[Bug c/108187] New: False positive -Wfree-nonheap-object on impossible path with -O1

[Bug c/108187] New: False positive -Wfree-nonheap-object on impossible path with -O1

[i.maximets at ovn dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108187

            Bug ID: 108187
           Summary: False positive -Wfree-nonheap-object on impossible
                    path with -O1
           Product: gcc
           Version: 12.2.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: i.maximets at ovn dot org
  Target Milestone: ---

Created attachment 54132
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54132&action=edit
Reproducer

This might be the same issue as 98753, but I'm not sure.

We're getting the following error while trying to build Open vSwitch
with AF_XDP support with GCC:

```
In file included from lib/netdev-linux-private.h:30,
                 from lib/netdev-afxdp.c:19:
In function ‘dp_packet_delete’,
    inlined from ‘dp_packet_delete’ at lib/dp-packet.h:246:1,
    inlined from ‘dp_packet_batch_add__’ at lib/dp-packet.h:775:9,
    inlined from ‘dp_packet_batch_add’ at lib/dp-packet.h:783:5,
    inlined from ‘netdev_afxdp_rxq_recv’ at lib/netdev-afxdp.c:898:9:
lib/dp-packet.h:260:9: warning: ‘free’ called on pointer ‘*umem.xpool.array’
with nonzero offset [8, 2558044588346441168] [-Wfree-nonheap-object]
  260 |         free(b);
      |         ^~~~~~~

```

The simplified code flow is following:

```
packet = &umem->xpool.array[index];
packet = &xpacket->packet;
dp_packet_use_afxdp(packet, pkt, FRAME_SIZE - FRAME_HEADROOM,
OVS_XDP_HEADROOM);
--> dp_packet_init__(packet, allocated, DPBUF_AFXDP);
    --> packet->source = source;
dp_packet_batch_add(batch, packet);
--> dp_packet_delete(packet);
    --> if (b->source == DPBUF_AFXDP) {
            free_afxdp_buf(b);
            return;
        }
        dp_packet_uninit(b);
        free(b);

```

The 'b->source' is always set unconditionally to DPBUF_AFXDP on that path,
so the free(b) cannot be reached, but compiler doesn't think so.
The issue is seen starting with -O1.

$ gcc --version
gcc (GCC) 12.2.1 20221121 (Red Hat 12.2.1-4)

Attached the file in question after -E.  To reproduce run:

$ gcc -O1 -c netdev-afxdp.E.c

[Bug tree-optimization/108187] False positive -Wfree-nonheap-object on impossible path with -O1

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108187

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Well, between the store to ->source and the read from it is the call
to dp_packet_use_afxdp which gets &xpacket->packet as argument and thus
needs to be treated as clobbering ->source.  So GCC can indeed not know
that ->source is DPBUF_AFXDP since the path is not provable impossible.
dp_packet_use_afxdp doesn't even get a const struct dp_packet * argument
(not that this would semantically change things in C).

[Bug tree-optimization/108187] False positive -Wfree-nonheap-object on impossible path with -O1

[i.maximets at ovn dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108187

--- Comment #2 from Ilya Maximets <i.maximets at ovn dot org> ---
(In reply to Richard Biener from comment #1)
> Well, between the store to ->source and the read from it is the call
> to dp_packet_use_afxdp which gets &xpacket->packet as argument and thus
> needs to be treated as clobbering ->source.  So GCC can indeed not know
> that ->source is DPBUF_AFXDP since the path is not provable impossible.
> dp_packet_use_afxdp doesn't even get a const struct dp_packet * argument
> (not that this would semantically change things in C).

Hmm, dp_packet_use_afxdp() is the function that sets source to DPBUF_AFXDP
and initializes other parts of the structure.  So, it cannot take a const
argument.  If GCC just doesn't look inside the dp_packet_use_afxdp() function
at all here, then it will indeed not know that the source is DPBUF_AFXDP now.

However, I'm not sure why the issue doesn't appear with -O0 then.

[Bug tree-optimization/108187] False positive -Wfree-nonheap-object on impossible path with -O1

[i.maximets at ovn dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108187

--- Comment #3 from Ilya Maximets <i.maximets at ovn dot org> ---
(In reply to Ilya Maximets from comment #2)
> (In reply to Richard Biener from comment #1)
> > Well, between the store to ->source and the read from it is the call
> > to dp_packet_use_afxdp which gets &xpacket->packet as argument and thus
> > needs to be treated as clobbering ->source.  So GCC can indeed not know
> > that ->source is DPBUF_AFXDP since the path is not provable impossible.
> > dp_packet_use_afxdp doesn't even get a const struct dp_packet * argument
> > (not that this would semantically change things in C).
> 
> Hmm, dp_packet_use_afxdp() is the function that sets source to DPBUF_AFXDP
> and initializes other parts of the structure.  So, it cannot take a const
> argument.  If GCC just doesn't look inside the dp_packet_use_afxdp() function
> at all here, then it will indeed not know that the source is DPBUF_AFXDP now.

Clarification:  I realized that dp_packet_use_afxdp() is part of a different
translation unit, so GCC doesn't have a chance to know what this function is
doing, hence it doesn't know that source is DPBUF_AFXDP.  Though I don't know
how we can change that code to make GCC happy.  We'll likely end up just
disabling a warning.

> However, I'm not sure why the issue doesn't appear with -O0 then.

I'm still not sure why this is happening though.  Is there something
special about -O0 ?

[Bug tree-optimization/108187] False positive -Wfree-nonheap-object on impossible path with -O1

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108187

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Ilya Maximets from comment #3)
> 
> Clarification:  I realized that dp_packet_use_afxdp() is part of a different
> translation unit, so GCC doesn't have a chance to know what this function is
> doing, hence it doesn't know that source is DPBUF_AFXDP.  Though I don't know
> how we can change that code to make GCC happy.  We'll likely end up just
> disabling a warning.
> 
> > However, I'm not sure why the issue doesn't appear with -O0 then.
> 
> I'm still not sure why this is happening though.  Is there something
> special about -O0 ?

Yes the warning code only runs with optimization turned on ...