From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pj1-x1034.google.com (mail-pj1-x1034.google.com [IPv6:2607:f8b0:4864:20::1034]) by sourceware.org (Postfix) with ESMTPS id 034763858401 for ; Wed, 10 Aug 2022 15:04:46 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 034763858401 Received: by mail-pj1-x1034.google.com with SMTP id q7-20020a17090a7a8700b001f300db8677so2379239pjf.5 for ; Wed, 10 Aug 2022 08:04:45 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc; bh=y07TJFSKhhcBT4H4XteqbXsSWiWKPiGQZH3VO4/nmPE=; b=y8uDrr2iTYCzuLc8q2csFRcbRI3koYYOmLh+8IJvWF2e50NUw01dDcGWWEDSBblm4E 9LRImIgDjnQHevVilUVU3gJv5Fjqfj8f6b6O8VMuK5/ZXe1TtoFe7R1ksxuNcMVgQxoj o9O1ueNDKPuQcs7FptJcruz3FEpX2t+bghai86KXkNTZ2U22vw4a4hayjLaRPCZnrKX+ B25z8HMUc1ZGXfFKtJbAwGf/xj9DsJJ57JTJVwHi/+jkinBQgKHwaj3RihSVxZhTEaCv VLrXxzhWE8o4eyv1mGmP2wzYZZjL0R1Ri2M8/tj0vaPqLvpHzoY5HdETx61+LihAZpug Fskw== X-Gm-Message-State: ACgBeo2fs5/aMRjCuN1Wmnqn4N2Dp8vMbdtygj+8p0ekY3GfC/nr8Ck6 z8Ha3sjSsg0c/zRn/Uf+8I0Jl81Y68z3P+c+X8E= X-Google-Smtp-Source: AA6agR6dC9U6s64Yrb8HchN+qWK7KJ4FuP/MLnEEvLcMhAw7AVb/g97HraXVj9xFlSWGJVba3BUnpfOXyLSdmf9mIWE= X-Received: by 2002:a17:90b:3849:b0:1f4:89bb:14dc with SMTP id nl9-20020a17090b384900b001f489bb14dcmr4320183pjb.144.1660143884829; Wed, 10 Aug 2022 08:04:44 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Mir Immad Date: Wed, 10 Aug 2022 20:34:32 +0530 Message-ID: Subject: Re: [PATCH] analyzer: fix ICE casued by dup2 in sm-fd.cc[PR106551] To: David Malcolm , gcc-patches@gcc.gnu.org X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_ENVFROM_END_DIGIT, FREEMAIL_FROM, GIT_PATCH_0, HTML_MESSAGE, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org Content-Type: text/plain; charset="UTF-8" X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2022 15:04:48 -0000 > if you convert the "int m;" locals into an extern global, like in > comment #0 of bug 106551, does that still trigger the crash on the > unpatched sm-fd.cc? Yes, it does, since m would be in "m_start" state. I'm sending an updated patch. Thanks Immad. On Wed, Aug 10, 2022 at 1:32 AM David Malcolm wrote: > On Tue, 2022-08-09 at 21:42 +0530, Immad Mir wrote: > > This patch fixes the ICE caused by valid_to_unchecked_state, > > at analyzer/sm-fd.cc by handling the m_start state in > > check_for_dup. > > > > Tested lightly on x86_64. > > > > gcc/analyzer/ChangeLog: > > PR analyzer/106551 > > * sm-fd.cc (check_for_dup): handle the m_start > > state when transitioning the state of LHS > > of dup, dup2 and dup3 call. > > > > gcc/testsuite/ChangeLog: > > * gcc.dg/analyzer/fd-dup-1.c: New testcases. > > > > Signed-off-by: Immad Mir > > --- > > gcc/analyzer/sm-fd.cc | 4 ++-- > > gcc/testsuite/gcc.dg/analyzer/fd-dup-1.c | 28 > > +++++++++++++++++++++++- > > 2 files changed, 29 insertions(+), 3 deletions(-) > > > > diff --git a/gcc/analyzer/sm-fd.cc b/gcc/analyzer/sm-fd.cc > > index 8bb76d72b05..c8b9930a7b6 100644 > > --- a/gcc/analyzer/sm-fd.cc > > +++ b/gcc/analyzer/sm-fd.cc > > @@ -983,7 +983,7 @@ fd_state_machine::check_for_dup (sm_context > > *sm_ctxt, const supernode *node, > > case DUP_1: > > if (lhs) > > { > > - if (is_constant_fd_p (state_arg_1)) > > + if (is_constant_fd_p (state_arg_1) || state_arg_1 == > > m_start) > > sm_ctxt->set_next_state (stmt, lhs, > > m_unchecked_read_write); > > else > > sm_ctxt->set_next_state (stmt, lhs, > > @@ -1011,7 +1011,7 @@ fd_state_machine::check_for_dup (sm_context > > *sm_ctxt, const supernode *node, > > file descriptor i.e the first argument. */ > > if (lhs) > > { > > - if (is_constant_fd_p (state_arg_1)) > > + if (is_constant_fd_p (state_arg_1) || state_arg_1 == > > m_start) > > sm_ctxt->set_next_state (stmt, lhs, > > m_unchecked_read_write); > > else > > sm_ctxt->set_next_state (stmt, lhs, > > diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-dup-1.c > > b/gcc/testsuite/gcc.dg/analyzer/fd-dup-1.c > > index eba2570568f..ed4d6de57db 100644 > > --- a/gcc/testsuite/gcc.dg/analyzer/fd-dup-1.c > > +++ b/gcc/testsuite/gcc.dg/analyzer/fd-dup-1.c > > @@ -220,4 +220,30 @@ test_19 (const char *path, void *buf) > > close (fd); > > } > > > > -} > > \ No newline at end of file > > +} > > + > > +void > > +test_20 () > > +{ > > + int m; > > + int fd = dup (m); /* { dg-warning "'dup' on possibly invalid > > file descriptor 'm'" } */ > > + close (fd); > > +} > > + > > +void > > +test_21 () > > +{ > > + int m; > > + int fd = dup2 (m, 1); /* { dg-warning "'dup2' on possibly > > invalid file descriptor 'm'" } */ > > + close (fd); > > +} > > + > > +void > > +test_22 (int flags) > > +{ > > + int m; > > + int fd = dup3 (m, 1, flags); /* { dg-warning "'dup3' on possibly > > invalid file descriptor 'm'" } */ > > + close (fd); > > +} > > Thanks for the updated patch. > > The test cases looked suspicious to me - I was wondering why the > analyzer doesn't complain about the uninitialized values being passed > to the various dup functions as parameters. So your test cases seem to > have uncovered a hidden pre-existing bug in the analyzer's > uninitialized value detection, which I've filed for myself to deal with > as PR analyzer/106573. > > If you convert the "int m;" locals into an extern global, like in > comment #0 of bug 106551, does that still trigger the crash on the > unpatched sm-fd.cc? If so, then that's greatly preferable as a > regression test, since otherwise I'll have to modify that test case > when I fix bug 106573. > > Dave > > > >