{"$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json",
 "version": "2.1.0",
 "runs": [{"tool": {"driver": {"name": "GNU C23",
                               "fullName": "GNU C23 (GCC) version 16.1.1 20260703 (Red Hat 16.1.1-4) (x86_64-redhat-linux)",
                               "version": "16.1.1 20260703 (Red Hat 16.1.1-4)",
                               "informationUri": "https://gcc.gnu.org/gcc-16/",
                               "rules": [{"id": "-Wanalyzer-unsafe-call-within-signal-handler",
                                          "helpUri": "https://gcc.gnu.org/onlinedocs/gcc-16.1.0/gcc/Static-Analyzer-Options.html#index-Wanalyzer-unsafe-call-within-signal-handler"}]}},
           "taxonomies": [{"name": "CWE",
                           "version": "4.7",
                           "organization": "MITRE",
                           "shortDescription": {"text": "The MITRE Common Weakness Enumeration"},
                           "taxa": [{"id": "479",
                                     "helpUri": "https://cwe.mitre.org/data/definitions/479.html"}]}],
           "invocations": [{"arguments": ["/usr/libexec/gcc/x86_64-redhat-linux/16/cc1",
                                          "-quiet",
                                          "-I",
                                          "../src/include/",
                                          "-D",
                                          "_GNU_SOURCE",
                                          "-D",
                                          "__SANE_USERSPACE_TYPES__",
                                          "-D",
                                          "_LARGEFILE_SOURCE",
                                          "-D",
                                          "_FILE_OFFSET_BITS=64",
                                          "-D",
                                          "LIBURING_BUILD_TEST",
                                          "-include",
                                          "../config-host.h",
                                          "35fa71a030ca.c",
                                          "-quiet",
                                          "-dumpbase",
                                          "35fa71a030ca.c",
                                          "-dumpbase-ext",
                                          ".c",
                                          "-m64",
                                          "-mtune=generic",
                                          "-march=x86-64",
                                          "-mtls-dialect=gnu2",
                                          "-O2",
                                          "-Wno-unused-parameter",
                                          "-Wno-sign-compare",
                                          "-Wno-unknown-pragmas",
                                          "-flto=auto",
                                          "-ffat-lto-objects",
                                          "-fexceptions",
                                          "-fstack-protector-strong",
                                          "-fasynchronous-unwind-tables",
                                          "-fstack-clash-protection",
                                          "-fcf-protection=full",
                                          "-fno-omit-frame-pointer",
                                          "-fanalyzer",
                                          "-fdiagnostics-path-format=separate-events",
                                          "-fno-diagnostics-show-caret",
                                          "-fno-lto",
                                          "-fanalyzer-assume-nothrow",
                                          "-fdiagnostics-text-art-charset=none",
                                          "-fdiagnostics-set-output=sarif:file=/builddir/gcc-results/739-dQU5.sarif",
                                          "-o",
                                          "/tmp/ccHwRLWE.s"],
                            "workingDirectory": {"uri": "/builddir/build/BUILD/liburing-2.13-build/liburing-2.13/test"},
                            "startTimeUtc": "2026-08-03T18:01:35Z",
                            "executionSuccessful": true,
                            "toolExecutionNotifications": [],
                            "endTimeUtc": "2026-08-03T18:01:36Z"}],
           "originalUriBaseIds": {"PWD": {"uri": "file:///builddir/build/BUILD/liburing-2.13-build/liburing-2.13/test/"}},
           "artifacts": [{"location": {"uri": "35fa71a030ca.c",
                                       "uriBaseId": "PWD"},
                          "sourceLanguage": "c",
