[analyzer] MIGChecker: Make use of the server routine annotation.

[NoQ]

Summary

The attribute that's added in D58365 allows us to avoid making unreliable guesses on whether the current function is a MIG server routine.

[NoQ]

Rebase due to an update in D58365 - namely, add support for Objective-C messages and blocks that are now allowed to wear the attribute.

[NoQ]

Whoops - make sure that the Objective-C test does actually test something.

[dcoughlin]

LGTM.

clang/test/Analysis/mig.mm

2

Ooh, I didn't know you could split RUN lines like this. That is awesome!

[NoQ]

Rebase.

[NoQ]

Committed as rC354638 but i screwed up the link in the commit message.

clang/lib/StaticAnalyzer/Checkers/MIGChecker.cpp

 // - When it returns anything except KERN_SUCCESS it must not take ownership,
 //   because the message and its descriptors will be destroyed by the server
 //   function.
 // For now we only check the last rule, as its violations lead to dangerous
 // use-after-free exploits.
 //
 //===----------------------------------------------------------------------===//
 
+#include "clang/Analysis/AnyCall.h"
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 
 using namespace clang;
static bool isCurrentArgSVal(SVal V, CheckerContext &C) {
   if (!Sym)
     return false;
 
   const auto *VR = dyn_cast_or_null<VarRegion>(Sym->getOriginRegion());
   return VR && VR->hasStackParametersStorage() &&
          VR->getStackFrame()->inTopFrame();
 }
 
-// This function will probably be replaced with looking up annotations.
-static bool isInMIGCall(const LocationContext *LC) {
+static bool isInMIGCall(CheckerContext &C) {
+  const LocationContext *LC = C.getLocationContext();
   const StackFrameContext *SFC;
   // Find the top frame.
   while (LC) {
     SFC = LC->getStackFrame();
     LC = SFC->getParent();
   }
 
-  const auto *FD = dyn_cast<FunctionDecl>(SFC->getDecl());
-  if (!FD)
+  const Decl *D = SFC->getDecl();
+
+  if (Optional<AnyCall> AC = AnyCall::forDecl(D)) {
+    // Even though there's a Sema warning when the return type of an annotated
+    // function is not a kern_return_t, this warning isn't an error, so we need
+    // an extra sanity check here.
+    // FIXME: AnyCall doesn't support blocks yet, so they remain unchecked
+    // for now.
+    if (!AC->getReturnType(C.getASTContext())
+             .getCanonicalType()->isSignedIntegerType())
       return false;
+  }
 
-  // FIXME: This is an unreliable (even if surprisingly reliable) heuristic.
-  // The real solution here is to make MIG annotate its callbacks in
-  // autogenerated headers so that we didn't need to think hard if it's
-  // actually a MIG callback.
-  QualType T = FD->getReturnType();
-  return T.getCanonicalType()->isIntegerType() &&
-         T.getAsString() == "kern_return_t";
+  if (D->hasAttr<MIGServerRoutineAttr>())
+    return true;
+
+  return false;
 }
 
 void MIGChecker::checkPostCall(const CallEvent &Call, CheckerContext &C) const {
-  if (!isInMIGCall(C.getStackFrame()))
+  if (!isInMIGCall(C))
     return;
 
   if (!Call.isGlobalCFunction())
     return;
 
   if (!Call.isCalled(vm_deallocate))
     return;
 
void MIGChecker::checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const {
   // that it's always the top frame that is of interest. There's a slight chance
   // that the user would want to enforce the MIG calling convention upon
   // a random routine in the middle of nowhere, but given that the convention is
   // fairly weird and hard to follow in the first place, there's relatively
   // little motivation to spread it this way.
   if (!C.inTopFrame())
     return;
 
-  if (!isInMIGCall(C.getStackFrame()))
+  if (!isInMIGCall(C))
     return;
 
