analyzer: add warnings relating to sockets [PR106140]

This patch generalizes the analyzer's file descriptor state machine
so that it tracks the states of sockets.

It adds two new warnings relating to misuses of socket APIs:
* -Wanalyzer-fd-phase-mismatch (e.g. calling 'accept' on a socket
before calling 'listen' on it)
* -Wanalyzer-fd-type-mismatch (e.g. using a stream socket operation
on a datagram socket)

gcc/analyzer/ChangeLog:
	PR analyzer/106140
	* analyzer-language.cc (on_finish_translation_unit): Stash named
	constants "SOCK_STREAM" and "SOCK_DGRAM".
	* analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
	(Wanalyzer-fd-type-mismatch): New.
	* engine.cc (impl_region_model_context::get_state_map_by_name):
	Add "out_sm_context" param.  Allow out_sm_idx to be NULL.
	* exploded-graph.h
	(impl_region_model_context::get_state_map_by_name):
	Add "out_sm_context" param.
	* region-model-impl-calls.cc (region_model::impl_call_accept): New.
	(region_model::impl_call_bind): New.
	(region_model::impl_call_connect): New.
	(region_model::impl_call_listen): New.
	(region_model::impl_call_socket): New.
	* region-model.cc (region_model::on_call_pre): Special-case
	"bind".
	(region_model::on_call_post): Special-case "accept", "bind",
	"connect", "listen", and "socket".
	* region-model.h (region_model::impl_call_accept): New decl.
	(region_model::impl_call_bind): New decl.
	(region_model::impl_call_connect): New decl.
	(region_model::impl_call_listen): New decl.
	(region_model::impl_call_socket): New decl.
	(region_model::on_socket): New decl.
	(region_model::on_bind): New decl.
	(region_model::on_listen): New decl.
	(region_model::on_accept): New decl.
	(region_model::on_connect): New decl.
	(region_model::add_constraint): Make public.
	(region_model::check_for_poison): Make public.
	(region_model_context::get_state_map_by_name): Add out_sm_context param.
	(region_model_context::get_fd_map): Likewise.
	(region_model_context::get_malloc_map): Likewise.
	(region_model_context::get_taint_map): Likewise.
	(noop_region_model_context::get_state_map_by_name): Likewise.
	(region_model_context_decorator::get_state_map_by_name): Likewise.
	* sm-fd.cc: Include "analyzer/supergraph.h" and
	"analyzer/analyzer-language.h".
	(enum expected_phase): New enum.
	(fd_state_machine::m_new_datagram_socket): New.
	(fd_state_machine::m_new_stream_socket): New.
	(fd_state_machine::m_new_unknown_socket): New.
	(fd_state_machine::m_bound_datagram_socket): New.
	(fd_state_machine::m_bound_stream_socket): New.
	(fd_state_machine::m_bound_unknown_socket): New.
	(fd_state_machine::m_listening_stream_socket): New.
	(fd_state_machine::m_m_connected_stream_socket): New.
	(fd_state_machine::m_SOCK_STREAM): New.
	(fd_state_machine::m_SOCK_DGRAM): New.
	(fd_diagnostic::describe_state_change): Handle socket states.
	(fd_diagnostic::get_meaning_for_state_change): Likewise.
	(class fd_phase_mismatch): New.
	(enum expected_type): New enum.
	(class fd_type_mismatch): New.
	(fd_state_machine::fd_state_machine): Initialize new states and
	stashed named constants.
	(fd_state_machine::is_socket_fd_p): New.
	(fd_state_machine::is_datagram_socket_fd_p): New.
	(fd_state_machine::is_stream_socket_fd_p): New.
	(fd_state_machine::on_close): Handle the socket states.
	(fd_state_machine::check_for_open_fd): Complain about fncalls on
	sockets in the wrong phase.  Support socket FDs.
	(add_constraint_ge_zero): New.
	(fd_state_machine::get_state_for_socket_type): New.
	(fd_state_machine::on_socket): New.
	(fd_state_machine::check_for_socket_fd): New.
	(fd_state_machine::check_for_new_socket_fd): New.
	(fd_state_machine::on_bind): New.
	(fd_state_machine::on_listen): New.
	(fd_state_machine::on_accept): New.
	(fd_state_machine::on_connect): New.
	(fd_state_machine::can_purge_p): Don't purge socket values.
	(get_fd_state): New.
	(region_model::mark_as_valid_fd): Use get_fd_state.
	(region_model::on_socket): New.
	(region_model::on_bind): New.
	(region_model::on_listen): New.
	(region_model::on_accept): New.
	(region_model::on_connect): New.
	* sm-fd.dot: Update to reflect sm-fd.cc changes.

gcc/ChangeLog:
	PR analyzer/106140
	* doc/invoke.texi (Static Analyzer Options): Add
	-Wanalyzer-fd-phase-mismatch and -Wanalyzer-fd-type-mismatch.  Add
	"socket", "bind", "listen", "accept", and "connect" to the list of
	functions known to the analyzer.

