| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
|
|
PR analyzer/103521 reports that commit r12-5585-g132902177138c09803d639e12b1daebf2b9edddc
("analyzer: further false leak fixes due to overzealous state merging [PR103217]")
led to failures of gcc.dg/analyzer/pr93032-mztools.c on some targets,
where rather than reporting FILE * leaks, the analyzer would hit
complexity limits and give up.
The cause is that pr93032-mztools.c has some 'unsigned char' values that
are copied to 'char'. On targets where 'char' defaults to being signed,
this leads to casts, whereas on targets where 'char' defaults to being
unsigned, no casts are needed.
When the casts occur, various symbolic values within the loop (the
locals 'crc', 'cpsize', and 'uncpsize') become sufficiently complex as
to hit the --param=analyzer-max-svalue-depth= limit, and are treated as
UNKNOWN, allowing the analysis of the loop to quickly terminate, with
much of this state as UNKNOWN (but retaining the FILE * information, and
thus correctly reporting the FILE * leaks).
Without the casts, the symbolic values for these variables don't quite
hit the complexity limit, and the analyzer attempts to track these
values in the loop, leading to the analyzer eventually hitting the
per-program-point limit on the number of states, and giving up on
these execution paths, thus failing to report the FILE * leaks.
This patch tweaks the default value of the param:
--param=analyzer-max-svalue-depth=.
from 13 down to 12. This allows the pr93032-mztools.c testcase to
succeeed with both -fsigned-char and -funsigned-char, and thus allows
this integration test to succeed on both styles of target without
requiring extra command-line flags. The patch duplicates the test so
it runs with both -fsigned-char and -funsigned-char.
My hope is that this will allow similar cases to terminate loop analysis
earlier. I tried reducing it further, but doing so caused some test
cases to regress.
The tradeoff here is between:
(a) precision of individual states in the analysis, versus
(b) maximizing code-path coverage in the analysis
I can imagine a more nuanced approach that splits the current
per-program-point hard limit into soft and hard limits: on hitting the
soft limit at a program point, go into a less precise mode for states
at that program point, in the hope that we can fully explore execution
paths beyond it without hitting the hard limit, but this seems like
GCC 13 material.
Another possible future fix might be for the analysis plan to make an
attempt to prioritize parts of the code in an enode budget, rather than
setting the same hard limit uniformly across all program points.
gcc/analyzer/ChangeLog:
PR analyzer/103521
* analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
to 12.
gcc/testsuite/ChangeLog:
PR analyzer/103521
* gcc.dg/analyzer/pr93032-mztools.c: Move to...
* gcc.dg/analyzer/pr93032-mztools-signed-char.c: ...this, adding
-fsigned-char to args, and...
* gcc.dg/analyzer/pr93032-mztools-unsigned-char.c: ...copy to here,
adding -funsigned-char to args.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
When testing -fanalyzer on openblas-0.3, I noticed slightly over 2000
false positives from -Wanalyzer-malloc-leak on code like this:
if( LAPACKE_lsame( vect, 'b' ) || LAPACKE_lsame( vect, 'p' ) ) {
pt_t = (lapack_complex_float*)
LAPACKE_malloc( sizeof(lapack_complex_float) *
ldpt_t * MAX(1,n) );
[...snip...]
}
[...snip lots of code...]
if( LAPACKE_lsame( vect, 'b' ) || LAPACKE_lsame( vect, 'q' ) ) {
LAPACKE_free( pt_t );
}
where LAPACKE_lsame is a char-comparison function implemented in a
different TU.
The analyzer naively considers the execution path where:
LAPACKE_lsame( vect, 'b' ) || LAPACKE_lsame( vect, 'p' )
is true at the malloc guard, but then false at the free guard, which
is thus a memory leak.
This patch makes -fanalyer respect __attribute__((const)), so that the
analyzer treats such functions as returning the same value when given
the same inputs.
I've filed https://github.com/xianyi/OpenBLAS/issues/3543 suggesting that
LAPACKE_lsame be annotated with __attribute__((const)); with that, and
with this patch, the false positives seem to be fixed.
gcc/analyzer/ChangeLog:
PR analyzer/104434
* analyzer.h (class const_fn_result_svalue): New decl.
* region-model-impl-calls.cc (call_details::get_manager): New.
* region-model-manager.cc
(region_model_manager::get_or_create_const_fn_result_svalue): New.
(region_model_manager::log_stats): Log
m_const_fn_result_values_map.
* region-model.cc (const_fn_p): New.
(maybe_get_const_fn_result): New.
(region_model::on_call_pre): Handle fndecls with
__attribute__((const)) by calling the above rather than making
a conjured_svalue.
* region-model.h (visitor::visit_const_fn_result_svalue): New.
(region_model_manager::get_or_create_const_fn_result_svalue): New
decl.
(region_model_manager::const_fn_result_values_map_t): New typedef.
(region_model_manager::m_const_fn_result_values_map): New field.
(call_details::get_manager): New decl.
* svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
(const_fn_result_svalue::dump_to_pp): New.
(const_fn_result_svalue::dump_input): New.
(const_fn_result_svalue::accept): New.
* svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
(svalue::dyn_cast_const_fn_result_svalue): New.
(class const_fn_result_svalue): New.
(is_a_helper <const const_fn_result_svalue *>::test): New.
(template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
New.
gcc/testsuite/ChangeLog:
PR analyzer/104434
* gcc.dg/analyzer/attr-const-1.c: New test.
* gcc.dg/analyzer/attr-const-2.c: New test.
* gcc.dg/analyzer/attr-const-3.c: New test.
* gcc.dg/analyzer/pr104434-const.c: New test.
* gcc.dg/analyzer/pr104434-nonconst.c: New test.
* gcc.dg/analyzer/pr104434.h: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
PR analyzer/104576 tracks that we issue a false positive from
-Wanalyzer-use-of-uninitialized-value for the reproducers of PR 63311
when optimization is disabled.
The root cause is that the analyzer was considering that a call to
__builtin_sinf could have side-effects.
This patch fixes things by generalizing the handling for "pure"
functions to also consider "const" functions.
gcc/analyzer/ChangeLog:
PR analyzer/104576
* region-model.cc: Include "calls.h".
(region_model::on_call_pre): Use flags_from_decl_or_type to
generalize check for DECL_PURE_P to also check for ECF_CONST.
gcc/testsuite/ChangeLog:
PR analyzer/104576
* gcc.dg/analyzer/torture/uninit-pr63311.c: New test.
* gcc.dg/analyzer/uninit-pr104576.c: New test.
* gfortran.dg/analyzer/uninit-pr63311.f90: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
PR analyzer/104560 reports various false positives from
-Wanalyzer-free-of-non-heap seen with rdma-core, on what's
effectively:
free (&ptr->field)
where in this case "field" is the first element of its struct, and thus
&ptr->field == ptr, and could be on the heap.
The root cause is due to malloc_state_machine::on_stmt making
"LHS = &EXPR;"
transition LHS from start to non_heap when EXPR is not a MEM_REF;
this assumption doesn't hold for the above case.
This patch eliminates that state transition, instead relying on
malloc_state_machine::get_default_state to detect regions known to
not be on the heap.
Doing so fixes the false positive, but eliminates some events relating
to free-of-alloca identifying the alloca, so the patch also reworks
free_of_non_heap to capture which region has been freed, adding
region creation events to diagnostic paths, so that the alloca calls
can be identified, and using the memory space of the region for more
precise wording of the diagnostic.
The improvement to malloc_state_machine::get_default_state also
means we now detect attempts to free VLAs, functions and code labels.
In doing so I spotted that I wasn't adding region creation events for
regions for global variables, and for cases where an allocation is the
last stmt within its basic block, so the patch also fixes these issues.
gcc/analyzer/ChangeLog:
PR analyzer/104560
* diagnostic-manager.cc (diagnostic_manager::build_emission_path):
Add region creation events for globals of interest.
(null_assignment_sm_context::get_old_program_state): New.
(diagnostic_manager::add_events_for_eedge): Move check for
changing dynamic extents from PK_BEFORE_STMT case to after the
switch on the dst_point's kind so that we can emit them for the
final stmt in a basic block.
* engine.cc (impl_sm_context::get_old_program_state): New.
* sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
detection of m_non_heap to use get_memory_space.
(free_of_non_heap::free_of_non_heap): Add freed_reg param.
(free_of_non_heap::subclass_equal_p): Update for changes to
fields.
(free_of_non_heap::emit): Drop m_kind in favor of
get_memory_space.
(free_of_non_heap::describe_state_change): Remove logic for
detecting alloca.
(free_of_non_heap::mark_interesting_stuff): Add region-creation of
m_freed_reg.
(free_of_non_heap::get_memory_space): New.
(free_of_non_heap::kind): Drop enum.
(free_of_non_heap::m_freed_reg): New field.
(free_of_non_heap::m_kind): Drop field.
(malloc_state_machine::on_stmt): Drop transition to m_non_heap.
(malloc_state_machine::handle_free_of_non_heap): New function,
split out from on_deallocator_call and on_realloc_call, adding
detection of the freed region.
(malloc_state_machine::on_deallocator_call): Use it.
(malloc_state_machine::on_realloc_call): Likewise.
* sm.h (sm_context::get_old_program_state): New vfunc.
gcc/testsuite/ChangeLog:
PR analyzer/104560
* g++.dg/analyzer/placement-new.C: Update expected wording.
* g++.dg/analyzer/pr100244.C: Likewise.
* gcc.dg/analyzer/attr-malloc-1.c (test_7): Likewise.
* gcc.dg/analyzer/malloc-1.c (test_24): Likewise.
(test_25): Likewise.
(test_26): Likewise.
(test_50a, test_50b, test_50c): New.
* gcc.dg/analyzer/malloc-callbacks.c (test_5): Update expected
wording.
* gcc.dg/analyzer/malloc-paths-8.c: Likewise.
* gcc.dg/analyzer/pr104560-1.c: New test.
* gcc.dg/analyzer/pr104560-2.c: New test.
* gcc.dg/analyzer/realloc-1.c (test_7): Updated expected wording.
* gcc.dg/analyzer/vla-1.c (test_2): New. Prune output from
-Wfree-nonheap-object.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
gcc/analyzer/ChangeLog:
PR analyzer/104524
* region-model-manager.cc
(region_model_manager::maybe_fold_sub_svalue): Only call
get_or_create_cast if type is non-NULL.
gcc/testsuite/ChangeLog:
PR analyzer/104524
* gcc.dg/analyzer/pr104524.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
There is false positive from -Wanalyzer-use-of-uninitialized-value on
gcc.dg/analyzer/pr102692.c here:
‘fix_overlays_before’: events 1-3
|
| 75 | while (tail
| | ~~~~
| 76 | && (tem = make_lisp_ptr (tail, 5),
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (1) following ‘false’ branch (when ‘tail’ is NULL)...
| 77 | (end = marker_position (XOVERLAY (tem)->end)) >= pos))
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|......
| 82 | if (!tail || end < prev || !tail->next)
| | ~~~~~ ~~~~~~~~~~
| | | |
| | | (3) use of uninitialized value ‘end’ here
| | (2) ...to here
|
The issue is that inner || of the conditionals have been folded within the
frontend from a chain of control flow:
5 │ if (tail == 0B) goto <D.1986>; else goto <D.1988>;
6 │ <D.1988>:
7 │ if (end < prev) goto <D.1986>; else goto <D.1989>;
8 │ <D.1989>:
9 │ _1 = tail->next;
10 │ if (_1 == 0B) goto <D.1986>; else goto <D.1987>;
11 │ <D.1986>:
to an OR expr (and then to a bitwise-or by the gimplifier):
5 │ _1 = tail == 0B;
6 │ _2 = end < prev;
7 │ _3 = _1 | _2;
8 │ if (_3 != 0) goto <D.1986>; else goto <D.1988>;
9 │ <D.1988>:
10 │ _4 = tail->next;
11 │ if (_4 == 0B) goto <D.1986>; else goto <D.1987>;
This happens for sufficiently simple conditionals in fold_truth_andor.
In particular, the (end < prev) is short-circuited without optimization,
but is evaluated with optimization, leading to the false positive.
Given how early this folding occurs, it seems the simplest fix is to
try to detect places where this optimization appears to have happened,
and suppress uninit warnings within the statement that would have
been short-circuited.
gcc/analyzer/ChangeLog:
PR analyzer/102692
* exploded-graph.h (impl_region_model_context::get_stmt): New.
* region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
"tree-ssa-operands.h", and "ssa-iterators.h".
(within_short_circuited_stmt_p): New.
(region_model::check_for_poison): Don't warn about uninit values
if within_short_circuited_stmt_p.
* region-model.h (region_model_context::get_stmt): New vfunc.
(noop_region_model_context::get_stmt): New.
gcc/testsuite/ChangeLog:
PR analyzer/102692
* gcc.dg/analyzer/pr102692-2.c: New test.
* gcc.dg/analyzer/pr102692.c: Remove xfail. Remove -O2 from
options and move to...
* gcc.dg/analyzer/torture/pr102692.c: ...here.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
PR analyzer/104274 reports a false positive from
-Wanalyzer-use-of-uninitialized-value on hppa when passing
an empty struct as a function parameter.
pa_pass_by_reference returns true for empty structs, so the
call is turned into:
struct empty arg.0;
arg.0 = arg
called_function (arg.0);
by gimplify_parameters.
However, gimplify_modify_expr discards assignments statments
of empty types, so that we end up with:
struct empty arg.0;
called_function (arg.0);
which the analyzer considers to be a use of uninitialized "arg.0";
Given that gimplify_modify_expr will discard any assignments to
such types, it seems simplest for -Wanalyzer-use-of-uninitialized-value
to ignore values of empty types.
gcc/analyzer/ChangeLog:
PR analyzer/104274
* region-model.cc (region_model::check_for_poison): Ignore
uninitialized uses of empty types.
gcc/testsuite/ChangeLog:
PR analyzer/104274
* gcc.dg/analyzer/torture/empty-struct-1.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
gcc/analyzer/ChangeLog:
PR analyzer/98797
* region-model-manager.cc
(region_model_manager::maybe_fold_sub_svalue): Generalize getting
individual chars of a STRING_CST from element_region to any
subregion which is a concrete access of a single byte from its
parent region.
* region.cc (region::get_relative_concrete_byte_range): New.
* region.h (region::get_relative_concrete_byte_range): New decl.
gcc/testsuite/ChangeLog:
PR analyzer/98797
* gcc.dg/analyzer/casts-1.c: Mark xfails as fixed; add further
test coverage for casts of string literals.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
gcc/analyzer/ChangeLog:
PR analyzer/104452
* region-model.cc (selftest::test_bit_range_regions): New.
(selftest::analyzer_region_model_cc_tests): Call it.