                          "contents": {"text": "/* SPDX-License-Identifier: MIT */\n// autogenerated by syzkaller (https://github.com/google/syzkaller)\n\n#include <dirent.h>\n#include <endian.h>\n#include <errno.h>\n#include <fcntl.h>\n#include <pthread.h>\n#include <signal.h>\n#include <stdarg.h>\n#include <stdbool.h>\n#include <stdint.h>\n#include <stdio.h>\n#include <stdlib.h>\n#include <string.h>\n#include <sys/prctl.h>\n#include <sys/stat.h>\n#include <sys/syscall.h>\n#include <sys/types.h>\n#include <sys/wait.h>\n#include <time.h>\n#include <unistd.h>\n#include <sys/mman.h>\n\n#include <linux/futex.h>\n\n#include \"liburing.h\"\n#include \"helpers.h\"\n#include \"../src/syscall.h\"\n\n#ifndef CONFIG_USE_SANITIZER\n#if !defined(SYS_futex) && defined(SYS_futex_time64)\n# define SYS_futex SYS_futex_time64\n#endif\n\nstatic void sleep_ms(uint64_t ms)\n{\n  usleep(ms * 1000);\n}\n\nstatic uint64_t current_time_ms(void)\n{\n  struct timespec ts;\n  if (clock_gettime(CLOCK_MONOTONIC, &ts))\n    exit(1);\n  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;\n}\n\nstatic void thread_start(void* (*fn)(void*), void* arg)\n{\n  pthread_t th;\n  pthread_attr_t attr;\n  pthread_attr_init(&attr);\n  pthread_attr_setstacksize(&attr, 128 << 10);\n  int i;\n  for (i = 0; i < 100; i++) {\n    if (pthread_create(&th, &attr, fn, arg) == 0) {\n      pthread_attr_destroy(&attr);\n      return;\n    }\n    if (errno == EAGAIN) {\n      usleep(50);\n      continue;\n    }\n    break;\n  }\n  exit(1);\n}\n\ntypedef struct {\n  int state;\n} event_t;\n\nstatic void event_init(event_t* ev)\n{\n  ev->state = 0;\n}\n\nstatic void event_reset(event_t* ev)\n{\n  ev->state = 0;\n}\n\nstatic void event_set(event_t* ev)\n{\n  if (ev->state)\n    exit(1);\n  __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);\n  syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG);\n}\n\nstatic void event_wait(event_t* ev)\n{\n  while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))\n    syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);\n}\n\nstatic int event_isset(event_t* ev)\n{\n  return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);\n}\n\nstatic int event_timedwait(event_t* ev, uint64_t timeout)\n{\n  uint64_t start = current_time_ms();\n  uint64_t now = start;\n  for (;;) {\n    uint64_t remain = timeout - (now - start);\n    struct timespec ts;\n    ts.tv_sec = remain / 1000;\n    ts.tv_nsec = (remain % 1000) * 1000 * 1000;\n    syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);\n    if (__atomic_load_n(&ev->state, __ATOMIC_RELAXED))\n      return 1;\n    now = current_time_ms();\n    if (now - start > timeout)\n      return 0;\n  }\n}\n\nstatic bool write_file(const char* file, const char* what, ...)\n{\n  char buf[1024];\n  va_list args;\n  va_start(args, what);\n  vsnprintf(buf, sizeof(buf), what, args);\n  va_end(args);\n  buf[sizeof(buf) - 1] = 0;\n  int len = strlen(buf);\n  int fd = open(file, O_WRONLY | O_CLOEXEC);\n  if (fd == -1)\n    return false;\n  if (write(fd, buf, len) != len) {\n    int err = errno;\n    close(fd);\n    errno = err;\n    return false;\n  }\n  close(fd);\n  return true;\n}\n\nstatic void kill_and_wait(int pid, int* status)\n{\n  kill(-pid, SIGKILL);\n  kill(pid, SIGKILL);\n  int i;\n  for (i = 0; i < 100; i++) {\n    if (waitpid(-1, status, WNOHANG | __WALL) == pid)\n      return;\n    usleep(1000);\n  }\n  DIR* dir = opendir(\"/sys/fs/fuse/connections\");\n  if (dir) {\n    for (;;) {\n      struct dirent* ent = readdir(dir);\n      if (!ent)\n        break;\n      if (strcmp(ent->d_name, \".\") == 0 || strcmp(ent->d_name, \"..\") == 0)\n        continue;\n      char abort[300];\n      snprintf(abort, sizeof(abort), \"/sys/fs/fuse/connections/%s/abort\",\n               ent->d_name);\n      int fd = open(abort, O_WRONLY);\n      if (fd == -1) {\n        continue;\n      }\n      if (write(fd, abort, 1) < 0) {\n      }\n      close(fd);\n    }\n    closedir(dir);\n  } else {\n  }\n  while (waitpid(-1, status, __WALL) != pid) {\n  }\n}\n\n#define SYZ_HAVE_SETUP_TEST 1\nstatic void setup_test(void)\n{\n  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);\n  setpgrp();\n  write_file(\"/proc/self/oom_score_adj\", \"1000\");\n}\n\nstruct thread_t {\n  int created, call;\n  event_t ready, done;\n};\n\nstatic struct thread_t threads[16];\nstatic void execute_call(int call);\nstatic int running;\n\nstatic void* thr(void* arg)\n{\n  struct thread_t* th = (struct thread_t*)arg;\n  for (;;) {\n    event_wait(&th->ready);\n    event_reset(&th->ready);\n    execute_call(th->call);\n    __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);\n    event_set(&th->done);\n  }\n  return 0;\n}\n\nstatic void execute_one(void)\n{\n  int i, call, thread;\n  for (call = 0; call < 3; call++) {\n    for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));\n         thread++) {\n      struct thread_t* th = &threads[thread];\n      if (!th->created) {\n        th->created = 1;\n        event_init(&th->ready);\n        event_init(&th->done);\n        event_set(&th->done);\n        thread_start(thr, th);\n      }\n      if (!event_isset(&th->done))\n        continue;\n      event_reset(&th->done);\n      th->call = call;\n      __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);\n      event_set(&th->ready);\n      event_timedwait(&th->done, 45);\n      break;\n    }\n  }\n  for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)\n    sleep_ms(1);\n}\n\nstatic void execute_one(void);\n\n#define WAIT_FLAGS __WALL\n\nstatic void loop(void)\n{\n  for (;;) {\n    int pid = fork();\n    if (pid < 0)\n      exit(1);\n    if (pid == 0) {\n      setup_test();\n      execute_one();\n      exit(0);\n    }\n    int status = 0;\n    uint64_t start = current_time_ms();\n    for (;;) {\n      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)\n        break;\n      sleep_ms(1);\n      if (current_time_ms() - start < 5 * 1000)\n        continue;\n      kill_and_wait(pid, &status);\n      break;\n    }\n  }\n}\n\nstatic uint64_t r[1] = {0xffffffffffffffff};\n\nvoid