From: David Malcolm <dmalcolm@redhat.com>
To: gcc-patches@gcc.gnu.org
Subject: [committed] analyzer: update "tainted" state of RHS in comparisons [PR106373]
Date: Wed, 20 Jul 2022 17:29:29 -0400 [thread overview]
Message-ID: <20220720212929.1490197-1-dmalcolm@redhat.com> (raw)
Doing so fixes various false positives from
-Wanalyzer-tainted-array-index at -O1 and above (e.g. seen on the
Linux kernel)
Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu.
Pushed to trunk as r13-1768-g5e830693dd3356.
gcc/analyzer/ChangeLog:
PR analyzer/106373
* sm-taint.cc (taint_state_machine::on_condition): Potentially
update the state of the RHS as well as the LHS.
gcc/testsuite/ChangeLog:
PR analyzer/106373
* gcc.dg/analyzer/torture/taint-read-index-3.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
---
gcc/analyzer/sm-taint.cc | 18 +++++--
.../analyzer/torture/taint-read-index-3.c | 52 +++++++++++++++++++
2 files changed, 67 insertions(+), 3 deletions(-)
create mode 100644 gcc/testsuite/gcc.dg/analyzer/torture/taint-read-index-3.c
diff --git a/gcc/analyzer/sm-taint.cc b/gcc/analyzer/sm-taint.cc
index 9cb78886c9f..0486c01aaca 100644
--- a/gcc/analyzer/sm-taint.cc
+++ b/gcc/analyzer/sm-taint.cc
@@ -830,13 +830,11 @@ taint_state_machine::on_condition (sm_context *sm_ctxt,
const gimple *stmt,
const svalue *lhs,
enum tree_code op,
- const svalue *rhs ATTRIBUTE_UNUSED) const
+ const svalue *rhs) const
{
if (stmt == NULL)
return;
- // TODO: this doesn't use the RHS; should we make it symmetric?
-
// TODO
switch (op)
{
@@ -845,10 +843,17 @@ taint_state_machine::on_condition (sm_context *sm_ctxt,
case GE_EXPR:
case GT_EXPR:
{
+ /* (LHS >= RHS) or (LHS > RHS)
+ LHS gains a lower bound
+ RHS gains an upper bound. */
sm_ctxt->on_transition (node, stmt, lhs, m_tainted,
m_has_lb);
sm_ctxt->on_transition (node, stmt, lhs, m_has_ub,
m_stop);
+ sm_ctxt->on_transition (node, stmt, rhs, m_tainted,
+ m_has_ub);
+ sm_ctxt->on_transition (node, stmt, rhs, m_has_lb,
+ m_stop);
}
break;
case LE_EXPR:
@@ -896,10 +901,17 @@ taint_state_machine::on_condition (sm_context *sm_ctxt,
}
}
+ /* (LHS <= RHS) or (LHS < RHS)
+ LHS gains an upper bound
+ RHS gains a lower bound. */
sm_ctxt->on_transition (node, stmt, lhs, m_tainted,
m_has_ub);
sm_ctxt->on_transition (node, stmt, lhs, m_has_lb,
m_stop);
+ sm_ctxt->on_transition (node, stmt, rhs, m_tainted,
+ m_has_lb);
+ sm_ctxt->on_transition (node, stmt, rhs, m_has_ub,
+ m_stop);
}
break;
default:
diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/taint-read-index-3.c b/gcc/testsuite/gcc.dg/analyzer/torture/taint-read-index-3.c
new file mode 100644
index 00000000000..8eb6061a08b
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/taint-read-index-3.c
@@ -0,0 +1,52 @@
+// TODO: remove need for the taint option:
+/* { dg-additional-options "-fanalyzer-checker=taint" } */
+/* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */
+
+struct raw_ep {
+ /* ...snip... */
+ int state;
+ /* ...snip... */
+};
+
+struct raw_dev {
+ /* ...snip... */
+ struct raw_ep eps[30];
+ int eps_num;
+ /* ...snip... */
+};
+
+int __attribute__((tainted_args))
+simplified_raw_ioctl_ep_disable(struct raw_dev *dev, unsigned long value)
+{
+ int ret = 0, i = value;
+
+ if (i < 0 || i >= dev->eps_num) {
+ ret = -16;
+ goto out_unlock;
+ }
+ if (dev->eps[i].state == 0) { /* { dg-bogus "attacker-controlled" } */
+ ret = -22;
+ goto out_unlock;
+ }
+
+out_unlock:
+ return ret;
+}
+
+int __attribute__((tainted_args))
+test_2(struct raw_dev *dev, int i)
+{
+ int ret = 0;
+
+ if (i < 0 || i >= dev->eps_num) {
+ ret = -16;
+ goto out_unlock;
+ }
+ if (dev->eps[i].state == 0) { /* { dg-bogus "attacker-controlled" } */
+ ret = -22;
+ goto out_unlock;
+ }
+
+out_unlock:
+ return ret;
+}
--
2.26.3
reply other threads:[~2022-07-20 21:29 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220720212929.1490197-1-dmalcolm@redhat.com \
--to=dmalcolm@redhat.com \
--cc=gcc-patches@gcc.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).