[Bug analyzer/106218] New: Analyzer false positives with Linux kernel's err.h

[Bug analyzer/106218] New: Analyzer false positives with Linux kernel's err.h

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106218

            Bug ID: 106218
           Summary: Analyzer false positives with Linux kernel's err.h
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

The Linux kernel has a header include/linux/err.h which stuffs small negative
values into pointers.

The analyzer's constraint handling doesn't handle this very well at the moment.
 For example:

extern void __analyzer_dump_path (void);

long __attribute__((noinline))
PTR_ERR(const void *ptr) {
  return (long)ptr;
}

_Bool __attribute__((noinline))
IS_ERR(const void *ptr) {
  return (unsigned long)(void *)((unsigned long)ptr) >= (unsigned long)-4095;
}

long __attribute__((noinline))
test(void *ptr)
{
  if (IS_ERR(ptr)) {
    int err = PTR_ERR(ptr);
    if (!err)
      __analyzer_dump_path (); // BUG: shouldn't get here
  }
}

In the above -analyzer erroneously considers there to be a feasible execution
path in which IS_ERR(ptr) and PTR_ERR(err) == 0.

(minimized from a false positive in ipc/shm.c)