From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id 20F283858410 for ; Fri, 17 Mar 2023 12:43:55 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 20F283858410 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1679057034; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references; bh=8D4yXQ3rXHtffMXISrYwpXYW09cSUaxiytqTlEN4yrw=; b=Tja1/BU2DDS/vjgSrCUBSk1+RhsW++gr3yk6mqKRggxaN9B7qMrrz/sS8fiAmCIsnPaQv+ IBrWPEi/6gS7qf12GBiBO/JW8zp0Mu82FajAAiDzGtTrrcR0RF9ua+HtA8yc47Zb9NKWGL qxODq8iALBqv7hj5fVrzpuwixmgbImg= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-619-sJMJYw4cO1KTCDb92-Oh7g-1; Fri, 17 Mar 2023 08:43:53 -0400 X-MC-Unique: sJMJYw4cO1KTCDb92-Oh7g-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 8FEFF1C08975; Fri, 17 Mar 2023 12:43:52 +0000 (UTC) Received: from tucnak.zalov.cz (unknown [10.39.192.16]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 5000E492B00; Fri, 17 Mar 2023 12:43:52 +0000 (UTC) Received: from tucnak.zalov.cz (localhost [127.0.0.1]) by tucnak.zalov.cz (8.17.1/8.17.1) with ESMTPS id 32HChn09922624 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 17 Mar 2023 13:43:50 +0100 Received: (from jakub@localhost) by tucnak.zalov.cz (8.17.1/8.17.1/Submit) id 32HChmGF922623; Fri, 17 Mar 2023 13:43:48 +0100 Date: Fri, 17 Mar 2023 13:43:48 +0100 From: Jakub Jelinek To: Richard Biener Cc: gcc-patches@gcc.gnu.org, aldyh@redhat.com, amacleod@redhat.com Subject: Re: [PATCH] tree-optimization/109170 - bogus use-after-free with __builtin_expect Message-ID: Reply-To: Jakub Jelinek References: <20230317121833.16A961346F@imap2.suse-dmz.suse.de> MIME-Version: 1.0 In-Reply-To: <20230317121833.16A961346F@imap2.suse-dmz.suse.de> X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-9.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On Fri, Mar 17, 2023 at 01:18:32PM +0100, Richard Biener wrote: > The following adds a missing range-op for __builtin_expect which > helps -Wuse-after-free to detect the case a realloc original > pointer is used when the result was NULL. > > Bootstrap and regtest running on x86_64-unknown-linux-gnu, OK? > > PR tree-optimization/109170 > * gimple-range-op.cc (cfn_expect): New. > (gimple_range_op_handler::maybe_builtin_call): Handle > __builtin_expect. > > * gcc.dg/Wuse-after-free-pr109170.c: New testcase. Shouldn't that be something we handle generically for all ERF_RETURNS_ARG calls (and not just for irange, but for any supported ranges)? Though, admittedly __builtin_expect probably doesn't set that and all the other current builtins with ERF_RETURNS_ARG return pointers I think. So, I think LGTM, but give Andrew/Aldy a chance to chime in. > diff --git a/gcc/gimple-range-op.cc b/gcc/gimple-range-op.cc > index a5d625387e7..f3d6e29e58d 100644 > --- a/gcc/gimple-range-op.cc > +++ b/gcc/gimple-range-op.cc > @@ -309,6 +309,25 @@ public: > } > } op_cfn_constant_p; > > +// Implement range operator for integral CFN_BUILT_IN_EXPECT. > +class cfn_expect : public range_operator > +{ > +public: > + using range_operator::fold_range; > + virtual bool fold_range (irange &r, tree, const irange &lh, > + const irange &, relation_trio) const > + { > + r = lh; > + return true; > + } > + virtual bool op1_range (irange &r, tree, const irange &lhs, > + const irange &, relation_trio) const > + { > + r = lhs; > + return true; > + } > +} op_cfn_expect; > + > // Implement range operator for CFN_BUILT_IN_SIGNBIT. > class cfn_signbit : public range_operator_float > { > @@ -966,6 +985,12 @@ gimple_range_op_handler::maybe_builtin_call () > m_int = &op_cfn_parity; > break; > > + case CFN_BUILT_IN_EXPECT: > + m_valid = true; > + m_op1 = gimple_call_arg (call, 0); > + m_int = &op_cfn_expect; > + break; > + > default: > break; > } > diff --git a/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c b/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c > new file mode 100644 > index 00000000000..fa7dc66d66c > --- /dev/null > +++ b/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c > @@ -0,0 +1,15 @@ > +/* { dg-do compile } */ > +/* { dg-options "-O2 -Wuse-after-free" } */ > + > +unsigned long bufmax = 0; > +unsigned long __open_catalog_bufmax; > +void *realloc(void *, __SIZE_TYPE__); > +void free(void *); > + > +void __open_catalog(char *buf) > +{ > + char *old_buf = buf; > + buf = realloc (buf, bufmax); > + if (__builtin_expect ((buf == ((void *)0)), 0)) > + free (old_buf); /* { dg-bogus "used after" } */ > +} > -- > 2.35.3 Jakub