Analyze unsafe code reachability #3546
Conversation
celinval
force-pushed
the
issue-xxxx-transitive-scan
branch
from
c208237
to
37bcc09
Compare
Add callgraph analysis to scanner in order to find the distance between functions in a crate and unsafe functions. For that, we build the crate call graph and collect the unsafe functions. After that, do reverse BFS traversal from the unsafe functions and store the distance to other functions. The result is stored in a new csv file.
celinval
force-pushed
the
issue-xxxx-transitive-scan
branch
from
37bcc09
to
c3d305f
Compare
| stable_mir = { path = "<path_to_rustc>/stable_mir", optional = true } | ||
|
|
||
| [features] | ||
| clion = ['rustc_smir', 'stable_mir'] |
There was a problem hiding this comment.
How are the changes in this file related to what the PR description says?
There was a problem hiding this comment.
I already removed them... They are not. :)
| @@ -104,7 +105,7 @@ for f in $results/*overall.csv; do | |||
| fname=$(basename $f) | |||
| crate=${fname%_scan_overall.csv} | |||
| echo -n "$crate," >> $summary | |||
| tr -d [:alpha:]_,; < $f | tr -s '\n' ',' \ | |||
| tr -d "[:alpha:]_,;" < $f | tr -s '\n' ',' \ | |||
There was a problem hiding this comment.
Thank you, but how did this ever work?
There was a problem hiding this comment.
I think it was a typo when I created the script from my local script. This script doesn't run as part of the CI, which is probably something that we need to address.
There was a problem hiding this comment.
Yes, would love for that to be in CI in some way or other!
|
|
||
| extern "C" { | ||
| fn external_function(); | ||
| } | ||
|
|
||
| pub fn call_external() { | ||
| unsafe { external_function() }; | ||
| } |
There was a problem hiding this comment.
Perhaps those various functions could have comments explaining why they are there?
| // Copyright Kani Contributors | ||
| // SPDX-License-Identifier: Apache-2.0 OR MIT | ||
|
|
||
| //! Provide different static analysis to be performed in the call graph |
There was a problem hiding this comment.
What does "different" mean here?
There was a problem hiding this comment.
Let me improve this... but I think what I wanted to express is that this module is for inter-function analysis while the other module is for intra-function analysis.
| pub const fn num_props() -> usize { | ||
| [$(stringify!($prop),)+].len() | ||
| } | ||
|
|
||
| fn new(fn_name: String) -> Self { | ||
| pub fn new(fn_name: String) -> Self { |
There was a problem hiding this comment.
Why are those newly public? Probably just a lack of understanding on my part, but I couldn't spot a new use of them.
There was a problem hiding this comment.
I thought I was using them in the call_graph module, but I can double check if that is still needed.
Add call graph analysis to scanner in order to find the distance between functions in a crate and unsafe functions.
For that, we build the crate call graph and collect the unsafe functions. After that, do reverse BFS traversal from the unsafe functions and store the distance to other functions. The result is stored in a new csv file.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT licenses.