From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2209) id E815A384D6DC; Fri, 16 Dec 2022 19:51:06 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E815A384D6DC DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1671220266; bh=hTO4Sf9yE1G3fpRnKIjGDwT54uqv3iY8qj9ocoqweSQ=; h=From:To:Subject:Date:From; b=PxtEmm/PEeKn2ppBipqID6jybBSMxUftYNXzSTz9uHduOkL2mvmQCaJRpWbmPC5Nj iHdjRADPZz/6xv5bIBOR4AWvkZnGdfXmebvNyt7LVUl8aYTT9uM+S01mD3kFT2/zox tcV/WwDfxZmqnaF8CoD7BkuXnQDGdrfsw3x7Z4ec= MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="utf-8" From: David Malcolm To: gcc-cvs@gcc.gnu.org Subject: [gcc r13-4750] analyzer: add src_region param to region_model::check_for_poison [PR106479] X-Act-Checkin: gcc X-Git-Author: David Malcolm X-Git-Refname: refs/heads/master X-Git-Oldrev: b50fe16a3b2214c418ecc5febc0bb21bc17912b7 X-Git-Newrev: 2fdc8546b5c6cb1fe254e40b5bdd19ed6fbb44da Message-Id: <20221216195106.E815A384D6DC@sourceware.org> Date: Fri, 16 Dec 2022 19:51:06 +0000 (GMT) List-Id: https://gcc.gnu.org/g:2fdc8546b5c6cb1fe254e40b5bdd19ed6fbb44da commit r13-4750-g2fdc8546b5c6cb1fe254e40b5bdd19ed6fbb44da Author: David Malcolm Date: Fri Dec 16 14:50:07 2022 -0500 analyzer: add src_region param to region_model::check_for_poison [PR106479] PR analyzer/106479 notes that we don't always show the region-creation event for a memmove from an uninitialized stack region. This occurs when using kf_memcpy_memmove. Fix by passing a src_region hint to region_model::check_for_poison. gcc/analyzer/ChangeLog: PR analyzer/106479 * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region to region_model::check_for_poison. * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL region to region_model::check_for_poison. * region-model.cc (region_model::check_for_poison): Add "src_region" param, and pass it to poisoned_value_diagnostic. (region_model::on_assignment): Pass NULL region to region_model::check_for_poison. (region_model::get_rvalue): Likewise. * region-model.h (region_model::check_for_poison): Add "src_region" param. * sm-fd.cc (fd_state_machine::on_accept): Pass in source region to region_model::check_for_poison. * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to region_model::check_for_poison. (kf_va_arg::impl_call_pre): Pass in source region to region_model::check_for_poison. gcc/testsuite/ChangeLog: PR analyzer/106479 * gcc.dg/analyzer/pr104308.c (test_memmove_within_uninit): Remove xfail on region creation event. Signed-off-by: David Malcolm Diff: --- gcc/analyzer/kf.cc | 2 +- gcc/analyzer/region-model-asm.cc | 2 +- gcc/analyzer/region-model.cc | 11 ++++++----- gcc/analyzer/region-model.h | 1 + gcc/analyzer/sm-fd.cc | 1 + gcc/analyzer/varargs.cc | 3 ++- gcc/testsuite/gcc.dg/analyzer/pr104308.c | 2 +- 7 files changed, 13 insertions(+), 9 deletions(-) diff --git a/gcc/analyzer/kf.cc b/gcc/analyzer/kf.cc index ff2f1b1ef9c..6088bfc72c0 100644 --- a/gcc/analyzer/kf.cc +++ b/gcc/analyzer/kf.cc @@ -288,7 +288,7 @@ kf_memcpy_memmove::impl_call_pre (const call_details &cd) const const svalue *src_contents_sval = model->get_store_value (sized_src_reg, cd.get_ctxt ()); model->check_for_poison (src_contents_sval, cd.get_arg_tree (1), - cd.get_ctxt ()); + sized_src_reg, cd.get_ctxt ()); model->set_value (sized_dest_reg, src_contents_sval, cd.get_ctxt ()); } diff --git a/gcc/analyzer/region-model-asm.cc b/gcc/analyzer/region-model-asm.cc index 171b2496f58..ac32c6f06f7 100644 --- a/gcc/analyzer/region-model-asm.cc +++ b/gcc/analyzer/region-model-asm.cc @@ -226,7 +226,7 @@ region_model::on_asm_stmt (const gasm *stmt, region_model_context *ctxt) tree src_expr = input_tvec[i]; const svalue *src_sval = get_rvalue (src_expr, ctxt); - check_for_poison (src_sval, src_expr, ctxt); + check_for_poison (src_sval, src_expr, NULL, ctxt); input_svals.quick_push (src_sval); reachable_regs.handle_sval (src_sval); diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc index f6cd34f4c22..55064400a08 100644 --- a/gcc/analyzer/region-model.cc +++ b/gcc/analyzer/region-model.cc @@ -1004,11 +1004,13 @@ due_to_ifn_deferred_init_p (const gassign *assign_stmt) /* Check for SVAL being poisoned, adding a warning to CTXT. Return SVAL, or, if a warning is added, another value, to avoid - repeatedly complaining about the same poisoned value in followup code. */ + repeatedly complaining about the same poisoned value in followup code. + SRC_REGION is a hint about where SVAL came from, and can be NULL. */ const svalue * region_model::check_for_poison (const svalue *sval, tree expr, + const region *src_region, region_model_context *ctxt) const { if (!ctxt) @@ -1046,8 +1048,7 @@ region_model::check_for_poison (const svalue *sval, the tree other than via the def stmts, using fixup_tree_for_diagnostic. */ tree diag_arg = fixup_tree_for_diagnostic (expr); - const region *src_region = NULL; - if (pkind == POISON_KIND_UNINIT) + if (src_region == NULL && pkind == POISON_KIND_UNINIT) src_region = get_region_for_poisoned_expr (expr); if (ctxt->warn (make_unique (diag_arg, pkind, @@ -1100,7 +1101,7 @@ region_model::on_assignment (const gassign *assign, region_model_context *ctxt) if (const svalue *sval = get_gassign_result (assign, ctxt)) { tree expr = get_diagnostic_tree_for_gassign (assign); - check_for_poison (sval, expr, ctxt); + check_for_poison (sval, expr, NULL, ctxt); set_value (lhs_reg, sval, ctxt); return; } @@ -2227,7 +2228,7 @@ region_model::get_rvalue (path_var pv, region_model_context *ctxt) const assert_compat_types (result_sval->get_type (), TREE_TYPE (pv.m_tree)); - result_sval = check_for_poison (result_sval, pv.m_tree, ctxt); + result_sval = check_for_poison (result_sval, pv.m_tree, NULL, ctxt); return result_sval; } diff --git a/gcc/analyzer/region-model.h b/gcc/analyzer/region-model.h index 626b10d2538..e8767e5ed41 100644 --- a/gcc/analyzer/region-model.h +++ b/gcc/analyzer/region-model.h @@ -485,6 +485,7 @@ class region_model const svalue *check_for_poison (const svalue *sval, tree expr, + const region *src_region, region_model_context *ctxt) const; void check_region_for_write (const region *dest_reg, diff --git a/gcc/analyzer/sm-fd.cc b/gcc/analyzer/sm-fd.cc index 50e1313f85b..03bcdfa60b4 100644 --- a/gcc/analyzer/sm-fd.cc +++ b/gcc/analyzer/sm-fd.cc @@ -1992,6 +1992,7 @@ fd_state_machine::on_accept (const call_details &cd, build_int_cst (TREE_TYPE (len_ptr), 0)); old_len_sval = model->check_for_poison (old_len_sval, star_len_ptr, + len_reg, cd.get_ctxt ()); if (successful) { diff --git a/gcc/analyzer/varargs.cc b/gcc/analyzer/varargs.cc index 1a3bddee4b2..5414f233ab1 100644 --- a/gcc/analyzer/varargs.cc +++ b/gcc/analyzer/varargs.cc @@ -723,6 +723,7 @@ kf_va_copy::impl_call_pre (const call_details &cd) const in_va_list = model->check_for_poison (in_va_list, get_va_list_diag_arg (cd.get_arg_tree (1)), + NULL, cd.get_ctxt ()); const region *out_dst_reg @@ -1004,7 +1005,7 @@ kf_va_arg::impl_call_pre (const call_details &cd) const ap_sval = cast; tree va_list_tree = get_va_list_diag_arg (cd.get_arg_tree (0)); - ap_sval = model->check_for_poison (ap_sval, va_list_tree, ctxt); + ap_sval = model->check_for_poison (ap_sval, va_list_tree, ap_reg, ctxt); if (const region *impl_reg = ap_sval->maybe_get_region ()) { diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104308.c b/gcc/testsuite/gcc.dg/analyzer/pr104308.c index e6a2c8821bf..a3a0cbb7317 100644 --- a/gcc/testsuite/gcc.dg/analyzer/pr104308.c +++ b/gcc/testsuite/gcc.dg/analyzer/pr104308.c @@ -6,7 +6,7 @@ int test_memmove_within_uninit (void) { - char s[5]; /* { dg-message "region created on stack here" "" { xfail riscv*-*-* } } */ + char s[5]; /* { dg-message "region created on stack here" } */ memmove(s, s + 1, 2); /* { dg-warning "use of uninitialized value" } */ return 0; }