From patchwork Fri Mar 17 12:18:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Biener X-Patchwork-Id: 66514 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 665CD385559F for ; Fri, 17 Mar 2023 12:19:04 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 665CD385559F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1679055544; bh=Kvl8i8HGmSr8pG8776moOHmXeZeE2+mC7JM38ssguCg=; h=Date:To:cc:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From:Reply-To:From; b=IKiI5+A5YqPrv3WXOErGRk9DjqZfV2JESzp2ThIBEkmP5qToljoIm6L4kC9Uxbb8/ I/vKSB7QBWKuSiD81FcKuSa1o7G1TQ3uamUYUnYvmtsXriiEBGffiroy+naUfUS7vK r5DK+OW+T6U0EzgdOt5uMUOhVe6keKPUrEkjkPE0= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2001:67c:2178:6::1c]) by sourceware.org (Postfix) with ESMTPS id 676F73858410 for ; Fri, 17 Mar 2023 12:18:34 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 676F73858410 Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 390BD21A6B; Fri, 17 Mar 2023 12:18:33 +0000 (UTC) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 16A961346F; Fri, 17 Mar 2023 12:18:33 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id JwduBJlaFGR2LwAAMHmgww (envelope-from ); Fri, 17 Mar 2023 12:18:33 +0000 Date: Fri, 17 Mar 2023 13:18:32 +0100 (CET) To: gcc-patches@gcc.gnu.org cc: Jakub Jelinek , aldyh@redhat.com, amacleod@redhat.com Subject: [PATCH] tree-optimization/109170 - bogus use-after-free with __builtin_expect MIME-Version: 1.0 Message-Id: <20230317121833.16A961346F@imap2.suse-dmz.suse.de> X-Spam-Status: No, score=-11.7 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Richard Biener via Gcc-patches From: Richard Biener Reply-To: Richard Biener Errors-To: gcc-patches-bounces+patchwork=sourceware.org@gcc.gnu.org Sender: "Gcc-patches" The following adds a missing range-op for __builtin_expect which helps -Wuse-after-free to detect the case a realloc original pointer is used when the result was NULL. Bootstrap and regtest running on x86_64-unknown-linux-gnu, OK? PR tree-optimization/109170 * gimple-range-op.cc (cfn_expect): New. (gimple_range_op_handler::maybe_builtin_call): Handle __builtin_expect. * gcc.dg/Wuse-after-free-pr109170.c: New testcase. --- gcc/gimple-range-op.cc | 25 +++++++++++++++++++ .../gcc.dg/Wuse-after-free-pr109170.c | 15 +++++++++++ 2 files changed, 40 insertions(+) create mode 100644 gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c diff --git a/gcc/gimple-range-op.cc b/gcc/gimple-range-op.cc index a5d625387e7..f3d6e29e58d 100644 --- a/gcc/gimple-range-op.cc +++ b/gcc/gimple-range-op.cc @@ -309,6 +309,25 @@ public: } } op_cfn_constant_p; +// Implement range operator for integral CFN_BUILT_IN_EXPECT. +class cfn_expect : public range_operator +{ +public: + using range_operator::fold_range; + virtual bool fold_range (irange &r, tree, const irange &lh, + const irange &, relation_trio) const + { + r = lh; + return true; + } + virtual bool op1_range (irange &r, tree, const irange &lhs, + const irange &, relation_trio) const + { + r = lhs; + return true; + } +} op_cfn_expect; + // Implement range operator for CFN_BUILT_IN_SIGNBIT. class cfn_signbit : public range_operator_float { @@ -966,6 +985,12 @@ gimple_range_op_handler::maybe_builtin_call () m_int = &op_cfn_parity; break; + case CFN_BUILT_IN_EXPECT: + m_valid = true; + m_op1 = gimple_call_arg (call, 0); + m_int = &op_cfn_expect; + break; + default: break; } diff --git a/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c b/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c new file mode 100644 index 00000000000..fa7dc66d66c --- /dev/null +++ b/gcc/testsuite/gcc.dg/Wuse-after-free-pr109170.c @@ -0,0 +1,15 @@ +/* { dg-do compile } */ +/* { dg-options "-O2 -Wuse-after-free" } */ + +unsigned long bufmax = 0; +unsigned long __open_catalog_bufmax; +void *realloc(void *, __SIZE_TYPE__); +void free(void *); + +void __open_catalog(char *buf) +{ + char *old_buf = buf; + buf = realloc (buf, bufmax); + if (__builtin_expect ((buf == ((void *)0)), 0)) + free (old_buf); /* { dg-bogus "used after" } */ +}