https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127518
--- Comment #4 from Huazhao Chen <lyican53 at sjtu dot edu.cn> ---
This is the reduced testcase. It reproduces exactly the same false positive:
same warning text on the same variable, same version window, and the warning
disappears under the same transformation the kernel workaround uses (moving the
initialization above the branch).
--------------- sev_reduced.c ---------------
enum { false, true } _copy_to_user();
_Bool copy_to_user___trans_tmp_1, psp_init_on_probe;
void *copy_to_user_from, *psp_master_0;
int psp_master, state, sev_ioctl_do_pdh_export_input,
sev_ioctl_do_pdh_export_input_0, sev_ioctl_do_pdh_export_input_1,
sev_ioctl_do_pdh_export_ret;
enum { SEV_PEK_CERT_EXPORT } cert_chain_address;
struct sev_platform_init_args {
_Bool probe
};
long sev_ioctl_do_pdh_export___trans_tmp_2;
long copy_to_user(void *to, long n) {
if (copy_to_user___trans_tmp_1)
return n;
_copy_to_user(to, copy_to_user_from);
}
void *kzalloc_noprof();
int __sev_platform_init_locked();
int _sev_platform_init_locked(struct sev_platform_init_args *args) {
if (psp_master || psp_master_0)
if (state)
return 0;
if (args->probe && psp_init_on_probe)
return 0;
return __sev_platform_init_locked(args);
}
void sev_move_to_init_state(_Bool *shutdown_required) {
struct sev_platform_init_args init_args = {};
int rc = _sev_platform_init_locked(&init_args);
if (rc)
*shutdown_required = true;
}
int sev_ioctl_do_pdh_export() {
void *pdh_blob = 0, *cert_blob = 0, *input_cert_chain_address;
_Bool shutdown_required = false;
if (sev_ioctl_do_pdh_export_input_1)
goto cmd;
input_cert_chain_address = (void *)cert_chain_address;
pdh_blob = kzalloc_noprof;
cert_blob = ({ ({ kzalloc_noprof(); }); });
cmd:
sev_move_to_init_state(&shutdown_required);
if (copy_to_user(0, sizeof(sev_ioctl_do_pdh_export_input)))
goto e_free_cert;
if (pdh_blob)
if (sev_ioctl_do_pdh_export___trans_tmp_2)
goto e_free_cert;
if (cert_blob)
copy_to_user(input_cert_chain_address, sev_ioctl_do_pdh_export_input_0);
sev_ioctl_do_pdh_export_ret = 4;
e_free_cert:
if (shutdown_required)
return 4;
}
----------------------------------------------
Reproduce (-std=gnu11 = the kernel's own build standard; the reduced file uses
implicit declarations):
gcc -std=gnu11 -O2 -Wall -Wextra -c sev_reduced.c -o /dev/null
Expected:
warning: 'input_cert_chain_address' may be used uninitialized
[-Wmaybe-uninitialized]
Version matrix (x86_64, same command, all exit 0):
gcc 11.3.0 12.2.0 12.5.0 13.1.0 13.2.0 13.3.0 14.3.0 15.3.0
buggy? yes yes yes yes yes no yes no
Identical to the unreduced testcase (buggy on 11/12 and 14, clean on 13.3+ and
15), consistent with known_to_fail/known_to_work and the point-release
bisection above.
Hoisting the single initialization above the "goto cmd" branch — the same
change af7e23c6 makes in the kernel — removes the warning on 11.3.0 and 12.5.0,
confirming the reduced testcase exercises the same false positive.
