From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id 01FF0385480D for ; Fri, 17 Mar 2023 14:03:57 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 01FF0385480D Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1679061837; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references; bh=MGLQzj8JjmhIGPGbdUtVJcdqYtPRSVOkBGpezTEYXDs=; b=Exd+oKPv1u703LurpvPVxhuPXOvzcrk6XE0Hbf7dyidjxOPdaB17WIbvfxPabMJNGIuWMp lnOEIfdxLxXzVg7n+C6v8NOFnlWMYFFP31vxDue7V4FeqtQuy3Anx2oSUDogBYUyqvlD0s x2uHpyYC+YfyCGTvRhxqK6FgEzJVuck= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-384-yY4EGuC4NwWkdmCnnZQsHQ-1; Fri, 17 Mar 2023 10:03:56 -0400 X-MC-Unique: yY4EGuC4NwWkdmCnnZQsHQ-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 38A201C01B51; Fri, 17 Mar 2023 14:03:56 +0000 (UTC) Received: from tucnak.zalov.cz (unknown [10.39.192.16]) by smtp.corp.redhat.com (Postfix) with ESMTPS id CA6E3C15BAE; Fri, 17 Mar 2023 14:03:52 +0000 (UTC) Received: from tucnak.zalov.cz (localhost [127.0.0.1]) by tucnak.zalov.cz (8.17.1/8.17.1) with ESMTPS id 32HE3lpK942628 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 17 Mar 2023 15:03:48 +0100 Received: (from jakub@localhost) by tucnak.zalov.cz (8.17.1/8.17.1/Submit) id 32HE3lBt942625; Fri, 17 Mar 2023 15:03:47 +0100 Date: Fri, 17 Mar 2023 15:03:46 +0100 From: Jakub Jelinek To: Richard Biener Cc: gcc-patches@gcc.gnu.org, aldyh@redhat.com, amacleod@redhat.com Subject: Re: [PATCH] tree-optimization/109170 - bogus use-after-free with __builtin_expect Message-ID: Reply-To: Jakub Jelinek References: <20230317121833.16A961346F@imap2.suse-dmz.suse.de> MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 3.1 on 10.11.54.8 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-9.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On Fri, Mar 17, 2023 at 01:55:51PM +0000, Richard Biener wrote: > > Anyway, I think it is fine to implement __builtin_expect this way > > for now, ERF_RETURNS_ARG will be more important for pointers, especially if > > we propagate something more than just maybe be/can't be/must be null. > > Don't you need to handle BUILT_IN_EXPECT_WITH_PROBABILITY the same though? > > Yes, BUILT_IN_ASSUME_ALIGNED would be another candidate. BUILT_IN_ASSUME_ALIGNED doesn't do that intentionally. E.g. tree-object-size.cc (pass_through_call) comments on this: unsigned rf = gimple_call_return_flags (call); if (rf & ERF_RETURNS_ARG) { unsigned argnum = rf & ERF_RETURN_ARG_MASK; if (argnum < gimple_call_num_args (call)) return gimple_call_arg (call, argnum); } /* __builtin_assume_aligned is intentionally not marked RET1. */ if (gimple_call_builtin_p (call, BUILT_IN_ASSUME_ALIGNED)) return gimple_call_arg (call, 0); The reason is that we don't want passes to propagate the argument to the return value but use a different SSA_NAME there, so that we can have there different alignment info. And as you show on the testcases, it probably isn't a good idea for BUILT_IN_EXPECT* either. So, perhaps use op_cfn_pass_through_arg1 for the ERF_RETURNS_ARG functions and BUILT_IN_EXPECT* ? > >From feb846cbff9774125d8401dfeacd8a4b9c2dccfa Mon Sep 17 00:00:00 2001 > From: Richard Biener > Date: Fri, 17 Mar 2023 13:14:49 +0100 > Subject: [PATCH] tree-optimization/109170 - bogus use-after-free with > __builtin_expect > To: gcc-patches@gcc.gnu.org > > The following adds a missing range-op for __builtin_expect which > helps -Wuse-after-free to detect the case a realloc original > pointer is used when the result was NULL. The implementation > should handle all argument one pass-through builtins we handle > in the fnspec machinery. > > tree-optimization/109170 > * gimple-range-op.cc (cfn_pass_through_arg1): New. > (gimple_range_op_handler::maybe_builtin_call): Handle > __builtin_expect and similar via cfn_pass_through_arg1 > and inspecting the calls fnspec. > * builtins.cc (builtin_fnspec): Handle BUILT_IN_EXPECT > and BUILT_IN_EXPECT_WITH_PROBABILITY. > > * gcc.dg/Wuse-after-free-pr109170.c: New testcase. > --- > gcc/builtins.cc | 2 ++ > gcc/gimple-range-op.cc | 32 ++++++++++++++++++- > .../gcc.dg/Wuse-after-free-pr109170.c | 15 +++++++++ > 3 files changed, 48 insertions(+), 1 deletion(-) > create mode 100644 gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c > > diff --git a/gcc/builtins.cc b/gcc/builtins.cc > index 90246e214d6..56545027297 100644 > --- a/gcc/builtins.cc > +++ b/gcc/builtins.cc > @@ -11715,6 +11715,8 @@ builtin_fnspec (tree callee) > case BUILT_IN_RETURN_ADDRESS: > return ".c"; > case BUILT_IN_ASSUME_ALIGNED: > + case BUILT_IN_EXPECT: > + case BUILT_IN_EXPECT_WITH_PROBABILITY: > return "1cX "; > /* But posix_memalign stores a pointer into the memory pointed to > by its first argument. */ > diff --git a/gcc/gimple-range-op.cc b/gcc/gimple-range-op.cc > index a5d625387e7..1a00f1690e5 100644 > --- a/gcc/gimple-range-op.cc > +++ b/gcc/gimple-range-op.cc > @@ -43,6 +43,7 @@ along with GCC; see the file COPYING3. If not see > #include "range.h" > #include "value-query.h" > #include "gimple-range.h" > +#include "attr-fnspec.h" > > // Given stmt S, fill VEC, up to VEC_SIZE elements, with relevant ssa-names > // on the statement. For efficiency, it is an error to not pass in enough > @@ -309,6 +310,26 @@ public: > } > } op_cfn_constant_p; > > +// Implement range operator for integral/pointer functions returning > +// the first argument. > +class cfn_pass_through_arg1 : public range_operator > +{ > +public: > + using range_operator::fold_range; > + virtual bool fold_range (irange &r, tree, const irange &lh, > + const irange &, relation_trio) const > + { > + r = lh; > + return true; > + } > + virtual bool op1_range (irange &r, tree, const irange &lhs, > + const irange &, relation_trio) const > + { > + r = lhs; > + return true; > + } > +} op_cfn_pass_through_arg1; > + > // Implement range operator for CFN_BUILT_IN_SIGNBIT. > class cfn_signbit : public range_operator_float > { > @@ -967,6 +988,15 @@ gimple_range_op_handler::maybe_builtin_call () > break; > > default: > - break; > + { > + unsigned arg; > + if (gimple_call_fnspec (call).returns_arg (&arg) && arg == 0) > + { > + m_valid = true; > + m_op1 = gimple_call_arg (call, 0); > + m_int = &op_cfn_pass_through_arg1; > + } > + break; > + } > } > } > diff --git a/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c b/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c > new file mode 100644 > index 00000000000..fa7dc66d66c > --- /dev/null > +++ b/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c > @@ -0,0 +1,15 @@ > +/* { dg-do compile } */ > +/* { dg-options "-O2 -Wuse-after-free" } */ > + > +unsigned long bufmax = 0; > +unsigned long __open_catalog_bufmax; > +void *realloc(void *, __SIZE_TYPE__); > +void free(void *); > + > +void __open_catalog(char *buf) > +{ > + char *old_buf = buf; > + buf = realloc (buf, bufmax); > + if (__builtin_expect ((buf == ((void *)0)), 0)) > + free (old_buf); /* { dg-bogus "used after" } */ > +} > -- > 2.35.3 Jakub