public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
* [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c @ 2024-01-26 15:00 dmalcolm at gcc dot gnu.org 2024-02-15 14:33 ` [Bug analyzer/113619] [14 Regression] " dmalcolm at gcc dot gnu.org ` (4 more replies) 0 siblings, 5 replies; 6+ messages in thread From: dmalcolm at gcc dot gnu.org @ 2024-01-26 15:00 UTC (permalink / raw) To: gcc-bugs https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619 Bug ID: 113619 Summary: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c Product: gcc Version: 14.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: analyzer Assignee: dmalcolm at gcc dot gnu.org Reporter: dmalcolm at gcc dot gnu.org Blocks: 106358 Target Milestone: --- Reduced from false positive in Linux kernel's kernel's fs/ceph/ioctl.c: __extension__ typedef unsigned long long __u64; struct ceph_ioctl_layout { __u64 stripe_unit, object_size; }; static long __validate_layout(struct ceph_ioctl_layout* l) { if ((l->object_size & ~(~(((1UL) << 12) - 1))) || (l->stripe_unit & ~(~(((1UL) << 12) - 1))) || ((unsigned)l->stripe_unit != 0 && ((unsigned)l->object_size % (unsigned)l->stripe_unit))) return -22; return 0; } long __attribute__((tainted_args)) ceph_ioctl_set_layout_policy(struct ceph_ioctl_layout l) { int err; err = __validate_layout(&l); if (err) return err; return err; } t.c: In function ‘__validate_layout’: t.c:13:34: warning: use of attacker-controlled value ‘l.stripe_unit’ as divisor without checking for zero [CWE-369] [-Wanalyzer-tainted-divisor] 13 | ((unsigned)l->object_size % (unsigned)l->stripe_unit))) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~ ‘ceph_ioctl_set_layout_policy’: event 1 | | 20 | ceph_ioctl_set_layout_policy(struct ceph_ioctl_layout l) | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (1) function ‘ceph_ioctl_set_layout_policy’ marked with ‘__attribute__((tainted_args))’ | +--> ‘ceph_ioctl_set_layout_policy’: events 2-3 | | 20 | ceph_ioctl_set_layout_policy(struct ceph_ioctl_layout l) | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (2) entry to ‘ceph_ioctl_set_layout_policy’ |...... | 23 | err = __validate_layout(&l); | | ~~~~~~~~~~~~~~~~~~~~~ | | | | | (3) calling ‘__validate_layout’ from ‘ceph_ioctl_set_layout_policy’ | +--> ‘__validate_layout’: events 4-11 | | 8 | __validate_layout(struct ceph_ioctl_layout* l) | | ^~~~~~~~~~~~~~~~~ | | | | | (4) entry to ‘__validate_layout’ | 9 | { | 10 | if ((l->object_size & ~(~(((1UL) << 12) - 1))) || | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | | (5) following ‘false’ branch... (7) following ‘false’ branch... | 11 | (l->stripe_unit & ~(~(((1UL) << 12) - 1))) || | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | | (6) ...to here (9) following ‘true’ branch... | 12 | ((unsigned)l->stripe_unit != 0 && | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (8) ...to here | 13 | ((unsigned)l->object_size % (unsigned)l->stripe_unit))) | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | | (10) ...to here (11) use of attacker-controlled value ‘l.stripe_unit’ as divisor without checking for zero | ...whereas (unsigned)l->stripe_unit != 0 is checked at line 12. Affects trunk: https://godbolt.org/z/3qfx6scT8 Might show up on earlier releases, but taint state machine required opt-in on them. Referenced Bugs: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358 [Bug 106358] [meta-bug] tracker bug for building the Linux kernel with -fanalyzer ^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c 2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org @ 2024-02-15 14:33 ` dmalcolm at gcc dot gnu.org 2024-03-04 13:08 ` rguenth at gcc dot gnu.org ` (3 subsequent siblings) 4 siblings, 0 replies; 6+ messages in thread From: dmalcolm at gcc dot gnu.org @ 2024-02-15 14:33 UTC (permalink / raw) To: gcc-bugs https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619 David Malcolm <dmalcolm at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Ever