[CHERI CSA Report] Bad pointer alignment cast in sdk/lib/queue/queue_compartment.cc

[resistor]

The new CHERI clang-static-analyzer checkers are producing the following warning. This could very well be a false positive.

---
MainSourceFile:  '/workspaces/cheriot-rtos/sdk/lib/queue/queue_compartment.cc'
Diagnostics:
  - DiagnosticName:  clang-analyzer-optin.portability.PointerAlignment
    DiagnosticMessage:
      Message:         'Pointer value aligned to a 4 byte boundary cast to type ''RestrictedEndpoint * __sealed_capability'' with 8-byte capability alignment'
      FilePath:        '/workspaces/cheriot-rtos/sdk/lib/queue/queue_compartment.cc'
      FileOffset:      1321
      Replacements:    []
    Notes:
      - Message:         'Calling ''unseal'''
        FilePath:        '/workspaces/cheriot-rtos/sdk/lib/queue/queue_compartment.cc'
        FileOffset:      5119
        Replacements:    []
        Ranges:
          - FilePath:        '/workspaces/cheriot-rtos/sdk/lib/queue/queue_compartment.cc'
            FileOffset:      5119
            Length:          26
      - Message:         'Pointer value aligned to a 4 byte boundary cast to type ''RestrictedEndpoint * __sealed_capability'' with 8-byte capability alignment'
        FilePath:        '/workspaces/cheriot-rtos/sdk/lib/queue/queue_compartment.cc'
        FileOffset:      1321
        Replacements:    []
        Ranges:
          - FilePath:        '/workspaces/cheriot-rtos/sdk/lib/queue/queue_compartment.cc'
            FileOffset:      1321
            Length:          60
    Level:           Warning
    BuildDirectory:  '/workspaces/cheriot-rtos'
...

[davidchisnall]

This looks like maybe the analysers don’t know what a sealed capability is?

[resistor]

This looks like maybe the analysers don’t know what a sealed capability is?

Seems plausible.

[resistor]

The AST node it's complaining about is:

CXXReinterpretCastExpr 0x120d6e510 'RestrictedEndpoint * __sealed_capability' reinterpret_cast<RestrictedEndpoint * __sealed_capability> <BitCast>
`-ImplicitCastExpr 0x120d6e4f8 'MessageQueue * __sealed_capability' <LValueToRValue> part_of_explicit_cast
  `-DeclRefExpr 0x120d6e400 'MessageQueue * __sealed_capability' lvalue ParmVar 0x120d6ddd0 'handle' 'MessageQueue * __sealed_capability'

[resistor]

So it's complaining because it believes RestrictedEndpoint has 8-byte alignment but MessageQueue has 4-byte alignment, which seems true to me? Are we perhaps missing a level of indirection in the cast?

[resistor]

Resolved by CHERIoT-Platform/llvm-project#204