scan-build possible false positive

Hi all,

I hope this is the correct place to report an issue scan-build. The code
below (also attached) compiles cleanly with:
clang -ggdb -O0 -Werror -Wall -Wextra main.c

I use what I believe to be the latest stable, as shipped by Ubuntu 13.10:
$ /usr/bin/clang --version
Ubuntu clang version 3.3-5ubuntu4 (branches/release_33) (based on LLVM 3.3)
Target: x86_64-pc-linux-gnu
Thread model: posix

The code uses the sys/queue.h implementations that come with Linux and
perhaps other OS' as well.

When I run this through scan-build, it reports a use after free case:

$ scan-build -v clang -ggdb -O0 -Werror -Wall -Wextra main.c && ./a.out
scan-build: Using '/usr/bin/clang' for static analysis
scan-build: Emitting reports for this run to
'/tmp/scan-build-2013-12-11-37'.
main.c:29:9: warning: Use of memory after it is freed
        printf("module %p\n", module);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
scan-build: 1 bugs found.
scan-build: Run 'scan-view /tmp/scan-build-2013-12-11-37' to examine bug
reports.
module 0x9a4010

However, if I enable the HWBARRIER define (see code below), the warning
goes away:

$ scan-build -v clang -ggdb -O0 -Werror -Wall -Wextra main.c
-DHWBARRIER=1 && ./a.out
scan-build: Using '/usr/bin/clang' for static analysis
scan-build: Emitting reports for this run to
'/tmp/scan-build-2013-12-11-38'.
scan-build: Removing directory '/tmp/scan-build-2013-12-11-38' because
it contains no reports.
scan-build: No bugs found.
module 0x1be1010

The compiler barrier (SWBARRIER) doesn't do the trick though.

Is this a bug in clang and/or scan-build or am I missing an issue with
this code? In all cases valgrind is happy with it.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <sys/queue.h>

typedef struct OutputModule_ {
    TAILQ_ENTRY(OutputModule_) entries;
} OutputModule;

static TAILQ_HEAD(, OutputModule_) output_modules =
    TAILQ_HEAD_INITIALIZER(output_modules);

void add_to_tailq(void) {
    OutputModule *module = calloc(1, sizeof(*module));
    TAILQ_INSERT_TAIL(&output_modules, module, entries);
}

int main () {
    add_to_tailq();

    OutputModule *module;
    while ((module = TAILQ_FIRST(&output_modules))) {
#if HWBARRIER
        __sync_synchronize();
#elif SWBARRIER
        asm volatile("" ::: "memory");
#endif
        printf("module %p\n", module);

        TAILQ_REMOVE(&output_modules, TAILQ_FIRST(&output_modules),
entries);
        free(module);
    }
    exit(EXIT_SUCCESS);
}

Thanks,
Victor

main.c (827 Bytes)

We've pretty consistently had issues with the TAILQ macros; there's some code in there to try to suppress issues dealing with them, but apparently we've missed your test case. Please file a bug at http://llvm.org/bugs/.

Jordan

main.c (827 Bytes)

We've pretty consistently had issues with the TAILQ macros; there's some code in there to try to suppress issues dealing with them, but apparently we've missed your test case. Please file a bug at http://llvm.org/bugs/.

Opened http://llvm.org/bugs/show_bug.cgi?id=18222, hope it's helpful.

Thanks,
Victor