public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c
@ 2024-01-26 15:00 dmalcolm at gcc dot gnu.org
2024-02-15 14:33 ` [Bug analyzer/113619] [14 Regression] " dmalcolm at gcc dot gnu.org
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2024-01-26 15:00 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619
Bug ID: 113619
Summary: -Wanalyzer-tainted-divisor false positive seen in
Linux kernel's fs/ceph/ioctl.c
Product: gcc
Version: 14.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106358
Target Milestone: ---
Reduced from false positive in Linux kernel's kernel's fs/ceph/ioctl.c:
__extension__ typedef unsigned long long __u64;
struct ceph_ioctl_layout
{
__u64 stripe_unit, object_size;
};
static long
__validate_layout(struct ceph_ioctl_layout* l)
{
if ((l->object_size & ~(~(((1UL) << 12) - 1))) ||
(l->stripe_unit & ~(~(((1UL) << 12) - 1))) ||
((unsigned)l->stripe_unit != 0 &&
((unsigned)l->object_size % (unsigned)l->stripe_unit)))
return -22;
return 0;
}
long
__attribute__((tainted_args))
ceph_ioctl_set_layout_policy(struct ceph_ioctl_layout l)
{
int err;
err = __validate_layout(&l);
if (err)
return err;
return err;
}
t.c: In function ‘__validate_layout’:
t.c:13:34: warning: use of attacker-controlled value ‘l.stripe_unit’ as divisor
without checking for zero [CWE-369] [-Wanalyzer-tainted-divisor]
13 | ((unsigned)l->object_size % (unsigned)l->stripe_unit)))
| ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~
‘ceph_ioctl_set_layout_policy’: event 1
|
| 20 | ceph_ioctl_set_layout_policy(struct ceph_ioctl_layout l)
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (1) function ‘ceph_ioctl_set_layout_policy’ marked with
‘__attribute__((tainted_args))’
|
+--> ‘ceph_ioctl_set_layout_policy’: events 2-3
|
| 20 | ceph_ioctl_set_layout_policy(struct ceph_ioctl_layout l)
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (2) entry to ‘ceph_ioctl_set_layout_policy’
|......
| 23 | err = __validate_layout(&l);
| | ~~~~~~~~~~~~~~~~~~~~~
| | |
| | (3) calling ‘__validate_layout’ from
‘ceph_ioctl_set_layout_policy’
|
+--> ‘__validate_layout’: events 4-11
|
| 8 | __validate_layout(struct ceph_ioctl_layout* l)
| | ^~~~~~~~~~~~~~~~~
| | |
| | (4) entry to ‘__validate_layout’
| 9 | {
| 10 | if ((l->object_size & ~(~(((1UL) << 12) - 1))) ||
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | | |
| | (5) following ‘false’ branch... (7)
following ‘false’ branch...
| 11 | (l->stripe_unit & ~(~(((1UL) << 12) - 1))) ||
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | | |
| | (6) ...to here (9)
following ‘true’ branch...
| 12 | ((unsigned)l->stripe_unit != 0 &&
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (8) ...to here
| 13 | ((unsigned)l->object_size %
(unsigned)l->stripe_unit)))
| |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | | |
| | (10) ...to here (11) use of
attacker-controlled value ‘l.stripe_unit’ as divisor without checking for zero
|
...whereas (unsigned)l->stripe_unit != 0 is checked at line 12.
Affects trunk: https://godbolt.org/z/3qfx6scT8
Might show up on earlier releases, but taint state machine required opt-in on
them.
Referenced Bugs:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
[Bug 106358] [meta-bug] tracker bug for building the Linux kernel with
-fanalyzer
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c
2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org
@ 2024-02-15 14:33 ` dmalcolm at gcc dot gnu.org
2024-03-04 13:08 ` rguenth at gcc dot gnu.org
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2024-02-15 14:33 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Ever confirmed|0 |1
Last reconfirmed| |2024-02-15
Summary|-Wanalyzer-tainted-divisor |[14 Regression]
|false positive seen in |-Wanalyzer-tainted-divisor
|Linux kernel's |false positive seen in
|fs/ceph/ioctl.c |Linux kernel's
| |fs/ceph/ioctl.c
Status|UNCONFIRMED |NEW
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c
2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org
2024-02-15 14:33 ` [Bug analyzer/113619] [14 Regression] " dmalcolm at gcc dot gnu.org
@ 2024-03-04 13:08 ` rguenth at gcc dot gnu.org
2024-03-07 20:43 ` law at gcc dot gnu.org
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: rguenth at gcc dot gnu.org @ 2024-03-04 13:08 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|--- |14.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c
2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org
2024-02-15 14:33 ` [Bug analyzer/113619] [14 Regression] " dmalcolm at gcc dot gnu.org
2024-03-04 13:08 ` rguenth at gcc dot gnu.org
@ 2024-03-07 20:43 ` law at gcc dot gnu.org
2024-03-21 21:49 ` cvs-commit at gcc dot gnu.org
2024-03-21 21:55 ` dmalcolm at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: law at gcc dot gnu.org @ 2024-03-07 20:43 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619
Jeffrey A. Law <law at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P3 |P2
CC| |law at gcc dot gnu.org
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c
2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org
` (2 preceding siblings ...)
2024-03-07 20:43 ` law at gcc dot gnu.org
@ 2024-03-21 21:49 ` cvs-commit at gcc dot gnu.org
2024-03-21 21:55 ` dmalcolm at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2024-03-21 21:49 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619
--- Comment #1 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:
https://gcc.gnu.org/g:7a5a4a4467b2e18ff4fe24f565e120280d3e6ba7
commit r14-9600-g7a5a4a4467b2e18ff4fe24f565e120280d3e6ba7
Author: David Malcolm <dmalcolm@redhat.com>
Date: Thu Mar 21 17:48:38 2024 -0400
analyzer: fix ignored constraints involving casts [PR113619]
gcc/analyzer/ChangeLog:
PR analyzer/113619
* region-model.cc (region_model::eval_condition): Fix
cast-handling from r14-3632-ge7b267444045c5 so that if those give
an unknown result, we continue trying the constraint manager.
gcc/testsuite/ChangeLog:
PR analyzer/113619
* c-c++-common/analyzer/taint-divisor-pr113619.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c
2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org
` (3 preceding siblings ...)
2024-03-21 21:49 ` cvs-commit at gcc dot gnu.org
@ 2024-03-21 21:55 ` dmalcolm at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2024-03-21 21:55 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|NEW |RESOLVED
--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-03-21 21:55 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org
2024-02-15 14:33 ` [Bug analyzer/113619] [14 Regression] " dmalcolm at gcc dot gnu.org
2024-03-04 13:08 ` rguenth at gcc dot gnu.org
2024-03-07 20:43 ` law at gcc dot gnu.org
2024-03-21 21:49 ` cvs-commit at gcc dot gnu.org
2024-03-21 21:55 ` dmalcolm at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).