1  // TODO: remove need for this option
       2  /* { dg-additional-options "-fanalyzer-checker=taint" } */
       3  
       4  /* We need this, otherwise the warnings are emitted inside the macros, which
       5     makes it hard to write the DejaGnu directives.  */
       6  /* { dg-additional-options " -ftrack-macro-expansion=0" } */
       7  
       8  /* Adapted from code in the Linux kernel, which has this: */
       9  /* SPDX-License-Identifier: GPL-2.0 */
      10  
      11  #define __noreturn __attribute__ ((__noreturn__))
      12  
      13  void panic(const char *fmt, ...) __noreturn;
      14  
      15  int _printk(const char *fmt, ...);
      16  #define __printk_index_emit(...) do {} while (0)
      17  #define printk_index_wrap(_p_func, _fmt, ...)				\
      18  	({								\
      19  		__printk_index_emit(_fmt, NULL, NULL);			\
      20  		_p_func(_fmt, ##__VA_ARGS__);				\
      21  	})
      22  #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__)
      23  #define barrier_before_unreachable() do { } while (0)
      24  
      25  #define BUG() do { \
      26  	printk("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \
      27  	barrier_before_unreachable(); \
      28  	panic("BUG!"); \
      29  } while (0)
      30  
      31  #define BUG_ON(condition) do { if (condition) BUG(); } while (0)
      32  
      33  void __attribute__((tainted_args))
      34  test_BUG(int n)
      35  {
      36    if (n > 100) /* { dg-message "use of attacker-controlled value for control flow" } */
      37      BUG(); /* { dg-warning "-Wanalyzer-tainted-assertion" "warning" } */
      38    /* { dg-message "treating 'panic' as an assertion failure handler due to '__attribute__\\(\\(__noreturn__\\)\\)'" "final event" { target *-*-* } .-1 } */
      39  }
      40  
      41  void __attribute__((tainted_args))
      42  test_BUG_ON(int n)
      43  {
      44    BUG_ON(n > 100); /* { dg-warning "-Wanalyzer-tainted-assertion" "warning" } */
      45    /* { dg-message "treating 'panic' as an assertion failure handler due to '__attribute__\\(\\(__noreturn__\\)\\)'" "final event" { target *-*-* } .-1 } */
      46  }
      47  
      48  int __attribute__((tainted_args))
      49  test_switch_BUG_1(int n)
      50  {
      51    switch (n) { /* { dg-message "use of attacker-controlled value for control flow" } */
      52    default:
      53    case 0:
      54      return 5;
      55    case 1:
      56      return 22;
      57    case 2:
      58      return -1;
      59    case 42:
      60      BUG (); /* { dg-warning "-Wanalyzer-tainted-assertion" } */
      61    }
      62  }
      63  
      64  int __attribute__((tainted_args))
      65  test_switch_BUG(int n)
      66  {
      67    switch (n) { /* { dg-message "use of attacker-controlled value for control flow" } */
      68    case 0:
      69      return 5;
      70    case 1:
      71      return 22;
      72    case 2:
      73      return -1;
      74    }
      75    BUG (); /* { dg-warning "-Wanalyzer-tainted-assertion" } */
      76  }