From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 883603858421; Tue, 20 Dec 2022 14:33:44 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 883603858421 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1671546824; bh=HPhhSfudutK/ZUxt27K+kEhp/nF0XKa6k40kXChT/NA=; h=From:To:Subject:Date:From; b=DFgxKAIDQk0rJaTyAdtXXr0Iubt/lVtu1ZHvljK1bGdDqXtVQwy4tOGg/2xO3sL0v ZKVAO7AeOGNj2KpeNSHvuflJgFI+b/BlWpuxDcXS2YYeCYpMicTHVMt4L/iPDW+gdl 0nTK9esr9UGS6BmCfh4ZxC0n3aths/Wmv5KSJBhY= From: "i.maximets at ovn dot org" To: gcc-bugs@gcc.gnu.org Subject: [Bug c/108187] New: False positive -Wfree-nonheap-object on impossible path with -O1 Date: Tue, 20 Dec 2022 14:33:43 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: c X-Bugzilla-Version: 12.2.1 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: i.maximets at ovn dot org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D108187 Bug ID: 108187 Summary: False positive -Wfree-nonheap-object on impossible path with -O1 Product: gcc Version: 12.2.1 Status: UNCONFIRMED Severity: normal Priority: P3 Component: c Assignee: unassigned at gcc dot gnu.org Reporter: i.maximets at ovn dot org Target Milestone: --- Created attachment 54132 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=3D54132&action=3Dedit Reproducer This might be the same issue as 98753, but I'm not sure. We're getting the following error while trying to build Open vSwitch with AF_XDP support with GCC: ``` In file included from lib/netdev-linux-private.h:30, from lib/netdev-afxdp.c:19: In function =E2=80=98dp_packet_delete=E2=80=99, inlined from =E2=80=98dp_packet_delete=E2=80=99 at lib/dp-packet.h:246:= 1, inlined from =E2=80=98dp_packet_batch_add__=E2=80=99 at lib/dp-packet.h= :775:9, inlined from =E2=80=98dp_packet_batch_add=E2=80=99 at lib/dp-packet.h:7= 83:5, inlined from =E2=80=98netdev_afxdp_rxq_recv=E2=80=99 at lib/netdev-afxd= p.c:898:9: lib/dp-packet.h:260:9: warning: =E2=80=98free=E2=80=99 called on pointer = =E2=80=98*umem.xpool.array=E2=80=99 with nonzero offset [8, 2558044588346441168] [-Wfree-nonheap-object] 260 | free(b); | ^~~~~~~ ``` The simplified code flow is following: ``` packet =3D &umem->xpool.array[index]; packet =3D &xpacket->packet; dp_packet_use_afxdp(packet, pkt, FRAME_SIZE - FRAME_HEADROOM, OVS_XDP_HEADROOM); --> dp_packet_init__(packet, allocated, DPBUF_AFXDP); --> packet->source =3D source; dp_packet_batch_add(batch, packet); --> dp_packet_delete(packet); --> if (b->source =3D=3D DPBUF_AFXDP) { free_afxdp_buf(b); return; } dp_packet_uninit(b); free(b); ``` The 'b->source' is always set unconditionally to DPBUF_AFXDP on that path, so the free(b) cannot be reached, but compiler doesn't think so. The issue is seen starting with -O1. $ gcc --version gcc (GCC) 12.2.1 20221121 (Red Hat 12.2.1-4) Attached the file in question after -E. To reproduce run: $ gcc -O1 -c netdev-afxdp.E.c=