From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id C1F2C3950428; Mon,  1 Feb 2021 20:14:52 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org C1F2C3950428
From: "cvs-commit at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug analyzer/98918] [11 Regression] Analyzer false positives due to
 sm-state involving UNKNOWN pointers
Date: Mon, 01 Feb 2021 20:14:52 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: analyzer
X-Bugzilla-Version: 11.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: cvs-commit at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: dmalcolm at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-98918-4-rgIeEwgQBD@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-98918-4@http.gcc.gnu.org/bugzilla/>
References: <bug-98918-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Feb 2021 20:14:52 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D98918

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:11d4ec5d45c02a19b8ff9d7f26800637ad563e05

commit r11-7024-g11d4ec5d45c02a19b8ff9d7f26800637ad563e05
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Feb 1 15:13:39 2021 -0500

    analyzer: fix false positives with *UNKNOWN_PTR [PR98918]

    PR analyzer/98918 reports various false positives and state explosions
    on correct code that frees nodes and other pointers in a singly-linked
    list.

    The issue is that state-merger in the loop leads to UNKNOWN_VALUEs,
    and these are then erroneously used to form compound symbolic values
    and regions, such as;
      INIT_VAL((*UNKNOWN(struct marker *)).ref)
    and:
      (*INIT_VAL((*UNKNOWN(struct marker * *))))
    The malloc state machine then treats these symbolic values as
    identifying specific pointers, and thus e.g. erroneously reports a
    double-free when
      INIT_VAL((*UNKNOWN(struct marker *)).ref)
    is freed twice (on subsequent iterations of the loop).

    Similarly, the increasingly complex compound symbolic values have
    sm-state which prevents state merging, and eventually lead to the
    analysis hitting safety limits and stopping.

    This patch makes various compound values involving UNKNOWN be
    themselves UNKNOWN, resolving both the false positives and the state
    explosions.

    gcc/analyzer/ChangeLog:
            PR analyzer/98918
            * region-model-manager.cc
            (region_model_manager::get_or_create_initial_value):
            Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
            (region_model_manager::get_field_region): Fold the value
            of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.

    gcc/testsuite/ChangeLog:
            PR analyzer/98918
            * gcc.dg/analyzer/pr98918.c: New test.=