Skip to content

Commit 1ead46d

Browse files
nicolaswillnicolaswill
authored
Merge pull request #819 from github/michaelrfairhurst/implement-concurrency9-package
Implement Concurrency9 package
2 parents d34b85c + 37caf0e commit 1ead46d

55 files changed

Lines changed: 2875 additions & 1103 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎c/common/src/codingstandards/c/SubObjects.qll‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
/**
2+
* A library that expands upon the `Objects.qll` library, to support nested "Objects" such as
3+
* `x.y.z` or `x[i][j]` within an object `x`.
4+
*
5+
* Objects in C are values in memory, that have a type and a storage duration. In the case of
6+
* array objects and struct objects, the object will contain other objects. The these subobjects
7+
* will share properties of the root object such as storage duration. This library can be used to,
8+
* for instance, find all usages of a struct member to ensure that member is initialized before it
9+
* is used.
10+
*
11+
* To use this library, select `SubObject` and find its usages in the AST via `getAnAccess()` (to
12+
* find usages of the subobject by value) or `getAnAddressOfExpr()` (to find usages of the object
13+
* by address).
14+
*
15+
* Note that a struct or array object may contain a pointer. In this case, the pointer itself is
16+
* a subobject of the struct or array object, but the object that the pointer points to is not.
17+
* This is because the pointed-to object does not necessarily have the same storage duration,
18+
* lifetime, or linkage as the pointer and the object containing the pointer.
19+
*
20+
* Note as well that `getAnAccess()` on an array subobject will return all accesses to the array,
21+
* not just accesses to a particular index. For this reason, `SubObject` exposes the predicate
22+
* `isPrecise()`. If a subobject is precise, that means all results of `getAnAccess()` will
23+
* definitely refer to the same object in memory. If it is not precise, the different accesses
24+
* may refer to the same or different objects in memory. For instance, `x[i].y` and `x[j].y` are
25+
* the same object if `i` and `j` are the same, but they are different objects if `i` and `j` are
26+
* different.
27+
*/
28+
29+
import codingstandards.c.Objects
30+
31+
newtype TSubObject =
32+
TObjectRoot(ObjectIdentity i) or
33+
TObjectMember(SubObject struct, MemberVariable m) {
34+
m = struct.getType().(Struct).getAMemberVariable()
35+
} or
36+
TObjectIndex(SubObject array) { array.getType() instanceof ArrayType }
37+
38+
class SubObject extends TSubObject {
39+
string toString() {
40+
exists(ObjectIdentity i |
41+
this = TObjectRoot(i) and
42+
result = i.toString()
43+
)
44+
or
45+
exists(SubObject struct, Variable m |
46+
this = TObjectMember(struct, m) and
47+
result = struct.toString() + "." + m.getName()
48+
)
49+
or
50+
exists(SubObject array |
51+
this = TObjectIndex(array) and
52+
result = array.toString()
53+
)
54+
}
55+
56+
Type getType() {
57+
exists(ObjectIdentity i |
58+
this = TObjectRoot(i) and
59+
result = i.getType()
60+
)
61+
or
62+
exists(Variable m |
63+
this = TObjectMember(_, m) and
64+
result = m.getType()
65+
)
66+
or
67+
exists(SubObject array |
68+
this = TObjectIndex(array) and
69+
result = array.getType().(ArrayType).getBaseType()
70+
)
71+
}
72+
73+
/**
74+
* Holds for object roots and for member accesses on that root, not for array accesses.
75+
*
76+
* This is useful for cases where we do not wish to treat `x[y]` and `x[z]` as the same object.
77+
*/
78+
predicate isPrecise() { not getParent*() = TObjectIndex(_) }
79+
80+
SubObject getParent() {
81+
exists(SubObject struct, MemberVariable m |
82+
this = TObjectMember(struct, m) and
83+
result = struct
84+
)
85+
or
86+
exists(SubObject array |
87+
this = TObjectIndex(array) and
88+
result = array
89+
)
90+
}
91+
92+
Expr getAnAccess() {
93+
exists(ObjectIdentity i |
94+
this = TObjectRoot(i) and
95+
result = i.getAnAccess()
96+
)
97+
or
98+
exists(MemberVariable m |
99+
this = TObjectMember(_, m) and
100+
result = m.getAnAccess() and
101+
// Only consider `DotFieldAccess`es, not `PointerFieldAccess`es, as the latter
102+
// are not subobjects of the root object:
103+
result.(DotFieldAccess).getQualifier() = getParent().getAnAccess()
104+
)
105+
or
106+
this = TObjectIndex(_) and
107+
result.(ArrayExpr).getArrayBase() = getParent().getAnAccess()
108+
}
109+
110+
AddressOfExpr getAnAddressOfExpr() { result.getOperand() = this.getAnAccess() }
111+
112+
/**
113+
* Get the "root" object identity to which this subobject belongs. For instance, in the
114+
* expression `x.y.z`, the root object is `x`. This subobject will share properties with the root
115+
* object such as storage duration, lifetime, and linkage.
116+
*/
117+
ObjectIdentity getRootIdentity() {
118+
exists(ObjectIdentity i |
119+
this = TObjectRoot(i) and
120+
result = i
121+
)
122+
or
123+
result = getParent().getRootIdentity()
124+
}
125+
}

