From patchwork Fri Dec 8 21:02:56 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 176031 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp5718225vqy; Fri, 8 Dec 2023 13:03:25 -0800 (PST) X-Google-Smtp-Source: AGHT+IG/hYXevhGH7GN1fXa3LwcONrbVw80kM4/XGSSQtARWKtuA3nATEQZVEwFctb1/x/WP8SIR X-Received: by 2002:a05:6122:91c:b0:4b2:d8c3:981c with SMTP id j28-20020a056122091c00b004b2d8c3981cmr1590177vka.1.1702069405086; Fri, 08 Dec 2023 13:03:25 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1702069405; cv=pass; d=google.com; s=arc-20160816; b=u20AZuT2XVESTQxh0J7yDn3+n9dkq8+hNR6fY1r/2DemAW6XgLPXUuBkf9nlLpbW2Y a5bG4DUoNGfYbw7Hn5+dcz23J9veQlufPQIIG020GjWxP+tpumQZlNl3fIH5qtW2KPA3 phlAc5NGf4mKcKJYeShGu2FoeYuau9NdBnt8i6H76G8BcD5OGqYUzVrUPk2E6IvGf7BO OBMbYbcRRvJ7ct66/HcWUqju2BAaVcUxQNVNOdkrzFWByee9VgvX+O36QsTb5uJO4dkr q7jCI44k3Zq2kKrBJkt3sfstk4gB2RJy9MKOK3R2cGh3kfdXYO6bbDMK6kRxT/AjP3RB q1yA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature :arc-filter:dmarc-filter:delivered-to; bh=sbAmoui0VPf091I+zfF9B3479Fgm3B2yNjBSZ5J6Ik8=; fh=NXemEfxTRbZtBxUkxR2ehQUaYlcDfMdzPkO8MChVQE4=; b=kwJdogSGsXLneJxAYNsUZFlFtW3xQKPQ2qWhkyrcR91Xe/WMF+bmPK/z7gUwrwe2Mh BQxfekggwzFfWCBeJkY/smNi8mLo5TVKp3LKTmNmoPX6QBCM4Uq6fbE7Er50BfYKk552 8KUhVhRAAlBjKDxtpg9rm0K8F76g/+JTYDpLZ0UR24ETW/UhIJzN3Sl6K+rwvv6ASXXN i3qk2WfWM2TlNZ+f4HqOKmBYfUhA+5bOd06oUFOll3C+ZyBZoa/4bFhly0tnbLHCqueo 9zIo+xz5cS7AaF4INj16XsaVpjCa9DwCKrWY8EpAgpqanNetUW/kGhQ5KgRixq9il0gg BCuA== ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=ORnP8Qwt; arc=pass (i=1); spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from server2.sourceware.org (server2.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id q126-20020a1fd984000000b004b2c382b403si724488vkg.86.2023.12.08.13.03.25 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Dec 2023 13:03:25 -0800 (PST) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=ORnP8Qwt; arc=pass (i=1); spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 8DC7B38582AF for ; Fri, 8 Dec 2023 21:03:24 +0000 (GMT) X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id 84BBC3858CD1 for ; Fri, 8 Dec 2023 21:03:00 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 84BBC3858CD1 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 84BBC3858CD1 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1702069382; cv=none; b=Cpm2UWGOTCCU89iAI2eZ1BGfl/qil/k/vE1DlfL45crJ4YTYNtJ4odw1vrJumzw+WfeRAyVTZF5FNauLZWV6w1VZaVZadKpdmMgeDn38psOC/9iugPTbdxGev+L9xG55EM5LZWxcI+G6mQtgrb+7LYi1cRMxX5CmHVl+Fen0V+o= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1702069382; c=relaxed/simple; bh=Hj+MRvy8mI5ubkq2itRwGEohG1I2UX2m7ZSZeIDfSrk=; h=DKIM-Signature:From:To:Subject:Date:Message-Id:MIME-Version; b=dJ4V4yioxcHEmxJ4t9KQzgouMAB20xNqfFKm9K4JfEH16OhS1CN+ImJfIhEAX4EvZWPLmjaRemU6X570YXMk2oGirFxHRF2Y73CoMEUzdOQMhM8e1As7ByXMFQzHkkpwaItQjhKmLdrYOjAzuba6JBTM142Mp72GsC/SJJs0QZA= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1702069380; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sbAmoui0VPf091I+zfF9B3479Fgm3B2yNjBSZ5J6Ik8=; b=ORnP8QwtqGmbNqQQrUcYWwiGzTTMzVuVkAOw5CH74l9CYceq5y0pHjwjhUfZz0MLSkwO7v x2Lh0r0t6OzeiFS9fsST5Whyy0aCGkpFk0twU5re3ofVyTdv0095CYJTFmhMGha9Ex4Mi9 lolL3Su/Jt7HE630NqamXuaqt4pinow= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-568-5nnCh_OaO3iuyMXsmLSUTg-1; Fri, 08 Dec 2023 16:02:58 -0500 X-MC-Unique: 5nnCh_OaO3iuyMXsmLSUTg-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.rdu2.redhat.com [10.11.54.7]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 3228F185A786 for ; Fri, 8 Dec 2023 21:02:58 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.33.182]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0BA971C060AF; Fri, 8 Dec 2023 21:02:58 +0000 (UTC) From: David Malcolm To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [pushed] analyzer: fix ICE on infoleak with poisoned size Date: Fri, 8 Dec 2023 16:02:56 -0500 Message-Id: <20231208210256.2705893-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.7 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.4 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1784749128538764299 X-GMAIL-MSGID: 1784749128538764299 Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu. Pushed to trunk as r14-6348-g08262e78209ed4. gcc/analyzer/ChangeLog: * region-model.cc (contains_uninit_p): Only check for svalues that the infoleak warning can handle. gcc/testsuite/ChangeLog: * gcc.dg/plugin/infoleak-uninit-size-1.c: New test. * gcc.dg/plugin/infoleak-uninit-size-2.c: New test. * gcc.dg/plugin/plugin.exp: Add the new tests. --- gcc/analyzer/region-model.cc | 37 ++++++++++++------- .../gcc.dg/plugin/infoleak-uninit-size-1.c | 20 ++++++++++ .../gcc.dg/plugin/infoleak-uninit-size-2.c | 20 ++++++++++ gcc/testsuite/gcc.dg/plugin/plugin.exp | 2 + 4 files changed, 66 insertions(+), 13 deletions(-) create mode 100644 gcc/testsuite/gcc.dg/plugin/infoleak-uninit-size-1.c create mode 100644 gcc/testsuite/gcc.dg/plugin/infoleak-uninit-size-2.c diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc index 2157ad2578b..9b970d7a3e3 100644 --- a/gcc/analyzer/region-model.cc +++ b/gcc/analyzer/region-model.cc @@ -6557,22 +6557,33 @@ private: static bool contains_uninit_p (const svalue *sval) { - struct uninit_finder : public visitor - { - public: - uninit_finder () : m_found_uninit (false) {} - void visit_poisoned_svalue (const poisoned_svalue *sval) + switch (sval->get_kind ()) { - if (sval->get_poison_kind () == POISON_KIND_UNINIT) - m_found_uninit = true; - } - bool m_found_uninit; - }; + default: + return false; + case SK_POISONED: + { + const poisoned_svalue *psval + = as_a (sval); + return psval->get_poison_kind () == POISON_KIND_UNINIT; + } + case SK_COMPOUND: + { + const compound_svalue *compound_sval + = as_a (sval); - uninit_finder v; - sval->accept (&v); + for (auto iter : *compound_sval) + { + const svalue *sval = iter.second; + if (const poisoned_svalue *psval + = sval->dyn_cast_poisoned_svalue ()) + if (psval->get_poison_kind () == POISON_KIND_UNINIT) + return true; + } - return v.m_found_uninit; + return false; + } + } } /* Function for use by plugins when simulating writing data through a diff --git a/gcc/testsuite/gcc.dg/plugin/infoleak-uninit-size-1.c b/gcc/testsuite/gcc.dg/plugin/infoleak-uninit-size-1.c new file mode 100644 index 00000000000..7466112fe14 --- /dev/null +++ b/gcc/testsuite/gcc.dg/plugin/infoleak-uninit-size-1.c @@ -0,0 +1,20 @@ +/* Reduced from infoleak ICE seen on Linux kernel with + -Wno-analyzer-use-of-uninitialized-value. + + Verify that we don't ICE when complaining about an infoleak + when the size is uninitialized. */ + +/* { dg-do compile } */ +/* { dg-options "-fanalyzer -Wno-analyzer-use-of-uninitialized-value" } */ +/* { dg-require-effective-target analyzer } */ + +extern unsigned long +copy_to_user(void* to, const void* from, unsigned long n); + +unsigned long +test_uninit_size (void *to, void *from) +{ + unsigned long n; + char buf[16]; + return copy_to_user(to, from, n); +} diff --git a/gcc/testsuite/gcc.dg/plugin/infoleak-uninit-size-2.c b/gcc/testsuite/gcc.dg/plugin/infoleak-uninit-size-2.c new file mode 100644 index 00000000000..a8a383f4b2d --- /dev/null +++ b/gcc/testsuite/gcc.dg/plugin/infoleak-uninit-size-2.c @@ -0,0 +1,20 @@ +/* Reduced from infoleak ICE seen on Linux kernel with + -Wno-analyzer-use-of-uninitialized-value. + + Verify that we complain about the uninit value when + -Wno-analyzer-use-of-uninitialized-value isn't supplied. */ + +/* { dg-do compile } */ +/* { dg-options "-fanalyzer" } */ +/* { dg-require-effective-target analyzer } */ + +extern unsigned long +copy_to_user(void* to, const void* from, unsigned long n); + +unsigned long +test_uninit_size (void *to, void *from) +{ + unsigned long n; + char buf[16]; + return copy_to_user(to, from, n); /* { dg-warning "use of uninitialized value 'n'" } */ +} diff --git a/gcc/testsuite/gcc.dg/plugin/plugin.exp b/gcc/testsuite/gcc.dg/plugin/plugin.exp index f0b4bb7a051..d6cccb269df 100644 --- a/gcc/testsuite/gcc.dg/plugin/plugin.exp +++ b/gcc/testsuite/gcc.dg/plugin/plugin.exp @@ -150,6 +150,8 @@ set plugin_test_list [list \ infoleak-CVE-2017-18550-1.c \ infoleak-antipatterns-1.c \ infoleak-fixit-1.c \ + infoleak-uninit-size-1.c \ + infoleak-uninit-size-2.c \ infoleak-net-ethtool-ioctl.c \ infoleak-vfio_iommu_type1.c \ taint-CVE-2011-0521-1-fixed.c \