Skip to content

Enhancement to CON-41C #48

Open
Open
@jsinglet

Description

@jsinglet

Context: #45 (comment)

Although this query will catch a lot real-world examples of flawed usage of weak cmpxchg functions (e.g., those used in one-off if-statements), I think that if false-positives don't become an issue, it can be improved by verifying that either:

The loop is infinite or
The loop condition contains the call and checks its result or
The loop condition checks a variable which is, within the loop, assigned either of the following:
The return value of the weak cmpxchg function call (via local data flow)
A literal assigned in and only in a block guarded by a success condition of the weak cmpxchg function call return value
or
To avoid false positives, any value assigned in a block guarded by the weak cmpxchg function call return value

Metadata

Metadata

Assignees

No one assigned

    Labels

    Difficulty-HighA false positive or false negative report which is expected to take 1+ week effort to addressStandard-CERT-CenhancementNew feature or request

    Type

    No type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions