[Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c

[Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619

            Bug ID: 113619
           Summary: -Wanalyzer-tainted-divisor false positive seen in
                    Linux kernel's fs/ceph/ioctl.c
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
            Blocks: 106358
  Target Milestone: ---

Reduced from false positive in Linux kernel's kernel's fs/ceph/ioctl.c:

__extension__ typedef unsigned long long __u64;

struct ceph_ioctl_layout
{
  __u64 stripe_unit, object_size;
};
static long
__validate_layout(struct ceph_ioctl_layout* l)
{
  if ((l->object_size & ~(~(((1UL) << 12) - 1))) ||
      (l->stripe_unit & ~(~(((1UL) << 12) - 1))) ||
      ((unsigned)l->stripe_unit != 0 &&
       ((unsigned)l->object_size % (unsigned)l->stripe_unit)))
    return -22;
  return 0;
}

long
__attribute__((tainted_args))
ceph_ioctl_set_layout_policy(struct ceph_ioctl_layout l)
{
  int err;
  err = __validate_layout(&l);
  if (err)
    return err;
  return err;
}


t.c: In function ‘__validate_layout’:
t.c:13:34: warning: use of attacker-controlled value ‘l.stripe_unit’ as divisor
without checking for zero [CWE-369] [-Wanalyzer-tainted-divisor]
   13 |        ((unsigned)l->object_size % (unsigned)l->stripe_unit)))
      |        ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~
  ‘ceph_ioctl_set_layout_policy’: event 1
    |
    |   20 | ceph_ioctl_set_layout_policy(struct ceph_ioctl_layout l)
    |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      | |
    |      | (1) function ‘ceph_ioctl_set_layout_policy’ marked with
‘__attribute__((tainted_args))’
    |
    +--> ‘ceph_ioctl_set_layout_policy’: events 2-3
           |
           |   20 | ceph_ioctl_set_layout_policy(struct ceph_ioctl_layout l)
           |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      | |
           |      | (2) entry to ‘ceph_ioctl_set_layout_policy’
           |......
           |   23 |   err = __validate_layout(&l);
           |      |         ~~~~~~~~~~~~~~~~~~~~~
           |      |         |
           |      |         (3) calling ‘__validate_layout’ from
‘ceph_ioctl_set_layout_policy’
           |
           +--> ‘__validate_layout’: events 4-11
                  |
                  |    8 | __validate_layout(struct ceph_ioctl_layout* l)
                  |      | ^~~~~~~~~~~~~~~~~
                  |      | |
                  |      | (4) entry to ‘__validate_layout’
                  |    9 | {
                  |   10 |   if ((l->object_size & ~(~(((1UL) << 12) - 1))) ||
                  |      |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  |      |      |                                           |
                  |      |      (5) following ‘false’ branch...             (7)
following ‘false’ branch...
                  |   11 |       (l->stripe_unit & ~(~(((1UL) << 12) - 1))) ||
                  |      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  |      |         |                                        |
                  |      |         (6) ...to here                           (9)
following ‘true’ branch...
                  |   12 |       ((unsigned)l->stripe_unit != 0 &&
                  |      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  |      |        |
                  |      |        (8) ...to here
                  |   13 |        ((unsigned)l->object_size %
(unsigned)l->stripe_unit)))
                  |      |       
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  |      |         |                        |
                  |      |         (10) ...to here          (11) use of
attacker-controlled value ‘l.stripe_unit’ as divisor without checking for zero
                  |

...whereas (unsigned)l->stripe_unit != 0 is checked at line 12.

Affects trunk: https://godbolt.org/z/3qfx6scT8

Might show up on earlier releases, but taint state machine required opt-in on
them.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
[Bug 106358] [meta-bug] tracker bug for building the Linux kernel with
-fanalyzer

[Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-02-15
            Summary|-Wanalyzer-tainted-divisor  |[14 Regression]
                   |false positive seen in      |-Wanalyzer-tainted-divisor
                   |Linux kernel's              |false positive seen in
                   |fs/ceph/ioctl.c             |Linux kernel's
                   |                            |fs/ceph/ioctl.c
             Status|UNCONFIRMED                 |NEW

[Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0

[Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
                 CC|                            |law at gcc dot gnu.org

[Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619

--- Comment #1 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:7a5a4a4467b2e18ff4fe24f565e120280d3e6ba7

commit r14-9600-g7a5a4a4467b2e18ff4fe24f565e120280d3e6ba7
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Mar 21 17:48:38 2024 -0400

    analyzer: fix ignored constraints involving casts [PR113619]

    gcc/analyzer/ChangeLog:
            PR analyzer/113619
            * region-model.cc (region_model::eval_condition): Fix
            cast-handling from r14-3632-ge7b267444045c5 so that if those give
            an unknown result, we continue trying the constraint manager.

    gcc/testsuite/ChangeLog:
            PR analyzer/113619
            * c-c++-common/analyzer/taint-divisor-pr113619.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit.