[Bug analyzer/112889] New: ICE with -fanalyzer seen on Linux kernel drivers/infiniband/hw/cxgb4/cm.c

[Bug analyzer/112889] New: ICE with -fanalyzer seen on Linux kernel drivers/infiniband/hw/cxgb4/cm.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112889

            Bug ID: 112889
           Summary: ICE with -fanalyzer seen on Linux kernel
                    drivers/infiniband/hw/cxgb4/cm.c
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
            Blocks: 106358
  Target Milestone: ---

Affects only trunk (for gcc 14): https://godbolt.org/z/Tshdnvshx

typedef unsigned char __u8;
struct sk_buff
{
  unsigned char *data;
};
struct cpl_pass_accept_req
{
  __u8 : 6;
  __u8 sack : 1;
};
void build_cpl_pass_accept_req(struct sk_buff* skb)
{
  struct cpl_pass_accept_req* req;
  skb->data -= sizeof(*req);
  req = (struct cpl_pass_accept_req *)skb->data;
  req->sack = 1;
}

gcc -fanalyzer 

t.c: In function ‘build_cpl_pass_accept_req’:
t.c:16:13: internal compiler error: in put, at hash-map.h:177
   16 |   req->sack = 1;
      |   ~~~~~~~~~~^~~
0x87eec0 hash_map<ana::binding_key const*, ana::svalue const*,
simple_hashmap_traits<default_hash_traits<ana::binding_key const*>, ana::svalue
const*> >::put(ana::binding_key const* const&, ana::svalue const* const&)
        ../../src/gcc/hash-map.h:177
0x87f842 hash_map<ana::concrete_binding, ana::concrete_binding*,
simple_hashmap_traits<default_hash_traits<ana::concrete_binding>,
ana::concrete_binding*> >::put(ana::concrete_binding const&,
ana::concrete_binding* const&)
        ../../src/gcc/analyzer/store.cc:2246
0x87f842 consolidation_map<ana::concrete_binding>::put(ana::concrete_binding
const&, ana::concrete_binding*)
        ../../src/gcc/analyzer/analyzer.h:525
0x87f842
ana::store_manager::get_concrete_binding(generic_wide_int<fixed_wide_int_storage<128>
>, generic_wide_int<fixed_wide_int_storage<128> >)
        ../../src/gcc/analyzer/store.cc:2232
0x14db141 ana::binding_key::make(ana::store_manager*, ana::region const*)
        ../../src/gcc/analyzer/store.cc:133
0x14ddcd6 ana::binding_cluster::bind(ana::store_manager*, ana::region const*,
ana::svalue const*)
        ../../src/gcc/analyzer/store.cc:1377
0x14ddcd6 ana::binding_cluster::bind(ana::store_manager*, ana::region const*,
ana::svalue const*)
        ../../src/gcc/analyzer/store.cc:1365
0x14de76a ana::store::set_value(ana::store_manager*, ana::region const*,
ana::svalue const*, ana::uncertainty_t*)
        ../../src/gcc/analyzer/store.cc:2617
0x144ceb5 ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::uncertainty_t*, bool*,
ana::path_context*)
        ../../src/gcc/analyzer/engine.cc:1507
0x144f680 ana::exploded_graph::process_node(ana::exploded_node*)
        ../../src/gcc/analyzer/engine.cc:4123
0x145035a ana::exploded_graph::process_worklist()
        ../../src/gcc/analyzer/engine.cc:3512
0x1452330 ana::impl_run_checkers(ana::logger*)
        ../../src/gcc/analyzer/engine.cc:6206
0x14532c6 ana::run_checkers()
        ../../src/gcc/analyzer/engine.cc:6297
0x14445ec execute
        ../../src/gcc/analyzer/analyzer-pass.cc:87


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
[Bug 106358] [meta-bug] tracker bug for building the Linux kernel with
-fanalyzer

[Bug analyzer/112889] ICE with -fanalyzer seen on Linux kernel drivers/infiniband/hw/cxgb4/cm.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112889

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-12-06

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Happens for a concrete_binding 2 bits below the start of the base region, due
to:

172           bool ins = Traits::is_empty (*e);
173           if (ins)
174             {
175               e->m_key = k;
176               new ((void *)&e->m_value) Value (v);
177               gcc_checking_assert (!Traits::is_empty (*e)
178                                    && !Traits::is_deleted (*e));
179             }

(gdb) call b.dump(true)
start: -2, size: 1, next: -1

(gdb) p k.is_empty()
$6 = true
(gdb) p k.is_deleted()
$7 = false

where concrete_binding has:
  void mark_deleted () { m_bit_range.m_start_bit_offset = -1; }
  void mark_empty () { m_bit_range.m_start_bit_offset = -2; }
  bool is_deleted () const { return m_bit_range.m_start_bit_offset == -1; }
  bool is_empty () const { return m_bit_range.m_start_bit_offset == -2; }

Possibly also affects the "1 bit before the base region" case as well.

