[C] Default implicit function pointer conversions diagnostic to be an error

[aaron.ballman]

Summary

Implicitly converting between incompatible function pointers in C is currently a default-on warning (it is an error in C++). However, this is very poor security posture. A mismatch in parameters or return types, or a mismatch in calling conventions, etc can lead to exploitable security vulnerabilities. Rather than allow this unsafe practice with a warning, this patch strengthens the warning to be an error (while still allowing users the ability to disable the error or the warning entirely to ease migration). Users should either ensure the signatures are correctly compatible or they should use an explicit cast if they believe that's more reasonable.

[cor3ntin]

LGTM.
I agree that this address potential security issues. I'm curious how many people will be affected, but hopefully by doing that early in the clang 16 cycle we might find out!
Thanks for working on this Aarron.

clang/include/clang/Basic/DiagnosticSemaKinds.td

8178

Fancy!

[erichkeane]

Yep, i think this is a good direction, and code changes look correct to me.

[aaron.ballman]

Rebased and fixing up clang-tools-extra tests caught by the precommit CI.

[nikic]

This seems to break the test-suite build:

FAILED: CTMark/ClamAV/CMakeFiles/clamscan.dir/libclamav_readdb.c.o 
/root/llvm-compile-time-tracker/llvm-test-suite-build/tools/timeit --summary CTMark/ClamAV/CMakeFiles/clamscan.dir/libclamav_readdb.c.o.time /root/llvm-compile-time-tracker/llvm-project-build/bin/clang -DNDEBUG  -fexperimental-new-pass-manager -O0 -g   -w -Werror=date-time -DHAVE_CONFIG_H -I/root/llvm-compile-time-tracker/llvm-test-suite/CTMark/ClamAV -I/root/llvm-compile-time-tracker/llvm-test-suite/CTMark/ClamAV/zlib -DDONT_LOCK_DBDIRS -DC_LINUX -DFPU_WORDS_BIGENDIAN=0 -DWORDS_BIGENDIAN=0 -MD -MT CTMark/ClamAV/CMakeFiles/clamscan.dir/libclamav_readdb.c.o -MF CTMark/ClamAV/CMakeFiles/clamscan.dir/libclamav_readdb.c.o.d -o CTMark/ClamAV/CMakeFiles/clamscan.dir/libclamav_readdb.c.o   -c /root/llvm-compile-time-tracker/llvm-test-suite/CTMark/ClamAV/libclamav_readdb.c
/root/llvm-compile-time-tracker/llvm-test-suite/CTMark/ClamAV/libclamav_readdb.c:1145:49: error: incompatible function pointer types passing 'int (const struct dirent *, const struct dirent *)' to parameter of type '__compar_fn_t' (aka 'int (*)(const void *, const void *)') [-Wincompatible-function-pointer-types]
    qsort(dents, ndents, sizeof(struct dirent), dirent_compare);
                                                ^~~~~~~~~~~~~~
/usr/include/stdlib.h:831:20: note: passing argument to parameter '__compar' here
                   __compar_fn_t __compar) __nonnull ((1, 4));
                                 ^
1 error generated.

Is it intentional that this generates an error for benign differences (in pointer types only)?

[aaron.ballman]

In D131351#3714062, @nikic wrote:

This seems to break the test-suite build:

FAILED: CTMark/ClamAV/CMakeFiles/clamscan.dir/libclamav_readdb.c.o 
/root/llvm-compile-time-tracker/llvm-test-suite-build/tools/timeit --summary CTMark/ClamAV/CMakeFiles/clamscan.dir/libclamav_readdb.c.o.time /root/llvm-compile-time-tracker/llvm-project-build/bin/clang -DNDEBUG  -fexperimental-new-pass-manager -O0 -g   -w -Werror=date-time -DHAVE_CONFIG_H -I/root/llvm-compile-time-tracker/llvm-test-suite/CTMark/ClamAV -I/root/llvm-compile-time-tracker/llvm-test-suite/CTMark/ClamAV/zlib -DDONT_LOCK_DBDIRS -DC_LINUX -DFPU_WORDS_BIGENDIAN=0 -DWORDS_BIGENDIAN=0 -MD -MT CTMark/ClamAV/CMakeFiles/clamscan.dir/libclamav_readdb.c.o -MF CTMark/ClamAV/CMakeFiles/clamscan.dir/libclamav_readdb.c.o.d -o CTMark/ClamAV/CMakeFiles/clamscan.dir/libclamav_readdb.c.o   -c /root/llvm-compile-time-tracker/llvm-test-suite/CTMark/ClamAV/libclamav_readdb.c
/root/llvm-compile-time-tracker/llvm-test-suite/CTMark/ClamAV/libclamav_readdb.c:1145:49: error: incompatible function pointer types passing 'int (const struct dirent *, const struct dirent *)' to parameter of type '__compar_fn_t' (aka 'int (*)(const void *, const void *)') [-Wincompatible-function-pointer-types]
    qsort(dents, ndents, sizeof(struct dirent), dirent_compare);
                                                ^~~~~~~~~~~~~~
/usr/include/stdlib.h:831:20: note: passing argument to parameter '__compar' here
                   __compar_fn_t __compar) __nonnull ((1, 4));
                                 ^
1 error generated.

Thanks, I'll try to take care of this shortly!

Is it intentional that this generates an error for benign differences (in pointer types only)?

Yes, it's still UB.

[brooksmoses]

For the record, so far we've seen this showing up in the following:

• A case in a notoriously warning-heavy third-party library where we'd backported a file from a newer version and didn't quite fix all the internal API mismatches.
• A ten-year-old bug in a local patch to another third-party library, where a function-pointer parameter was defined as returning a void and then assigned to a function-pointer that returns a void *.
• A probably-innocuous bug in a local patch to yet another third-party library, where we were passing an int foo(char *, char *) function to GLIBC's qsort, which expects a function with a signature of int foo(void *, void *).
• A case where https://gitlab.freedesktop.org/pixman/pixman/-/commit/e0d4403e78a7af8f4be4110ae25e9c3d1ac93a78 wasn't applied to our local version. This is also probably an innocuous case, not a "real" bug.
• A case where SciPy's extension has a function that uses void * for a FILE * pointer (https://github.com/scipy/scipy/blob/main/scipy/spatial/_qhull.pyx#L187, second argument) while the corresponding C code's function has a real FILE * pointer (https://github.com/qhull/qhull/blob/master/src/libqhull_r/io_r.h#L97). The SciPy function also uses a void * for an argument of a struct type, which seems rather odd to me given that it just defined the type two lines earlier.

So, real bugs in 40% of cases, I'd say.

[MaskRay]

Nit: I think it is useful mentioning -Wincompatible-pointer-types-Wincompatible-function-pointer-types in the commit message, not just in clang/docs/ReleaseNotes.rst, so that git log --grep incompatible-function-pointer-types will reveal something when the user knows incompatible-function-pointer-types but not "implicit function pointer conversions diagnostic".

[aaron.ballman]

In D131351#3714968, @brooksmoses wrote:

For the record, so far we've seen this showing up in the following:

• A case in a notoriously warning-heavy third-party library where we'd backported a file from a newer version and didn't quite fix all the internal API mismatches.
• A ten-year-old bug in a local patch to another third-party library, where a function-pointer parameter was defined as returning a void and then assigned to a function-pointer that returns a void *.
• A probably-innocuous bug in a local patch to yet another third-party library, where we were passing an int foo(char *, char *) function to GLIBC's qsort, which expects a function with a signature of int foo(void *, void *).
• A case where https://gitlab.freedesktop.org/pixman/pixman/-/commit/e0d4403e78a7af8f4be4110ae25e9c3d1ac93a78 wasn't applied to our local version. This is also probably an innocuous case, not a "real" bug.
• A case where SciPy's extension has a function that uses void * for a FILE * pointer (https://github.com/scipy/scipy/blob/main/scipy/spatial/_qhull.pyx#L187, second argument) while the corresponding C code's function has a real FILE * pointer (https://github.com/qhull/qhull/blob/master/src/libqhull_r/io_r.h#L97). The SciPy function also uses a void * for an argument of a struct type, which seems rather odd to me given that it just defined the type two lines earlier.