confirmed|0 |1 Last reconfirmed| |2024-02-15 Summary|-Wanalyzer-tainted-divisor |[14 Regression] |false positive seen in |-Wanalyzer-tainted-divisor |Linux kernel's |false positive seen in |fs/ceph/ioctl.c |Linux kernel's | |fs/ceph/ioctl.c Status|UNCONFIRMED |NEW ^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c 2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org 2024-02-15 14:33 ` [Bug analyzer/113619] [14 Regression] " dmalcolm at gcc dot gnu.org @ 2024-03-04 13:08 ` rguenth at gcc dot gnu.org 2024-03-07 20:43 ` law at gcc dot gnu.org ` (2 subsequent siblings) 4 siblings, 0 replies; 6+ messages in thread From: rguenth at gcc dot gnu.org @ 2024-03-04 13:08 UTC (permalink / raw) To: gcc-bugs https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619 Richard Biener <rguenth at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |14.0 ^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c 2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org 2024-02-15 14:33 ` [Bug analyzer/113619] [14 Regression] " dmalcolm at gcc dot gnu.org 2024-03-04 13:08 ` rguenth at gcc dot gnu.org @ 2024-03-07 20:43 ` law at gcc dot gnu.org 2024-03-21 21:49 ` cvs-commit at gcc dot gnu.org 2024-03-21 21:55 ` dmalcolm at gcc dot gnu.org 4 siblings, 0 replies; 6+ messages in thread From: law at gcc dot gnu.org @ 2024-03-07 20:43 UTC (permalink / raw) To: gcc-bugs https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619 Jeffrey A. Law <law at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P3 |P2 CC| |law at gcc dot gnu.org ^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c 2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org ` (2 preceding siblings ...) 2024-03-07 20:43 ` law at gcc dot gnu.org @ 2024-03-21 21:49 ` cvs-commit at gcc dot gnu.org 2024-03-21 21:55 ` dmalcolm at gcc dot gnu.org 4 siblings, 0 replies; 6+ messages in thread From: cvs-commit at gcc dot gnu.org @ 2024-03-21 21:49 UTC (permalink / raw) To: gcc-bugs https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619 --- Comment #1 from GCC Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>: https://gcc.gnu.org/g:7a5a4a4467b2e18ff4fe24f565e120280d3e6ba7 commit r14-9600-g7a5a4a4467b2e18ff4fe24f565e120280d3e6ba7 Author: David Malcolm <dmalcolm@redhat.com> Date: Thu Mar 21 17:48:38 2024 -0400 analyzer: fix ignored constraints involving casts [PR113619] gcc/analyzer/ChangeLog: PR analyzer/113619 * region-model.cc (region_model::eval_condition): Fix cast-handling from r14-3632-ge7b267444045c5 so that if those give an unknown result, we continue trying the constraint manager. gcc/testsuite/ChangeLog: PR analyzer/113619 * c-c++-common/analyzer/taint-divisor-pr113619.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com> ^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug analyzer/113619] [14 Regression] -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c 2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org ` (3 preceding siblings ...) 2024-03-21 21:49 ` cvs-commit at gcc dot gnu.org @ 2024-03-21 21:55 ` dmalcolm at gcc dot gnu.org 4 siblings, 0 replies; 6+ messages in thread From: dmalcolm at gcc dot gnu.org @ 2024-03-21 21:55 UTC (permalink / raw) To: gcc-bugs https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619 David Malcolm <dmalcolm at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> --- Should be fixed by the above commit. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-03-21 21:55 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2024-01-26 15:00 [Bug analyzer/113619] New: -Wanalyzer-tainted-divisor false positive seen in Linux kernel's fs/ceph/ioctl.c dmalcolm at gcc dot gnu.org 2024-02-15 14:33 ` [Bug analyzer/113619] [14 Regression] " dmalcolm at gcc dot gnu.org 2024-03-04 13:08 ` rguenth at gcc dot gnu.org 2024-03-07 20:43 ` law at gcc dot gnu.org 2024-03-21 21:49 ` cvs-commit at gcc dot gnu.org 2024-03-21 21:55 ` dmalcolm at gcc dot gnu.org
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).