public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/98918] New: Analyzer false positives due to sm-state involving UNKNOWN pointers
@ 2021-02-01 15:17 dmalcolm at gcc dot gnu.org
2021-02-01 15:20 ` [Bug analyzer/98918] " dmalcolm at gcc dot gnu.org
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2021-02-01 15:17 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98918
Bug ID: 98918
Summary: Analyzer false positives due to sm-state involving
UNKNOWN pointers
Product: gcc
Version: 11.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
Reported to me via email:
> gcc -fanalyzer for the sample code below gives false positive results.
> If I remove field ref from struct marker, no problem is reported.
test.c
======
#include <stdlib.h>
struct marker {
struct marker *next;
void *ref;
};
struct data {
struct marker *marker;
};
void data_free(struct data d)
{
struct marker *nm, *m;
m = d.marker;
while (m) {
nm = m->next;
free(m->ref);
free(m);
m = nm;
}
}
$ gcc test.c -fanalyzer -c
test.c: In function ‘data_free’:
test.c:17:20: warning: use after ‘free’ of ‘m’ [CWE-416]
[-Wanalyzer-use-after-free]
17 | nm = m->next;
| ~~~^~~~~~~~~
‘data_free’: events 1-18
|
| 16 | while (m) {
| | ^
| | |
| | (1) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (3) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (5) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (7) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (10) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (12) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (14) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (16) following ‘true’ branch (when ‘m’ is
non-NULL)...
| 17 | nm = m->next;
| | ~~~~~~~~~~~~
| | |
| | (2) ...to here
| | (4) ...to here
| | (6) ...to here
| | (8) ...to here
| | (11) ...to here
| | (13) ...to here
| | (15) ...to here
| | (17) ...to here
| | (18) use after ‘free’ of ‘m’; freed at (9)
| 18 | free(m->ref);
| 19 | free(m);
| | ~~~~~~~
| | |
| | (9) freed here
|
test.c:18:17: warning: double-‘free’ of ‘*m.ref’ [CWE-415]
[-Wanalyzer-double-free]
18 | free(m->ref);
| ^~~~~~~~~~~~
‘data_free’: events 1-16
|
| 16 | while (m) {
| | ^
| | |
| | (1) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (3) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (5) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (8) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (10) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (12) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (14) following ‘true’ branch (when ‘m’ is
non-NULL)...
| 17 | nm = m->next;
| | ~~~~~~~~~~~~
| | |
| | (2) ...to here
| | (4) ...to here
| | (6) ...to here
| | (9) ...to here
| | (11) ...to here
| | (13) ...to here
| | (15) ...to here
| 18 | free(m->ref);
| | ~~~~~~~~~~~~
| | |
| | (7) first ‘free’ here
| | (16) second ‘free’ here; first ‘free’ was
at (7)
|
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/98918] Analyzer false positives due to sm-state involving UNKNOWN pointers
2021-02-01 15:17 [Bug analyzer/98918] New: Analyzer false positives due to sm-state involving UNKNOWN pointers dmalcolm at gcc dot gnu.org
@ 2021-02-01 15:20 ` dmalcolm at gcc dot gnu.org
2021-02-01 15:23 ` [Bug analyzer/98918] [11 Regression] " dmalcolm at gcc dot gnu.org
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2021-02-01 15:20 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98918
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Ever confirmed|0 |1
Last reconfirmed| |2021-02-01
Status|UNCONFIRMED |ASSIGNED
--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Confirmed.
The issue occurs due to state-merger in the loop, where we eventually have
various symbolic values involving UNKNOWN in the iteration
e.g. at EN 69 a free(_1) where
cluster for: _1: INIT_VAL((*UNKNOWN(struct marker *)).ref)
and the analyzer treats the various UNKNOWNs as being the same, hence
eventually a double free when this symbolic value reoccurs.
