analyzer: fix deref-before-check false positives due to inlining [PR112790]

Backported from commit r14-6918-g5743e1899d5964 (moving testcase from
c-c++-common to gcc.dg).

gcc/analyzer/ChangeLog:
	PR analyzer/112790
	* checker-event.cc (class inlining_info): Move to...
	* inlining-iterator.h (class inlining_info): ...here.
	* sm-malloc.cc: Include "analyzer/inlining-iterator.h".
	(maybe_complain_about_deref_before_check): Reject stmts that were
	inlined from another function.

gcc/testsuite/ChangeLog:
	PR analyzer/112790
	* gcc.dg/analyzer/deref-before-check-pr112790.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

diff --git a/gcc/analyzer/checker-event.cc b/gcc/analyzer/checker-event.cc
index 3612df7bd1d36914cf5f00a0c0e3f87a503a5290..3cb2fb9175cd95e86c71683a502f34891dc8679a 100644 (file)
--- a/gcc/analyzer/checker-event.cc
+++ b/gcc/analyzer/checker-event.cc
@@ -106,46 +106,6 @@ event_kind_to_string (enum event_kind ek)
     }
 }
 
-/* A class for fixing up fndecls and stack depths in checker_event, based
-   on inlining records.
-
-   The early inliner runs before the analyzer, which can lead to confusing
-   output.
-
-   Tne base fndecl and depth within a checker_event are from call strings
-   in program_points, which reflect the call strings after inlining.
-   This class lets us offset the depth and fix up the reported fndecl and
-   stack depth to better reflect the user's original code.  */
-
-class inlining_info
-{
-public:
-  inlining_info (location_t loc)
-  {
-    inlining_iterator iter (loc);
-    m_inner_fndecl = iter.get_fndecl ();
-    int num_frames = 0;
-    while (!iter.done_p ())
-      {
-       m_outer_fndecl = iter.get_fndecl ();
-       num_frames++;
-       iter.next ();
-      }
-    if (num_frames > 1)
-      m_extra_frames = num_frames - 1;
-    else
-      m_extra_frames = 0;
-  }
-
-  tree get_inner_fndecl () const { return m_inner_fndecl; }
-  int get_extra_frames () const { return m_extra_frames; }
-
-private:
-  tree m_outer_fndecl;
-  tree m_inner_fndecl;
-  int m_extra_frames;
-};
-
 /* class checker_event : public diagnostic_event.  */
 
 /* checker_event's ctor.  */

diff --git a/gcc/analyzer/inlining-iterator.h b/gcc/analyzer/inlining-iterator.h
index 7d4798ce6ea532ddba58aea56d73892cf9f5831a..76ba1dc3cf4a3917f8bda8e9353735ff415672cb 100644 (file)
--- a/gcc/analyzer/inlining-iterator.h
+++ b/gcc/analyzer/inlining-iterator.h
@@ -106,4 +106,44 @@ private:
   tree m_next_abstract_origin;
 };
 
+/* A class for fixing up fndecls and stack depths in checker_event, based
+   on inlining records.
+
+   The early inliner runs before the analyzer, which can lead to confusing
+   output.
+
+   Tne base fndecl and depth within a checker_event are from call strings
+   in program_points, which reflect the call strings after inlining.
+   This class lets us offset the depth and fix up the reported fndecl and
+   stack depth to better reflect the user's original code.  */
+
+class inlining_info
+{
+public:
+  inlining_info (location_t loc)
+  {
+    inlining_iterator iter (loc);
+    m_inner_fndecl = iter.get_fndecl ();
+    int num_frames = 0;
+    while (!iter.done_p ())
+      {
+       m_outer_fndecl = iter.get_fndecl ();
+       num_frames++;
+       iter.next ();
+      }
+    if (num_frames > 1)
+      m_extra_frames = num_frames - 1;
+    else
+      m_extra_frames = 0;
+  }
+
+  tree get_inner_fndecl () const { return m_inner_fndecl; }
+  int get_extra_frames () const { return m_extra_frames; }
+
+private:
+  tree m_outer_fndecl;
+  tree m_inner_fndecl;
+  int m_extra_frames;
+};
+
 #endif /* GCC_ANALYZER_INLINING_ITERATOR_H */

diff --git a/gcc/analyzer/sm-malloc.cc b/gcc/analyzer/sm-malloc.cc
index 74701375409d214cb239a292a52e89705832e1ee..64295cfb66e75d189bf347e9ba335f0facebfa8b 100644 (file)
--- a/gcc/analyzer/sm-malloc.cc
+++ b/gcc/analyzer/sm-malloc.cc
@@ -47,6 +47,7 @@ along with GCC; see the file COPYING3.  If not see
 #include "analyzer/program-state.h"
 #include "analyzer/checker-event.h"
 #include "analyzer/exploded-graph.h"
+#include "analyzer/inlining-iterator.h"
 
 #if ENABLE_ANALYZER
 
@@ -2147,6 +2148,15 @@ maybe_complain_about_deref_before_check (sm_context *sm_ctxt,
   if (checked_in_frame->get_index () > assumed_nonnull_in_frame->get_index ())
     return;
 
+  /* Don't complain if STMT was inlined from another function, to avoid
+     similar false positives involving shared helper functions.  */
+  if (stmt->location)
+    {
+      inlining_info info (stmt->location);
+      if (info.get_extra_frames () > 0)
+       return;
+    }
+
   tree diag_ptr = sm_ctxt->get_diagnostic_tree (ptr);
   if (diag_ptr)
     sm_ctxt->warn

diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr112790.c b/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr112790.c
new file mode 100644 (file)
index 0000000..8f74468
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr112790.c
@@ -0,0 +1,27 @@
+/* Reproducer for false positive from -Wanalyzer-deref-before-check
+   seen on Linux kernel's block/bdev.c due to -fanalyzer mishandling
+   inlined functions.  */
+
+/* { dg-additional-options "-O2 -g -fno-delete-null-pointer-checks" } */
+
+typedef unsigned char u8;
+struct inode {
+  void *i_mapping;
+  u8 i_blkbits;
+};
+struct block_device {
+  struct inode *bd_inode;
+};
+int sync_blockdev(struct block_device *bdev);
+int set_blocksize(struct block_device *bdev, u8 size) {
+  if (bdev->bd_inode->i_blkbits != size) { /* { dg-bogus "pointer 'bdev' is dereferenced here" } */
+    sync_blockdev(bdev);
+  }
+  return 0;
+}
+extern int filemap_write_and_wait(void *);
+int sync_blockdev(struct block_device *bdev) {
+  if (!bdev) /* { dg-bogus "check of 'bdev' for NULL after already dereferencing it" } */
+    return 0;
+  return filemap_write_and_wait(bdev->bd_inode->i_mapping);
+}