From patchwork Fri Mar 17 12:18:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Biener X-Patchwork-Id: 71267 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:604a:0:0:0:0:0 with SMTP id j10csp305059wrt; Fri, 17 Mar 2023 05:19:20 -0700 (PDT) X-Google-Smtp-Source: AK7set+klPMtPNiKiZofWKSScR6W10nzQKKtl5Tg8zRuLjEaPhrHuiku2IWkRMv7LjCXIB7Hcnzg X-Received: by 2002:a05:6402:455:b0:4fd:1fe1:838f with SMTP id p21-20020a056402045500b004fd1fe1838fmr3217691edw.14.1679055560743; Fri, 17 Mar 2023 05:19:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1679055560; cv=none; d=google.com; s=arc-20160816; b=vqS8fFd75lCTJnN0KRAj9HMuxLM6m1vpGwrCY1X2p9SZMtgu3XMqf3x31RgIFWNG9z hCRg1lcHRQpeRYCMZb1WIr2QEgAGL7T1gGupDMfHFPMh9nZmgkDoWMYHRgXoMlgMz76M V6RKmpeNcfyRsvfVUSv2yCzdKhFtyojasgV87CyEgJJVMsxz9oKtfaWKOtvDjpxW+NTK dHKFJZobVyhj+sWqIw6b9cUXYr9jSd1xU0VrCHVas4iAtk3LZ5yu0LXoerggD+N3mEyS HjkK2A+f6w3Sw9yWEgpfhOzXH/qN+f3NgIymT2puBWa8B63RJhTvg2YsayL7TpsVf5FE MsjQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence:message-id :mime-version:subject:cc:to:date:dmarc-filter:delivered-to :dkim-signature:dkim-filter; bh=Kvl8i8HGmSr8pG8776moOHmXeZeE2+mC7JM38ssguCg=; b=g0jJCORuSY9f8MBeASUZWgHMh8dU/3wMPgiGuA6tH9QsppQjlD1k56/kgoV/D4XUjK OXL3qIEFSEMiZs9uW5LAUBE+lYjY0cv3Nlh+nNArzCBnPqJx+8+ql5yVDKpi1LLdQn86 IFZP8TOY1s8swaRw0lyZmL3gmqa4kuMpK5wrae+URKRLAHumBzv3aHXZ2ZX02kCaBEjN fYWnshbI0wdt4dHN0ipF0Wjs2nMXfOTpubswoXsrziZ/QSAzkB1kMbKzr7jnq/ctoY6i pyKGZMK1e8nCw9Ew7Nvo0AWMyQny9NumOqBfGCjFn3UZGx6ePhSJBp50OcOrT54JYjKs MK/Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=PvmCsN8T; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from sourceware.org (ip-8-43-85-97.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id o1-20020aa7dd41000000b004acc19b2698si2217957edw.162.2023.03.17.05.19.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Mar 2023 05:19:20 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=PvmCsN8T; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 861D238582B0 for ; Fri, 17 Mar 2023 12:19:19 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 861D238582B0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1679055559; bh=Kvl8i8HGmSr8pG8776moOHmXeZeE2+mC7JM38ssguCg=; h=Date:To:cc:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From:Reply-To:From; b=PvmCsN8TMbmFu7z2644s6UXIm8SeTwJx5rqxWsQDBrg6wCUmoLE9nGx/2+XTCSMy6 AmPtNxlvpt+9trFURB/xbzHuaMqnAraKZWVqPFdW5KjypZUjYJGSGufC+5PcASN7N5 izTi/TJ1EUqU6JvrJsawMIV3uT5Gip+76Ohrl3zs= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2001:67c:2178:6::1c]) by sourceware.org (Postfix) with ESMTPS id 676F73858410 for ; Fri, 17 Mar 2023 12:18:34 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 676F73858410 Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 390BD21A6B; Fri, 17 Mar 2023 12:18:33 +0000 (UTC) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 16A961346F; Fri, 17 Mar 2023 12:18:33 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id JwduBJlaFGR2LwAAMHmgww (envelope-from ); Fri, 17 Mar 2023 12:18:33 +0000 Date: Fri, 17 Mar 2023 13:18:32 +0100 (CET) To: gcc-patches@gcc.gnu.org cc: Jakub Jelinek , aldyh@redhat.com, amacleod@redhat.com Subject: [PATCH] tree-optimization/109170 - bogus use-after-free with __builtin_expect MIME-Version: 1.0 Message-Id: <20230317121833.16A961346F@imap2.suse-dmz.suse.de> X-Spam-Status: No, score=-11.7 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Richard Biener via Gcc-patches From: Richard Biener Reply-To: Richard Biener Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1760617363942123738?= X-GMAIL-MSGID: =?utf-8?q?1760617363942123738?= The following adds a missing range-op for __builtin_expect which helps -Wuse-after-free to detect the case a realloc original pointer is used when the result was NULL. Bootstrap and regtest running on x86_64-unknown-linux-gnu, OK? PR tree-optimization/109170 * gimple-range-op.cc (cfn_expect): New. (gimple_range_op_handler::maybe_builtin_call): Handle __builtin_expect. * gcc.dg/Wuse-after-free-pr109170.c: New testcase. --- gcc/gimple-range-op.cc | 25 +++++++++++++++++++ .../gcc.dg/Wuse-after-free-pr109170.c | 15 +++++++++++ 2 files changed, 40 insertions(+) create mode 100644 gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c diff --git a/gcc/gimple-range-op.cc b/gcc/gimple-range-op.cc index a5d625387e7..f3d6e29e58d 100644 --- a/gcc/gimple-range-op.cc +++ b/gcc/gimple-range-op.cc @@ -309,6 +309,25 @@ public: } } op_cfn_constant_p; +// Implement range operator for integral CFN_BUILT_IN_EXPECT. +class cfn_expect : public range_operator +{ +public: + using range_operator::fold_range; + virtual bool fold_range (irange &r, tree, const irange &lh, + const irange &, relation_trio) const + { + r = lh; + return true; + } + virtual bool op1_range (irange &r, tree, const irange &lhs, + const irange &, relation_trio) const + { + r = lhs; + return true; + } +} op_cfn_expect; + // Implement range operator for CFN_BUILT_IN_SIGNBIT. class cfn_signbit : public range_operator_float { @@ -966,6 +985,12 @@ gimple_range_op_handler::maybe_builtin_call () m_int = &op_cfn_parity; break; + case CFN_BUILT_IN_EXPECT: + m_valid = true; + m_op1 = gimple_call_arg (call, 0); + m_int = &op_cfn_expect; + break; + default: break; } diff --git a/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c b/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c new file mode 100644 index 00000000000..fa7dc66d66c --- /dev/null +++ b/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c @@ -0,0 +1,15 @@ +/* { dg-do compile } */ +/* { dg-options "-O2 -Wuse-after-free" } */ + +unsigned long bufmax = 0; +unsigned long __open_catalog_bufmax; +void *realloc(void *, __SIZE_TYPE__); +void free(void *); + +void __open_catalog(char *buf) +{ + char *old_buf = buf; + buf = realloc (buf, bufmax); + if (__builtin_expect ((buf == ((void *)0)), 0)) + free (old_buf); /* { dg-bogus "used after" } */ +}