‎c/common/src/codingstandards/c/initialization/GlobalInitializationAnalysis.qll‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
import cpp
2+
import codingstandards.c.Objects
3+
import codingstandards.cpp.Concurrency
4+
import codingstandards.cpp.Type
5+
6+
signature module GlobalInitializationAnalysisConfigSig {
7+
/** A function which is not called or started as a thread */
8+
default predicate isRootFunction(Function f) {
9+
not exists(Function f2 | f2.calls(f)) and
10+
not f instanceof ThreadedFunction and
11+
// Exclude functions which are used as function pointers.
12+
not exists(FunctionAccess access | f = access.getTarget())
13+
}
14+
15+
ObjectIdentity getAnInitializedObject(Expr e);
16+
17+
ObjectIdentity getAUsedObject(Expr e);
18+
}
19+
20+
module GlobalInitalizationAnalysis<GlobalInitializationAnalysisConfigSig Config> {
21+
final class FinalFunction = Function;
22+
23+
final class FinalExpr = Expr;
24+
25+
class RootFunction extends FinalFunction {
26+
RootFunction() { Config::isRootFunction(this) }
27+
}
28+
29+
/** A function call which initializes a mutex or a condition */
30+
class ObjectInit extends FinalExpr {
31+
ObjectIdentity owningObject;
32+
33+
ObjectInit() { owningObject = Config::getAnInitializedObject(this) }
34+
35+
ObjectIdentity getOwningObject() { result = owningObject }
36+
}
37+
38+
/**
39+
* A function argument where that argument is used as a mutex or condition object.
40+
*/
41+
class ObjectUse extends FinalExpr {
42+
ObjectIdentity owningObject;
43+
44+
ObjectUse() { owningObject = Config::getAUsedObject(this) }
45+
46+
ObjectIdentity getOwningObject() { result = owningObject }
47+
}
48+
49+
predicate requiresInitializedMutexObject(
50+
Function func, ObjectUse mutexUse, ObjectIdentity owningObject
51+
) {
52+
mutexUse.getEnclosingFunction() = func and
53+
owningObject = mutexUse.getOwningObject() and
54+
not exists(ObjectInit init |
55+
init.getEnclosingFunction() = func and
56+
init.getOwningObject() = owningObject and
57+
mutexUse.getAPredecessor+() = init
58+
)
59+
or
60+
exists(FunctionCall call |
61+
func = call.getEnclosingFunction() and
62+
requiresInitializedMutexObject(call.getTarget(), mutexUse, owningObject) and
63+
not exists(ObjectInit init |
64+
call.getAPredecessor*() = init and
65+
init.getOwningObject() = owningObject
66+
)
67+
)
68+
or
69+
exists(C11ThreadCreateCall call |
70+
func = call.getEnclosingFunction() and
71+
not owningObject.getStorageDuration().isThread() and
72+
requiresInitializedMutexObject(call.getFunction(), mutexUse, owningObject) and
73+
not exists(ObjectInit init |
74+
call.getAPredecessor*() = init and
75+
init.getOwningObject() = owningObject
76+
)
77+
)
78+
}
79+
80+
predicate uninitializedFrom(Expr e, ObjectIdentity obj, Function callRoot) {
81+
exists(ObjectUse use | use = e |
82+
obj = use.getOwningObject() and
83+
requiresInitializedMutexObject(callRoot, use, obj) and
84+
(
85+
if obj.getStorageDuration().isAutomatic()
86+
then obj.getEnclosingElement+() = callRoot
87+
else (
88+
obj.getStorageDuration().isThread() and callRoot instanceof ThreadedFunction
89+
or
90+
callRoot instanceof RootFunction
91+
)
92+
)
93+
)
94+
}
95+
}

