https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126833
Bug ID: 126833
Summary: false -Wanalyzer-undefined-behavior-ptrdiff on
linker-defined symbol pairs
Product: gcc
Version: 17.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 126830
Target Milestone: ---
All -Wanalyzer-undefined-behavior-ptrdiff FPs in the August 2026 OpenScanHub
mass scan of Fedora 45 (PR 126830) involve extern array/symbol declarations
that are placed contiguously by the linker. The subtraction is well-defined in
practice but the analyzer treats them as distinct C objects.
All 10 instances of this are from the kernel package (100% of
-Wanalyzer-undefined-behavior-ptrdiff FPs in the scan).
Three sub-patterns:
(A) __start_X / __stop_X section boundary pairs (linker auto-generated)
(B) Classic linker boundary symbols (_text/_end, _bss/_ebss)
(C) Assembly labels declared as functions, address-subtracted
$ cat t.c
typedef __SIZE_TYPE__ size_t;
extern void *memset(void *, int, size_t);
/* Sub-pattern A */
struct kernel_param { int x; };
extern struct kernel_param __start___param[];
extern struct kernel_param __stop___param[];
long count_params(void) {
return __stop___param - __start___param; /* bogus ptrdiff warning */
}
/* Sub-pattern B */
extern char _bss[];
extern char _ebss[];
void clear_bss(void) {
memset(_bss, 0, _ebss - _bss); /* bogus ptrdiff warning */
}
/* Sub-pattern C */
extern void trampoline_start(void);
extern void trampoline_end(void);
long trampoline_size(void) {
return (char *)&trampoline_end - (char *)&trampoline_start; /* bogus */
}
$ gcc -fanalyzer -c t.c
t.c:10:12: warning: undefined behavior when subtracting pointers
[-Wanalyzer-undefined-behavior-ptrdiff]
t.c:18:23: warning: undefined behavior when subtracting pointers
[-Wanalyzer-undefined-behavior-ptrdiff]
t.c:25:12: warning: undefined behavior when subtracting pointers
[-Wanalyzer-undefined-behavior-ptrdiff]
Trunk: https://godbolt.org/z/zjcTYbKha
We can probably come up with some kind of heuristic to suppress these.
Referenced Bugs:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126830
[Bug 126830] Tracker bug for -fanalyzer false positives seen in August 2026
OpenScanHub mass scan