execute_call(int call)\n{\n  long res;\n  switch (call) {\n  case 0:\n    *(uint32_t*)0x20000040 = 0;\n    *(uint32_t*)0x20000044 = 0;\n    *(uint32_t*)0x20000048 = 0;\n    *(uint32_t*)0x2000004c = 0;\n    *(uint32_t*)0x20000050 = 0;\n    *(uint32_t*)0x20000054 = 0;\n    *(uint32_t*)0x20000058 = 0;\n    *(uint32_t*)0x2000005c = 0;\n    *(uint32_t*)0x20000060 = 0;\n    *(uint32_t*)0x20000064 = 0;\n    *(uint32_t*)0x20000068 = 0;\n    *(uint32_t*)0x2000006c = 0;\n    *(uint32_t*)0x20000070 = 0;\n    *(uint32_t*)0x20000074 = 0;\n    *(uint32_t*)0x20000078 = 0;\n    *(uint32_t*)0x2000007c = 0;\n    *(uint32_t*)0x20000080 = 0;\n    *(uint32_t*)0x20000084 = 0;\n    *(uint64_t*)0x20000088 = 0;\n    *(uint32_t*)0x20000090 = 0;\n    *(uint32_t*)0x20000094 = 0;\n    *(uint32_t*)0x20000098 = 0;\n    *(uint32_t*)0x2000009c = 0;\n    *(uint32_t*)0x200000a0 = 0;\n    *(uint32_t*)0x200000a4 = 0;\n    *(uint32_t*)0x200000a8 = 0;\n    *(uint32_t*)0x200000ac = 0;\n    *(uint64_t*)0x200000b0 = 0;\n    res = __sys_io_uring_setup(0x64, (struct io_uring_params *) 0x20000040UL);\n    if (res != -1)\n      r[0] = res;\n    break;\n  case 1:\n    __sys_io_uring_register((long)r[0], 0, 0, 0);\n    break;\n  case 2:\n    __sys_io_uring_register((long)r[0], 0, 0, 0);\n    break;\n  }\n}\n\nstatic void sig_int(int sig)\n{\n\texit(0);\n}\n\nint main(int argc, char *argv[])\n{\n\tif (argc > 1)\n\t\treturn T_EXIT_SKIP;\n\tsignal(SIGINT, sig_int);\n\tmmap((void *) 0x20000000, 0x1000000, 3, MAP_ANON|MAP_PRIVATE, -1, 0);\n\tsignal(SIGALRM, sig_int);\n\talarm(5);\n\n\tloop();\n\treturn T_EXIT_PASS;\n}\n#else\nint main(int argc, char *argv[])\n{\n\treturn T_EXIT_SKIP;\n}\n#endif\n"},
                          "roles": ["analysisTarget",
                                    "tracedFile"]}],
           "results": [{"ruleId": "-Wanalyzer-unsafe-call-within-signal-handler",
                        "taxa": [{"id": "479",
                                  "toolComponent": {"name": "cwe"}}],
                        "properties": {"gcc/analyzer/saved_diagnostic/sm": "signal",
                                       "gcc/analyzer/saved_diagnostic/ploc": {"enode": 831},
                                       "gcc/analyzer/saved_diagnostic/state": "in_signal_handler",
                                       "gcc/analyzer/saved_diagnostic/idx": 0,
                                       "gcc/analyzer/pending_diagnostic/kind": "signal_unsafe_call"},
                        "level": "warning",
                        "message": {"text": "call to ‘exit’ from within signal handler"},
                        "locations": [{"physicalLocation": {"artifactLocation": {"uri": "35fa71a030ca.c",
                                                                                 "uriBaseId": "PWD"},
                                                            "region": {"startLine": 316,
                                                                       "startColumn": 9,
                                                                       "endColumn": 16},
                                                            "contextRegion": {"startLine": 316,
                                                                              "snippet": {"text": "\texit(0);\n"}}},
                                       "logicalLocations": [{"index": 0,
                                                             "fullyQualifiedName": "sig_int"}]}],
                        "codeFlows": [{"threadFlows": [{"id": "main",
                                                        "locations": [{"properties": {"gcc/analyzer/checker_event/emission_id": "(1)",
                                                                                      "gcc/analyzer/checker_event/kind": "function_entry"},
                                                                       "location": {"physicalLocation": {"artifactLocation": {"uri": "35fa71a030ca.c",
                                                                                                                              "uriBaseId": "PWD"},
                                                                                                         "region": {"startLine": 319,
                                                                                                                    "startColumn": 5,
                                                                                                                    "endColumn": 9},
                                                                                                         "contextRegion": {"startLine": 319,
                                                                                                                           "snippet": {"text": "int main(int argc, char *argv[])\n"}}},
                                                                                    "logicalLocations": [{"index": 1,
                                                                                                          "fullyQualifiedName": "main"}],
                                                                                    "message": {"text": "entry to ‘main’"}},
                                                                       "kinds": ["enter",
                                                                                 "function"],