* region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
to avoid using uninitialized data.
gcc/testsuite/ChangeLog:
PR analyzer/104452
* gcc.dg/analyzer/pr104452.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
gcc/analyzer/ChangeLog:
PR analyzer/104417
* sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
Remove overzealous assertion.
(tainted_allocation_size::emit): Likewise.
(region_model::check_dynamic_size_for_taint): Likewise.
gcc/testsuite/ChangeLog:
PR analyzer/104417
* gcc.dg/analyzer/pr104417.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
PR analyzer/103872 reports a failure of gcc.dg/analyzer/pr103526.c on
riscv64-unknown-elf-gcc. The issue is that I wrote the test on x86_64
where a memcpy in the test is optimized to a write to a read/write pair,
whereas due to alignment differences the analyzer can see it as a
memcpy call, revealing problems with the analyzer's implementation
of memcpy.
This patch reimplements region_model::impl_call_memcpy in terms of a
get_store_value followed by a set_value, fixing the issue.
gcc/analyzer/ChangeLog:
PR analyzer/103872
* region-model-impl-calls.cc (region_model::impl_call_memcpy):
Reimplement in terms of a get_store_value followed by a set_value.
gcc/testsuite/ChangeLog:
PR analyzer/103872
* gcc.dg/analyzer/memcpy-1.c: Add alternate versions of test cases
in which the calls to memcpy are hidden from the optimizer. Add
further test cases.
* gcc.dg/analyzer/taint-size-1.c: Add test coverage for memcpy
with tainted size.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
This patch fixes various issues with how -fanalyzer handles "realloc"
seen when debugging PR analyzer/104369.
Previously it wasn't correctly copying over the contents of the old
buffer for the success-with-move case, leading to false
-Wanalyzer-use-of-uninitialized-value diagnostics.
I also noticed that -fanalyzer failed to properly handle "realloc" for
cases where the ptr's region had unknown dynamic extents, and an ICE
for the case where a tainted value is used as a realloc size argument.
This patch fixes these issues, including the false uninit diagnostics
seen in PR analyzer/104369.
gcc/analyzer/ChangeLog:
PR analyzer/104369
* engine.cc (exploded_graph::process_node): Use the node for any
diagnostics, avoiding ICE if a bifurcation update adds a
saved_diagnostic, such as for a tainted realloc size.
* region-model-impl-calls.cc
(region_model::impl_call_realloc::success_no_move::update_model):
Require the old pointer to be non-NULL to be able successfully
grow in place. Use model->deref_rvalue rather than maybe_get_region
to support the old pointer being symbolic.
(region_model::impl_call_realloc::success_with_move::update_model):
Likewise. Add a constraint that the new pointer != the old pointer.
Use a sized_region when setting the value of the new region.
Handle the case where we don't know the dynamic size of the old
region by marking the new region as unknown.
* sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
Update assertion to also allow for MEMSPACE_UNKNOWN.
(tainted_allocation_size::emit): Likewise.
(region_model::check_dynamic_size_for_taint): Likewise.
gcc/testsuite/ChangeLog:
PR analyzer/104369
* gcc.dg/analyzer/pr104369-1.c: New test.
* gcc.dg/analyzer/pr104369-2.c: New test.
* gcc.dg/analyzer/realloc-3.c: New test.
* gcc.dg/analyzer/realloc-4.c: New test.
* gcc.dg/analyzer/taint-realloc.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
It turned out that the analyzer wasn't treating calloc regions
as zero-filled, due to binding_cluster::fill_region getting an
unknown value for the byte_size_size_sval, and thus
get_or_create_repeated_svalue returning an unknown_svalue, which
was then used to fill the region.
Fixed thusly.
gcc/analyzer/ChangeLog:
* region-model-impl-calls.cc (region_model::impl_call_calloc): Use
a sized_region when calling zero_fill_region.
gcc/testsuite/ChangeLog:
* gcc.dg/analyzer/calloc-1.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
When moving the -fanalyzer tests for -ftrivial-auto-var-init to the
"torture" subdirectory of gcc.dg/analyzer I noticed that -fanalyzer
wasn't always properly checking for initialization of return values.
The issue was that some "return" handling was using
region_model::copy_region to copy to the RESULT_DECL, and copy_region
wasn't checking for poisoned svalues.
This patch eliminates region_model::copy_region in favor of simply
doing a get_ravlue/set_value pair, fixing the issue.
gcc/analyzer/ChangeLog:
* region-model.cc (region_model::on_return): Replace usage of
copy_region with get_rvalue/set_value pair.
(region_model::pop_frame): Likewise.
(selftest::test_compound_assignment): Likewise.
* region-model.h (region_model::copy_region): Delete decl.
* region.cc (region_model::copy_region): Delete.
gcc/testsuite/ChangeLog:
* gcc.dg/analyzer/torture/ubsan-1.c: Add missing return stmts.
* gcc.dg/analyzer/uninit-trivial-auto-var-init-pattern.c: Move
to...
* gcc.dg/analyzer/torture/uninit-trivial-auto-var-init-pattern.c:
...here.
* gcc.dg/analyzer/uninit-trivial-auto-var-init-uninitialized.c:
Move to...
* gcc.dg/analyzer/torture/uninit-trivial-auto-var-init-uninitialized.c:
...here.
* gcc.dg/analyzer/uninit-trivial-auto-var-init-zero.c: Move to...
* gcc.dg/analyzer/torture/uninit-trivial-auto-var-init-zero.c: ...here.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
gcc/analyzer/ChangeLog:
* region.cc (region::calc_offset): Consolidate effectively
identical cases.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
GCC 12 has gained -Wanalyzer-use-of-uninitialized-value, and I'm
seeing various false positives from it due to region_model::get_lvalue
not properly handling BIT_FIELD_REF, and falling back to
using an UNKNOWN_REGION for them.
This patch fixes these false positives by implementing a new
bit_range_region region subclass for handling BIT_FIELD_REF.
gcc/analyzer/ChangeLog:
* analyzer.h (class bit_range_region): New forward decl.
* region-model-manager.cc (region_model_manager::get_bit_range):
New.
(region_model_manager::log_stats): Handle m_bit_range_regions.
* region-model.cc (region_model::get_lvalue_1): Handle
BIT_FIELD_REF.
* region-model.h (region_model_manager::get_bit_range): New decl.
(region_model_manager::m_bit_range_regions): New field.
* region.cc (region::get_base_region): Handle RK_BIT_RANGE.
(region::base_region_p): Likewise.
(region::calc_offset): Likewise.
(bit_range_region::dump_to_pp): New.
(bit_range_region::get_byte_size): New.
(bit_range_region::get_bit_size): New.
(bit_range_region::get_byte_size_sval): New.
(bit_range_region::get_relative_concrete_offset): New.
* region.h (enum region_kind): Add RK_BIT_RANGE.
(region::dyn_cast_bit_range_region): New vfunc.
(class bit_range_region): New.
(is_a_helper <const bit_range_region *>::test): New.
(default_hash_traits<bit_range_region::key_t>): New.
gcc/testsuite/ChangeLog:
* gcc.dg/analyzer/torture/uninit-bit-field-ref.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
[PR104270]
GCC 12 has gained two features for dealing with uninitialized variables:
(a) a new -Wanalyzer-use-of-uninitialized-value warning within -fanalyzer
for interprocedural path-sensitive detection of ununit uses, and
(b) a new -ftrivial-auto-var-init option for mitigating some uses of
uninit variables
It turns out that using (b) was thwarting (a), as it led to -fanalyzer
seeing calls to IFN_DEFERRED_INIT, which -fanalyzer wasn't
special-casing, thus treating it as initializing the variables in
question, and thus silencing -Wanalyzer-use-of-uninitialized-value on
them.
invoke.texi says:
"GCC still considers an automatic variable that doesn't have an explicit
initializer as uninitialized, @option{-Wuninitialized} will still report
warning messages on such automatic variables."
and thus -Wanalyzer-use-of-uninitialized-value ought to as well.
This patch adds special-case handling to -fanalyzer for
IFN_DEFERRED_INIT, so that -fanalyzer will warn on uninit uses of
variables that are mitigated by -ftrivial-auto-var-init.
gcc/analyzer/ChangeLog:
PR analyzer/104270
* region-model.cc (region_model::on_call_pre): Handle
IFN_DEFERRED_INIT.
gcc/testsuite/ChangeLog:
PR analyzer/104270
* gcc.dg/analyzer/uninit-trivial-auto-var-init-pattern.c: New
test.
* gcc.dg/analyzer/uninit-trivial-auto-var-init-uninitialized.c:
New test.
* gcc.dg/analyzer/uninit-trivial-auto-var-init-zero.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
When reviewing the output of -fanalyzer on PR analyzer/104224 I noticed
that despite very verbose paths, the diagnostic paths for
-Wanalyzer-use-of-uninitialized-value
don't show where the uninitialized memory is allocated.
This patch adapts and simplifies material from
"[PATCH 3/6] analyzer: implement infoleak detection"
https://gcc.gnu.org/pipermail/gcc-patches/2021-November/584377.html
in order to add region creation events for the pertinent region (whether
on the stack or heap).
For example, this patch extends:
malloc-1.c: In function 'test_40':
malloc-1.c:461:5: warning: use of uninitialized value '*p' [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
461 | i = *p;
| ~~^~~~
'test_40': event 1
|
| 461 | i = *p;
| | ~~^~~~
| | |
| | (1) use of uninitialized value '*p' here
|
to:
malloc-1.c: In function 'test_40':
malloc-1.c:461:5: warning: use of uninitialized value '*p' [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
461 | i = *p;
| ~~^~~~
'test_40': events 1-2
|
| 460 | int *p = (int*)malloc(sizeof(int*));
| | ^~~~~~~~~~~~~~~~~~~~
| | |
| | (1) region created on heap here
| 461 | i = *p;
| | ~~~~~~
| | |
| | (2) use of uninitialized value '*p' here
|
and this helps readability of the resulting warnings, especially in
more complicated cases.
gcc/analyzer/ChangeLog:
* checker-path.cc (event_kind_to_string): Handle
EK_REGION_CREATION.
(region_creation_event::region_creation_event): New.
(region_creation_event::get_desc): New.
(checker_path::add_region_creation_event): New.
* checker-path.h (enum event_kind): Add EK_REGION_CREATION.
(class region_creation_event): New subclass.
(checker_path::add_region_creation_event): New decl.
* diagnostic-manager.cc
(diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
param to add_events_for_eedge when handling trailing eedge.
(diagnostic_manager::build_emission_path): Create an interesting_t
instance, allow the pending diagnostic to populate it, and pass it
to the calls to add_events_for_eedge.
(diagnostic_manager::add_events_for_eedge): Add "interest" param.
Use it to add region_creation_events for on-stack regions created
within at function entry, and when pertinent dynamically-sized
regions are created.
(diagnostic_manager::prune_for_sm_diagnostic): Add case for
EK_REGION_CREATION.
* diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
Add "interest" param.
* pending-diagnostic.cc: Include "selftest.h", "tristate.h",
"analyzer/call-string.h", "analyzer/program-point.h",
"analyzer/store.h", and "analyzer/region-model.h".
(interesting_t::add_region_creation): New.
(interesting_t::dump_to_pp): New.
* pending-diagnostic.h (struct interesting_t): New.
(pending_diagnostic::mark_interesting_stuff): New vfunc.
* region-model.cc
(poisoned_value_diagnostic::poisoned_value_diagnostic): Add
(poisoned_value_diagnostic::operator==): Compare m_pkind and
m_src_region fields.
(poisoned_value_diagnostic::mark_interesting_stuff): New.
(poisoned_value_diagnostic::m_src_region): New.
(region_model::check_for_poison): Call
get_region_for_poisoned_expr for uninit values and pass the resul
to the diagnostic.
(region_model::get_region_for_poisoned_expr): New.
(region_model::deref_rvalue): Pass NULL for
poisoned_value_diagnostic's src_region.
* region-model.h (region_model::get_region_for_poisoned_expr): New
decl.
* region.h (frame_region::get_fndecl): New.
gcc/testsuite/ChangeLog:
* gcc.dg/analyzer/data-model-1.c: Add dg-message directives for
expected region creation events.
* gcc.dg/analyzer/malloc-1.c: Likewise.
* gcc.dg/analyzer/memset-CVE-2017-18549-1.c: Likewise.
* gcc.dg/analyzer/pr101547.c: Likewise.
* gcc.dg/analyzer/pr101875.c: Likewise.
* gcc.dg/analyzer/pr101962.c: Likewise.
* gcc.dg/analyzer/pr104224.c: Likewise.
* gcc.dg/analyzer/pr94047.c: Likewise.
* gcc.dg/analyzer/symbolic-1.c: Likewise.
* gcc.dg/analyzer/uninit-1.c: Likewise.
* gcc.dg/analyzer/uninit-4.c: Likewise.
* gcc.dg/analyzer/uninit-alloca.c: New test.
* gcc.dg/analyzer/uninit-pr94713.c: Add dg-message directive for
expected region creation event.
* gcc.dg/analyzer/uninit-pr94714.c: Likewise.
* gcc.dg/analyzer/zlib-3.c: Likewise.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
PR analyzer/104247
gcc/analyzer/ChangeLog:
* constraint-manager.cc (bounded_ranges_manager::log_stats):
Cast to long for format purpose.
* region-model-manager.cc (log_uniq_map): Likewise.
|
|
|
|
We were failing to check for uninitialized arguments to stdio builtins,
such as when passing local "go" to the call to "printf" in "main" in
the testcase.
gcc/analyzer/ChangeLog:
PR analyzer/104224
* region-model.cc (region_model::check_call_args): New.
(region_model::on_call_pre): Call it when ignoring stdio builtins.
* region-model.h (region_model::check_call_args): New decl
gcc/testsuite/ChangeLog:
PR analyzer/104224
* gcc.dg/analyzer/pr104224.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
Mikael Morin spotted that I got the sense wrong when discarding
redundant constraints in
r12-6782-gc4b8f3730a80025192fdb485ad2535c165340e41.
Fixed as follows, which also moves the rejection of contradictory
constraints in range::add_bound to earlier, so that this code can
be self-tested.
gcc/analyzer/ChangeLog:
PR analyzer/94362
* constraint-manager.cc (range::add_bound): Fix tests for
discarding redundant constraints. Perform test for rejecting
unsatisfiable constraints earlier so that they don't update
the object on failure.
(selftest::test_range): New.
(selftest::test_constant_comparisons): Add test coverage for
existing constraints becoming narrower until they are
unsatisfiable.
