From patchwork Thu Jan 4 14:27:16 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 1882477 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=QRVOdej1; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=gcc.gnu.org (client-ip=8.43.85.97; helo=server2.sourceware.org; envelope-from=gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [8.43.85.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4T5TSv4cZ6z23dM for ; Fri, 5 Jan 2024 01:27:43 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 9E75F3858428 for ; Thu, 4 Jan 2024 14:27:41 +0000 (GMT) X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id A68223858C41 for ; Thu, 4 Jan 2024 14:27:19 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org A68223858C41 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org A68223858C41 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1704378441; cv=none; b=C1pEb4BnM58EC7AbnVgL9GDAQZEC2WhLzVlPo2oA9Ek39kFuwDPEUWszDzpt30Q/NDP9tNe/2mO/lrC6TlyxOzNpYI8296AZP7iNsPDUpGv9Z5lIvjlXTZmVmVsoIpid69kDhxOl75315UBIw5wMJOtjctk3KYCY1KyGSyBPWDU= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1704378441; c=relaxed/simple; bh=fizxbbL1RktHtAuU7Uee0EKVuDeMEeixOJ+0p/VB/TM=; h=DKIM-Signature:From:To:Subject:Date:Message-Id:MIME-Version; b=u/tJCl1iR1z+xl+gBMTou+KEu9VSByuQjlt7W5Grkfu9hfkH6PnrWkE8UdzRG4T4eEwzizyELZGf+sh3Oytqiiq8GItJEiyZCGLHGzmrbXWYGWu92EXdn49FefR41jas3XdPQYmFukYDwW6I3k87y6M7esXyo4sjgWZj88mSeAA= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1704378439; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=v7WmX++BIckN138zKLUgTanCEecyI8n2hjfDy0gm9JQ=; b=QRVOdej1SebkyeZF3uYbkT4vjZUyjKZgcuh9AquviJGspaz63x2k0wzRcqIks3ZIR5vBqg cqybvgIxCZ2fVb5TyzfovanG9XfbuCZtk/IOzoTZXPSAnHr538LQn3oCUNxrHxO3YRRsy0 yCorH2iN3lWFtBxyyWdzjScemAKcC2Q= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-474-crwjcUemOIKOK8XwTB0vAw-1; Thu, 04 Jan 2024 09:27:17 -0500 X-MC-Unique: crwjcUemOIKOK8XwTB0vAw-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id AAC6485A58B for ; Thu, 4 Jan 2024 14:27:17 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.17.251]) by smtp.corp.redhat.com (Postfix) with ESMTP id 71E20C15968; Thu, 4 Jan 2024 14:27:17 +0000 (UTC) From: David Malcolm To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [pushed] analyzer: fix deref-before-check false positives due to inlining [PR112790] Date: Thu, 4 Jan 2024 09:27:16 -0500 Message-Id: <20240104142716.427365-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.8 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-12.8 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu. Successful run of analyzer integration tests on x86_64-pc-linux-gnu. Pushed to trunk as r14-6918-g5743e1899d5964. gcc/analyzer/ChangeLog: PR analyzer/112790 * checker-event.cc (class inlining_info): Move to... * inlining-iterator.h (class inlining_info): ...here. * sm-malloc.cc: Include "analyzer/inlining-iterator.h". (maybe_complain_about_deref_before_check): Reject stmts that were inlined from another function. gcc/testsuite/ChangeLog: PR analyzer/112790 * c-c++-common/analyzer/deref-before-check-pr112790.c: New test. Signed-off-by: David Malcolm --- gcc/analyzer/checker-event.cc | 40 ------------------- gcc/analyzer/inlining-iterator.h | 40 +++++++++++++++++++ gcc/analyzer/sm-malloc.cc | 10 +++++ .../analyzer/deref-before-check-pr112790.c | 27 +++++++++++++ 4 files changed, 77 insertions(+), 40 deletions(-) create mode 100644 gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr112790.c diff --git a/gcc/analyzer/checker-event.cc b/gcc/analyzer/checker-event.cc index 3612df7bd1d3..3cb2fb9175cd 100644 --- a/gcc/analyzer/checker-event.cc +++ b/gcc/analyzer/checker-event.cc @@ -106,46 +106,6 @@ event_kind_to_string (enum event_kind ek) } } -/* A class for fixing up fndecls and stack depths in checker_event, based - on inlining records. - - The early inliner runs before the analyzer, which can lead to confusing - output. - - Tne base fndecl and depth within a checker_event are from call strings - in program_points, which reflect the call strings after inlining. - This class lets us offset the depth and fix up the reported