                                                                       "nestingLevel": 1,
                                                                       "executionOrder": 1},
                                                                      {"properties": {"gcc/analyzer/checker_event/emission_id": "(2)",
                                                                                      "gcc/analyzer/checker_event/kind": "start_cfg_edge",
                                                                                      "gcc/analyzer/superedge_event/superedge": {"src_id": 5,
                                                                                                                                 "dst_id": 9}},
                                                                       "location": {"physicalLocation": {"artifactLocation": {"uri": "35fa71a030ca.c",
                                                                                                                              "uriBaseId": "PWD"},
                                                                                                         "region": {"startLine": 321,
                                                                                                                    "startColumn": 12,
                                                                                                                    "endColumn": 13},
                                                                                                         "contextRegion": {"startLine": 321,
                                                                                                                           "snippet": {"text": "\tif (argc > 1)\n"}}},
                                                                                    "logicalLocations": [{"index": 1,
                                                                                                          "fullyQualifiedName": "main"}],
                                                                                    "message": {"text": "following ‘false’ branch (when ‘argc <= 1’)..."}},
                                                                       "kinds": ["branch",
                                                                                 "false"],
                                                                       "nestingLevel": 1,
                                                                       "executionOrder": 2},
                                                                      {"properties": {"gcc/analyzer/checker_event/emission_id": "(3)",
                                                                                      "gcc/analyzer/checker_event/kind": "end_cfg_edge",
                                                                                      "gcc/analyzer/superedge_event/superedge": {"src_id": 5,
                                                                                                                                 "dst_id": 9}},
                                                                       "location": {"physicalLocation": {"artifactLocation": {"uri": "35fa71a030ca.c",
                                                                                                                              "uriBaseId": "PWD"},
                                                                                                         "region": {"startLine": 323,
                                                                                                                    "startColumn": 9,
                                                                                                                    "endColumn": 32},
                                                                                                         "contextRegion": {"startLine": 323,
                                                                                                                           "snippet": {"text": "\tsignal(SIGINT, sig_int);\n"}}},
                                                                                    "logicalLocations": [{"index": 1,
                                                                                                          "fullyQualifiedName": "main"}],
                                                                                    "message": {"text": "...to here"}},
                                                                       "kinds": ["branch",
                                                                                 "false"],
                                                                       "nestingLevel": 1,
                                                                       "executionOrder": 3},
                                                                      {"properties": {"gcc/analyzer/checker_event/emission_id": "(4)",
                                                                                      "gcc/analyzer/checker_event/kind": "state_change"},
                                                                       "location": {"physicalLocation": {"artifactLocation": {"uri": "35fa71a030ca.c",
                                                                                                                              "uriBaseId": "PWD"},
