gcc/testsuite/gcc.dg/plugin/taint-pr112974.c

   1 /* Reduced from false positive in Linux kernel in
   2    drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c.  */
   3
   4 /* { dg-do compile } */
   5 /* { dg-options "-fanalyzer" } */
   6 /* { dg-require-effective-target analyzer } */
   7
   8 typedef unsigned char __u8;
   9 typedef unsigned short __u16;
  10 extern unsigned int __max_logical_packages;
  11 extern unsigned long
  12 copy_from_user(void* to, const void* from, unsigned long n);
  13 extern unsigned long
  14 copy_to_user(void* to, const void* from, unsigned long n);
  15 struct isst_tpmi_instance_count
  16 {
  17   __u8 socket_id;
  18   __u8 count;
  19   __u16 valid_mask;
  20 };
  21 struct tpmi_per_power_domain_info
  22 {
  23   void* sst_base;
  24 };
  25 struct tpmi_sst_struct
  26 {
  27   int number_of_power_domains;
  28   struct tpmi_per_power_domain_info* power_domain_info;
  29 };
  30 struct tpmi_sst_common_struct
  31 {
  32   int max_index;
  33   struct tpmi_sst_struct** sst_inst;
  34 };
  35 static struct tpmi_sst_common_struct isst_common;
  36 int
  37 isst_if_get_tpmi_instance_count(void* argp)
  38 {
  39   struct isst_tpmi_instance_count tpmi_inst;
  40   struct tpmi_sst_struct* sst_inst;
  41   int i;
  42   if (copy_from_user(&tpmi_inst, argp, sizeof(tpmi_inst)))
  43     return -14;
  44   if (tpmi_inst.socket_id >= (__max_logical_packages))
  45     return -22;
  46   tpmi_inst.count =
  47     isst_common.sst_inst[tpmi_inst.socket_id]->number_of_power_domains; /* { dg-bogus "use of attacker-controlled value as offset without upper-bounds checking" } */
  48   sst_inst = isst_common.sst_inst[tpmi_inst.socket_id];
  49   tpmi_inst.valid_mask = 0;
  50   for (i = 0; i < sst_inst->number_of_power_domains; ++i) {
  51     struct tpmi_per_power_domain_info* pd_info;
  52     pd_info = &sst_inst->power_domain_info[i];
  53     if (pd_info->sst_base)
  54       tpmi_inst.valid_mask |= ((((1UL))) << (i));
  55   }
  56   if (copy_to_user(argp, &tpmi_inst, sizeof(tpmi_inst)))
  57     return -14;
  58   return 0;
  59 }