[Bug analyzer/109251] New: -Wanalyzer-deref-before-check false positives seen in Linux kernel due to check in macros

[Bug analyzer/109251] New: -Wanalyzer-deref-before-check false positives seen in Linux kernel due to check in macros

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109251

            Bug ID: 109251
           Summary: -Wanalyzer-deref-before-check false positives seen in
                    Linux kernel due to check in macros
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

Created attachment 54734
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54734&action=edit
Reduced reproducer

The attached triggers a false positive from -Wanalyzer-deref-before-check:

https://godbolt.org/z/TsrnedsWP

<source>: In function 'sched_slice':
<source>:50:25: warning: check of 'se' for NULL after already dereferencing it
[-Wanalyzer-deref-before-check]
   50 |   for_each_sched_entity(se) {
      |                         ^~
<source>:32:10: note: in definition of macro 'for_each_sched_entity'
   32 |   for (; se; se = NULL)
      |          ^~
  'sched_slice': event 1
    |
    |   48 |   slice = __sched_period(nr_running + !se->on_rq);
    |      |                                        ~~^~~~~~~
    |      |                                          |
    |      |                                          (1) pointer 'se' is
dereferenced here
    |
  'sched_slice': event 2
    |
    |   50 |   for_each_sched_entity(se) {
    |      |                         ^~
    |      |                         |
    |      |                         (2) pointer 'se' is checked for NULL here
but it was already dereferenced at (1)
<source>:32:10: note: in definition of macro 'for_each_sched_entity'
    |   32 |   for (; se; se = NULL)
    |      |          ^~
    |

Looks similar to PR 108745, but that one's marked as fixed, whereas this one is
still firing.

[Bug analyzer/109251] [13/14 Regression] -Wanalyzer-deref-before-check false positives seen in Linux kernel due to check in macros

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109251

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
            Summary|-Wanalyzer-deref-before-che |[13/14 Regression]
                   |ck false positives seen in  |-Wanalyzer-deref-before-che
                   |Linux kernel due to check   |ck false positives seen in
                   |in macros                   |Linux kernel due to check
                   |                            |in macros
   Last reconfirmed|                            |2024-02-16

[Bug analyzer/109251] [13/14 Regression] -Wanalyzer-deref-before-check false positives seen in Linux kernel due to check in macros

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109251

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.3

[Bug analyzer/109251] [13/14 Regression] -Wanalyzer-deref-before-check false positives seen in Linux kernel due to check in macros

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109251

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org
           Priority|P3                          |P2

[Bug analyzer/109251] [13/14 Regression] -Wanalyzer-deref-before-check false positives seen in Linux kernel due to check in macros

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109251

--- Comment #1 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:9093f275e0a3430e4517e782e7f5419d403113f7

commit r14-9586-g9093f275e0a3430e4517e782e7f5419d403113f7
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Mar 20 18:33:11 2024 -0400

    analyzer: fix -Wanalyzer-deref-before-check false positive seen in loop
header macro [PR109251]

    gcc/analyzer/ChangeLog:
            PR analyzer/109251
            * sm-malloc.cc (deref_before_check::emit): Reject cases where the
            check is in a loop header within a macro expansion.
            (deref_before_check::loop_header_p): New.

    gcc/testsuite/ChangeLog:
            PR analyzer/109251
            * c-c++-common/analyzer/deref-before-check-pr109251-1.c: New test.
            * c-c++-common/analyzer/deref-before-check-pr109251-2.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/109251] [13 Regression] -Wanalyzer-deref-before-check false positives seen in Linux kernel due to check in macros

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109251

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
            Summary|[13/14 Regression]          |[13 Regression]
                   |-Wanalyzer-deref-before-che |-Wanalyzer-deref-before-che
                   |ck false positives seen in  |ck false positives seen in
                   |Linux kernel due to check   |Linux kernel due to check
                   |in macros                   |in macros

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed for GCC 14 by the above patch.  Keeping open to track
backporting to GCC 13.

[Bug analyzer/109251] [13 Regression] -Wanalyzer-deref-before-check false positives seen in Linux kernel due to check in macros

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109251

--- Comment #3 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by David Malcolm
<dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:ed026106ce420c7d9dd4d89caac017b6f235e219

commit r13-8756-ged026106ce420c7d9dd4d89caac017b6f235e219
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu May 9 13:09:31 2024 -0400

    analyzer: fix -Wanalyzer-deref-before-check false positive seen in loop
header macro [PR109251]

    Backported from commit r14-9586-g9093f275e0a343 (moving tests from
    c-c++-common to gcc.dg)

    gcc/analyzer/ChangeLog:
            PR analyzer/109251
            * sm-malloc.cc (deref_before_check::emit): Reject cases where the
            check is in a loop header within a macro expansion.
            (deref_before_check::loop_header_p): New.

    gcc/testsuite/ChangeLog:
            PR analyzer/109251
            * gcc.dg/analyzer/deref-before-check-pr109251-1.c: New test.
            * gcc.dg/analyzer/deref-before-check-pr109251-2.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/109251] -Wanalyzer-deref-before-check false positives seen in Linux kernel due to check in macros

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109251

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
            Summary|[13 Regression]             |-Wanalyzer-deref-before-che
                   |-Wanalyzer-deref-before-che |ck false positives seen in
                   |ck false positives seen in  |Linux kernel due to check
                   |Linux kernel due to check   |in macros
                   |in macros                   |
         Resolution|---                         |FIXED

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed for GCC 13 (for the upcoming GCC 13.3) by the above patch.