https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104560
Bug ID: 104560
Summary: False positive from -Wanalyzer-free-of-non-heap seen
with rdma-core
Product: gcc
Version: 12.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
Created attachment 52450
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52450&action=edit
Reduced reproducer
I'm seeing various -Wanalyzer-free-of-non-heap when compiling rdma-core with
-fanalyzer, e.g.:
rdma-core-33.0/providers/mlx5/mlx5.c: scope_hint: In function
'mlx5_uninit_device'
rdma-core-33.0/providers/mlx5/mlx5.c:2101:9:
warning[-Wanalyzer-free-of-non-heap]: 'free' of '&*verbs_device.device' which
points to memory not on the heap
# 2099| struct mlx5_device *dev = to_mdev(&verbs_device->device);
# 2100|
# 2101|-> free(dev);
# 2102| }
# 2103|
Am attaching a reproducer, which triggers the current false positive with trunk
when compiled without optimization:
<source>: In function 'mlx5_uninit_device':
<source>:42:9: warning: 'free' of 'dev' which points to memory not on the heap
[CWE-590] [-Wanalyzer-free-of-non-heap]
42 | __builtin_free(dev);
| ^~~~~~~~~~~~~~~~~~~
'mlx5_uninit_device': events 1-3
|
| 40 | struct mlx5_device *dev = to_mdev(&verbs_device->device);
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (1) pointer is from here
| | (2) pointer is from here
| 41 |
| 42 | __builtin_free(dev);
| | ~~~~~~~~~~~~~~~~~~~
| | |
| | (3) call to 'free' here
|
Uploaded to Compiler Explorer as:
https://godbolt.org/z/nazc15z1h
