_RESULT_NONE ((void *)(uintptr_t)1)
79
80 bool VforkChecker::isChildProcess(const ProgramStateRef State) {
81 return State->get<VforkResultRegion>() != VFORK_RESULT_INVALID;
82 }
83
isVforkCall(const Decl * D,CheckerContext & C) const84 bool VforkChecker::isVforkCall(const Decl *D, CheckerContext &C) const {
85 auto FD = dyn_cast_or_null<FunctionDecl>(D);
86 if (!FD || !C.isCLibraryFunction(FD))
87 return false;
88
89 if (!II_vfork) {
90 ASTContext &AC = C.getASTContext();
91 II_vfork = &AC.Idents.get("vfork");
92 }
93
94 return FD->getIdentifier() == II_vfork;
95 }
96
97 // Returns true iff ok to call function after successful vfork.
isCallExplicitelyAllowed(const IdentifierInfo * II,CheckerContext & C) const98 bool VforkChecker::isCallExplicitelyAllowed(const IdentifierInfo *II,
99 CheckerContext &C) const {
100 if (VforkAllowlist.empty()) {
101 // According to manpage.
102 const char *ids[] = {
103 "_Exit",
104 "_exit",
105 "execl",
106 "execle",
107 "execlp",
108 "execv",
109 "execve",
110 "execvp",
111 "execvpe",
112 nullptr
113 };
114
115 ASTContext &AC = C.getASTContext();
116 for (const char **id = ids; *id; ++id)
117 VforkAllowlist.insert(&AC.Idents.get(*id));
118 }
119
120 return VforkAllowlist.count(II);
121 }
122
reportBug(const char * What,CheckerContext & C,const char * Details) const123 void VforkChecker::reportBug(const char *What, CheckerContext &C,
124 const char *Details) const {
125 if (ExplodedNode *N = C.generateErrorNode(C.getState())) {
126 if (!BT)
127 BT.reset(new BuiltinBug(this,
128 "Dangerous construct in a vforked process"));
129
130 SmallString<256> buf;
131 llvm::raw_svector_ostream os(buf);
132
133 os << What << " is prohibited after a successful vfork";
134
135 if (Details)
136 os << "; " << Details;
137
138 auto Report = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
139 // TODO: mark vfork call in BugReportVisitor
140 C.emitReport(std::move(Report));
141 }
142 }
143
144 // Detect calls to vfork and split execution appropriately.
checkPostCall(const CallEvent & Call,CheckerContext & C) const145 void VforkChecker::checkPostCall(const CallEvent &Call,
146 CheckerContext &C) const {
147 // We can't call vfork in child so don't bother
148 // (corresponding warning has already been emitted in checkPreCall).
149 ProgramStateRef State = C.getState();
150 if (isChildProcess(State))
151 return;
152
153 if (!isVforkCall(Call.getDecl(), C))
154 return;
155
156 // Get return value of vfork.
157 SVal VforkRetVal = Call.getReturnValue();
158 std::optional<DefinedOrUnknownSVal> DVal =
159 VforkRetVal.getAs<DefinedOrUnknownSVal>();
160 if (!DVal)
161 return;
162
163 // Get assigned variable.
164 const ParentMap &PM = C.getLocationContext()->getParentMap();
165 const Stmt *P = PM.getParentIgnoreParenCasts(Call.getOriginExpr());
166 const VarDecl *LhsDecl;
167 std::tie(LhsDecl, std::ignore) = parseAssignment(P);
168
169 // Get assigned memory region.
170 MemRegionManager &M = C.getStoreManager().getRegionManager();
171 const MemRegion *LhsDeclReg =
172 LhsDecl
173 ? M.getVarRegion(LhsDecl, C.getLocationContext())
174 : (const MemRegion *)VFORK_RESULT_NONE;
175
176 // Parent branch gets nonzero return value (according to manpage).
177 ProgramStateRef ParentState, ChildState;
178 std::tie(ParentState, ChildState) = C.getState()->assume(*DVal);
179 C.addTransition(ParentState);
180 ChildState = ChildState->set<VforkResultRegion>(LhsDeclReg);
181 C.addTransition(ChildState);
182 }
183
184 // Prohibit calls to functions in child process which are not explicitly
185 // allowed.
checkPreCall(const CallEvent & Call,CheckerContext & C) const186 void VforkChecker::checkPreCall(const CallEvent &Call,
187 CheckerContext &C) const {
188 ProgramStateRef State = C.getState();
189 if (isChildProcess(State) &&
190 !isCallExplicitelyAllowed(Call.getCalleeIdentifier(), C))
191 reportBug("This function call", C);
192 }
193
194 // Prohibit writes in child process (except for vfork's lhs).
checkBind(SVal L,SVal V,const Stmt * S,CheckerContext & C) const195 void VforkChecker::checkBind(SVal L, SVal V, const Stmt *S,
196 CheckerContext &C) const {
197 ProgramStateRef State = C.getState();
198 if (!isChildProcess(State))
199 return;
200
201 const MemRegion *VforkLhs =
202 static_cast<const MemRegion *>(State->get<VforkResultRegion>());
203 const MemRegion *MR = L.getAsRegion();
204
205 // Child is allowed to modify only vfork's lhs.
206 if (!MR || MR == VforkLhs)
207 return;
208
209 reportBug("This assignment", C);
210 }
211
212 // Prohibit return from function in child process.
checkPreStmt(const ReturnStmt * RS,CheckerContext & C) const213 void VforkChecker::checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const {
214 ProgramStateRef State = C.getState();
215 if (isChildProcess(State))
216 reportBug("Return", C, "call _exit() instead");
217 }
218
registerVforkChecker(CheckerManager & mgr)219 void ento::registerVforkChecker(CheckerManager &mgr) {
220 mgr.registerChecker<VforkChecker>();
221 }
222
shouldRegisterVforkChecker(const CheckerManager & mgr)223 bool ento::shouldRegisterVforkChecker(const CheckerManager &mgr) {
224 return true;
225 }
226