Bug Summary

File:src/lib/libc/stdlib/atexit.c
Warning:line 70, column 17
Value stored to 'p' during its initialization is never read

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name atexit.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libc/obj -resource-dir /usr/local/lib/clang/13.0.0 -include namespace.h -I /usr/src/lib/libc/include -I /usr/src/lib/libc/hidden -D __LIBC__ -D APIWARN -D YP -I /usr/src/lib/libc/yp -I /usr/src/lib/libc -I /usr/src/lib/libc/gdtoa -I /usr/src/lib/libc/arch/amd64/gdtoa -D INFNAN_CHECK -D MULTIPLE_THREADS -D NO_FENV_H -D USE_LOCALE -I /usr/src/lib/libc -I /usr/src/lib/libc/citrus -D RESOLVSORT -D FLOATING_POINT -D PRINTF_WIDE_CHAR -D SCANF_WIDE_CHAR -D FUTEX -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libc/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/lib/libc/stdlib/atexit.c
1/* $OpenBSD: atexit.c,v 1.27 2017/12/16 20:06:56 guenther Exp $ */
2/*
3 * Copyright (c) 2002 Daniel Hartmeier
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * - Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * - Redistributions in binary form must reproduce the above
13 * copyright notice, this list of conditions and the following
14 * disclaimer in the documentation and/or other materials provided
15 * with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
20 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
21 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
23 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
25 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
27 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 * POSSIBILITY OF SUCH DAMAGE.
29 *
30 */
31
32#include <sys/types.h>
33#include <sys/mman.h>
34#include <stdlib.h>
35#include <string.h>
36#include <tib.h>
37#include <unistd.h>
38
39#include "atexit.h"
40#include "atfork.h"
41#include "thread_private.h"
42
43struct atexit *__atexit;
44static int restartloop;
45
46/* define and initialize the list */
47struct atfork_listhead _atfork_list = TAILQ_HEAD_INITIALIZER(_atfork_list){ ((void*)0), &(_atfork_list).tqh_first };
48
49
50/*
51 * Function pointers are stored in a linked list of pages. The list
52 * is initially empty, and pages are allocated on demand. The first
53 * function pointer in the first allocated page (the last one in
54 * the linked list) is reserved for the cleanup function.
55 *
56 * Outside the following functions, all pages are mprotect()'ed
57 * to prevent unintentional/malicious corruption.
58 */
59
60/*
61 * Register a function to be performed at exit or when a shared object
62 * with the given dso handle is unloaded dynamically. Also used as
63 * the backend for atexit(). For more info on this API, see:
64 *
65 * http://www.codesourcery.com/cxx-abi/abi.html#dso-dtor
66 */
67int
68__cxa_atexit(void (*func)(void *), void *arg, void *dso)
69{
70 struct atexit *p = __atexit;
Value stored to 'p' during its initialization is never read
71 struct atexit_fn *fnp;
72 int pgsize = getpagesize();
73 int ret = -1;
74
75 if (pgsize < sizeof(*p))
76 return (-1);
77 _ATEXIT_LOCK()do { if (__isthreaded) _thread_cb.tc_atexit_lock(); } while (
0);
78 p = __atexit;
79 if (p != NULL((void*)0)) {
80 if (p->ind + 1 >= p->max)
81 p = NULL((void*)0);
82 else if (mprotect(p, pgsize, PROT_READ0x01 | PROT_WRITE0x02))
83 goto unlock;
84 }
85 if (p == NULL((void*)0)) {
86 p = mmap(NULL((void*)0), pgsize, PROT_READ0x01 | PROT_WRITE0x02,
87 MAP_ANON0x1000 | MAP_PRIVATE0x0002, -1, 0);
88 if (p == MAP_FAILED((void *)-1))
89 goto unlock;
90 if (__atexit == NULL((void*)0)) {
91 memset(&p->fns[0], 0, sizeof(p->fns[0]));
92 p->ind = 1;
93 } else
94 p->ind = 0;
95 p->max = (pgsize - ((char *)&p->fns[0] - (char *)p)) /
96 sizeof(p->fns[0]);
97 p->next = __atexit;
98 __atexit = p;
99 }
100 fnp = &p->fns[p->ind++];
101 fnp->fn_ptr = func;
102 fnp->fn_arg = arg;
103 fnp->fn_dso = dso;
104 if (mprotect(p, pgsize, PROT_READ0x01))
105 goto unlock;
106 restartloop = 1;
107 ret = 0;
108unlock:
109 _ATEXIT_UNLOCK()do { if (__isthreaded) _thread_cb.tc_atexit_unlock(); } while
(0);
110 return (ret);
111}
112DEF_STRONG(__cxa_atexit)__asm__(".global " "__cxa_atexit" " ; " "__cxa_atexit" " = " "_libc___cxa_atexit"
);
113
114/*
115 * Copy of atexit() used by libc and anything staticly linked into the
116 * executable. This passes NULL for the dso, so the callbacks are only
117 * invoked by exit() and not dlclose()
118 */
119int
120atexit(void (*fn)(void))
121{
122 return (__cxa_atexit((void (*)(void *))fn, NULL((void*)0), NULL((void*)0)));
123}
124DEF_STRONG(atexit)__asm__(".global " "atexit" " ; " "atexit" " = " "_libc_atexit"
);
125
126void
127_thread_finalize(void)
128{
129 struct tib *tib = TIB_GET()((struct tib *)((char *)(__amd64_read_tcb(0)) - (__builtin_offsetof
(struct tib, __tib_self) + 0)));
130
131 while (tib->tib_atexit) {
132 struct thread_atexit_fn *fnp = tib->tib_atexit;
133 tib->tib_atexit = fnp->next;
134 fnp->func(fnp->arg);
135 free(fnp);
136 }
137}
138
139/*
140 * Call all handlers registered with __cxa_atexit() for the shared
141 * object owning 'dso'.
