https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108187
Bug ID: 108187
Summary: False positive -Wfree-nonheap-object on impossible
path with -O1
Product: gcc
Version: 12.2.1
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: c
Assignee: unassigned at gcc dot gnu.org
Reporter: i.maximets at ovn dot org
Target Milestone: ---
Created attachment 54132
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54132&action=edit
Reproducer
This might be the same issue as 98753, but I'm not sure.
We're getting the following error while trying to build Open vSwitch
with AF_XDP support with GCC:
```
In file included from lib/netdev-linux-private.h:30,
from lib/netdev-afxdp.c:19:
In function ‘dp_packet_delete’,
inlined from ‘dp_packet_delete’ at lib/dp-packet.h:246:1,
inlined from ‘dp_packet_batch_add__’ at lib/dp-packet.h:775:9,
inlined from ‘dp_packet_batch_add’ at lib/dp-packet.h:783:5,
inlined from ‘netdev_afxdp_rxq_recv’ at lib/netdev-afxdp.c:898:9:
lib/dp-packet.h:260:9: warning: ‘free’ called on pointer ‘*umem.xpool.array’
with nonzero offset [8, 2558044588346441168] [-Wfree-nonheap-object]
260 | free(b);
| ^~~~~~~
```
The simplified code flow is following:
```
packet = &umem->xpool.array[index];
packet = &xpacket->packet;
dp_packet_use_afxdp(packet, pkt, FRAME_SIZE - FRAME_HEADROOM,
OVS_XDP_HEADROOM);
--> dp_packet_init__(packet, allocated, DPBUF_AFXDP);
--> packet->source = source;
dp_packet_batch_add(batch, packet);
--> dp_packet_delete(packet);
--> if (b->source == DPBUF_AFXDP) {
free_afxdp_buf(b);
return;
}
dp_packet_uninit(b);
free(b);
```
The 'b->source' is always set unconditionally to DPBUF_AFXDP on that path,
so the free(b) cannot be reached, but compiler doesn't think so.
The issue is seen starting with -O1.
$ gcc --version
gcc (GCC) 12.2.1 20221121 (Red Hat 12.2.1-4)
Attached the file in question after -E. To reproduce run:
$ gcc -O1 -c netdev-afxdp.E.c
