1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
|
/* { dg-do compile } */
/* { dg-options "-fanalyzer" } */
/* { dg-require-effective-target analyzer } */
#include <string.h>
#include "test-uaccess.h"
typedef unsigned char u8;
typedef unsigned __INT16_TYPE__ u16;
typedef unsigned __INT32_TYPE__ u32;
struct s1
{
u32 i;
};
void test_1a (void __user *dst, u32 a)
{
struct s1 s;
s.i = a;
copy_to_user(dst, &s, sizeof (struct s1)); /* { dg-bogus "" } */
}
void test_1b (void __user *dst, u32 a)
{
struct s1 s;
copy_to_user(dst, &s, sizeof (struct s1)); /* { dg-warning "potential exposure of sensitive information by copying uninitialized data from stack" "warning" } */
/* { dg-message "4 bytes are uninitialized" "note how much" { target *-*-* } .-1 } */
}
void test_1c (void __user *dst, u32 a)
{
struct s1 s;
memset (&s, 0, sizeof (struct s1));
copy_to_user(dst, &s, sizeof (struct s1)); /* { dg-bogus "" } */
}
void test_1d (void __user *dst, u32 a)
{
struct s1 s = {0};
copy_to_user(dst, &s, sizeof (struct s1)); /* { dg-bogus "" } */
}
struct s2
{
u32 i;
u32 j; /* { dg-message "field 'j' is uninitialized \\(4 bytes\\)" } */
};
void test_2a (void __user *dst, u32 a)
{
struct s2 s; /* { dg-message "region created on stack here" "where" } */
/* { dg-message "capacity: 8 bytes" "capacity" { target *-*-* } .-1 } */
s.i = a;
copy_to_user(dst, &s, sizeof (struct s2)); /* { dg-warning "potential exposure of sensitive information by copying uninitialized data from stack" "warning" } */
/* { dg-message "4 bytes are uninitialized" "note how much" { target *-*-* } .-1 } */
}
void test_2b (void __user *dst, u32 a)
{
struct s2 s;
s.i = a;
/* Copy with wrong size (only part of s2). */
copy_to_user(dst, &s, sizeof (struct s1));
}
void test_2d (void __user *dst, u32 a)
{
struct s2 s = {0};
s.i = a;
copy_to_user(dst, &s, sizeof (struct s2)); /* { dg-bogus "" } */
}
struct empty {};
void test_empty (void __user *dst)
{
struct empty e;
copy_to_user(dst, &e, sizeof (struct empty));
}
union un_a
{
u32 i;
u8 j;
};
/* As above, but in a different order. */
union un_b
{
u8 j;
u32 i;
};
void test_union_1a (void __user *dst, u8 v)
{
union un_a u; /* { dg-message "region created on stack here" "where" } */
/* { dg-message "capacity: 4 bytes" "capacity" { target *-*-* } .-1 } */
u.j = v;
copy_to_user(dst, &u, sizeof (union un_a)); /* { dg-warning "potential exposure of sensitive information by copying uninitialized data from stack" "warning" } */
/* { dg-message "3 bytes are uninitialized" "note how much" { target *-*-* } .-1 } */
/* { dg-message "bytes 1 - 3 are uninitialized" "note how much" { target *-*-* } .-2 } */
}
void test_union_1b (void __user *dst, u8 v)
{
union un_b u; /* { dg-message "region created on stack here" "where" } */
/* { dg-message "capacity: 4 bytes" "capacity" { target *-*-* } .-1 } */
u.j = v;
copy_to_user(dst, &u, sizeof (union un_b)); /* { dg-warning "potential exposure of sensitive information by copying uninitialized data from stack" "warning" } */
/* { dg-message "3 bytes are uninitialized" "note how much" { target *-*-* } .-1 } */
/* { dg-message "bytes 1 - 3 are uninitialized" "note how much" { target *-*-* } .-2 } */
}
void test_union_2a (void __user *dst, u8 v)
{
union un_a u = {0};
u.j = v;
copy_to_user(dst, &u, sizeof (union un_a));
}
void test_union_2b (void __user *dst, u8 v)
{
union un_b u = {0}; /* { dg-message "region created on stack here" "where" } */
/* { dg-message "capacity: 4 bytes" "capacity" { target *-*-* } .-1 } */
u.j = v;
copy_to_user(dst, &u, sizeof (union un_b)); /* { dg-warning "potential exposure of sensitive information by copying uninitialized data from stack" "warning" } */
/* { dg-message "3 bytes are uninitialized" "note how much" { target *-*-* } .-1 } */
/* { dg-message "bytes 1 - 3 are uninitialized" "note how much" { target *-*-* } .-2 } */
}
void test_union_3a (void __user *dst, u32 v)
{
union un_a u;
u.i = v;
copy_to_user(dst, &u, sizeof (union un_a)); /* { dg-bogus "" } */
}
void test_union_3b (void __user *dst, u32 v)
{
union un_b u;
u.i = v;
copy_to_user(dst, &u, sizeof (union un_b)); /* { dg-bogus "" } */
}
void test_union_4a (void __user *dst, u8 v)
{
union un_a u = {0};
copy_to_user(dst, &u, sizeof (union un_a)); /* { dg-bogus "" } */
}
void test_union_4b (void __user *dst, u8 v)
{
union un_b u = {0}; /* { dg-message "region created on stack here" "where" } */
/* { dg-message "capacity: 4 bytes" "capacity" { target *-*-* } .-1 } */
copy_to_user(dst, &u, sizeof (union un_b)); /* { dg-warning "potential exposure of sensitive information by copying uninitialized data from stack" "warning" } */
/* { dg-message "3 bytes are uninitialized" "note how much" { target *-*-* } .-1 } */
/* { dg-message "bytes 1 - 3 are uninitialized" "note how much" { target *-*-* } .-2 } */
}
struct st_union_5
{
union {
u8 f1;
u32 f2;
} u; /* { dg-message "field 'u' is partially uninitialized" } */
};
void test_union_5 (void __user *dst, u8 v)
{
struct st_union_5 st; /* { dg-message "region created on stack here" "where" } */
/* { dg-message "capacity: 4 bytes" "capacity" { target *-*-* } .-1 } */
/* This write only initializes the u8 within the union "u",
leaving the remaining 3 bytes uninitialized. */
st.u.f1 = v;
copy_to_user (dst, &st, sizeof(st)); /* { dg-warning "potential exposure of sensitive information by copying uninitialized data from stack" "warning" } */
/* { dg-message "3 bytes are uninitialized" "note how much" { target *-*-* } .-1 } */
}
void test_one_byte (void __user *dst)
{
char src; /* { dg-message "region created on stack here" "where" } */
/* { dg-message "capacity: 1 byte" "capacity" { target *-*-* } .-1 } */
copy_to_user (dst, &src, sizeof(src)); /* { dg-warning "potential exposure of sensitive information by copying uninitialized data from stack" "warning" } */
/* { dg-message "1 byte is uninitialized" "note how much" { target *-*-* } .-1 } */
}
|
