[Bug analyzer/126833] New: false -Wanalyzer-undefined-behavior-ptrdiff on linker-defined symbol pairs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126833

            Bug ID: 126833
           Summary: false -Wanalyzer-undefined-behavior-ptrdiff on
                    linker-defined symbol pairs
           Product: gcc
           Version: 17.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
            Blocks: 126830
  Target Milestone: ---

All -Wanalyzer-undefined-behavior-ptrdiff FPs in the August 2026 OpenScanHub
mass scan of Fedora 45 (PR 126830) involve extern array/symbol declarations
that are placed contiguously by the linker.  The subtraction is well-defined in
practice but the analyzer treats them as distinct C objects.

All 10 instances of this are from the kernel package (100% of
-Wanalyzer-undefined-behavior-ptrdiff FPs in the scan).


Three sub-patterns:
(A) __start_X / __stop_X section boundary pairs (linker auto-generated)
(B) Classic linker boundary symbols (_text/_end, _bss/_ebss)
(C) Assembly labels declared as functions, address-subtracted

$ cat t.c
typedef __SIZE_TYPE__ size_t;
extern void *memset(void *, int, size_t);

/* Sub-pattern A */
struct kernel_param { int x; };
extern struct kernel_param __start___param[];
extern struct kernel_param __stop___param[];

long count_params(void) {
    return __stop___param - __start___param; /* bogus ptrdiff warning */
}

/* Sub-pattern B */
extern char _bss[];
extern char _ebss[];

void clear_bss(void) {
    memset(_bss, 0, _ebss - _bss); /* bogus ptrdiff warning */
}

/* Sub-pattern C */
extern void trampoline_start(void);
extern void trampoline_end(void);

long trampoline_size(void) {
    return (char *)&trampoline_end - (char *)&trampoline_start; /* bogus */
}

$ gcc -fanalyzer -c t.c
t.c:10:12: warning: undefined behavior when subtracting pointers
[-Wanalyzer-undefined-behavior-ptrdiff]
t.c:18:23: warning: undefined behavior when subtracting pointers
[-Wanalyzer-undefined-behavior-ptrdiff]
t.c:25:12: warning: undefined behavior when subtracting pointers
[-Wanalyzer-undefined-behavior-ptrdiff]

Trunk: https://godbolt.org/z/zjcTYbKha

We can probably come up with some kind of heuristic to suppress these.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126830
[Bug 126830] Tracker bug for -fanalyzer false positives seen in August 2026
OpenScanHub mass scan