142 * Note: if 'dso' is NULL, then all remaining handlers are called.
143 */
144void
145__cxa_finalize(void *dso)
146{
147 struct atexit *p, *q;
148 struct atexit_fn fn;
149 int n, pgsize = getpagesize();
150 static int call_depth;
151
152 if (dso == NULL((void*)0))
153 _thread_finalize();
154
155 _ATEXIT_LOCK()do { if (__isthreaded) _thread_cb.tc_atexit_lock(); } while (
0);
156 call_depth++;
157
158restart:
159 restartloop = 0;
160 for (p = __atexit; p != NULL((void*)0); p = p->next) {
161 for (n = p->ind; --n >= 0;) {
162 if (p->fns[n].fn_ptr == NULL((void*)0))
163 continue; /* already called */
164 if (dso != NULL((void*)0) && dso != p->fns[n].fn_dso)
165 continue; /* wrong DSO */
166
167 /*
168 * Mark handler as having been already called to avoid
169 * dupes and loops, then call the appropriate function.
170 */
171 fn = p->fns[n];
172 if (mprotect(p, pgsize, PROT_READ0x01 | PROT_WRITE0x02) == 0) {
173 p->fns[n].fn_ptr = NULL((void*)0);
174 mprotect(p, pgsize, PROT_READ0x01);
175 }
176 _ATEXIT_UNLOCK()do { if (__isthreaded) _thread_cb.tc_atexit_unlock(); } while
(0);
177 (*fn.fn_ptr)(fn.fn_arg);
178 _ATEXIT_LOCK()do { if (__isthreaded) _thread_cb.tc_atexit_lock(); } while (
0);
179 if (restartloop)
180 goto restart;
181 }
182 }
183
184 call_depth--;
185
186 /*
187 * If called via exit(), unmap the pages since we have now run
188 * all the handlers. We defer this until calldepth == 0 so that
189 * we don't unmap things prematurely if called recursively.
190 */
191 if (dso == NULL((void*)0) && call_depth == 0) {
192 for (p = __atexit; p != NULL((void*)0); ) {
193 q = p;
194 p = p->next;
195 munmap(q, pgsize);
196 }
197 __atexit = NULL((void*)0);
198 }
199 _ATEXIT_UNLOCK()do { if (__isthreaded) _thread_cb.tc_atexit_unlock(); } while
(0);
200
201 /*
202 * If unloading a DSO, unregister any atfork handlers registered
203 * by it. Skip the locking if the list is currently empty.
204 */
205 if (dso != NULL((void*)0) && TAILQ_FIRST(&_atfork_list)((&_atfork_list)->tqh_first) != NULL((void*)0)) {
206 struct atfork_fn *af, *afnext;
207
208 _ATFORK_LOCK()do { if (__isthreaded) _thread_cb.tc_atfork_lock(); } while (
0);
209 TAILQ_FOREACH_SAFE(af, &_atfork_list, fn_next, afnext)for ((af) = ((&_atfork_list)->tqh_first); (af) != ((void
*)0) && ((afnext) = ((af)->fn_next.tqe_next), 1); (
af) = (afnext))
210 if (af->fn_dso == dso) {
211 TAILQ_REMOVE(&_atfork_list, af, fn_next)do { if (((af)->fn_next.tqe_next) != ((void*)0)) (af)->
fn_next.tqe_next->fn_next.tqe_prev = (af)->fn_next.tqe_prev
; else (&_atfork_list)->tqh_last = (af)->fn_next.tqe_prev
; *(af)->fn_next.tqe_prev = (af)->fn_next.tqe_next; ; ;
} while (0);
212 free(af);
213 }
214 _ATFORK_UNLOCK()do { if (__isthreaded) _thread_cb.tc_atfork_unlock(); } while
(0);
215
216 }
217}
218DEF_STRONG(__cxa_finalize)__asm__(".global " "__cxa_finalize" " ; " "__cxa_finalize" " = "
"_libc___cxa_finalize");
219
220/*
221 * Register the cleanup function
222 */
223void
224__atexit_register_cleanup(void (*func)(void))
225{
226 struct atexit *p;
227 int pgsize = getpagesize();
228
229 if (pgsize < sizeof(*p))
230 return;
231 _ATEXIT_LOCK()do { if (__isthreaded) _thread_cb.tc_atexit_lock(); } while (
0);
232 p = __atexit;
233 while (p != NULL((void*)0) && p->next != NULL((void*)0))
234 p = p->next;
235 if (p == NULL((void*)0)) {
236 p = mmap(NULL((void*)0), pgsize, PROT_READ0x01 | PROT_WRITE0x02,
237 MAP_ANON0x1000 | MAP_PRIVATE0x0002, -1, 0);
238 if (p == MAP_FAILED((void *)-1))
239 goto unlock;
240 p->ind = 1;
241 p->max = (pgsize - ((char *)&p->fns[0] - (char *)p)) /
242 sizeof(p->fns[0]);
243 p->next = NULL((void*)0);
244 __atexit = p;
245 } else {
246 if (mprotect(p, pgsize, PROT_READ0x01 | PROT_WRITE0x02))
247 goto unlock;
248 }
249 p->fns[0].fn_ptr = (void (*)(void *))func;
250 p->fns[0].fn_arg = NULL((void*)0);
251 p->fns[0].fn_dso = NULL((void*)0);
252 mprotect(p, pgsize, PROT_READ0x01);
253 restartloop = 1;
254unlock:
255 _ATEXIT_UNLOCK()do { if (__isthreaded) _thread_cb.tc_atexit_unlock(); } while
(0);
256}