There are also warnings from -Wanalyzer-too-complex:
t.c:16:17: warning: terminating analysis for this program point: callstring: []
before (SN: 3 stmt: 0): if (m_2 != 0B)EN: 7, EN: 17, EN: 26, EN: 35, EN: 45,
EN: 55, EN: 64, EN: 73 [-Wanalyzer-too-complex]
16 | while (m) {
| ^
t.c: At top level:
t.c:22:1: warning: analysis bailed out early (32 'after-snode' enodes; 110
enodes) [-Wanalyzer-too-complex]
22 | }
| ^
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/98918] [11 Regression] Analyzer false positives due to sm-state involving UNKNOWN pointers
2021-02-01 15:17 [Bug analyzer/98918] New: Analyzer false positives due to sm-state involving UNKNOWN pointers dmalcolm at gcc dot gnu.org
2021-02-01 15:20 ` [Bug analyzer/98918] " dmalcolm at gcc dot gnu.org
@ 2021-02-01 15:23 ` dmalcolm at gcc dot gnu.org
2021-02-01 20:14 ` cvs-commit at gcc dot gnu.org
2021-02-01 20:17 ` dmalcolm at gcc dot gnu.org
3 siblings, 0 replies; 5+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2021-02-01 15:23 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98918
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|Analyzer false positives |[11 Regression] Analyzer
|due to sm-state involving |false positives due to
|UNKNOWN pointers |sm-state involving UNKNOWN
| |pointers
--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Technically a regression in gcc 11 as the false positives don't appear with gcc
10.2 (the -Wanalyzer-too-complex warnings do).
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/98918] [11 Regression] Analyzer false positives due to sm-state involving UNKNOWN pointers
2021-02-01 15:17 [Bug analyzer/98918] New: Analyzer false positives due to sm-state involving UNKNOWN pointers dmalcolm at gcc dot gnu.org
2021-02-01 15:20 ` [Bug analyzer/98918] " dmalcolm at gcc dot gnu.org
2021-02-01 15:23 ` [Bug analyzer/98918] [11 Regression] " dmalcolm at gcc dot gnu.org
@ 2021-02-01 20:14 ` cvs-commit at gcc dot gnu.org
2021-02-01 20:17 ` dmalcolm at gcc dot gnu.org
3 siblings, 0 replies; 5+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2021-02-01 20:14 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98918
--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:
https://gcc.gnu.org/g:11d4ec5d45c02a19b8ff9d7f26800637ad563e05
commit r11-7024-g11d4ec5d45c02a19b8ff9d7f26800637ad563e05
Author: David Malcolm <dmalcolm@redhat.com>
Date: Mon Feb 1 15:13:39 2021 -0500
analyzer: fix false positives with *UNKNOWN_PTR [PR98918]
PR analyzer/98918 reports various false positives and state explosions
on correct code that frees nodes and other pointers in a singly-linked
list.
The issue is that state-merger in the loop leads to UNKNOWN_VALUEs,
and these are then erroneously used to form compound symbolic values
and regions, such as;
INIT_VAL((*UNKNOWN(struct marker *)).ref)
and:
(*INIT_VAL((*UNKNOWN(struct marker * *))))
The malloc state machine then treats these symbolic values as
identifying specific pointers, and thus e.g. erroneously reports a
double-free when
INIT_VAL((*UNKNOWN(struct marker *)).ref)
is freed twice (on subsequent iterations of the loop).
Similarly, the increasingly complex compound symbolic values have
sm-state which prevents state merging, and eventually lead to the
analysis hitting safety limits and stopping.
This patch makes various compound values involving UNKNOWN be
themselves UNKNOWN, resolving both the false positives and the state
explosions.
gcc/analyzer/ChangeLog:
PR analyzer/98918
* region-model-manager.cc
(region_model_manager::get_or_create_initial_value):
Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
(region_model_manager::get_field_region): Fold the value
of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
gcc/testsuite/ChangeLog:
PR analyzer/98918
* gcc.dg/analyzer/pr98918.c: New test.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/98918] [11 Regression] Analyzer false positives due to sm-state involving UNKNOWN pointers
2021-02-01 15:17 [Bug analyzer/98918] New: Analyzer false positives due to sm-state involving UNKNOWN pointers dmalcolm at gcc dot gnu.org
` (2 preceding siblings ...)
2021-02-01 20:14 ` cvs-commit at gcc dot gnu.org
@ 2021-02-01 20:17 ` dmalcolm at gcc dot gnu.org
3 siblings, 0 replies; 5+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2021-02-01 20:17 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98918
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Resolution|--- |FIXED
--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit; marking as resolved.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-02-01 20:17 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-01 15:17 [Bug analyzer/98918] New: Analyzer false positives due to sm-state involving UNKNOWN pointers dmalcolm at gcc dot gnu.org
2021-02-01 15:20 ` [Bug analyzer/98918] " dmalcolm at gcc dot gnu.org
2021-02-01 15:23 ` [Bug analyzer/98918] [11 Regression] " dmalcolm at gcc dot gnu.org
2021-02-01 20:14 ` cvs-commit at gcc dot gnu.org
2021-02-01 20:17 ` dmalcolm at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).