[Bug analyzer/106394] New: Possible false positive from -Wanalyzer-allocation-size with empty array

[Bug analyzer/106394] New: Possible false positive from -Wanalyzer-allocation-size with empty array

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106394

            Bug ID: 106394
           Summary: Possible false positive from
                    -Wanalyzer-allocation-size with empty array
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
                CC: tlange at gcc dot gnu.org
            Blocks: 106358
  Target Milestone: ---

Given:

struct msm_gpu {
  // [...snip...]
  const struct msm_gpu_perfcntr *perfcntrs;
  // [...snip...]
};

struct msm_gpu_perfcntr {
  // [...snip...]
  const char *name;
};

static const struct msm_gpu_perfcntr perfcntrs[] = {};

struct msm_gpu *test(struct msm_gpu *gpu) {
  // [...snip...]
  gpu->perfcntrs = perfcntrs;
  // [...snip...]
  return gpu;
}

I see this with -fanalyzer and trunk:

../../src/a2xx_gpu.c: In function ‘test’:
../../src/a2xx_gpu.c:16:18: warning: allocated buffer size is not a multiple of
the pointee's size [CWE-131] [-Wanalyzer-allocation-size]
   16 |   gpu->perfcntrs = perfcntrs;
      |   ~~~~~~~~~~~~~~~^~~~~~~~~~~
  event 1
    |
    |   12 | static const struct msm_gpu_perfcntr perfcntrs[] = {};
    |      |                                      ^~~~~~~~~
    |      |                                      |
    |      |                                      (1) allocated 0 bytes here
    |
    +--> ‘test’: events 2-3
           |
           |   14 | struct msm_gpu *test(struct msm_gpu *gpu) {
           |      |                 ^~~~
           |      |                 |
           |      |                 (2) entry to ‘test’
           |   15 |   // [...snip...]
           |   16 |   gpu->perfcntrs = perfcntrs;
           |      |   ~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                  |
           |      |                  (3) assigned to ‘const struct
msm_gpu_perfcntr *’ here; ‘sizeof (const struct msm_gpu_perfcntr)’ is ‘8’
           |

which looks like a false positive.

Reduced from Linux kernel's drivers/gpu/drm/msm/adreno/a2xx_gpu.c: function
‘a2xx_gpu_init’:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/msm/adreno/a2xx_gpu.c#n521
which has:

drivers/gpu/drm/msm/adreno/a2xx_gpu.c: In function ‘a2xx_gpu_init’:
drivers/gpu/drm/msm/adreno/a2xx_gpu.c:521:24: error: allocated buffer size is
not a multiple of the pointee's size [CWE-131]
[-Werror=analyzer-allocation-size]
  521 |         gpu->perfcntrs = perfcntrs;
      |         ~~~~~~~~~~~~~~~^~~~~~~~~~~
  event 1
    |
    |  493 | static const struct msm_gpu_perfcntr perfcntrs[] = {
    |      |                                      ^~~~~~~~~
    |      |                                      |
    |      |                                      (1) allocated 0 bytes here
    |
    +--> ‘a2xx_gpu_init’: events 2-7
           |
           |  497 | struct msm_gpu *a2xx_gpu_init(struct drm_device *dev)
           |      |                 ^~~~~~~~~~~~~
           |      |                 |
           |      |                 (2) entry to ‘a2xx_gpu_init’
           |......
           |  506 |         if (!pdev) {
           |      |            ~     
           |      |            |
           |      |            (3) following ‘false’ branch (when ‘pdev’ is
non-NULL)...
           |......
           |  512 |         a2xx_gpu = kzalloc(sizeof(*a2xx_gpu), GFP_KERNEL);
           |      |                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                    |
           |      |                    (4) ...to here
           |  513 |         if (!a2xx_gpu) {
           |      |            ~     
           |      |            |
           |      |            (5) following ‘false’ branch (when ‘a2xx_gpu’ is
non-NULL)...
           |......
           |  518 |         adreno_gpu = &a2xx_gpu->base;
           |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                    |
           |      |                    (6) ...to here
           |......
           |  521 |         gpu->perfcntrs = perfcntrs;
           |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                        |
           |      |                        (7) assigned to ‘const struct
msm_gpu_perfcntr *’ here; ‘sizeof (const struct msm_gpu_perfcntr)’ is ‘24’
           |


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
[Bug 106358] [meta-bug] tracker bug for building the Linux kernel with
-fanalyzer

[Bug analyzer/106394] Possible false positive from -Wanalyzer-allocation-size with empty array

[tlange at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106394

Tim Lange <tlange at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-07-21
     Ever confirmed|0                           |1

--- Comment #1 from Tim Lange <tlange at gcc dot gnu.org> ---
I've noticed earlier that I produced a different behavior for structs and other
types, i.e. for struct I check for 'alloc_size >= pointee_size' while for other
types I check for 'alloc_size % pointee_size == 0'. I already had it fixed in
the first draft patch I sent for PR106181.

Long story short, it is a simple fix and regression tests are running. I'll
post the fix to the gcc-patches mailing list when the regression tests passed.

[...]
--- a/gcc/analyzer/region-model.cc
+++ b/gcc/analyzer/region-model.cc
@@ -2956,7 +2956,7 @@ capacity_compatible_with_type (tree cst, tree
pointee_size_tree,
   unsigned HOST_WIDE_INT alloc_size = TREE_INT_CST_LOW (cst);

   if (is_struct)
-    return alloc_size >= pointee_size;
+    return alloc_size == 0 || alloc_size >= pointee_size;
   return alloc_size % pointee_size == 0;
 }
[...]

[Bug analyzer/106394] Possible false positive from -Wanalyzer-allocation-size with empty array

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106394

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|dmalcolm at gcc dot gnu.org        |tlange at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks - I'll mark this as assigned to you then.

[Bug analyzer/106394] False positive from -Wanalyzer-allocation-size with empty array

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106394

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Tim Lange <tlange@gcc.gnu.org>:

https://gcc.gnu.org/g:b4cc945c045db74f719ab030969806c14e2d5fc3

commit r13-1802-gb4cc945c045db74f719ab030969806c14e2d5fc3
Author: Tim Lange <mail@tim-lange.me>
Date:   Fri Jul 22 21:44:07 2022 +0200

    Fix handling of zero capacity regions in -Wanalyzer-allocation-size
[PR106394]

    This patch unifies the handling of zero capacity regions for structs
    and other types in the allocation size checker.
    Regression-tested on x86_64 Linux.

    2022-07-22  Tim Lange  <mail@tim-lange.me>

    gcc/analyzer/ChangeLog:

            PR analyzer/106394
            * region-model.cc (capacity_compatible_with_type): Always return
true
            if alloc_size is zero.

    gcc/testsuite/ChangeLog:

            PR analyzer/106394
            * gcc.dg/analyzer/pr106394.c: New test.

[Bug analyzer/106394] False positive from -Wanalyzer-allocation-size with empty array

[tlange at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106394

Tim Lange <tlange at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Tim Lange <tlange at gcc dot gnu.org> ---
Marking this fixed as the fix landed in trunk.