@@ -4704,17 +4704,27 @@ region_model::eval_condition (const svalue *lhs,
if (lhs_un_op && CONVERT_EXPR_CODE_P (lhs_un_op->get_op ())
&& rhs_un_op && CONVERT_EXPR_CODE_P (rhs_un_op->get_op ())
&& lhs_type == rhs_type)
- return eval_condition (lhs_un_op->get_arg (),
- op,
- rhs_un_op->get_arg ());
-
+ {
+ tristate res = eval_condition (lhs_un_op->get_arg (),
+ op,
+ rhs_un_op->get_arg ());
+ if (res.is_known ())
+ return res;
+ }
else if (lhs_un_op && CONVERT_EXPR_CODE_P (lhs_un_op->get_op ())
&& lhs_type == rhs_type)
- return eval_condition (lhs_un_op->get_arg (), op, rhs);
-
+ {
+ tristate res = eval_condition (lhs_un_op->get_arg (), op, rhs);
+ if (res.is_known ())
+ return res;
+ }
else if (rhs_un_op && CONVERT_EXPR_CODE_P (rhs_un_op->get_op ())
&& lhs_type == rhs_type)
- return eval_condition (lhs, op, rhs_un_op->get_arg ());
+ {
+ tristate res = eval_condition (lhs, op, rhs_un_op->get_arg ());
+ if (res.is_known ())
+ return res;
+ }
}
/* Otherwise, try constraints.
new file mode 100644
@@ -0,0 +1,29 @@
+/* Reduced from false positive in Linux kernel's fs/ceph/ioctl.c: */
+
+__extension__ typedef unsigned long long __u64;
+
+struct ceph_ioctl_layout
+{
+ __u64 stripe_unit, object_size;
+};
+static long
+__validate_layout(struct ceph_ioctl_layout* l)
+{
+ if ((l->object_size & ~(~(((1UL) << 12) - 1))) ||
+ (l->stripe_unit & ~(~(((1UL) << 12) - 1))) ||
+ ((unsigned)l->stripe_unit != 0 &&
+ ((unsigned)l->object_size % (unsigned)l->stripe_unit))) /* { dg-bogus "use of attacker-controlled value 'l.stripe_unit' as divisor without checking for zero" "PR analyzer/113619" } */
+ return -22;
+ return 0;
+}
+
+long
+__attribute__((tainted_args))
+ceph_ioctl_set_layout_policy(struct ceph_ioctl_layout l)
+{
+ int err;
+ err = __validate_layout(&l);
+ if (err)
+ return err;
+ return err;
+}
Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu. Successful run of analyzer integration tests on x86_64-pc-linux-gnu. Pushed to trunk as r14-9600-g7a5a4a4467b2e1. gcc/analyzer/ChangeLog: PR analyzer/113619 * region-model.cc (region_model::eval_condition): Fix cast-handling from r14-3632-ge7b267444045c5 so that if those give an unknown result, we continue trying the constraint manager. gcc/testsuite/ChangeLog: PR analyzer/113619 * c-c++-common/analyzer/taint-divisor-pr113619.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com> --- gcc/analyzer/region-model.cc | 24 ++++++++++----- .../analyzer/taint-divisor-pr113619.c | 29 +++++++++++++++++++ 2 files changed, 46 insertions(+), 7 deletions(-) create mode 100644 gcc/testsuite/c-c++-common/analyzer/taint-divisor-pr113619.c