(selftest::run_constraint_manager_tests): Call test_range.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
PR analyzer/104159 describes an ICE attempting to convert a vector_cst,
which occurs when symbolically executing within a recursive call on:
_4 = BIT_FIELD_REF <w_3(D), 32, 0>;
_1 = VIEW_CONVERT_EXPR<T>(_4);
where the BIT_FIELD_REF leads to a get_or_create_cast from
VEC<long, 8> to VEC<unsigned 4>
which get_code_for_cast erroneously picks NOP_EXPR for the cast, leading
to a bogus input to the VIEW_CONVERT_EXPR.
This patch fixes the issue by giving up on attempts to cast symbolic
values of vector types, treating the result of such casts as unknowable.
gcc/analyzer/ChangeLog:
PR analyzer/104159
* region-model-manager.cc
(region_model_manager::get_or_create_cast): Bail out if the types
are the same. Don't attempt to handle casts involving vector
types.
gcc/testsuite/ChangeLog:
PR analyzer/104159
* gcc.dg/analyzer/torture/pr104159.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
PR analyzer/94362 reports a false positive from
-Wanalyzer-null-dereference seen when analyzing OpenSSL.
The root cause is that the analyzer's path feasibility checker
erroneously considers this to be feasible:
(R + 1 > 0) && (R < 0)
for int R (the return value from sk_EVP_PKEY_ASN1_METHOD_num),
whereas it's not satisfiable for any int R.
This patch makes the constraint manager try harder to reject
such combinations of conditions, fixing the false positive;
perhaps in the longer term we ought to use an SMT solver.
gcc/analyzer/ChangeLog:
PR analyzer/94362
* constraint-manager.cc (bound::ensure_closed): Convert param to
enum bound_kind.
(range::constrained_to_single_element): Likewise.
(range::add_bound): New.
(constraint_manager::add_constraint): Handle SVAL + OFFSET
compared to a constant.
(constraint_manager::get_ec_bounds): Rewrite in terms of
range::add_bound.
(constraint_manager::eval_condition): Reject if range::add_bound
fails.
(selftest::test_constant_comparisons): Add test coverage for
various impossible combinations of integer comparisons.
* constraint-manager.h (enum bound_kind): New.
(struct bound): Likewise.
(bound::ensure_closed): Convert to param to enum bound_kind.
(struct range): Convert to...
(class range): ...this, making fields private.
(range::add_bound): New decls.
* region-model.cc (region_model::add_constraint): Fail if
constraint_manager::add_constraint fails.
gcc/testsuite/ChangeLog:
PR analyzer/94362
* gcc.dg/analyzer/pr94362-1.c: New test.
* gcc.dg/analyzer/pr94362-2.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
gcc/analyzer/ChangeLog:
PR analyzer/104089
* region-model-manager.cc
(region_model_manager::get_or_create_constant_svalue): Assert that
we have a CONSTANT_CLASS_P.
(region_model_manager::maybe_fold_unaryop): Only fold a constant
when fold_unary's result is a constant or a cast of a constant.
gcc/testsuite/ChangeLog:
* gcc.dg/analyzer/pr104089.c: New test.
PR analyzer/104089
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
gcc/analyzer/ChangeLog:
PR analyzer/104062
* region-model-manager.cc
(region_model_manager::maybe_fold_sub_svalue): Avoid casting to
NULL type when folding access to repeated svalue.
gcc/testsuite/ChangeLog:
PR analyzer/104062
* gcc.dg/analyzer/pr104062.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
ChangeLog:
* MAINTAINERS: Rename .c names to .cc.
contrib/ChangeLog:
* filter-clang-warnings.py: Rename .c names to .cc.
* gcc_update: Likewise.
* paranoia.cc: Likewise.
contrib/header-tools/ChangeLog:
* README: Rename .c names to .cc.
gcc/ChangeLog:
* Makefile.in: Rename .c names to .cc.
* alias.h: Likewise.
* asan.cc: Likewise.
* auto-profile.h: Likewise.
* basic-block.h (struct basic_block_d): Likewise.
* btfout.cc: Likewise.
* builtins.cc (expand_builtin_longjmp): Likewise.
(validate_arg): Likewise.
(access_ref::offset_bounded): Likewise.
* caller-save.cc (reg_restore_code): Likewise.
(setup_save_areas): Likewise.
* calls.cc (initialize_argument_information): Likewise.
(expand_call): Likewise.
(emit_library_call_value_1): Likewise.
* cfg-flags.def (RTL): Likewise.
(SIBCALL): Likewise.
(CAN_FALLTHRU): Likewise.
* cfganal.cc (post_order_compute): Likewise.
* cfgcleanup.cc (try_simplify_condjump): Likewise.
(merge_blocks_move_predecessor_nojumps): Likewise.
(merge_blocks_move_successor_nojumps): Likewise.
(merge_blocks_move): Likewise.
(old_insns_match_p): Likewise.
(try_crossjump_bb): Likewise.
* cfgexpand.cc (expand_gimple_stmt): Likewise.
* cfghooks.cc (split_block_before_cond_jump): Likewise.
(profile_record_check_consistency): Likewise.
* cfghooks.h: Likewise.
* cfgrtl.cc (pass_free_cfg::execute): Likewise.
(rtl_can_merge_blocks): Likewise.
(try_redirect_by_replacing_jump): Likewise.
(make_pass_outof_cfg_layout_mode): Likewise.
(cfg_layout_can_merge_blocks_p): Likewise.
* cgraph.cc (release_function_body): Likewise.
(cgraph_node::get_fun): Likewise.
* cgraph.h (struct cgraph_node): Likewise.
(asmname_hasher::equal): Likewise.
(cgraph_inline_failed_type): Likewise.
(thunk_adjust): Likewise.
(dump_callgraph_transformation): Likewise.
(record_references_in_initializer): Likewise.
(ipa_discover_variable_flags): Likewise.
* cgraphclones.cc (GTY): Likewise.
* cgraphunit.cc (symbol_table::finalize_compilation_unit): Likewise.
* collect-utils.h (GCC_COLLECT_UTILS_H): Likewise.
* collect2-aix.h (GCC_COLLECT2_AIX_H): Likewise.
* collect2.cc (maybe_run_lto_and_relink): Likewise.
* combine-stack-adj.cc: Likewise.
* combine.cc (setup_incoming_promotions): Likewise.
(combine_simplify_rtx): Likewise.
(count_rtxs): Likewise.
* common.opt: Likewise.
* common/config/aarch64/aarch64-common.cc: Likewise.
* common/config/arm/arm-common.cc (arm_asm_auto_mfpu): Likewise.
* common/config/avr/avr-common.cc: Likewise.
* common/config/i386/i386-isas.h (struct _isa_names_table): Likewise.
* conditions.h: Likewise.
* config.gcc: Likewise.
* config/aarch64/aarch64-builtins.cc (aarch64_resolve_overloaded_memtag): Likewise.
* config/aarch64/aarch64-protos.h (aarch64_classify_address): Likewise.
(aarch64_get_extension_string_for_isa_flags): Likewise.
* config/aarch64/aarch64-sve-builtins.cc (function_builder::add_function): Likewise.
* config/aarch64/aarch64.cc (aarch64_regmode_natural_size): Likewise.
(aarch64_sched_first_cycle_multipass_dfa_lookahead): Likewise.
(aarch64_option_valid_attribute_p): Likewise.
(aarch64_short_vector_p): Likewise.
(aarch64_float_const_representable_p): Likewise.
* config/aarch64/aarch64.h (DBX_REGISTER_NUMBER): Likewise.
(ASM_OUTPUT_POOL_EPILOGUE): Likewise.
(GTY): Likewise.
* config/aarch64/cortex-a57-fma-steering.cc: Likewise.
* config/aarch64/driver-aarch64.cc (contains_core_p): Likewise.
* config/aarch64/t-aarch64: Likewise.
* config/aarch64/x-aarch64: Likewise.
* config/aarch64/x-darwin: Likewise.
* config/alpha/alpha-protos.h: Likewise.
* config/alpha/alpha.cc (alpha_scalar_mode_supported_p): Likewise.
* config/alpha/alpha.h (LONG_DOUBLE_TYPE_SIZE): Likewise.
(enum reg_class): Likewise.
* config/alpha/alpha.md: Likewise.
* config/alpha/driver-alpha.cc (AMASK_LOCKPFTCHOK): Likewise.
* config/alpha/x-alpha: Likewise.
* config/arc/arc-protos.h (arc_eh_uses): Likewise.
* config/arc/arc.cc (ARC_OPT): Likewise.
(arc_ccfsm_advance): Likewise.
(arc_arg_partial_bytes): Likewise.
(conditionalize_nonjump): Likewise.
* config/arc/arc.md: Likewise.
* config/arc/builtins.def: Likewise.
* config/arc/t-arc: Likewise.
* config/arm/arm-c.cc (arm_resolve_overloaded_builtin): Likewise.
(arm_pragma_target_parse): Likewise.
* config/arm/arm-protos.h (save_restore_target_globals): Likewise.
(arm_cpu_cpp_builtins): Likewise.
* config/arm/arm.cc (vfp3_const_double_index): Likewise.
(shift_op): Likewise.
(thumb2_final_prescan_insn): Likewise.
(arm_final_prescan_insn): Likewise.
(arm_asm_output_labelref): Likewise.
(arm_small_register_classes_for_mode_p): Likewise.
* config/arm/arm.h: Likewise.
* config/arm/arm.md: Likewise.
* config/arm/driver-arm.cc: Likewise.
* config/arm/symbian.h: Likewise.
* config/arm/t-arm: Likewise.
* config/arm/thumb1.md: Likewise.
* config/arm/x-arm: Likewise.
* config/avr/avr-c.cc (avr_register_target_pragmas): Likewise.
* config/avr/avr-fixed.md: Likewise.
* config/avr/avr-log.cc (avr_log_vadump): Likewise.
* config/avr/avr-mcus.def: Likewise.
* config/avr/avr-modes.def (FRACTIONAL_INT_MODE): Likewise.
* config/avr/avr-passes.def (INSERT_PASS_BEFORE): Likewise.
* config/avr/avr-protos.h (make_avr_pass_casesi): Likewise.
* config/avr/avr.cc (avr_option_override): Likewise.
(avr_build_builtin_va_list): Likewise.
(avr_mode_dependent_address_p): Likewise.
(avr_function_arg_advance): Likewise.
(avr_asm_output_aligned_decl_common): Likewise.
* config/avr/avr.h (RETURN_ADDR_RTX): Likewise.
(SUPPORTS_INIT_PRIORITY): Likewise.
* config/avr/avr.md: Likewise.
* config/avr/builtins.def: Likewise.
* config/avr/gen-avr-mmcu-specs.cc (IN_GEN_AVR_MMCU_TEXI): Likewise.
* config/avr/gen-avr-mmcu-texi.cc (IN_GEN_AVR_MMCU_TEXI): Likewise.
(main): Likewise.
* config/avr/t-avr: Likewise.
* config/bfin/bfin.cc (frame_related_constant_load): Likewise.
* config/bpf/bpf-protos.h (GCC_BPF_PROTOS_H): Likewise.
* config/bpf/bpf.h (enum reg_class): Likewise.
* config/bpf/t-bpf: Likewise.
* config/c6x/c6x-protos.h (GCC_C6X_PROTOS_H): Likewise.
* config/cr16/cr16-protos.h: Likewise.
* config/cris/cris.cc (cris_address_cost): Likewise.
(cris_side_effect_mode_ok): Likewise.
(cris_init_machine_status): Likewise.
(cris_emit_movem_store): Likewise.
* config/cris/cris.h (INDEX_REG_CLASS): Likewise.
(enum reg_class): Likewise.
(struct cum_args): Likewise.
* config/cris/cris.opt: Likewise.
* config/cris/sync.md: Likewise.
* config/csky/csky.cc (csky_expand_prologue): Likewise.
* config/darwin-c.cc: Likewise.
* config/darwin-f.cc: Likewise.
* config/darwin-sections.def (zobj_const_section): Likewise.
* config/darwin.cc (output_objc_section_asm_op): Likewise.
(fprintf): Likewise.
* config/darwin.h (GTY): Likewise.
* config/elfos.h: Likewise.
* config/epiphany/epiphany-sched.md: Likewise.
* config/epiphany/epiphany.cc (epiphany_function_value): Likewise.
* config/epiphany/epiphany.h (GTY): Likewise.
(NO_FUNCTION_CSE): Likewise.
* config/epiphany/mode-switch-use.cc: Likewise.
* config/epiphany/predicates.md: Likewise.
* config/epiphany/t-epiphany: Likewise.
* config/fr30/fr30-protos.h: Likewise.
* config/frv/frv-protos.h: Likewise.
* config/frv/frv.cc (TLS_BIAS): Likewise.
* config/frv/frv.h (ASM_OUTPUT_ALIGNED_LOCAL): Likewise.
* config/ft32/ft32-protos.h: Likewise.
* config/gcn/gcn-hsa.h (ASM_APP_OFF): Likewise.
* config/gcn/gcn.cc (gcn_init_libfuncs): Likewise.
* config/gcn/mkoffload.cc (copy_early_debug_info): Likewise.
* config/gcn/t-gcn-hsa: Likewise.
* config/gcn/t-omp-device: Likewise.
* config/h8300/h8300-protos.h (GCC_H8300_PROTOS_H): Likewise.
(same_cmp_following_p): Likewise.
* config/h8300/h8300.cc (F): Likewise.
* config/h8300/h8300.h (struct cum_arg): Likewise.
(BRANCH_COST): Likewise.
* config/i386/cygming.h (DEFAULT_PCC_STRUCT_RETURN): Likewise.
* config/i386/djgpp.h (TARGET_ASM_LTO_END): Likewise.
* config/i386/dragonfly.h (NO_PROFILE_COUNTERS): Likewise.
* config/i386/driver-i386.cc (detect_caches_intel): Likewise.
* config/i386/freebsd.h (NO_PROFILE_COUNTERS): Likewise.
* config/i386/i386-c.cc (ix86_target_macros): Likewise.
* config/i386/i386-expand.cc (get_mode_wider_vector): Likewise.
* config/i386/i386-options.cc (ix86_set_func_type): Likewise.
* config/i386/i386-protos.h (ix86_extract_perm_from_pool_constant): Likewise.
(ix86_register_pragmas): Likewise.
(ix86_d_has_stdcall_convention): Likewise.
(i386_pe_seh_init_sections): Likewise.
* config/i386/i386.cc (ix86_function_arg_regno_p): Likewise.
(ix86_function_value_regno_p): Likewise.
(ix86_compute_frame_layout): Likewise.
(legitimize_pe_coff_symbol): Likewise.
(output_pic_addr_const): Likewise.
* config/i386/i386.h (defined): Likewise.
(host_detect_local_cpu): Likewise.
(CONSTANT_ADDRESS_P): Likewise.
(DEFAULT_LARGE_SECTION_THRESHOLD): Likewise.
(struct machine_frame_state): Likewise.
* config/i386/i386.md: Likewise.
* config/i386/lynx.h (ASM_OUTPUT_ALIGN): Likewise.
* config/i386/mmx.md: Likewise.
* config/i386/sse.md: Likewise.
* config/i386/t-cygming: Likewise.
* config/i386/t-djgpp: Likewise.
* config/i386/t-gnu-property: Likewise.
* config/i386/t-i386: Likewise.
* config/i386/t-intelmic: Likewise.
* config/i386/t-omp-device: Likewise.
* config/i386/winnt-cxx.cc (i386_pe_type_dllimport_p): Likewise.
(i386_pe_adjust_class_at_definition): Likewise.
* config/i386/winnt.cc (gen_stdcall_or_fastcall_suffix): Likewise.
(i386_pe_mangle_decl_assembler_name): Likewise.
(i386_pe_encode_section_info): Likewise.
* config/i386/x-cygwin: Likewise.
* config/i386/x-darwin: Likewise.
* config/i386/x-i386: Likewise.
* config/i386/x-mingw32: Likewise.
* config/i386/x86-tune-sched-core.cc: Likewise.
* config/i386/x86-tune.def: Likewise.
* config/i386/xm-djgpp.h (STANDARD_STARTFILE_PREFIX_1): Likewise.
* config/ia64/freebsd.h: Likewise.
* config/ia64/hpux.h (REGISTER_TARGET_PRAGMAS): Likewise.
* config/ia64/ia64-protos.h (ia64_except_unwind_info): Likewise.
* config/ia64/ia64.cc (ia64_function_value_regno_p): Likewise.
(ia64_secondary_reload_class): Likewise.
(bundling): Likewise.
* config/ia64/ia64.h: Likewise.
* config/ia64/ia64.md: Likewise.
* config/ia64/predicates.md: Likewise.
* config/ia64/sysv4.h: Likewise.
* config/ia64/t-ia64: Likewise.
* config/iq2000/iq2000.h (FUNCTION_MODE): Likewise.
* config/iq2000/iq2000.md: Likewise.
* config/linux.h (TARGET_HAS_BIONIC): Likewise.
(if): Likewise.
* config/m32c/m32c.cc (m32c_function_needs_enter): Likewise.
* config/m32c/m32c.h (MAX_REGS_PER_ADDRESS): Likewise.
* config/m32c/t-m32c: Likewise.
* config/m32r/m32r-protos.h: Likewise.
* config/m32r/m32r.cc (m32r_print_operand): Likewise.
* config/m32r/m32r.h: Likewise.
* config/m32r/m32r.md: Likewise.
* config/m68k/m68k-isas.def: Likewise.
* config/m68k/m68k-microarchs.def: Likewise.
* config/m68k/m68k-protos.h (strict_low_part_peephole_ok): Likewise.
(m68k_epilogue_uses): Likewise.
* config/m68k/m68k.cc (m68k_call_tls_get_addr): Likewise.
(m68k_sched_adjust_cost): Likewise.
(m68k_sched_md_init): Likewise.
* config/m68k/m68k.h (__transfer_from_trampoline): Likewise.
(enum m68k_function_kind): Likewise.
* config/m68k/m68k.md: Likewise.
* config/m68k/m68kemb.h: Likewise.
* config/m68k/uclinux.h (ENDFILE_SPEC): Likewise.
* config/mcore/mcore-protos.h: Likewise.
* config/mcore/mcore.cc (mcore_expand_insv): Likewise.
(mcore_expand_prolog): Likewise.
* config/mcore/mcore.h (TARGET_MCORE): Likewise.
* config/mcore/mcore.md: Likewise.
* config/microblaze/microblaze-protos.h: Likewise.
* config/microblaze/microblaze.cc (microblaze_legitimate_pic_operand): Likewise.
(microblaze_function_prologue): Likewise.
(microblaze_function_epilogue): Likewise.
(microblaze_select_section): Likewise.
(microblaze_asm_output_mi_thunk): Likewise.
(microblaze_eh_return): Likewise.
* config/microblaze/microblaze.h: Likewise.
* config/microblaze/microblaze.md: Likewise.
* config/microblaze/t-microblaze: Likewise.
* config/mips/driver-native.cc: Likewise.
* config/mips/loongson2ef.md: Likewise.
* config/mips/mips-protos.h (mips_expand_vec_cmp_expr): Likewise.
* config/mips/mips.cc (mips_rtx_costs): Likewise.
(mips_output_filename): Likewise.
(mips_output_function_prologue): Likewise.
(mips_output_function_epilogue): Likewise.
(mips_output_mi_thunk): Likewise.
* config/mips/mips.h: Likewise.
* config/mips/mips.md: Likewise.
* config/mips/t-mips: Likewise.
* config/mips/x-native: Likewise.
* config/mmix/mmix-protos.h: Likewise.
* config/mmix/mmix.cc (mmix_option_override): Likewise.
(mmix_dbx_register_number): Likewise.
(mmix_expand_prologue): Likewise.
* config/mmix/mmix.h: Likewise.
* config/mmix/mmix.md: Likewise.
* config/mmix/predicates.md: Likewise.
* config/mn10300/mn10300.cc (mn10300_symbolic_operand): Likewise.
(mn10300_legitimate_pic_operand_p): Likewise.
* config/mn10300/mn10300.h (enum reg_class): Likewise.
(NO_FUNCTION_CSE): Likewise.
* config/moxie/moxie-protos.h: Likewise.
* config/moxie/uclinux.h (TARGET_LIBC_HAS_FUNCTION): Likewise.
* config/msp430/msp430-devices.cc (extract_devices_dir_from_exec_prefix): Likewise.
* config/msp430/msp430.cc (msp430_gimplify_va_arg_expr): Likewise.
(msp430_incoming_return_addr_rtx): Likewise.
* config/msp430/msp430.h (msp430_get_linker_devices_include_path): Likewise.
* config/msp430/t-msp430: Likewise.
* config/nds32/nds32-cost.cc (nds32_rtx_costs_speed_prefer): Likewise.
(nds32_rtx_costs_size_prefer): Likewise.
(nds32_init_rtx_costs): Likewise.
* config/nds32/nds32-doubleword.md: Likewise.
* config/nds32/nds32.cc (nds32_memory_move_cost): Likewise.
(nds32_builtin_decl): Likewise.
* config/nds32/nds32.h (enum nds32_16bit_address_type): Likewise.
(enum nds32_isr_nested_type): Likewise.
(enum reg_class): Likewise.
* config/nds32/predicates.md: Likewise.
* config/nds32/t-nds32: Likewise.
* config/nios2/nios2.cc (nios2_pragma_target_parse): Likewise.
* config/nvptx/nvptx-protos.h: Likewise.
* config/nvptx/nvptx.cc (nvptx_goacc_expand_var_decl): Likewise.
* config/nvptx/nvptx.h (TARGET_CPU_CPP_BUILTINS): Likewise.
* config/nvptx/t-nvptx: Likewise.
* config/nvptx/t-omp-device: Likewise.
* config/pa/elf.h: Likewise.
* config/pa/pa-linux.h (GLOBAL_ASM_OP): Likewise.
* config/pa/pa-netbsd.h (GLOBAL_ASM_OP): Likewise.
* config/pa/pa-openbsd.h (TARGET_ASM_GLOBALIZE_LABEL): Likewise.
* config/pa/pa-protos.h (pa_eh_return_handler_rtx): Likewise.
(pa_legitimize_reload_address): Likewise.
(pa_can_use_return_insn): Likewise.
* config/pa/pa.cc (mem_shadd_or_shadd_rtx_p): Likewise.
(som_output_text_section_asm_op): Likewise.
* config/pa/pa.h (PROFILE_BEFORE_PROLOGUE): Likewise.
* config/pa/pa.md: Likewise.
* config/pa/som.h: Likewise.
* config/pa/t-pa: Likewise.
* config/pdp11/pdp11.cc (decode_pdp11_d): Likewise.
* config/pdp11/pdp11.h: Likewise.
* config/pdp11/pdp11.md: Likewise.
* config/pdp11/t-pdp11: Likewise.
* config/pru/pru.md: Likewise.
* config/pru/t-pru: Likewise.
* config/riscv/riscv-protos.h (NUM_SYMBOL_TYPES): Likewise.
(riscv_gpr_save_operation_p): Likewise.
(riscv_d_register_target_info): Likewise.
(riscv_init_builtins): Likewise.
* config/riscv/riscv.cc (riscv_output_mi_thunk): Likewise.
* config/riscv/riscv.h (CSW_MAX_OFFSET): Likewise.
* config/riscv/t-riscv: Likewise.
* config/rl78/rl78.cc (rl78_asm_ctor_dtor): Likewise.
* config/rl78/t-rl78: Likewise.
* config/rs6000/aix.h: Likewise.
* config/rs6000/aix71.h (ASM_SPEC_COMMON): Likewise.
* config/rs6000/aix72.h (ASM_SPEC_COMMON): Likewise.
* config/rs6000/aix73.h (ASM_SPEC_COMMON): Likewise.
* config/rs6000/darwin.h (TARGET_ASM_GLOBALIZE_LABEL): Likewise.
* config/rs6000/driver-rs6000.cc: Likewise.
* config/rs6000/freebsd.h: Likewise.
* config/rs6000/freebsd64.h: Likewise.
* config/rs6000/lynx.h (ASM_OUTPUT_ALIGN): Likewise.
* config/rs6000/rbtree.cc: Likewise.
* config/rs6000/rbtree.h: Likewise.
* config/rs6000/rs6000-c.cc (rs6000_target_modify_macros): Likewise.
* config/rs6000/rs6000-call.cc (rs6000_invalid_builtin): Likewise.
(rs6000_expand_builtin): Likewise.
(rs6000_init_builtins): Likewise.
* config/rs6000/rs6000-cpus.def: Likewise.
* config/rs6000/rs6000-gen-builtins.cc (write_init_ovld_table): Likewise.
* config/rs6000/rs6000-internal.h (ALTIVEC_REG_BIT): Likewise.
(quad_address_offset_p): Likewise.
* config/rs6000/rs6000-logue.cc (interesting_frame_related_regno): Likewise.
(rs6000_emit_epilogue): Likewise.
* config/rs6000/rs6000-overload.def: Likewise.
* config/rs6000/rs6000-p8swap.cc: Likewise.
* config/rs6000/rs6000-protos.h (GCC_RS6000_PROTOS_H): Likewise.
(rs6000_const_f32_to_i32): Likewise.
* config/rs6000/rs6000.cc (legitimate_lo_sum_address_p): Likewise.
(rs6000_debug_legitimize_address): Likewise.
(rs6000_mode_dependent_address): Likewise.
(rs6000_adjust_priority): Likewise.
(rs6000_c_mode_for_suffix): Likewise.
* config/rs6000/rs6000.h (defined): Likewise.
(LONG_DOUBLE_TYPE_SIZE): Likewise.
* config/rs6000/rs6000.md: Likewise.
* config/rs6000/sysv4.h: Likewise.
* config/rs6000/t-linux: Likewise.
* config/rs6000/t-linux64: Likewise.
* config/rs6000/t-rs6000: Likewise.
* config/rs6000/x-darwin: Likewise.
* config/rs6000/x-darwin64: Likewise.
* config/rs6000/x-rs6000: Likewise.
* config/rs6000/xcoff.h (ASM_OUTPUT_LABELREF): Likewise.
* config/rx/rx.cc (rx_expand_builtin): Likewise.
* config/s390/constraints.md: Likewise.
* config/s390/driver-native.cc: Likewise.
* config/s390/htmxlintrin.h: Likewise.
* config/s390/s390-builtins.def (B_DEF): Likewise.
(OB_DEF_VAR): Likewise.
* config/s390/s390-builtins.h: Likewise.
* config/s390/s390-c.cc: Likewise.
* config/s390/s390-opts.h: Likewise.
* config/s390/s390-protos.h (s390_check_symref_alignment): Likewise.
(s390_register_target_pragmas): Likewise.
* config/s390/s390.cc (s390_init_builtins): Likewise.
(s390_expand_plus_operand): Likewise.
(s390_expand_atomic): Likewise.
(s390_valid_target_attribute_inner_p): Likewise.
* config/s390/s390.h (LONG_DOUBLE_TYPE_SIZE): Likewise.
* config/s390/s390.md: Likewise.
* config/s390/t-s390: Likewise.
* config/s390/vx-builtins.md: Likewise.
* config/s390/x-native: Likewise.
* config/sh/divtab-sh4-300.cc (main): Likewise.
* config/sh/divtab-sh4.cc (main): Likewise.
* config/sh/divtab.cc (main): Likewise.
* config/sh/elf.h: Likewise.
* config/sh/sh-protos.h (sh_fsca_int2sf): Likewise.
* config/sh/sh.cc (SYMBOL_FLAG_FUNCVEC_FUNCTION): Likewise.
(sh_struct_value_rtx): Likewise.
(sh_remove_reg_dead_or_unused_notes): Likewise.
* config/sh/sh.h (MIN_UNITS_PER_WORD): Likewise.
* config/sh/t-sh: Likewise.
* config/sol2-protos.h (solaris_override_options): Likewise.
* config/sol2.h: Likewise.
* config/sparc/driver-sparc.cc: Likewise.
* config/sparc/freebsd.h: Likewise.
* config/sparc/sparc-protos.h (make_pass_work_around_errata): Likewise.
* config/sparc/sparc.cc (sparc_output_mi_thunk): Likewise.
(sparc_asan_shadow_offset): Likewise.
* config/sparc/sparc.h: Likewise.
* config/sparc/sparc.md: Likewise.
* config/sparc/t-sparc: Likewise.
* config/sparc/x-sparc: Likewise.
* config/stormy16/stormy16.cc (xstormy16_mode_dependent_address_p): Likewise.
* config/t-darwin: Likewise.
* config/t-dragonfly: Likewise.
* config/t-freebsd: Likewise.
* config/t-glibc: Likewise.
* config/t-linux: Likewise.
* config/t-netbsd: Likewise.
* config/t-openbsd: Likewise.
* config/t-pnt16-warn: Likewise.
* config/t-sol2: Likewise.
* config/t-vxworks: Likewise.
* config/t-winnt: Likewise.
* config/tilegx/t-tilegx: Likewise.
* config/tilegx/tilegx-c.cc: Likewise.
* config/tilegx/tilegx-protos.h (tilegx_function_profiler): Likewise.
* config/tilegx/tilegx.md: Likewise.
* config/tilepro/t-tilepro: Likewise.
* config/tilepro/tilepro-c.cc: Likewise.
* config/v850/t-v850: Likewise.
* config/v850/v850-protos.h: Likewise.
* config/v850/v850.cc (F): Likewise.
* config/v850/v850.h (enum reg_class): Likewise.