‎c/common/test/includes/standard-library/stdlib.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ int at_quick_exit (void (*) (void));
4949
_Noreturn void quick_exit (int);
5050

5151
char *getenv (const char *);
52+
char *getenv_s (size_t *restrict len, char *restrict value, size_t valuesz, const char *restrict name);
5253

5354
int system (const char *);
5455

‎c/misra/src/rules/DIR-5-1/PossibleDataRaceBetweenThreads.ql‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
/**
2+
* @id c/misra/possible-data-race-between-threads
3+
* @name DIR-5-1: There shall be no data races between threads
4+
* @description Threads shall not access the same memory location concurrently without utilization
5+
* of thread synchronization objects.
6+
* @kind problem
7+
* @precision medium
8+
* @problem.severity error
9+
* @tags external/misra/id/dir-5-1
10+
* correctness
11+
* concurrency
12+
* external/misra/c/2012/amendment4
13+
* external/misra/obligation/required
14+
*/
15+
16+
import cpp
17+
import codingstandards.c.misra
18+
import codingstandards.c.Objects
19+
import codingstandards.c.SubObjects
20+
import codingstandards.cpp.Concurrency
21+
22+
newtype TNonReentrantOperation =
23+
TReadWrite(SubObject object) {
24+
object.getRootIdentity().getStorageDuration().isStatic()
25+
or
26+
object.getRootIdentity().getStorageDuration().isAllocated()
27+
} or
28+
TStdFunctionCall(FunctionCall call) {
29+
call.getTarget()
30+
.hasName([
31+
"setlocale", "tmpnam", "rand", "srand", "getenv", "getenv_s", "strok", "strerror",
32+
"asctime", "ctime", "gmtime", "localtime", "mbrtoc16", "c16rtomb", "mbrtoc32",
33+
"c32rtomb", "mbrlen", "mbrtowc", "wcrtomb", "mbsrtowcs", "wcsrtombs"
34+
])
35+
}
36+
37+
class NonReentrantOperation extends TNonReentrantOperation {
38+
string toString() {
39+
exists(SubObject object |
40+
this = TReadWrite(object) and
41+
result = object.toString()
42+
)
43+
or
44+
exists(FunctionCall call |
45+
this = TStdFunctionCall(call) and
46+
result = call.getTarget().getName()
47+
)
48+
}
49+
50+
Expr getAReadExpr() {
51+
exists(SubObject object |
52+
this = TReadWrite(object) and
53+
result = object.getAnAccess()
54+
)
55+
or
56+
this = TStdFunctionCall(result)
57+
}
58+
59+
Expr getAWriteExpr() {
60+
exists(SubObject object, Assignment assignment |
61+
this = TReadWrite(object) and
62+
result = assignment and
63+
assignment.getLValue() = object.getAnAccess()
64+
)
65+
or
66+
this = TStdFunctionCall(result)
67+
}
68+
69+
string getReadString() {
70+
this = TReadWrite(_) and
71+
result = "read operation"
72+
or
73+
this = TStdFunctionCall(_) and
74+
result = "call to non-reentrant function"
75+
}
76+
77+
string getWriteString() {
78+
this = TReadWrite(_) and
79+
result = "write to object"
80+
or
81+
this = TStdFunctionCall(_) and
82+
result = "call to non-reentrant function"
83+