                                                                                                         "region": {"startLine": 323,
                                                                                                                    "startColumn": 9,
                                                                                                                    "endColumn": 32},
                                                                                                         "contextRegion": {"startLine": 323,
                                                                                                                           "snippet": {"text": "\tsignal(SIGINT, sig_int);\n"}}},
                                                                                    "logicalLocations": [{"index": 1,
                                                                                                          "fullyQualifiedName": "main"}],
                                                                                    "message": {"text": "registering ‘sig_int’ as signal handler"}},
                                                                       "nestingLevel": 1,
                                                                       "executionOrder": 4},
                                                                      {"properties": {"gcc/analyzer/checker_event/emission_id": "(5)",
                                                                                      "gcc/analyzer/checker_event/kind": "custom"},
                                                                       "location": {"message": {"text": "later on, when the signal is delivered to the process"}},
                                                                       "nestingLevel": 0,
                                                                       "executionOrder": 5},
                                                                      {"properties": {"gcc/analyzer/checker_event/emission_id": "(6)",
                                                                                      "gcc/analyzer/checker_event/kind": "warning"},
                                                                       "location": {"physicalLocation": {"artifactLocation": {"uri": "35fa71a030ca.c",
                                                                                                                              "uriBaseId": "PWD"},
                                                                                                         "region": {"startLine": 316,
                                                                                                                    "startColumn": 9,
                                                                                                                    "endColumn": 16},
                                                                                                         "contextRegion": {"startLine": 316,
                                                                                                                           "snippet": {"text": "\texit(0);\n"}}},
                                                                                    "logicalLocations": [{"index": 0,
                                                                                                          "fullyQualifiedName": "sig_int"}],
                                                                                    "message": {"text": "call to ‘exit’ from within signal handler"}},
                                                                       "kinds": ["danger"],
                                                                       "nestingLevel": 1,
                                                                       "executionOrder": 6}]}]}],
                        "relatedLocations": [{"physicalLocation": {"artifactLocation": {"uri": "35fa71a030ca.c",
                                                                                        "uriBaseId": "PWD"},
                                                                   "region": {"startLine": 316,
                                                                              "startColumn": 9,
                                                                              "endColumn": 16},
                                                                   "contextRegion": {"startLine": 316,
                                                                                     "snippet": {"text": "\texit(0);\n"}}},
                                              "message": {"text": "‘_exit’ is a possible signal-safe alternative for ‘exit’"},
                                              "properties": {"nestingLevel": 0}}]}],
           "logicalLocations": [{"name": "sig_int",
                                 "fullyQualifiedName": "sig_int",
                                 "decoratedName": "sig_int",
                                 "kind": "function",
                                 "index": 0},
                                {"name": "main",
                                 "fullyQualifiedName": "main",
                                 "decoratedName": "main",
                                 "kind": "function",
                                 "index": 1}]}]}
