[analyzer] MIGChecker: A checker for Mach Interface Generator calling convention.

[NoQ]

Summary

This is a fairly common source of use-after-free exploits in the XNU kernel, so it kinda makes sense to attempt to catch these statically. It makes even more sense because these errors occur on error paths that are hard to test dynamically.

MIG is an autogenerator for C headers (and, partially, implementations) of processes that want to communicate via the Mach IPC. It allows processes to pass relatively arbitrary C structures to each other in a relatively transparent manner. These headers are generated for both the IPC client to include in order to be able to call MIG routines and for the IPC server to implement MIG routines it provides as callback functions written in C. Sometimes resources passed through MIG need to be "deallocated" on the other side within the actual body of the routine. Such resources include virtual memory page addresses and Mach ports. These resources are called "out-of-line" ("OOL") resources and they can be thought of as pointers that make sense in kernel address space. When an OOL resource is passed from a client to the server, the following calling convention applies:

• If a server routine returns error code KERNEL_SUCCESS or MIG_NO_REPLY as its return value, it shall deallocate all OOL data manually.
• If a server routine returns any other error code (i.e., fails with an error), OOL arguments shall be deallocated by the client.

In particular, if a server routine deallocates an OOL object and then returns an error, this is always a use-after-free. This is exactly what the checker is supposed to warn about.

---

It's a trivial initial commit for now - the checker in this shape passes just one test and it's not listing any APIs apart from vm_deallocate() and detects MIG routine code heuristically rather than relying on a better source information such as source-level annotations.

The checker is path-sensitive and it detects the following sequence of events on the execution paths Static Analyzer explores: first an OOL argument is deallocated, then an error is returned to the caller. It is sufficient to track a single bit in the program state in order to issue the warning: "was at least one OOL argument deallocated?".

The checker believes that all MIG routines are analyzed as top-level functions rather than inlined from other functions. This is the right thing to do for now, but if we introduce annotations, we might as well allow them on arbitrary functions that suddenly want to follow the same calling convention (which is usually a bad idea because this calling convention is fairly hard to follow, which is exactly why we ended up in this situation, but if it's about documenting an existing behavior, than it kinda makes sense), and then we'll have to drop the "inTopFrame" check and probably introduce more complexity.

The checker lacks a bug visitor for now, hence alpha.

[NoQ]

Clean up a bit. Fix kern_return_t accidentally defined as unsigned. Expand one comment.

[NoQ]

Add a test that demonstrates that we correctly handle unknown or under-constrained return values. I.e., it would fail if we replace

!State->isNonNull(V).isConstrainedTrue()

with

!State->isNonNull(V).isConstrainedTrue()

Rename the test file to *.mm because Objective-C tests are going to be added eventually.

[dcoughlin]

LGTM with a minor grammatical nits inline. It is great to see a checker for this!

clang/include/clang/StaticAnalyzer/Checkers/Checkers.td

817

Minor grammar nit: "Find violations of *the* Mach Interface Generator calling convention"

clang/lib/StaticAnalyzer/Checkers/MIGChecker.cpp

131

Minor wording nit: "This is *a* use-after-free vulnerability because *the* caller will try to deallocate it again"

[NoQ]

Fxd! Also addressed D58368#1404768.

clang/include/clang/StaticAnalyzer/Checkers/Checkers.td

 let ParentPackage = Performance in {
 
 def GCDAntipattern : Checker<"GCDAntipattern">,
   HelpText<"Check for performance anti-patterns when using Grand Central "
            "Dispatch">,
   Documentation<NotDocumented>;
 } // end "optin.performance"
 
+let ParentPackage = OSXAlpha in {
+
+def MIGChecker : Checker<"MIG">,
+  HelpText<"Find violations of Mach Interface Generator calling convention">,
+  Documentation<NotDocumented>;
+
+} // end "alpha.osx"
+
 let ParentPackage = CocoaAlpha in {
 
 def IvarInvalidationModeling : Checker<"IvarInvalidationModeling">,
   HelpText<"Gathers information for annotation driven invalidation checking "
            "for classes that contains a method annotated with "
            "'objc_instance_variable_invalidator'">,
   Documentation<NotDocumented>;
 

clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt

add_clang_library(clangStaticAnalyzerCheckers
   LLVMConventionsChecker.cpp
   LocalizationChecker.cpp
   MacOSKeychainAPIChecker.cpp
   MacOSXAPIChecker.cpp
   MallocChecker.cpp
   MallocOverflowSecurityChecker.cpp
   MallocSizeofChecker.cpp
   MmapWriteExecChecker.cpp
+  MIGChecker.cpp
   MoveChecker.cpp
   MPI-Checker/MPIBugReporter.cpp
   MPI-Checker/MPIChecker.cpp
   MPI-Checker/MPIFunctionClassifier.cpp
   NSAutoreleasePoolChecker.cpp
   NSErrorChecker.cpp
   NoReturnFunctionChecker.cpp
   NonNullParamChecker.cpp

