Google Git
Sign in
kernel / pub / scm / devel / sparse / sparse / e44f724a5ce007ad789d4688a37d03c4845032c0
commite44f724a5ce007ad789d4688a37d03c4845032c0[log] [tgz]
authorLuc Van Oostenryck <luc.vanoostenryck@gmail.com>Mon Jun 06 23:49:14 2022 +0200
committerLuc Van Oostenryck <luc.vanoostenryck@gmail.com>Tue Jun 07 14:52:37 2022 +0200
tree5323db16e47c5b9f4b89b4d7c39f0351358877d5
parentb3cf30ba5b47dfa7414416fe3bc5ae34db6065e7 [diff]
fix crash when inlining casts of erroneous expressions

Sparse do inlining very early, during expansion, just after (type)
evaluation and before IR linearization, and is done even if some
errors have been found. This means that the inlining must be robust
against erroneous code.

However, during inlining, a cast expression is always dereferenced and
a crash will occur if not valid (in which case it should be null).

Fix this by checking for null cast expressions and directly returning
NULL, like done for the inlining of the other invalid expressions.

Link: https://lore.kernel.org/r/e42698a9-494c-619f-ac16-8ffe2c87e04e@intel.com
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Yafang Shao <laoar.shao@gmail.com>
Reported-by: Yujie Liu <yujie.liu@intel.com>
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
2 files changed
tree: 5323db16e47c5b9f4b89b4d7c39f0351358877d5
  1. compat/
  2. Documentation/
  3. gvpr/
  4. validation/
  5. .gitignore
  6. allocate.c
  7. allocate.h
  8. ast-inspect.c
  9. ast-inspect.h
  10. ast-model.c
  11. ast-model.h
  12. ast-view.c
  13. ast-view.h
  14. bitmap.h
  15. bits.h
  16. builtin.c
  17. builtin.h
  18. c2xml.c
  19. cgcc
  20. cgcc.1
  21. char.c
  22. char.h
  23. compat-bsd.c
  24. compat-cygwin.c
  25. compat-linux.c
  26. compat-mingw.c
  27. compat-solaris.c
  28. compat.h
  29. compile-i386.c
  30. compile.c
  31. compile.h
  32. cse.c
  33. cse.h
  34. ctags.c
  35. dissect.c
  36. dissect.h
  37. dominate.c
  38. dominate.h
  39. evaluate.c
  40. evaluate.h
  41. example.c
  42. expand.c
  43. expand.h
  44. expression.c
  45. expression.h
  46. FAQ
  47. flow.c
  48. flow.h
  49. flowgraph.c
  50. flowgraph.h
  51. gcc-attr-list.h
  52. gdbhelpers
  53. graph.c
  54. ident-list.h
  55. inline.c
  56. ir.c
  57. ir.h
  58. lib.c
  59. lib.h
  60. LICENSE
  61. linearize.c
  62. linearize.h
  63. liveness.c
  64. liveness.h
  65. machine.h
  66. Makefile
  67. memops.c
  68. obfuscate.c
  69. opcode.c
  70. opcode.def
  71. opcode.h
  72. optimize.c
  73. optimize.h
  74. options.c
  75. options.h
  76. parse.c
  77. parse.dtd
  78. parse.h
  79. pre-process.c
  80. predefine.c
  81. ptrlist.c
  82. ptrlist.h
  83. ptrmap.c
  84. ptrmap.h
  85. README
  86. scheck.c
  87. scope.c
  88. scope.h
  89. semind.1
  90. semind.c
  91. show-parse.c
  92. simplify.c
  93. simplify.h
  94. sort.c
  95. sparse-llvm-dis
  96. sparse-llvm.c
  97. sparse.1
  98. sparse.c
  99. sparsec
  100. sparsei
  101. ssa.c
  102. ssa.h
  103. stats.c
  104. storage.c
  105. storage.h
  106. symbol.c
  107. symbol.h
  108. target-alpha.c
  109. target-arm.c
  110. target-arm64.c
  111. target-bfin.c
  112. target-default.c
  113. target-h8300.c
  114. target-m68k.c
  115. target-microblaze.c
  116. target-mips.c
  117. target-nds32.c
  118. target-nios2.c
  119. target-openrisc.c
  120. target-ppc.c
  121. target-riscv.c
  122. target-s390.c
  123. target-sh.c
  124. target-sparc.c
  125. target-x86.c
  126. target-xtensa.c
  127. target.c
  128. target.h
  129. test-dissect.c
  130. test-inspect.c
  131. test-lexing.c
  132. test-linearize.c
  133. test-parsing.c
  134. test-show-type.c
  135. test-sort.c
  136. test-unssa.c
  137. token.h
  138. tokenize.c
  139. unssa.c
  140. utils.c
  141. utils.h
  142. version.c