Working on a fix to use the size field for the deleted/empty values.

It's a failing assertion, so may well be present (but latent) in older
releases.

[Bug analyzer/112889] ICE with -fanalyzer seen on Linux kernel drivers/infiniband/hw/cxgb4/cm.c

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112889

--- Comment #2 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:775aeabcb870b74e4d0986341c7a39add9bbb06d

commit r14-6297-g775aeabcb870b74e4d0986341c7a39add9bbb06d
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Dec 7 19:42:45 2023 -0500

    analyzer: fix ICE for 2 bits before the start of base region [PR112889]

    Cncrete bindings were using -1 and -2 in the offset field to signify
    deleted and empty hash slots, but these are valid values, leading to
    assertion failures inside hash_map::put on a debug build, and probable
    bugs in a release build.

    (gdb) call k.dump(true)
    start: -2, size: 1, next: -1

    (gdb) p k.is_empty()
    $6 = true

    Fix by using the size field rather than the offset.

    gcc/analyzer/ChangeLog:
            PR analyzer/112889
            * store.h (concrete_binding::concrete_binding): Strengthen
            assertion to require size to be be positive, rather than just
            non-zero.
            (concrete_binding::mark_deleted): Use size rather than start bit
            offset.
            (concrete_binding::mark_empty): Likewise.
            (concrete_binding::is_deleted): Likewise.
            (concrete_binding::is_empty): Likewise.

    gcc/testsuite/ChangeLog:
            PR analyzer/112889
            * c-c++-common/analyzer/ice-pr112889.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/112889] ICE with -fanalyzer seen on Linux kernel drivers/infiniband/hw/cxgb4/cm.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112889

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed on trunk by the above patch.

Keeping open to backport to older releases.

[Bug analyzer/112889] [11/12/13 Regression] ICE with -fanalyzer seen on Linux kernel drivers/infiniband/hw/cxgb4/cm.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112889

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|ICE with -fanalyzer seen on |[11/12/13 Regression] ICE
                   |Linux kernel                |with -fanalyzer seen on
                   |drivers/infiniband/hw/cxgb4 |Linux kernel
                   |/cm.c                       |drivers/infiniband/hw/cxgb4
                   |                            |/cm.c

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Bug is at least present but latent on older releases (from gcc 11 onwards)

[Bug analyzer/112889] [11/12/13 Regression] ICE with -fanalyzer seen on Linux kernel drivers/infiniband/hw/cxgb4/cm.c

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112889

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.5

[Bug analyzer/112889] [11/12/13 Regression] ICE with -fanalyzer seen on Linux kernel drivers/infiniband/hw/cxgb4/cm.c

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112889

--- Comment #5 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by David Malcolm
<dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:a1cb188cb2ca2ad3f4e837dba2967f323669d36e

commit r13-8750-ga1cb188cb2ca2ad3f4e837dba2967f323669d36e
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu May 9 13:09:29 2024 -0400

    analyzer: fix ICE for 2 bits before the start of base region [PR112889]

    Cncrete bindings were using -1 and -2 in the offset field to signify
    deleted and empty hash slots, but these are valid values, leading to
    assertion failures inside hash_map::put on a debug build, and probable
    bugs in a release build.

    (gdb) call k.dump(true)
    start: -2, size: 1, next: -1

    (gdb) p k.is_empty()
    $6 = true

    Fix by using the size field rather than the offset.

    Backported from commit r14-6297-g775aeabcb870b7 (moving the testcase
    from c-c++-common to gcc.dg).

    gcc/analyzer/ChangeLog:
            PR analyzer/112889
            * store.h (concrete_binding::concrete_binding): Strengthen
            assertion to require size to be be positive, rather than just
            non-zero.
            (concrete_binding::mark_deleted): Use size rather than start bit
            offset.
            (concrete_binding::mark_empty): Likewise.
            (concrete_binding::is_deleted): Likewise.
            (concrete_binding::is_empty): Likewise.

    gcc/testsuite/ChangeLog:
            PR analyzer/112889
            * gcc.dg/analyzer/ice-pr112889.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/112889] [11/12 Regression] ICE with -fanalyzer seen on Linux kernel drivers/infiniband/hw/cxgb4/cm.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112889

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[11/12/13 Regression] ICE   |[11/12 Regression] ICE with
                   |with -fanalyzer seen on     |-fanalyzer seen on Linux
                   |Linux kernel                |kernel
                   |drivers/infiniband/hw/cxgb4 |drivers/infiniband/hw/cxgb4
                   |/cm.c                       |/cm.c

--- Comment #6 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed for GCC 13 (for the upcoming GCC 13.3) by the above patch.

Keeping open to track backporting to older branches.