clang/lib/StaticAnalyzer/Checkers/MIGChecker.cpp

+//== MIGChecker.cpp - MIG calling convention checker ------------*- C++ -*--==//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines MIGChecker, a Mach Interface Generator calling convention
+// checker. Namely, in MIG callback implementation the following rules apply:
+// - When a server routine returns KERN_SUCCESS, it must take ownership of
+//   resources (and eventually release them).
+// - Additionally, when returning KERN_SUCCESS, all out-parameters must be
+//   initialized.
+// - When it returns anything except KERN_SUCCESS it must not take ownership,
+//   because the message and its descriptors will be destroyed by the server
+//   function.
+// For now we only check the last rule, as its violations lead to dangerous
+// use-after-free exploits.
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+
+using namespace clang;
+using namespace ento;
+
+namespace {
+class MIGChecker : public Checker<check::PostCall, check::PreStmt<ReturnStmt>> {
+  BugType BT{this, "Use-after-free (MIG calling convention violation)",
+             categories::MemoryError};
+
+  CallDescription vm_deallocate { "vm_deallocate", 3 };
+
+public:
+  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
+  void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
+};
+} // end anonymous namespace
+
+REGISTER_TRAIT_WITH_PROGRAMSTATE(ReleasedParameter, bool);
+
+static bool isCurrentArgSVal(SVal V, CheckerContext &C) {
+  SymbolRef Sym = V.getAsSymbol();
+  if (!Sym)
+    return false;
+
+  const auto *VR = dyn_cast_or_null<VarRegion>(Sym->getOriginRegion());
+  return VR && VR->hasStackParametersStorage() &&
+         VR->getStackFrame()->inTopFrame();
+}
+
+// This function will probably be replaced with looking up annotations.
+static bool isInMIGCall(const LocationContext *LC) {
+  const StackFrameContext *SFC;
+  // Find the top frame.
+  while (LC) {
+    SFC = LC->getStackFrame();
+    LC = SFC->getParent();
+  }
+
+  const auto *FD = dyn_cast<FunctionDecl>(SFC->getDecl());
+  if (!FD)
+    return false;
+
+  // FIXME: This is an unreliable (even if surprisingly reliable) heuristic.
+  // The real solution here is to make MIG annotate its callbacks in
+  // autogenerated headers so that we didn't need to think hard if it's
+  // actually a MIG callback.
+  QualType T = FD->getReturnType();
+  return T.getCanonicalType()->isIntegerType() &&
+         T.getAsString() == "kern_return_t";
+}
+
+void MIGChecker::checkPostCall(const CallEvent &Call, CheckerContext &C) const {
+  if (!isInMIGCall(C.getStackFrame()))
+    return;
+
+  if (!Call.isGlobalCFunction())
+    return;
+
+  if (!Call.isCalled(vm_deallocate))
+    return;
+
+  // TODO: Unhardcode "1".
+  SVal Arg = Call.getArgSVal(1);
+  if (isCurrentArgSVal(Arg, C))
+    C.addTransition(C.getState()->set<ReleasedParameter>(true));
+}
+
+void MIGChecker::checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const {
+  // It is very unlikely that a MIG callback will be called from anywhere
+  // within the project under analysis and the caller isn't itself a routine
+  // that follows the MIG calling convention. Therefore we're safe to believe
+  // that it's always the top frame that is of interest. There's a slight chance
+  // that the user would want to enforce the MIG calling convention upon
+  // a random routine in the middle of nowhere, but given that the convention is
+  // fairly weird and hard to follow in the first place, there's relatively
+  // little motivation to spread it this way.
+  if (!C.inTopFrame())
+    return;
+
+  if (!isInMIGCall(C.getStackFrame()))
+    return;
+
+  // We know that the function is non-void, but what if the return statement
+  // is not there in the code? It's not a compile error, we should not crash.
+  if (!RS)
+    return;
+
+  ProgramStateRef State = C.getState();
+  if (!State->get<ReleasedParameter>())
+    return;
+
+  SVal V = C.getSVal(RS);
+  if (!State->isNonNull(V).isConstrainedTrue())
+    return;
+
+  ExplodedNode *N = C.generateErrorNode();
+  if (!N)
+    return;
+
+  auto R = llvm::make_unique<BugReport>(
+      BT,
+      "MIG callback fails with error after deallocating argument value. "
+      "This is use-after-free vulnerability because caller will try to "
+      "deallocate it again",
+      N);
+
+  C.emitReport(std::move(R));
+}
+
+void ento::registerMIGChecker(CheckerManager &Mgr) {
+  Mgr.registerChecker<MIGChecker>();
+}
+
+bool ento::shouldRegisterMIGChecker(const LangOptions &LO) {
+  return true;
+}

clang/test/Analysis/mig.mm

+// RUN: %clang_analyze_cc1 -w -analyzer-checker=core,alpha.osx.MIG -verify %s
+
+// XNU APIs.
+
+typedef int kern_return_t;
+#define KERN_SUCCESS 0
+#define KERN_ERROR 1
+
+typedef unsigned mach_port_name_t;
+typedef unsigned vm_address_t;
+typedef unsigned vm_size_t;
+
+kern_return_t vm_deallocate(mach_port_name_t, vm_address_t, vm_size_t);
+
+// Tests.
+
+kern_return_t basic_test(mach_port_name_t port, vm_address_t address, vm_size_t size) {
+  vm_deallocate(port, address, size);
+  if (size > 10) {
+    return KERN_ERROR; // expected-warning{{MIG callback fails with error after deallocating argument value. This is use-after-free vulnerability because caller will try to deallocate it again}}
+  }
+  return KERN_SUCCESS;
+}
+
+kern_return_t test_unknown_return_value(mach_port_name_t port, vm_address_t address, vm_size_t size) {
+  extern kern_return_t foo();
+
+  vm_deallocate(port, address, size);
+  // We don't know if it's a success or a failure.
+  return foo(); // no-warning
+}
+
+// Make sure we don't crash when they forgot to write the return statement.
+kern_return_t no_crash(mach_port_name_t port, vm_address_t address, vm_size_t size) {
+  vm_deallocate(port, address, size);
+}