gcc/testsuite/ChangeLog:
	PR analyzer/106140
	* gcc.dg/analyzer/fd-accept.c: New test.
	* gcc.dg/analyzer/fd-bind.c: New test.
	* gcc.dg/analyzer/fd-connect.c: New test.
	* gcc.dg/analyzer/fd-datagram-socket.c: New test.
	* gcc.dg/analyzer/fd-glibc-byte-stream-connection-server.c: New test.
	* gcc.dg/analyzer/fd-glibc-byte-stream-socket.c: New test.
	* gcc.dg/analyzer/fd-glibc-datagram-client.c: New test.
	* gcc.dg/analyzer/fd-glibc-datagram-socket.c: New test.
	* gcc.dg/analyzer/fd-glibc-make_named_socket.h: New test.
	* gcc.dg/analyzer/fd-listen.c: New test.
	* gcc.dg/analyzer/fd-manpage-getaddrinfo-client.c: New test.
	* gcc.dg/analyzer/fd-mappage-getaddrinfo-server.c: New test.
	* gcc.dg/analyzer/fd-socket-meaning.c: New test.
	* gcc.dg/analyzer/fd-socket-misuse.c: New test.
	* gcc.dg/analyzer/fd-stream-socket-active-open.c: New test.
	* gcc.dg/analyzer/fd-stream-socket-passive-open.c: New test.
	* gcc.dg/analyzer/fd-stream-socket.c: New test.
	* gcc.dg/analyzer/fd-symbolic-socket.c: New test.
	* gcc.dg/analyzer/pr104369-1.c: Add -Wno-analyzer-too-complex and
	-Wno-analyzer-fd-leak to options.
	* gcc.dg/analyzer/pr104369-2.c: Add -Wno-analyzer-fd-leak to
	options.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

1 files changed, 98 insertions, 0 deletions

diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-stream-socket.c b/gcc/testsuite/gcc.dg/analyzer/fd-stream-socket.c
new file mode 100644
index 0000000..3a292d0
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/fd-stream-socket.c
@@ -0,0 +1,98 @@
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <unistd.h>
+#include <errno.h>
+#include "analyzer-decls.h"
+
+void test_leak_socket (void)
+{
+  int fd = socket (AF_UNIX, SOCK_STREAM, 0); /* { dg-message "stream socket created here" } */
+} /* { dg-warning "leak of file descriptor 'fd'" } */
+
+void test_leak_socket_no_lhs (void)
+{
+  socket (AF_UNIX, SOCK_STREAM, 0);  /* { dg-warning "leak of file descriptor" } */
+}
+
+void test_close_unchecked_socket (void)
+{
+  int fd = socket (AF_UNIX, SOCK_STREAM, 0);
+  close (fd);
+}
+
+void test_close_checked_socket (void)
+{
+  int fd = socket (AF_UNIX, SOCK_STREAM, 0);
+  if (fd == -1)
+    return;
+  close (fd);
+}
+
+void test_leak_checked_socket (void)
+{
+  int fd = socket (AF_UNIX, SOCK_STREAM, 0); /* { dg-message "stream socket created here" } */
+  if (fd == -1) /* { dg-warning "leak of file descriptor 'fd'" } */
+    return;
+  // TODO: strange location for leak message
+}
+
+void test_bind_on_checked_socket (const char *sockname)
+{
+  struct sockaddr_un addr;
+  int fd = socket (AF_UNIX, SOCK_STREAM, 0);
+  if (fd == -1)
+    return;
+  memset (&addr, 0, sizeof (addr));
+  addr.sun_family = AF_UNIX;
+  strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1);
+  bind (fd, (struct sockaddr *)&addr, sizeof (addr));
+  close (fd);
+}
+
+void test_bind_on_unchecked_socket (const char *sockname)
+{
+  struct sockaddr_un addr;
+  int fd = socket (AF_UNIX, SOCK_STREAM, 0); /* { dg-message "when 'socket' fails" } */
+  memset (&addr, 0, sizeof (addr));
+  addr.sun_family = AF_UNIX;
+  strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1);
+  bind (fd, (struct sockaddr *)&addr, sizeof (addr)); /* { dg-warning "'bind' on possibly invalid file descriptor 'fd'" } */
+  close (fd);
+}
+
+void test_leak_of_bound_socket (const char *sockname)
+{
+  struct sockaddr_un addr;
+  int fd = socket (AF_UNIX, SOCK_STREAM, 0); /* { dg-message "stream socket created here" } */
+  if (fd == -1)
+    return;
+  memset (&addr, 0, sizeof (addr));
+  addr.sun_family = AF_UNIX;
+  strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1);
+  bind (fd, (struct sockaddr *)&addr, sizeof (addr)); /* { dg-warning "leak of file descriptor 'fd'" } */
+}
+
+void test_listen_without_bind (void)
+{
+  int fd = socket (AF_UNIX, SOCK_STREAM, 0); /* { dg-message "stream socket created here" } */
+  if (fd == -1)
+    return;
+  listen (fd, 5); /* { dg-warning "'listen' on file descriptor 'fd' in wrong phase" "warning" } */
+  /* { dg-message "'listen' expects a bound stream socket file descriptor but 'fd' has not yet been bound" "final event" { target *-*-* } .-1 } */
+  close (fd);
+}
+
+void test_listen_on_unchecked_bind (const char *sockname)
+{
+  struct sockaddr_un addr;
+  int fd = socket (AF_UNIX, SOCK_STREAM, 0); /* { dg-message "stream socket created here" } */
+  if (fd == -1)
+    return;
+  memset (&addr, 0, sizeof (addr));
+  addr.sun_family = AF_UNIX;
+  strncpy (addr.sun_path, sockname, sizeof(addr.sun_path) - 1);
+  bind (fd, (struct sockaddr *)&addr, sizeof (addr)); /* { dg-message "when 'bind' fails" } */
+  listen (fd, 5); /* { dg-warning "'listen' on file descriptor 'fd' in wrong phase" "warning" } */
+  /* { dg-message "'listen' expects a bound stream socket file descriptor but 'fd' has not yet been bound" "final event" { target *-*-* } .-1 } */
+  close (fd);
+}