What Every C Programmer Should Know About Undefined Behavior #1/3

It was roughly this

read-from-p;

if(p != NULL) write-to-p;

since read-from-p is undefined if p is null, gcc could (and did) legally optimize out the NULL check, so you could end up writing to NULL.

[edit] I noticed that this case of bug is actually mentioned in the regehr article that is linked.

- http://lkml.org/lkml/2009/7/17/187

- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6...

I've put a gist file demonstrating the problem: https://gist.github.com/968723

  #include 
  
  struct agnx_priv {
      char demo;
  };
  
  struct ieee80211_hw {
      struct agnx_priv *priv;
  };
  
  struct pci_dev {
      struct ieee80211_hw* dev;
  };
  
  struct ieee80211_hw* pci_get_drvdata(struct pci_dev *pdev) {
  
      if(!pdev)
          return NULL;
  
      return pdev->dev;
  }
  
  static void agnx_pci_remove (struct pci_dev *pdev)
  {
      struct ieee80211_hw *dev = pci_get_drvdata(pdev);
      struct agnx_priv *priv = dev->priv;
  
      if (!dev) return;
  
      // This will segfault if the previous if is optimized
      printf("%c\n", priv->demo);
  }
  
  int main(int argc, char **argv)
  {
      // (struct pci_dev *)argv[1] is just to avoid compiler optimisations
      // =~ NULL if no args are passed.
      struct pci_dev * pdev = (struct pci_dev *)argv[1];
  
      agnx_pci_remove(pdev);
      return 0;
  }

  gcc -O2 -ggdb -Wall -Wundef -fno-strict-aliasing \
    -fno-common -fdelete-null-pointer-checks test-deref.c \
    -o test-deref

  gcc -O2 -ggdb -Wall -Wundef -fno-strict-aliasing \
    -fno-common -fno-delete-null-pointer-checks test-deref.c  \
    -o test-deref