(SLOW_BYTE_ACCESS): Likewise.
* config/vax/vax.cc (vax_mode_dependent_address_p): Likewise.
* config/vax/vax.h (enum reg_class): Likewise.
* config/vax/vax.md: Likewise.
* config/visium/visium.cc (visium_legitimate_address_p): Likewise.
* config/visium/visium.h: Likewise.
* config/vms/t-vms: Likewise.
* config/vms/vms-crtlmap.map: Likewise.
* config/vms/vms-protos.h (vms_c_get_vms_ver): Likewise.
* config/vx-common.h: Likewise.
* config/x-darwin: Likewise.
* config/x-hpux: Likewise.
* config/x-linux: Likewise.
* config/x-netbsd: Likewise.
* config/x-openbsd: Likewise.
* config/x-solaris: Likewise.
* config/xtensa/xtensa-protos.h (xtensa_mem_offset): Likewise.
* config/xtensa/xtensa.cc (xtensa_option_override): Likewise.
* config/xtensa/xtensa.h: Likewise.
* configure.ac: Likewise.
* context.cc: Likewise.
* convert.h: Likewise.
* coretypes.h: Likewise.
* coverage.cc: Likewise.
* coverage.h: Likewise.
* cppdefault.h (struct default_include): Likewise.
* cprop.cc (local_cprop_pass): Likewise.
(one_cprop_pass): Likewise.
* cse.cc (hash_rtx_cb): Likewise.
(fold_rtx): Likewise.
* ctfc.h (ctfc_get_num_vlen_bytes): Likewise.
* data-streamer.h (bp_unpack_var_len_int): Likewise.
(streamer_write_widest_int): Likewise.
* dbgcnt.def: Likewise.
* dbxout.cc (dbxout_early_global_decl): Likewise.
(dbxout_common_check): Likewise.
* dbxout.h: Likewise.
* debug.h (struct gcc_debug_hooks): Likewise.
(dump_go_spec_init): Likewise.
* df-core.cc: Likewise.
* df-scan.cc (df_insn_info_delete): Likewise.
(df_insn_delete): Likewise.
* df.h (debug_df_chain): Likewise.
(can_move_insns_across): Likewise.
* dfp.cc (decimal_from_binary): Likewise.
* diagnostic-color.cc: Likewise.
* diagnostic-event-id.h: Likewise.
* diagnostic-show-locus.cc (test_one_liner_labels): Likewise.
* diagnostic.cc (bt_callback): Likewise.
(num_digits): Likewise.
* doc/avr-mmcu.texi: Likewise.
* doc/cfg.texi: Likewise.
* doc/contrib.texi: Likewise.
* doc/cppinternals.texi: Likewise.
* doc/extend.texi: Likewise.
* doc/generic.texi: Likewise.
* doc/gimple.texi: Likewise.
* doc/gty.texi: Likewise.
* doc/invoke.texi: Likewise.
* doc/loop.texi: Likewise.
* doc/lto.texi: Likewise.
* doc/match-and-simplify.texi: Likewise.
* doc/md.texi: Likewise.
* doc/optinfo.texi: Likewise.
* doc/options.texi: Likewise.
* doc/passes.texi: Likewise.
* doc/plugins.texi: Likewise.
* doc/rtl.texi: Likewise.
* doc/sourcebuild.texi: Likewise.
* doc/tm.texi: Likewise.
* doc/tm.texi.in: Likewise.
* doc/tree-ssa.texi: Likewise.
* dojump.cc (do_jump): Likewise.
* dojump.h: Likewise.
* dumpfile.cc (test_impl_location): Likewise.
(test_capture_of_dump_calls): Likewise.
* dumpfile.h (enum dump_kind): Likewise.
(class dump_location_t): Likewise.
(dump_enabled_p): Likewise.
(enable_rtl_dump_file): Likewise.
(dump_combine_total_stats): Likewise.
* dwarf2asm.cc (dw2_asm_output_delta_uleb128): Likewise.
* dwarf2ctf.h (ctf_debug_finish): Likewise.
* dwarf2out.cc (dwarf2out_begin_prologue): Likewise.
(struct loc_descr_context): Likewise.
(rtl_for_decl_location): Likewise.
(gen_subprogram_die): Likewise.
(gen_label_die): Likewise.
(is_trivial_indirect_ref): Likewise.
(dwarf2out_late_global_decl): Likewise.
(dwarf_file_hasher::hash): Likewise.
(dwarf2out_end_source_file): Likewise.
(dwarf2out_define): Likewise.
(dwarf2out_early_finish): Likewise.
* dwarf2out.h (struct dw_fde_node): Likewise.
(struct dw_discr_list_node): Likewise.
(output_loc_sequence_raw): Likewise.
* emit-rtl.cc (gen_raw_REG): Likewise.
(maybe_set_max_label_num): Likewise.
* emit-rtl.h (struct rtl_data): Likewise.
* errors.cc (internal_error): Likewise.
(trim_filename): Likewise.
* et-forest.cc: Likewise.
* except.cc (init_eh_for_function): Likewise.
* explow.cc (promote_ssa_mode): Likewise.
(get_dynamic_stack_size): Likewise.
* explow.h: Likewise.
* expmed.h: Likewise.
* expr.cc (safe_from_p): Likewise.
(expand_expr_real_2): Likewise.
(expand_expr_real_1): Likewise.
* file-prefix-map.cc (remap_filename): Likewise.
* final.cc (app_enable): Likewise.
(make_pass_compute_alignments): Likewise.
(final_scan_insn_1): Likewise.
(final_scan_insn): Likewise.
* fixed-value.h (fixed_from_string): Likewise.
* flag-types.h (NO_DEBUG): Likewise.
(DWARF2_DEBUG): Likewise.
(VMS_DEBUG): Likewise.
(BTF_DEBUG): Likewise.
(enum ctf_debug_info_levels): Likewise.
* fold-const.cc (const_binop): Likewise.
(fold_binary_loc): Likewise.
(fold_checksum_tree): Likewise.
* fp-test.cc: Likewise.
* function.cc (expand_function_end): Likewise.
* function.h (struct function): Likewise.
* fwprop.cc (should_replace_address): Likewise.
* gcc-main.cc: Likewise.
* gcc-rich-location.h (class gcc_rich_location): Likewise.
* gcc-symtab.h: Likewise.
* gcc.cc (MIN_FATAL_STATUS): Likewise.
(driver_handle_option): Likewise.
(quote_spec_arg): Likewise.
(driver::finalize): Likewise.
* gcc.h (set_input): Likewise.
* gcov-dump.cc: Likewise.
* gcov.cc (solve_flow_graph): Likewise.
* gcse-common.cc: Likewise.
* gcse.cc (make_pass_rtl_hoist): Likewise.
* genattr-common.cc: Likewise.
* genattrtab.cc (min_fn): Likewise.
(write_const_num_delay_slots): Likewise.
* genautomata.cc: Likewise.
* genconditions.cc (write_one_condition): Likewise.
* genconstants.cc: Likewise.
* genemit.cc (gen_exp): Likewise.
* generic-match-head.cc: Likewise.
* genextract.cc: Likewise.
* gengenrtl.cc (always_void_p): Likewise.
* gengtype-parse.cc (gtymarker_opt): Likewise.
* gengtype-state.cc (state_writer::state_writer): Likewise.
(write_state_trailer): Likewise.
(equals_type_number): Likewise.
(read_state): Likewise.
* gengtype.cc (open_base_files): Likewise.
(struct file_rule_st): Likewise.
(header_dot_h_frul): Likewise.
* gengtype.h: Likewise.
* genmatch.cc (main): Likewise.
* genmddeps.cc: Likewise.
* genmodes.cc (emit_mode_inner): Likewise.
(emit_mode_unit_size): Likewise.
* genpeep.cc (gen_peephole): Likewise.
* genpreds.cc (write_tm_preds_h): Likewise.
* genrecog.cc (validate_pattern): Likewise.
(write_header): Likewise.
(main): Likewise.
* gensupport.cc (change_subst_attribute): Likewise.
(traverse_c_tests): Likewise.
(add_predicate): Likewise.
(init_predicate_table): Likewise.
* gensupport.h (struct optab_pattern): Likewise.
(get_num_insn_codes): Likewise.
(maybe_eval_c_test): Likewise.
(struct pred_data): Likewise.
* ggc-internal.h: Likewise.
* gimple-fold.cc (maybe_fold_reference): Likewise.
(get_range_strlen_tree): Likewise.
* gimple-fold.h (gimple_stmt_integer_valued_real_p): Likewise.
* gimple-low.cc: Likewise.
* gimple-match-head.cc (directly_supported_p): Likewise.
* gimple-pretty-print.h: Likewise.
* gimple-ssa-sprintf.cc (format_percent): Likewise.
(adjust_range_for_overflow): Likewise.
* gimple-streamer.h: Likewise.
* gimple.h (struct GTY): Likewise.
(is_gimple_resx): Likewise.
* gimplify.cc (gimplify_expr): Likewise.
(gimplify_init_constructor): Likewise.
(omp_construct_selector_matches): Likewise.
(gimplify_omp_target_update): Likewise.
(gimplify_omp_ordered): Likewise.
(gimplify_va_arg_expr): Likewise.
* graphite-isl-ast-to-gimple.cc (should_copy_to_new_region): Likewise.
* haifa-sched.cc (increase_insn_priority): Likewise.
(try_ready): Likewise.
(sched_create_recovery_edges): Likewise.
* ifcvt.cc (find_if_case_1): Likewise.
(find_if_case_2): Likewise.
* inchash.h: Likewise.
* incpath.cc (add_env_var_paths): Likewise.
* input.cc (dump_location_info): Likewise.
(assert_loceq): Likewise.
(test_lexer_string_locations_concatenation_1): Likewise.
(test_lexer_string_locations_concatenation_2): Likewise.
(test_lexer_string_locations_concatenation_3): Likewise.
* input.h (BUILTINS_LOCATION): Likewise.
(class string_concat_db): Likewise.
* internal-fn.cc (expand_MUL_OVERFLOW): Likewise.
(expand_LOOP_VECTORIZED): Likewise.
* ipa-cp.cc (make_pass_ipa_cp): Likewise.
* ipa-fnsummary.cc (remap_freqcounting_preds_after_dup): Likewise.
(ipa_fn_summary_t::duplicate): Likewise.
(make_pass_ipa_fn_summary): Likewise.
* ipa-fnsummary.h (enum ipa_hints_vals): Likewise.
* ipa-free-lang-data.cc (fld_simplified_type): Likewise.
(free_lang_data_in_decl): Likewise.
* ipa-inline.cc (compute_inlined_call_time): Likewise.
(inline_always_inline_functions): Likewise.
* ipa-inline.h (free_growth_caches): Likewise.
(inline_account_function_p): Likewise.
* ipa-modref.cc (modref_access_analysis::analyze_stmt): Likewise.
(modref_eaf_analysis::analyze_ssa_name): Likewise.
* ipa-param-manipulation.cc (ipa_param_body_adjustments::mark_dead_statements): Likewise.
(ipa_param_body_adjustments::remap_with_debug_expressions): Likewise.
* ipa-prop.cc (ipa_set_node_agg_value_chain): Likewise.
* ipa-prop.h (IPA_UNDESCRIBED_USE): Likewise.
(unadjusted_ptr_and_unit_offset): Likewise.
* ipa-reference.cc (make_pass_ipa_reference): Likewise.
* ipa-reference.h (GCC_IPA_REFERENCE_H): Likewise.
* ipa-split.cc (consider_split): Likewise.
* ipa-sra.cc (isra_read_node_info): Likewise.
* ipa-utils.h (struct ipa_dfs_info): Likewise.
(recursive_call_p): Likewise.
(ipa_make_function_pure): Likewise.
* ira-build.cc (ira_create_allocno): Likewise.
(ira_flattening): Likewise.
* ira-color.cc (do_coloring): Likewise.
(update_curr_costs): Likewise.
* ira-conflicts.cc (process_regs_for_copy): Likewise.
* ira-int.h (struct ira_emit_data): Likewise.
(ira_prohibited_mode_move_regs): Likewise.
(ira_get_dup_out_num): Likewise.
(ira_destroy): Likewise.
(ira_tune_allocno_costs): Likewise.
(ira_implicitly_set_insn_hard_regs): Likewise.
(ira_build_conflicts): Likewise.
(ira_color): Likewise.
* ira-lives.cc (process_bb_node_lives): Likewise.
* ira.cc (class ira_spilled_reg_stack_slot): Likewise.
(setup_uniform_class_p): Likewise.
(def_dominates_uses): Likewise.
* ira.h (ira_nullify_asm_goto): Likewise.
* langhooks.cc (lhd_post_options): Likewise.
* langhooks.h (class substring_loc): Likewise.
(struct lang_hooks_for_tree_inlining): Likewise.
(struct lang_hooks_for_types): Likewise.
(struct lang_hooks): Likewise.
* libfuncs.h (synchronize_libfunc): Likewise.
* loop-doloop.cc (doloop_condition_get): Likewise.
* loop-init.cc (fix_loop_structure): Likewise.
* loop-invariant.cc: Likewise.
* lower-subreg.h: Likewise.
* lra-constraints.cc (curr_insn_transform): Likewise.
* lra-int.h (struct lra_insn_reg): Likewise.
(lra_undo_inheritance): Likewise.
(lra_setup_reload_pseudo_preferenced_hard_reg): Likewise.
(lra_split_hard_reg_for): Likewise.
(lra_coalesce): Likewise.
(lra_final_code_change): Likewise.
* lra-spills.cc (lra_final_code_change): Likewise.
* lra.cc (lra_process_new_insns): Likewise.
* lto-compress.h (struct lto_compression_stream): Likewise.
* lto-streamer-out.cc (DFS::DFS_write_tree_body): Likewise.
(write_symbol): Likewise.
* lto-streamer.h (enum LTO_tags): Likewise.
(lto_value_range_error): Likewise.
(lto_append_block): Likewise.
(lto_streamer_hooks_init): Likewise.
(stream_read_tree_ref): Likewise.
(lto_prepare_function_for_streaming): Likewise.
(select_what_to_stream): Likewise.
(omp_lto_input_declare_variant_alt): Likewise.
(cl_optimization_stream_in): Likewise.
* lto-wrapper.cc (append_compiler_options): Likewise.
* machmode.def: Likewise.
* machmode.h (struct int_n_data_t): Likewise.
* main.cc (main): Likewise.
* match.pd: Likewise.
* omp-builtins.def (BUILT_IN_GOMP_CRITICAL_NAME_END): Likewise.
(BUILT_IN_GOMP_LOOP_ULL_ORDERED_RUNTIME_NEXT): Likewise.
* omp-expand.cc (expand_omp_atomic_fetch_op): Likewise.
(make_pass_expand_omp_ssa): Likewise.
* omp-low.cc (struct omp_context): Likewise.
(struct omp_taskcopy_context): Likewise.
(lower_omp): Likewise.
* omp-oacc-neuter-broadcast.cc (omp_sese_active_worker_call): Likewise.
(mask_name): Likewise.
(omp_sese_dump_pars): Likewise.
(worker_single_simple): Likewise.
* omp-offload.cc (omp_finish_file): Likewise.
(execute_oacc_loop_designation): Likewise.
* optabs-query.cc (lshift_cheap_p): Likewise.
* optc-gen.awk: Likewise.
* optc-save-gen.awk: Likewise.
* optinfo-emit-json.cc (optrecord_json_writer::optrecord_json_writer): Likewise.
* opts-common.cc: Likewise.
* output.h (app_enable): Likewise.
(output_operand_lossage): Likewise.
(insn_current_reference_address): Likewise.
(get_insn_template): Likewise.
(output_quoted_string): Likewise.
* pass_manager.h (struct register_pass_info): Likewise.
* plugin.cc: Likewise.
* plugin.def (PLUGIN_ANALYZER_INIT): Likewise.
* plugin.h (invoke_plugin_callbacks): Likewise.
* pointer-query.cc (handle_mem_ref): Likewise.
* postreload-gcse.cc (alloc_mem): Likewise.
* predict.h (enum prediction): Likewise.
(add_reg_br_prob_note): Likewise.
* prefix.h: Likewise.
* profile.h (get_working_sets): Likewise.
* read-md.cc: Likewise.
* read-md.h (struct mapping): Likewise.
(class md_reader): Likewise.
(class noop_reader): Likewise.
* read-rtl-function.cc (function_reader::create_function): Likewise.
(function_reader::extra_parsing_for_operand_code_0): Likewise.
* read-rtl.cc (initialize_iterators): Likewise.
* real.cc: Likewise.
* real.h (struct real_value): Likewise.
(format_helper::format_helper): Likewise.
(real_hash): Likewise.
(real_can_shorten_arithmetic): Likewise.
* recog.cc (struct target_recog): Likewise.
(offsettable_nonstrict_memref_p): Likewise.
(constrain_operands): Likewise.
* recog.h (MAX_RECOG_ALTERNATIVES): Likewise.
(which_op_alt): Likewise.
(struct insn_gen_fn): Likewise.
* reg-notes.def (REG_NOTE): Likewise.
* reg-stack.cc: Likewise.
* regs.h (reg_is_parm_p): Likewise.
* regset.h: Likewise.
* reload.cc (push_reload): Likewise.
(find_reloads): Likewise.
(find_reloads_address_1): Likewise.
(find_replacement): Likewise.
(refers_to_regno_for_reload_p): Likewise.
(refers_to_mem_for_reload_p): Likewise.
* reload.h (push_reload): Likewise.
(deallocate_reload_reg): Likewise.
* reload1.cc (emit_input_reload_insns): Likewise.
* reorg.cc (relax_delay_slots): Likewise.
* rtl.def (UNKNOWN): Likewise.
(SEQUENCE): Likewise.
(BARRIER): Likewise.
(ASM_OPERANDS): Likewise.
(EQ_ATTR_ALT): Likewise.
* rtl.h (struct GTY): Likewise.
(LABEL_NAME): Likewise.
(LABEL_ALT_ENTRY_P): Likewise.
(SUBREG_BYTE): Likewise.
(get_stack_check_protect): Likewise.
(dump_rtx_statistics): Likewise.
(unwrap_const_vec_duplicate): Likewise.
(subreg_promoted_mode): Likewise.
(gen_lowpart_common): Likewise.
(operand_subword): Likewise.
(immed_wide_int_const): Likewise.
(decide_function_section): Likewise.
(active_insn_p): Likewise.
(delete_related_insns): Likewise.
(try_split): Likewise.
(val_signbit_known_clear_p): Likewise.
(simplifiable_subregs): Likewise.
(set_insn_deleted): Likewise.
(subreg_get_info): Likewise.
(remove_free_EXPR_LIST_node): Likewise.
(finish_subregs_of_mode): Likewise.
(get_mem_attrs): Likewise.
(lookup_constant_def): Likewise.
(rtx_to_tree_code): Likewise.
(hash_rtx): Likewise.
(condjump_in_parallel_p): Likewise.
(validate_subreg): Likewise.
(make_compound_operation): Likewise.
(schedule_ebbs): Likewise.
(print_inline_rtx): Likewise.
(fixup_args_size_notes): Likewise.
(expand_dec): Likewise.
(prepare_copy_insn): Likewise.
(mark_elimination): Likewise.
(valid_mode_changes_for_regno): Likewise.
(make_debug_expr_from_rtl): Likewise.
(delete_vta_debug_insns): Likewise.
(simplify_using_condition): Likewise.
(set_insn_locations): Likewise.
(fatal_insn_not_found): Likewise.
(word_register_operation_p): Likewise.
* rtlanal.cc (get_call_fndecl): Likewise.
(side_effects_p): Likewise.
(subreg_nregs): Likewise.
(rtx_cost): Likewise.
(canonicalize_condition): Likewise.
* rtlanal.h (rtx_properties::try_to_add_note): Likewise.
* run-rtl-passes.cc (run_rtl_passes): Likewise.
* sanitizer.def (BUILT_IN_ASAN_VERSION_MISMATCH_CHECK): Likewise.
* sched-deps.cc (add_dependence_1): Likewise.
* sched-ebb.cc (begin_move_insn): Likewise.
(add_deps_for_risky_insns): Likewise.
(advance_target_bb): Likewise.
* sched-int.h (reemit_notes): Likewise.
(struct _haifa_insn_data): Likewise.
(HID): Likewise.
(DEP_CANCELLED): Likewise.
(debug_ds): Likewise.
(number_in_ready): Likewise.
(schedule_ebbs_finish): Likewise.
(find_modifiable_mems): Likewise.
* sched-rgn.cc (debug_rgn_dependencies): Likewise.
* sel-sched-dump.cc (dump_lv_set): Likewise.
* sel-sched-dump.h: Likewise.
* sel-sched-ir.cc (sel_insn_rtx_cost): Likewise.
(setup_id_reg_sets): Likewise.
(has_dependence_p): Likewise.
(sel_num_cfg_preds_gt_1): Likewise.
(bb_ends_ebb_p): Likewise.
* sel-sched-ir.h (struct _list_node): Likewise.
(struct idata_def): Likewise.
(bb_next_bb): Likewise.
* sel-sched.cc (vinsn_writes_one_of_regs_p): Likewise.
(choose_best_pseudo_reg): Likewise.
(verify_target_availability): Likewise.
(can_speculate_dep_p): Likewise.
(sel_rank_for_schedule): Likewise.
* selftest-run-tests.cc (selftest::run_tests): Likewise.
* selftest.h (class auto_fix_quotes): Likewise.
* shrink-wrap.cc (handle_simple_exit): Likewise.
* shrink-wrap.h: Likewise.
* simplify-rtx.cc (simplify_context::simplify_associative_operation): Likewise.
(simplify_context::simplify_gen_vec_select): Likewise.
* spellcheck-tree.h: Likewise.
* spellcheck.h: Likewise.
* statistics.h (struct function): Likewise.
* stmt.cc (conditional_probability): Likewise.
* stmt.h: Likewise.
* stor-layout.h: Likewise.
* streamer-hooks.h: Likewise.
* stringpool.h: Likewise.
* symtab.cc (symbol_table::change_decl_assembler_name): Likewise.
* target.def (HOOK_VECTOR_END): Likewise.
(type.): Likewise.
* target.h (union cumulative_args_t): Likewise.
(by_pieces_ninsns): Likewise.
(class predefined_function_abi): Likewise.
* targhooks.cc (default_translate_mode_attribute): Likewise.
* timevar.def: Likewise.
* timevar.h (class timer): Likewise.
* toplev.h (enable_rtl_dump_file): Likewise.
* trans-mem.cc (collect_bb2reg): Likewise.
* tree-call-cdce.cc (gen_conditions_for_pow): Likewise.
* tree-cfg.cc (remove_bb): Likewise.
(verify_gimple_debug): Likewise.
(remove_edge_and_dominated_blocks): Likewise.
(push_fndecl): Likewise.
* tree-cfgcleanup.h (GCC_TREE_CFGCLEANUP_H): Likewise.
* tree-complex.cc (expand_complex_multiplication): Likewise.
(expand_complex_div_straight): Likewise.
* tree-core.h (enum tree_index): Likewise.
(enum operand_equal_flag): Likewise.
* tree-eh.cc (honor_protect_cleanup_actions): Likewise.
* tree-if-conv.cc (if_convertible_gimple_assign_stmt_p): Likewise.
* tree-inline.cc (initialize_inlined_parameters): Likewise.
* tree-inline.h (force_value_to_type): Likewise.
* tree-nested.cc (get_chain_decl): Likewise.
(walk_all_functions): Likewise.
* tree-object-size.h: Likewise.
* tree-outof-ssa.cc: Likewise.
* tree-parloops.cc (create_parallel_loop): Likewise.
* tree-pretty-print.cc (print_generic_expr_to_str): Likewise.
(dump_generic_node): Likewise.
* tree-profile.cc (tree_profiling): Likewise.
* tree-sra.cc (maybe_add_sra_candidate): Likewise.
* tree-ssa-address.cc: Likewise.
* tree-ssa-alias.cc: Likewise.
* tree-ssa-alias.h (ao_ref::max_size_known_p): Likewise.
(dump_alias_stats): Likewise.
* tree-ssa-ccp.cc: Likewise.
* tree-ssa-coalesce.h: Likewise.
* tree-ssa-live.cc (remove_unused_scope_block_p): Likewise.
* tree-ssa-loop-manip.cc (copy_phi_node_args): Likewise.
* tree-ssa-loop-unswitch.cc: Likewise.
* tree-ssa-math-opts.cc: Likewise.
* tree-ssa-operands.cc (class operands_scanner): Likewise.
* tree-ssa-pre.cc: Likewise.
* tree-ssa-reassoc.cc (optimize_ops_list): Likewise.
(debug_range_entry): Likewise.
* tree-ssa-sccvn.cc (eliminate_dom_walker::eliminate_stmt): Likewise.
* tree-ssa-sccvn.h (TREE_SSA_SCCVN_H): Likewise.
* tree-ssa-scopedtables.cc (add_expr_commutative): Likewise.
(equal_mem_array_ref_p): Likewise.
* tree-ssa-strlen.cc (is_strlen_related_p): Likewise.
* tree-ssa-strlen.h (get_range_strlen_dynamic): Likewise.
* tree-ssa-tail-merge.cc (stmt_local_def): Likewise.
* tree-ssa-ter.h: Likewise.
* tree-ssa-threadupdate.h (enum bb_dom_status): Likewise.
* tree-streamer-in.cc (lto_input_ts_block_tree_pointers): Likewise.
* tree-streamer-out.cc (pack_ts_block_value_fields): Likewise.
(write_ts_block_tree_pointers): Likewise.
* tree-streamer.h (struct streamer_tree_cache_d): Likewise.
(streamer_read_tree_bitfields): Likewise.
(streamer_write_integer_cst): Likewise.
* tree-vect-patterns.cc (apply_binop_and_append_stmt): Likewise.
(vect_synth_mult_by_constant): Likewise.
* tree-vect-stmts.cc (vectorizable_operation): Likewise.
* tree-vectorizer.cc: Likewise.
* tree-vectorizer.h (class auto_purge_vect_location): Likewise.
(vect_update_inits_of_drs): Likewise.
(vect_get_mask_type_for_stmt): Likewise.
(vect_rgroup_iv_might_wrap_p): Likewise.
(cse_and_gimplify_to_preheader): Likewise.
(vect_free_slp_tree): Likewise.
(vect_pattern_recog): Likewise.
(vect_stmt_dominates_stmt_p): Likewise.
* tree.cc (initialize_tree_contains_struct): Likewise.
(need_assembler_name_p): Likewise.
(type_with_interoperable_signedness): Likewise.
* tree.def (SWITCH_EXPR): Likewise.
* tree.h (TYPE_SYMTAB_ADDRESS): Likewise.
(poly_int_tree_p): Likewise.
(inlined_function_outer_scope_p): Likewise.
(tree_code_for_canonical_type_merging): Likewise.
* value-prof.cc: Likewise.
* value-prof.h (get_nth_most_common_value): Likewise.
(find_func_by_profile_id): Likewise.
* value-range.cc (vrp_operand_equal_p): Likewise.
* value-range.h: Likewise.
* var-tracking.cc: Likewise.
* varasm.cc (default_function_section): Likewise.
(function_section_1): Likewise.
(assemble_variable): Likewise.
(handle_vtv_comdat_section): Likewise.
* vec.h (struct vec_prefix): Likewise.
* vmsdbgout.cc (full_name): Likewise.
* vtable-verify.cc: Likewise.
* vtable-verify.h (struct vtv_graph_node): Likewise.
* xcoffout.cc: Likewise.
* xcoffout.h (DEBUG_SYMS_TEXT): Likewise.
gcc/ada/ChangeLog:
* Make-generated.in: Rename .c names to .cc.
* adaint.c: Likewise.
* ctrl_c.c (dummy_handler): Likewise.
* gcc-interface/Makefile.in: Likewise.
* gcc-interface/config-lang.in: Likewise.
* gcc-interface/decl.cc (concat_name): Likewise.
(init_gnat_decl): Likewise.
* gcc-interface/gigi.h (concat_name): Likewise.
(init_gnat_utils): Likewise.
(build_call_raise_range): Likewise.
(gnat_mark_addressable): Likewise.
(gnat_protect_expr): Likewise.
(gnat_rewrite_reference): Likewise.
* gcc-interface/lang-specs.h (ADA_DUMPS_OPTIONS): Likewise.
* gcc-interface/utils.cc (GTY): Likewise.
(add_deferred_type_context): Likewise.
(init_gnat_utils): Likewise.
* gcc-interface/utils2.cc (gnat_stable_expr_p): Likewise.
(gnat_protect_expr): Likewise.
(gnat_stabilize_reference_1): Likewise.
(gnat_rewrite_reference): Likewise.
* gsocket.h: Likewise.
* init.cc (__gnat_error_handler): Likewise.
* libgnarl/s-intman.ads: Likewise.
* libgnarl/s-osinte__android.ads: Likewise.
* libgnarl/s-osinte__darwin.ads: Likewise.
* libgnarl/s-osinte__hpux.ads: Likewise.
* libgnarl/s-osinte__linux.ads: Likewise.
* libgnarl/s-osinte__qnx.ads: Likewise.
* libgnarl/s-taskin.ads: Likewise.