}
84+
85+
Element getSourceElement() {
86+
exists(SubObject object |
87+
this = TReadWrite(object) and
88+
result = object.getRootIdentity()
89+
)
90+
or
91+
this = TStdFunctionCall(result)
92+
}
93+
}
94+
95+
class WritingThread extends ThreadedFunction {
96+
NonReentrantOperation aWriteObject;
97+
Expr aWriteExpr;
98+
99+
WritingThread() {
100+
aWriteExpr = aWriteObject.getAWriteExpr() and
101+
// This function directly contains the write expression, or transitively calls the function
102+
// that contains the write expression.
103+
this.calls*(aWriteExpr.getEnclosingFunction()) and
104+
// The write isn't synchronized with a mutex or condition object.
105+
not aWriteExpr instanceof LockProtectedControlFlowNode and
106+
// The write doesn't seem to be during a special initialization phase of the program.
107+
not aWriteExpr.getEnclosingFunction().getName().matches(["%init%", "%boot%", "%start%"])
108+
}
109+
110+
Expr getAWriteExpr() { result = aWriteExpr }
111+
}
112+
113+
class ReadingThread extends ThreadedFunction {
114+
Expr aReadExpr;
115+
116+
ReadingThread() {
117+
exists(NonReentrantOperation op |
118+
aReadExpr = op.getAReadExpr() and
119+
this.calls*(aReadExpr.getEnclosingFunction()) and
120+
not aReadExpr instanceof LockProtectedControlFlowNode
121+
)
122+
}
123+
124+
Expr getAReadExpr() { result = aReadExpr }
125+
}
126+
127+
predicate mayBeDataRace(Expr write, Expr read, NonReentrantOperation operation) {
128+
exists(WritingThread wt |
129+
wt.getAWriteExpr() = write and
130+
write = operation.getAWriteExpr() and
131+
exists(ReadingThread rt |
132+
read = rt.getAReadExpr() and
133+
read = operation.getAReadExpr() and
134+
(
135+
wt.isMultiplySpawned() or
136+
not wt = rt
137+
)
138+
)
139+
)
140+
}
141+
142+
from
143+
WritingThread wt, ReadingThread rt, Expr write, Expr read, NonReentrantOperation operation,
144+
string message, string writeString, string readString
145+
where
146+
not isExcluded(write, Concurrency9Package::possibleDataRaceBetweenThreadsQuery()) and
147+
mayBeDataRace(write, read, operation) and
148+
wt = min(WritingThread f | f.getAWriteExpr() = write | f order by f.getName()) and
149+
rt = min(ReadingThread f | f.getAReadExpr() = read | f order by f.getName()) and
150+
writeString = operation.getWriteString() and
151+
readString = operation.getReadString() and
152+
if wt.isMultiplySpawned()
153+
then
154+
message =
155+
"Threaded " + writeString +
156+
" $@ not synchronized from thread function $@ spawned from a loop."
157+
else
158+
message =
159+
"Threaded " + writeString +
160+
" $@ from thread function $@ is not synchronized with $@ from thread function $@."
161+
select write, message, operation.getSourceElement(), operation.toString(), wt, wt.getName(), read,
162+
"concurrent " + readString, rt, rt.getName()

0 commit comments

Comments
 (0)