[Bug analyzer/112969] -Wanalyzer-exposure-through-uninit-copy false positive seen on Linux kernel's drivers/net/ethernet/intel/ice/ice_ptp.c

[dmalcolm at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112969

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-01-24

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Issue seems to be with compound assignments where the source struct is not at
offset 0 within its binding_cluster.

A simpler reproducer, which generates a -Wanalyzer-use-of-uninitialized-value:
  Trunk: https://godbolt.org/z/qrzqb7EeP
  GCC 13.2: https://godbolt.org/z/8voo1zbq6
  GCC 12.3: https://godbolt.org/z/oMxTnsdv6
  GCC 11.4 didn't have -Wanalyzer-use-of-uninitialized-value but still doesn't
properly handle the compound assignment: https://godbolt.org/z/Ks36YddTG




/* Reduced from -Wanalyzer-exposure-through-uninit-copy false positives
   seen in Linux kernel in drivers/net/ethernet/intel/ice/ice_ptp.c  */

extern void __analyzer_eval (int);

struct hwtstamp_config
{
  int flags;
  int tx_type;
  int rx_filter;
};

struct ice_ptp
{
  long placeholder;
  struct hwtstamp_config tstamp_config;
};

struct ice_pf
{
  struct ice_ptp ptp;
};

void
ice_ptp_set_ts_config(struct ice_pf* pf)
{
  struct hwtstamp_config config;
  pf->ptp.tstamp_config.tx_type = 1;
  pf->ptp.tstamp_config.rx_filter = 2;
  config = pf->ptp.tstamp_config;
  __analyzer_eval (config.flags == pf->ptp.tstamp_config.flags); /* {
dg-warning "TRUE" } */
  /* { dg-bogus "use of uninitialized value 'config.flags'" "PR
analyzer/112969" { target *-*-* } .-1 } */
}