   // We know that the function is non-void, but what if the return statement
   // is not there in the code? It's not a compile error, we should not crash.
   if (!RS)
     return;
 
   ProgramStateRef State = C.getState();

clang/test/Analysis/mig.mm

-// RUN: %clang_analyze_cc1 -w -analyzer-checker=core,alpha.osx.MIG -verify %s
+// RUN: %clang_analyze_cc1 -w -analyzer-checker=core,alpha.osx.MIG\
+// RUN:                    -fblocks -verify %s
 
 // XNU APIs.
 
 typedef int kern_return_t;
 #define KERN_SUCCESS 0
 #define KERN_ERROR 1
 
 typedef unsigned mach_port_name_t;
 typedef unsigned vm_address_t;
 typedef unsigned vm_size_t;
 
 kern_return_t vm_deallocate(mach_port_name_t, vm_address_t, vm_size_t);
 
+#define MIG_SERVER_ROUTINE __attribute__((mig_server_routine))
+
+
 // Tests.
 
+MIG_SERVER_ROUTINE
 kern_return_t basic_test(mach_port_name_t port, vm_address_t address, vm_size_t size) {
   vm_deallocate(port, address, size);
   if (size > 10) {
     return KERN_ERROR; // expected-warning{{MIG callback fails with error after deallocating argument value. This is a use-after-free vulnerability because the caller will try to deallocate it again}}
   }
   return KERN_SUCCESS;
 }
 
+MIG_SERVER_ROUTINE
 kern_return_t test_unknown_return_value(mach_port_name_t port, vm_address_t address, vm_size_t size) {
   extern kern_return_t foo();
 
   vm_deallocate(port, address, size);
   // We don't know if it's a success or a failure.
   return foo(); // no-warning
 }
 
 // Make sure we don't crash when they forgot to write the return statement.
+MIG_SERVER_ROUTINE
 kern_return_t no_crash(mach_port_name_t port, vm_address_t address, vm_size_t size) {
   vm_deallocate(port, address, size);
 }
+
+// Check that we work on Objective-C messages and blocks.
+@interface I
+- (kern_return_t)fooAtPort:(mach_port_name_t)port withAddress:(vm_address_t)address ofSize:(vm_size_t)size;
+@end
+
+@implementation I
+- (kern_return_t)fooAtPort:(mach_port_name_t)port
+               withAddress:(vm_address_t)address
+                    ofSize:(vm_size_t)size MIG_SERVER_ROUTINE {
+  vm_deallocate(port, address, size);
+  return KERN_ERROR; // expected-warning{{MIG callback fails with error after deallocating argument value. This is a use-after-free vulnerability because the caller will try to deallocate it again}}
+}
+@end
+
+void test_block() {
+  kern_return_t (^block)(mach_port_name_t, vm_address_t, vm_size_t) =
+      ^MIG_SERVER_ROUTINE (mach_port_name_t port,
+                           vm_address_t address, vm_size_t size) {
+        vm_deallocate(port, address, size);
+      ! return KERN_ERROR; // expected-warning{{MIG callback fails with error after deallocating argument value. This is a use-after-free vulnerability because the caller will try to deallocate it again}}
+      };
+}
+
+void test_block_with_weird_return_type() {
+  struct Empty {};
+
+  // The block is written within a function so that it was actually analyzed as
+  // a top-level function during analysis. If we were to write it as a global
+  // variable of block type instead, it would not have been analyzed, because
+  // ASTConsumer won't find the block's code body within the VarDecl.
+  // At the same time, we shouldn't call it from the function, because otherwise
+  // it will be analyzed as an inlined function rather than as a top-level
+  // function.
+  Empty (^block)(mach_port_name_t, vm_address_t, vm_size_t) =
+      ^MIG_SERVER_ROUTINE(mach_port_name_t port,
+                          vm_address_t address, vm_size_t size) {
+        vm_deallocate(port, address, size);
+        return Empty{}; // no-crash
+      };
+}