fndecl and - stack depth to better reflect the user's original code. */ - -class inlining_info -{ -public: - inlining_info (location_t loc) - { - inlining_iterator iter (loc); - m_inner_fndecl = iter.get_fndecl (); - int num_frames = 0; - while (!iter.done_p ()) - { - m_outer_fndecl = iter.get_fndecl (); - num_frames++; - iter.next (); - } - if (num_frames > 1) - m_extra_frames = num_frames - 1; - else - m_extra_frames = 0; - } - - tree get_inner_fndecl () const { return m_inner_fndecl; } - int get_extra_frames () const { return m_extra_frames; } - -private: - tree m_outer_fndecl; - tree m_inner_fndecl; - int m_extra_frames; -}; - /* class checker_event : public diagnostic_event. */ /* checker_event's ctor. */ diff --git a/gcc/analyzer/inlining-iterator.h b/gcc/analyzer/inlining-iterator.h index 7d4798ce6ea5..76ba1dc3cf4a 100644 --- a/gcc/analyzer/inlining-iterator.h +++ b/gcc/analyzer/inlining-iterator.h @@ -106,4 +106,44 @@ private: tree m_next_abstract_origin; }; +/* A class for fixing up fndecls and stack depths in checker_event, based + on inlining records. + + The early inliner runs before the analyzer, which can lead to confusing + output. + + Tne base fndecl and depth within a checker_event are from call strings + in program_points, which reflect the call strings after inlining. + This class lets us offset the depth and fix up the reported fndecl and + stack depth to better reflect the user's original code. */ + +class inlining_info +{ +public: + inlining_info (location_t loc) + { + inlining_iterator iter (loc); + m_inner_fndecl = iter.get_fndecl (); + int num_frames = 0; + while (!iter.done_p ()) + { + m_outer_fndecl = iter.get_fndecl (); + num_frames++; + iter.next (); + } + if (num_frames > 1) + m_extra_frames = num_frames - 1; + else + m_extra_frames = 0; + } + + tree get_inner_fndecl () const { return m_inner_fndecl; } + int get_extra_frames () const { return m_extra_frames; } + +private: + tree m_outer_fndecl; + tree m_inner_fndecl; + int m_extra_frames; +}; + #endif /* GCC_ANALYZER_INLINING_ITERATOR_H */ diff --git a/gcc/analyzer/sm-malloc.cc b/gcc/analyzer/sm-malloc.cc index bb7844483979..61ee9cfc1e28 100644 --- a/gcc/analyzer/sm-malloc.cc +++ b/gcc/analyzer/sm-malloc.cc @@ -46,6 +46,7 @@ along with GCC; see the file COPYING3. If not see #include "analyzer/program-state.h" #include "analyzer/checker-event.h" #include "analyzer/exploded-graph.h" +#include "analyzer/inlining-iterator.h" #if ENABLE_ANALYZER @@ -2168,6 +2169,15 @@ maybe_complain_about_deref_before_check (sm_context *sm_ctxt, if (checked_in_frame->get_index () > assumed_nonnull_in_frame->get_index ()) return; + /* Don't complain if STMT was inlined from another function, to avoid + similar false positives involving shared helper functions. */ + if (stmt->location) + { + inlining_info info (stmt->location); + if (info.get_extra_frames () > 0) + return; + } + tree diag_ptr = sm_ctxt->get_diagnostic_tree (ptr); if (diag_ptr) sm_ctxt->warn diff --git a/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr112790.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr112790.c new file mode 100644 index 000000000000..8f74468f849b --- /dev/null +++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr112790.c @@ -0,0 +1,27 @@ +/* Reproducer for false positive from -Wanalyzer-deref-before-check + seen on Linux kernel's block/bdev.c due to -fanalyzer mishandling + inlined functions. */ + +/* { dg-additional-options "-O2 -g -fno-delete-null-pointer-checks" } */ + +typedef unsigned char u8; +struct inode { + void *i_mapping; + u8 i_blkbits; +}; +struct block_device { + struct inode *bd_inode; +}; +int sync_blockdev(struct block_device *bdev); +int set_blocksize(struct block_device *bdev, u8 size) { + if (bdev->bd_inode->i_blkbits != size) { /* { dg-bogus "pointer 'bdev' is dereferenced here" } */ + sync_blockdev(bdev); + } + return 0; +} +extern int filemap_write_and_wait(void *); +int sync_blockdev(struct block_device *bdev) { + if (!bdev) /* { dg-bogus "check of 'bdev' for NULL after already dereferencing it" } */ + return 0; + return filemap_write_and_wait(bdev->bd_inode->i_mapping); +}