* rtfinal.cc: Likewise.
* s-oscons-tmplt.c (CND): Likewise.
* set_targ.ads: Likewise.
gcc/analyzer/ChangeLog:
* analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
(is_named_call_p): Likewise.
* region-model-asm.cc (deterministic_p): Likewise.
* region.cc (field_region::get_relative_concrete_offset): Likewise.
* sm-malloc.cc (method_p): Likewise.
* supergraph.cc (superedge::dump_dot): Likewise.
gcc/c-family/ChangeLog:
* c-ada-spec.cc: Rename .c names to .cc.
* c-ada-spec.h: Likewise.
* c-common.cc (c_build_vec_convert): Likewise.
(warning_candidate_p): Likewise.
* c-common.h (enum rid): Likewise.
(build_real_imag_expr): Likewise.
(finish_label_address_expr): Likewise.
(c_get_substring_location): Likewise.
(c_build_bind_expr): Likewise.
(conflict_marker_get_final_tok_kind): Likewise.
(c_parse_error): Likewise.
(check_missing_format_attribute): Likewise.
(invalid_array_size_error): Likewise.
(warn_for_multistatement_macros): Likewise.
(build_attr_access_from_parms): Likewise.
* c-cppbuiltin.cc (c_cpp_builtins): Likewise.
* c-format.cc: Likewise.
* c-gimplify.cc (c_gimplify_expr): Likewise.
* c-indentation.h: Likewise.
* c-objc.h (objc_prop_attr_kind_for_rid): Likewise.
* c-omp.cc (c_omp_predetermined_mapping): Likewise.
* c-opts.cc (c_common_post_options): Likewise.
(set_std_cxx23): Likewise.
* c-pragma.cc (handle_pragma_redefine_extname): Likewise.
* c-pretty-print.h: Likewise.
gcc/c/ChangeLog:
* Make-lang.in: Rename .c names to .cc.
* c-convert.cc: Likewise.
* c-decl.cc (struct lang_identifier): Likewise.
(pop_scope): Likewise.
(finish_decl): Likewise.
* c-objc-common.h (GCC_C_OBJC_COMMON): Likewise.
* c-parser.cc (c_parser_skip_to_end_of_block_or_statement): Likewise.
* c-parser.h (GCC_C_PARSER_H): Likewise.
* c-tree.h (c_keyword_starts_typename): Likewise.
(finish_declspecs): Likewise.
(c_get_alias_set): Likewise.
(enum c_oracle_request): Likewise.
(tag_exists_p): Likewise.
(set_c_expr_source_range): Likewise.
* c-typeck.cc (c_common_type): Likewise.
(c_finish_omp_clauses): Likewise.
* config-lang.in: Likewise.
gcc/cp/ChangeLog:
* Make-lang.in: Rename .c names to .cc.
* config-lang.in: Likewise.
* constexpr.cc (cxx_eval_constant_expression): Likewise.
* coroutines.cc (morph_fn_to_coro): Likewise.
* cp-gimplify.cc (cp_gimplify_expr): Likewise.
* cp-lang.cc (struct lang_hooks): Likewise.
(get_template_argument_pack_elems_folded): Likewise.
* cp-objcp-common.cc (cp_tree_size): Likewise.
(cp_unit_size_without_reusable_padding): Likewise.
(pop_file_scope): Likewise.
(cp_pushdecl): Likewise.
* cp-objcp-common.h (GCC_CP_OBJCP_COMMON): Likewise.
(cxx_simulate_record_decl): Likewise.
* cp-tree.h (struct named_label_entry): Likewise.
(current_function_return_value): Likewise.
(more_aggr_init_expr_args_p): Likewise.
(get_function_version_dispatcher): Likewise.
(common_enclosing_class): Likewise.
(strip_fnptr_conv): Likewise.
(current_decl_namespace): Likewise.
(do_aggregate_paren_init): Likewise.
(cp_check_const_attributes): Likewise.
(qualified_name_lookup_error): Likewise.
(generic_targs_for): Likewise.
(mark_exp_read): Likewise.
(is_global_friend): Likewise.
(maybe_reject_flexarray_init): Likewise.
(module_token_lang): Likewise.
(handle_module_option): Likewise.
(literal_integer_zerop): Likewise.
(build_extra_args): Likewise.
(build_if_nonnull): Likewise.
(maybe_check_overriding_exception_spec): Likewise.
(finish_omp_target_clauses): Likewise.
(maybe_warn_zero_as_null_pointer_constant): Likewise.
(cxx_print_error_function): Likewise.
(decl_in_std_namespace_p): Likewise.
(merge_exception_specifiers): Likewise.
(mangle_module_global_init): Likewise.
(cxx_block_may_fallthru): Likewise.
(fold_builtin_source_location): Likewise.
(enum cp_oracle_request): Likewise.
(subsumes): Likewise.
(cp_finish_injected_record_type): Likewise.
(vtv_build_vtable_verify_fndecl): Likewise.
(cp_tree_c_finish_parsing): Likewise.
* cvt.cc (diagnose_ref_binding): Likewise.
(convert_to_void): Likewise.
(convert_force): Likewise.
(type_promotes_to): Likewise.
* decl.cc (make_unbound_class_template_raw): Likewise.
(cxx_init_decl_processing): Likewise.
(check_class_member_definition_namespace): Likewise.
(cxx_maybe_build_cleanup): Likewise.
* decl2.cc (maybe_emit_vtables): Likewise.
* error.cc (dump_function_name): Likewise.
* init.cc (is_class_type): Likewise.
(build_new_1): Likewise.
* lang-specs.h: Likewise.
* method.cc (make_alias_for_thunk): Likewise.
* module.cc (specialization_add): Likewise.
(module_state::read_cluster): Likewise.
* name-lookup.cc (check_extern_c_conflict): Likewise.
* name-lookup.h (struct cxx_binding): Likewise.
* parser.cc (cp_parser_identifier): Likewise.
* parser.h (struct cp_parser): Likewise.
* pt.cc (has_value_dependent_address): Likewise.
(push_tinst_level_loc): Likewise.
* semantics.cc (finish_omp_clauses): Likewise.
(finish_omp_atomic): Likewise.
* tree.cc (cp_save_expr): Likewise.
(cp_free_lang_data): Likewise.
* typeck.cc (cp_common_type): Likewise.
(strip_array_domain): Likewise.
(rationalize_conditional_expr): Likewise.
(check_return_expr): Likewise.
* vtable-class-hierarchy.cc: Likewise.
gcc/d/ChangeLog:
* d-gimplify.cc: Rename .c names to .cc.
* d-incpath.cc: Likewise.
* lang-specs.h: Likewise.
gcc/fortran/ChangeLog:
* check.cc (gfc_check_all_any): Rename .c names to .cc.
* class.cc (find_intrinsic_vtab): Likewise.
* config-lang.in: Likewise.
* cpp.cc (cpp_define_builtins): Likewise.
* data.cc (get_array_index): Likewise.
* decl.cc (match_clist_expr): Likewise.
(get_proc_name): Likewise.
(gfc_verify_c_interop_param): Likewise.
(gfc_get_pdt_instance): Likewise.
(gfc_match_formal_arglist): Likewise.
(gfc_get_type_attr_spec): Likewise.
* dependency.cc: Likewise.
* error.cc (gfc_format_decoder): Likewise.
* expr.cc (check_restricted): Likewise.
(gfc_build_default_init_expr): Likewise.
* f95-lang.cc: Likewise.
* gfc-internals.texi: Likewise.
* gfortran.h (enum match): Likewise.
(enum procedure_type): Likewise.
(enum oacc_routine_lop): Likewise.
(gfc_get_pdt_instance): Likewise.
(gfc_end_source_files): Likewise.
(gfc_mpz_set_hwi): Likewise.
(gfc_get_option_string): Likewise.
(gfc_find_sym_in_expr): Likewise.
(gfc_errors_to_warnings): Likewise.
(gfc_real_4_kind): Likewise.
(gfc_free_finalizer): Likewise.
(gfc_sym_get_dummy_args): Likewise.
(gfc_check_intrinsic_standard): Likewise.
(gfc_free_case_list): Likewise.
(gfc_resolve_oacc_routines): Likewise.
(gfc_check_vardef_context): Likewise.
(gfc_free_association_list): Likewise.
(gfc_implicit_pure_function): Likewise.
(gfc_ref_dimen_size): Likewise.
(gfc_compare_actual_formal): Likewise.
(gfc_resolve_wait): Likewise.
(gfc_dt_upper_string): Likewise.
(gfc_generate_module_code): Likewise.
(gfc_delete_bbt): Likewise.
(debug): Likewise.
(gfc_build_block_ns): Likewise.
(gfc_dep_difference): Likewise.
(gfc_invalid_null_arg): Likewise.
(gfc_is_finalizable): Likewise.
(gfc_fix_implicit_pure): Likewise.
(gfc_is_size_zero_array): Likewise.
(gfc_is_reallocatable_lhs): Likewise.
* gfortranspec.cc: Likewise.
* interface.cc (compare_actual_expr): Likewise.
* intrinsic.cc (add_functions): Likewise.
* iresolve.cc (gfc_resolve_matmul): Likewise.
(gfc_resolve_alarm_sub): Likewise.
* iso-c-binding.def: Likewise.
* lang-specs.h: Likewise.
* libgfortran.h (GFC_STDERR_UNIT_NUMBER): Likewise.
* match.cc (gfc_match_label): Likewise.
(gfc_match_symbol): Likewise.
(match_derived_type_spec): Likewise.
(copy_ts_from_selector_to_associate): Likewise.
* match.h (gfc_match_call): Likewise.
(gfc_get_common): Likewise.
(gfc_match_omp_end_single): Likewise.
(gfc_match_volatile): Likewise.
(gfc_match_bind_c): Likewise.
(gfc_match_literal_constant): Likewise.
(gfc_match_init_expr): Likewise.
(gfc_match_array_constructor): Likewise.
(gfc_match_end_interface): Likewise.
(gfc_match_print): Likewise.
(gfc_match_expr): Likewise.
* matchexp.cc (next_operator): Likewise.
* mathbuiltins.def: Likewise.
* module.cc (free_true_name): Likewise.
* openmp.cc (gfc_resolve_omp_parallel_blocks): Likewise.
(gfc_omp_save_and_clear_state): Likewise.
* parse.cc (parse_union): Likewise.
(set_syms_host_assoc): Likewise.
* resolve.cc (resolve_actual_arglist): Likewise.
(resolve_elemental_actual): Likewise.
(check_host_association): Likewise.
(resolve_typebound_function): Likewise.
(resolve_typebound_subroutine): Likewise.
(gfc_resolve_expr): Likewise.
(resolve_assoc_var): Likewise.
(resolve_typebound_procedures): Likewise.
(resolve_equivalence_derived): Likewise.
* simplify.cc (simplify_bound): Likewise.
* symbol.cc (gfc_set_default_type): Likewise.
(gfc_add_ext_attribute): Likewise.
* target-memory.cc (gfc_target_interpret_expr): Likewise.
* target-memory.h (gfc_target_interpret_expr): Likewise.
* trans-array.cc (gfc_get_cfi_dim_sm): Likewise.
(gfc_conv_shift_descriptor_lbound): Likewise.
(gfc_could_be_alias): Likewise.
(gfc_get_dataptr_offset): Likewise.
* trans-const.cc: Likewise.
* trans-decl.cc (trans_function_start): Likewise.
(gfc_trans_deferred_vars): Likewise.
(generate_local_decl): Likewise.
(gfc_generate_function_code): Likewise.
* trans-expr.cc (gfc_vptr_size_get): Likewise.
(gfc_trans_class_array_init_assign): Likewise.
(POWI_TABLE_SIZE): Likewise.
(gfc_conv_procedure_call): Likewise.
(gfc_trans_arrayfunc_assign): Likewise.
* trans-intrinsic.cc (gfc_conv_intrinsic_len): Likewise.
(gfc_conv_intrinsic_loc): Likewise.
(conv_intrinsic_event_query): Likewise.
* trans-io.cc (gfc_build_st_parameter): Likewise.
* trans-openmp.cc (gfc_omp_check_optional_argument): Likewise.
(gfc_omp_unshare_expr_r): Likewise.
(gfc_trans_omp_array_section): Likewise.
(gfc_trans_omp_clauses): Likewise.
* trans-stmt.cc (trans_associate_var): Likewise.
(gfc_trans_deallocate): Likewise.
* trans-stmt.h (gfc_trans_class_init_assign): Likewise.
(gfc_trans_deallocate): Likewise.
(gfc_trans_oacc_declare): Likewise.
* trans-types.cc: Likewise.
* trans-types.h (enum gfc_packed): Likewise.
* trans.cc (N_): Likewise.
(trans_code): Likewise.
* trans.h (gfc_build_compare_string): Likewise.
(gfc_conv_expr_type): Likewise.
(gfc_trans_deferred_vars): Likewise.
(getdecls): Likewise.
(gfc_get_array_descr_info): Likewise.
(gfc_omp_firstprivatize_type_sizes): Likewise.
(GTY): Likewise.
gcc/go/ChangeLog:
* config-lang.in: Rename .c names to .cc.
* go-backend.cc: Likewise.
* go-lang.cc: Likewise.
* gospec.cc: Likewise.
* lang-specs.h: Likewise.
gcc/jit/ChangeLog:
* config-lang.in: Rename .c names to .cc.
* docs/_build/texinfo/libgccjit.texi: Likewise.
* docs/internals/index.rst: Likewise.
* jit-builtins.cc (builtins_manager::make_builtin_function): Likewise.
* jit-playback.cc (fold_const_var): Likewise.
(playback::context::~context): Likewise.
(new_field): Likewise.
(new_bitfield): Likewise.
(new_compound_type): Likewise.
(playback::compound_type::set_fields): Likewise.
(global_set_init_rvalue): Likewise.
(load_blob_in_ctor): Likewise.
(new_global_initialized): Likewise.
(double>): Likewise.
(new_string_literal): Likewise.
(as_truth_value): Likewise.
(build_call): Likewise.
(playback::context::build_cast): Likewise.
(new_array_access): Likewise.
(new_field_access): Likewise.
(dereference): Likewise.
(postprocess): Likewise.
(add_jump): Likewise.
(add_switch): Likewise.
(build_goto_operands): Likewise.
(playback::context::read_dump_file): Likewise.
(init_types): Likewise.
* jit-recording.cc (recording::context::get_int_type): Likewise.
* jit-recording.h: Likewise.
* libgccjit.cc (compatible_types): Likewise.
(gcc_jit_context_acquire): Likewise.
(gcc_jit_context_release): Likewise.
(gcc_jit_context_new_child_context): Likewise.
(gcc_jit_type_as_object): Likewise.
(gcc_jit_context_get_type): Likewise.
(gcc_jit_context_get_int_type): Likewise.
(gcc_jit_type_get_pointer): Likewise.
(gcc_jit_type_get_const): Likewise.
(gcc_jit_type_get_volatile): Likewise.
(gcc_jit_type_dyncast_array): Likewise.
(gcc_jit_type_is_bool): Likewise.
(gcc_jit_type_is_pointer): Likewise.
(gcc_jit_type_is_integral): Likewise.
(gcc_jit_type_dyncast_vector): Likewise.
(gcc_jit_type_is_struct): Likewise.
(gcc_jit_vector_type_get_num_units): Likewise.
(gcc_jit_vector_type_get_element_type): Likewise.
(gcc_jit_type_unqualified): Likewise.
(gcc_jit_type_dyncast_function_ptr_type): Likewise.
(gcc_jit_function_type_get_return_type): Likewise.
(gcc_jit_function_type_get_param_count): Likewise.
(gcc_jit_function_type_get_param_type): Likewise.
(gcc_jit_context_new_array_type): Likewise.
(gcc_jit_context_new_field): Likewise.
(gcc_jit_field_as_object): Likewise.
(gcc_jit_context_new_struct_type): Likewise.
(gcc_jit_struct_as_type): Likewise.
(gcc_jit_struct_set_fields): Likewise.
(gcc_jit_struct_get_field_count): Likewise.
(gcc_jit_context_new_union_type): Likewise.
(gcc_jit_context_new_function_ptr_type): Likewise.
(gcc_jit_param_as_rvalue): Likewise.
(gcc_jit_context_new_function): Likewise.
(gcc_jit_function_get_return_type): Likewise.
(gcc_jit_function_dump_to_dot): Likewise.
(gcc_jit_block_get_function): Likewise.
(gcc_jit_global_set_initializer_rvalue): Likewise.
(gcc_jit_rvalue_get_type): Likewise.
(gcc_jit_context_new_rvalue_from_int): Likewise.
(gcc_jit_context_one): Likewise.
(gcc_jit_context_new_rvalue_from_double): Likewise.
(gcc_jit_context_null): Likewise.
(gcc_jit_context_new_string_literal): Likewise.
(valid_binary_op_p): Likewise.
(gcc_jit_context_new_binary_op): Likewise.
(gcc_jit_context_new_comparison): Likewise.
(gcc_jit_context_new_call): Likewise.
(is_valid_cast): Likewise.
(gcc_jit_context_new_cast): Likewise.
(gcc_jit_object_get_context): Likewise.
(gcc_jit_object_get_debug_string): Likewise.
(gcc_jit_lvalue_access_field): Likewise.
(gcc_jit_rvalue_access_field): Likewise.
(gcc_jit_rvalue_dereference_field): Likewise.
(gcc_jit_rvalue_dereference): Likewise.
(gcc_jit_lvalue_get_address): Likewise.
(gcc_jit_lvalue_set_tls_model): Likewise.
(gcc_jit_lvalue_set_link_section): Likewise.
(gcc_jit_function_new_local): Likewise.
(gcc_jit_block_add_eval): Likewise.
(gcc_jit_block_add_assignment): Likewise.
(is_bool): Likewise.
(gcc_jit_block_end_with_conditional): Likewise.
(gcc_jit_block_add_comment): Likewise.
(gcc_jit_block_end_with_jump): Likewise.
(gcc_jit_block_end_with_return): Likewise.
(gcc_jit_block_end_with_void_return): Likewise.
(case_range_validator::case_range_validator): Likewise.
(case_range_validator::validate): Likewise.
(case_range_validator::get_wide_int): Likewise.
(gcc_jit_block_end_with_switch): Likewise.
(gcc_jit_context_set_str_option): Likewise.
(gcc_jit_context_set_int_option): Likewise.
(gcc_jit_context_set_bool_option): Likewise.
(gcc_jit_context_set_bool_allow_unreachable_blocks): Likewise.
(gcc_jit_context_set_bool_use_external_driver): Likewise.
(gcc_jit_context_add_command_line_option): Likewise.
(gcc_jit_context_add_driver_option): Likewise.
(gcc_jit_context_enable_dump): Likewise.
(gcc_jit_context_compile): Likewise.
(gcc_jit_context_compile_to_file): Likewise.
(gcc_jit_context_set_logfile): Likewise.
(gcc_jit_context_dump_reproducer_to_file): Likewise.
(gcc_jit_context_get_first_error): Likewise.
(gcc_jit_context_get_last_error): Likewise.
(gcc_jit_result_get_code): Likewise.
(gcc_jit_result_get_global): Likewise.
(gcc_jit_rvalue_set_bool_require_tail_call): Likewise.
(gcc_jit_type_get_aligned): Likewise.
(gcc_jit_type_get_vector): Likewise.
(gcc_jit_function_get_address): Likewise.
(gcc_jit_version_patchlevel): Likewise.
(gcc_jit_block_add_extended_asm): Likewise.
(gcc_jit_extended_asm_as_object): Likewise.
(gcc_jit_extended_asm_set_volatile_flag): Likewise.
(gcc_jit_extended_asm_set_inline_flag): Likewise.
(gcc_jit_extended_asm_add_output_operand): Likewise.
(gcc_jit_extended_asm_add_input_operand): Likewise.
(gcc_jit_extended_asm_add_clobber): Likewise.
* notes.txt: Likewise.
gcc/lto/ChangeLog:
* config-lang.in: Rename .c names to .cc.
* lang-specs.h: Likewise.
* lto-common.cc (gimple_register_canonical_type_1): Likewise.
* lto-common.h: Likewise.
* lto-dump.cc (lto_main): Likewise.
* lto-lang.cc (handle_fnspec_attribute): Likewise.
(lto_getdecls): Likewise.
(lto_init): Likewise.
* lto.cc (lto_main): Likewise.
* lto.h: Likewise.
gcc/objc/ChangeLog:
* Make-lang.in: Rename .c names to .cc.
* config-lang.in: Likewise.
* lang-specs.h: Likewise.
* objc-act.cc (objc_build_component_ref): Likewise.
(objc_copy_binfo): Likewise.
(lookup_method_in_hash_lists): Likewise.
(objc_finish_foreach_loop): Likewise.
* objc-act.h (objc_common_init_ts): Likewise.
* objc-gnu-runtime-abi-01.cc: Likewise.
* objc-lang.cc (struct lang_hooks): Likewise.
* objc-map.cc: Likewise.
* objc-next-runtime-abi-01.cc (generate_objc_symtab_decl): Likewise.
* objc-runtime-shared-support.cc: Likewise.
* objc-runtime-shared-support.h (build_protocol_initializer): Likewise.
gcc/objcp/ChangeLog:
* Make-lang.in: Rename .c names to .cc.
* config-lang.in: Likewise.
* lang-specs.h: Likewise.
* objcp-decl.cc (objcp_end_compound_stmt): Likewise.
* objcp-lang.cc (struct lang_hooks): Likewise.
gcc/po/ChangeLog:
* EXCLUDES: Rename .c names to .cc.
libcpp/ChangeLog:
* Makefile.in: Rename .c names to .cc.
* charset.cc (convert_escape): Likewise.
* directives.cc (directive_diagnostics): Likewise.
(_cpp_handle_directive): Likewise.
(lex_macro_node): Likewise.
* include/cpplib.h (struct _cpp_file): Likewise.
(PURE_ZERO): Likewise.
(cpp_defined): Likewise.
(cpp_error_at): Likewise.
(cpp_forall_identifiers): Likewise.
(cpp_compare_macros): Likewise.
(cpp_get_converted_source): Likewise.
(cpp_read_state): Likewise.
(cpp_directive_only_process): Likewise.
(struct cpp_decoded_char): Likewise.
* include/line-map.h (enum lc_reason): Likewise.
(enum location_aspect): Likewise.
* include/mkdeps.h: Likewise.
* init.cc (cpp_destroy): Likewise.
(cpp_finish): Likewise.
* internal.h (struct cpp_reader): Likewise.
(_cpp_defined_macro_p): Likewise.
(_cpp_backup_tokens_direct): Likewise.
(_cpp_destroy_hashtable): Likewise.
(_cpp_has_header): Likewise.
(_cpp_expand_op_stack): Likewise.
(_cpp_commit_buff): Likewise.
(_cpp_restore_special_builtin): Likewise.
(_cpp_bracket_include): Likewise.
(_cpp_replacement_text_len): Likewise.
(ufputs): Likewise.
* line-map.cc (linemap_macro_loc_to_exp_point): Likewise.
(linemap_check_files_exited): Likewise.
(line_map_new_raw): Likewise.
* traditional.cc (enum ls): Likewise.
|
|
|
|
gcc/analyzer/ChangeLog:
* sm-taint.cc (taint_state_machine::combine_states): Handle combination
of has_ub and has_lb.
gcc/testsuite/ChangeLog:
* gcc.dg/analyzer/taint-merger.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
gcc/analyzer/ChangeLog:
PR analyzer/104029
* sm-taint.cc (taint_state_machine::alt_get_inherited_state):
Remove gcc_unreachable from default case for unary ops.
gcc/testsuite/ChangeLog:
PR analyzer/104029
* gcc.dg/analyzer/pr104029.c: New test.
* gcc.dg/analyzer/taint-ops.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
This patch adds a new __attribute__ ((tainted_args)) to the C/C++ frontends.
It can be used on function decls: the analyzer will treat as tainted
all parameters to the function and all buffers pointed to by parameters
to the function. Adding this in one place to the Linux kernel's
__SYSCALL_DEFINEx macro allows the analyzer to treat all syscalls as
having tainted inputs. This gives some coverage of system calls without
needing to "teach" the analyzer about "__user" - an example of the use
of this can be seen in CVE-2011-2210, where given:
SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,
unsigned long, nbytes, int __user *, start, void __user *, arg)
the analyzer will treat the nbytes param as under attacker control, and
can complain accordingly:
taint-CVE-2011-2210-1.c: In function 'sys_osf_getsysinfo':
taint-CVE-2011-2210-1.c:69:21: warning: use of attacker-controlled value
'nbytes' as size without upper-bounds checking [CWE-129] [-Wanalyzer-tainted-size]
69 | if (copy_to_user(buffer, hwrpb, nbytes) != 0)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Additionally, the patch allows the attribute to be used on field decls:
specifically function pointers. Any function used as an initializer
for such a field gets treated as being called with tainted arguments.
An example can be seen in CVE-2020-13143, where adding
__attribute__((tainted_args)) to the "store" callback of
configfs_attribute:
struct configfs_attribute {
/* [...snip...] */
ssize_t (*store)(struct config_item *, const char *, size_t)
__attribute__((tainted_args));
/* [...snip...] */
};
allows the analyzer to see:
CONFIGFS_ATTR(gadget_dev_desc_, UDC);
and treat gadget_dev_desc_UDC_store as having tainted arguments, so that
it complains:
taint-CVE-2020-13143-1.c: In function 'gadget_dev_desc_UDC_store':
taint-CVE-2020-13143-1.c:33:17: warning: use of attacker-controlled value
'len + 18446744073709551615' as offset without upper-bounds checking [CWE-823] [-Wanalyzer-tainted-offset]
33 | if (name[len - 1] == '\n')
| ~~~~^~~~~~~~~
As before this currently still needs -fanalyzer-checker=taint (in
addition to -fanalyzer).
gcc/analyzer/ChangeLog:
* engine.cc: Include "stringpool.h", "attribs.h", and
"tree-dfa.h".
(mark_params_as_tainted): New.
(class tainted_args_function_custom_event): New.
(class tainted_args_function_info): New.
(exploded_graph::add_function_entry): Handle functions with
"tainted_args" attribute.
(class tainted_args_field_custom_event): New.
(class tainted_args_callback_custom_event): New.
(class tainted_args_call_info): New.
(add_tainted_args_callback): New.
(add_any_callbacks): New.
(exploded_graph::build_initial_worklist): Likewise.
(exploded_graph::build_initial_worklist): Find callbacks that are
reachable from global initializers, calling add_any_callbacks on
them.
gcc/c-family/ChangeLog:
* c-attribs.c (c_common_attribute_table): Add "tainted_args".
(handle_tainted_args_attribute): New.
gcc/ChangeLog:
* doc/extend.texi (Function Attributes): Note that "tainted_args" can
be used on field decls.
(Common Function Attributes): Add entry on "tainted_args" attribute.
gcc/testsuite/ChangeLog:
* gcc.dg/analyzer/attr-tainted_args-1.c: New test.
* gcc.dg/analyzer/attr-tainted_args-misuses.c: New test.
* gcc.dg/analyzer/taint-CVE-2011-2210-1.c: New test.
* gcc.dg/analyzer/taint-CVE-2020-13143-1.c: New test.
* gcc.dg/analyzer/taint-CVE-2020-13143-2.c: New test.
* gcc.dg/analyzer/taint-CVE-2020-13143.h: New test.
* gcc.dg/analyzer/taint-alloc-3.c: New test.
* gcc.dg/analyzer/taint-alloc-4.c: New test.
* gcc.dg/analyzer/test-uaccess.h: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
|
GCC 10 gained the "access" function and type attribute, which
optionally can take a size-index param:
https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html
-fanalyzer in trunk (for GCC 12) has gained a -Wanalyzer-tainted-size to
complain about attacker-controlled size values, but this was only being
used deep inside the region-model code when handling the hardcoded known
behavior of certain functions (memset, IIRC).
This patch extends -Wanalyzer-tainted-size to also complain about
unsanitized attacker-controlled values being passed to function
parameters marked as a size via the "access" attribute.
Note that -fanalyzer-checker=taint is currently required in
addition to -fanalyzer to use this warning, due to scaling issues
(see bug 103533).
gcc/analyzer/ChangeLog:
PR analyzer/103940
* engine.cc (impl_sm_context::impl_sm_context): Add
"unknown_side_effects" param and use it to initialize
new m_unknown_side_effects field.
(impl_sm_context::unknown_side_effects_p): New.
(impl_sm_context::m_unknown_side_effects): New.
(exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
ctor.
* sm-taint.cc: Include "stringpool.h" and "attribs.h".
(tainted_size::tainted_size): Drop "dir" param.
(tainted_size::get_kind): Drop "FINAL".
(tainted_size::emit): Likewise.
(tainted_size::m_dir): Drop unused field.
(class tainted_access_attrib_size): New subclass.
(taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
external functions with unknown side effects.
(taint_state_machine::check_for_tainted_size_arg): New.
(region_model::check_region_for_taint): Drop "dir" param from
tainted_size ctor.
* sm.h (sm_context::unknown_side_effects_p): New.
gcc/testsuite/ChangeLog:
PR analyzer/103940
* gcc.dg/analyzer/taint-size-access-attr-1.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
|
|
|