So, real bugs in 40% of cases, I'd say.

I double-checked these scenarios against the standard (where possible) and all of them are undefined behavior per the spec (and would be things I would expect a type sanitizer to report on), but I agree that not all of them seem likely to lead to a security vulnerability.

In D131351#3714993, @MaskRay wrote:

Nit: I think it is useful mentioning -Wincompatible-pointer-types-Wincompatible-function-pointer-types in the commit message, not just in clang/docs/ReleaseNotes.rst, so that git log --grep incompatible-function-pointer-types will reveal something when the user knows incompatible-function-pointer-types but not "implicit function pointer conversions diagnostic".

Good point, thanks!

[mstorsjo]

I found another case of this warning, which is kinda borderline whether it really is an error not:

#include <stdlib.h>
static _Noreturn void my_exit(void) {
  exit(42);
}
__attribute__((noreturn)) void (*handler)(void) = my_exit;

The fix is simple though, just be consistent with _Noreturn vs __attribute__((noreturn)) on both function and function pointer.

[aaron.ballman]

In D131351#3718421, @mstorsjo wrote:

I found another case of this warning, which is kinda borderline whether it really is an error not:

#include <stdlib.h>
static _Noreturn void my_exit(void) {
  exit(42);
}
__attribute__((noreturn)) void (*handler)(void) = my_exit;

The fix is simple though, just be consistent with _Noreturn vs __attribute__((noreturn)) on both function and function pointer.

Oh wow, that one is neat, weird, and I'm not certain what I think about it yet. __attribute__((noreturn)) is part of the function type, which is why you're allowed to write it on a function pointer declaration. _Noreturn is not part of the function type (nor is [[noreturn]] in C2x), so the two functions types do not match and that's why you get the diagnostic. This is the same logic that allows a diagnostic for a case like:

__attribute__((stdcall)) void func(int a, int b);
void (*fp)(int, int) = func; // Oops, calling convention mismatch

(on targets where these calling conventions exist and stdcall is not the default calling convention).

However, we don't care about the type mismatch when doing a redeclaration or when dropping the attribute, as in:

__attribute__((noreturn)) void my_exit(void);
void (*handler)(void) = my_exit; // Silently drops the attribute

_Noreturn void my_exit(void) { // No concerns about the type mismatch on redeclaration because we inherit __attribute__((noreturn))
}

so maybe we shouldn't worry about it here.

[mizvekov]

In D131351#3718725, @aaron.ballman wrote:

However, we don't care about the type mismatch when doing a redeclaration or when dropping the attribute, as in:

__attribute__((noreturn)) void my_exit(void);
void (*handler)(void) = my_exit; // Silently drops the attribute

_Noreturn void my_exit(void) { // No concerns about the type mismatch on redeclaration because we inherit __attribute__((noreturn))
}

so maybe we shouldn't worry about it here.

Are you sure? If the function types don't match in C++, I would expect that to become a different overload, not a redeclaration, right?

[mstorsjo]

In D131351#3718725, @aaron.ballman wrote:

In D131351#3718421, @mstorsjo wrote:

I found another case of this warning, which is kinda borderline whether it really is an error not:

#include <stdlib.h>
static _Noreturn void my_exit(void) {
  exit(42);
}
__attribute__((noreturn)) void (*handler)(void) = my_exit;

The fix is simple though, just be consistent with _Noreturn vs __attribute__((noreturn)) on both function and function pointer.

Oh wow, that one is neat, weird, and I'm not certain what I think about it yet.

FWIW, the source of the code here is a piece of code from glibc, distributed as part of gnulib and in gettext (in various older/newer copies of it). The bug has itself been fixed in gnulib already almost 2 years ago, as result of the Clang warning at the time: https://git.savannah.gnu.org/cgit/gnulib.git/commit/lib/obstack.c?id=0cc39712803ade7b2d4b89c36b143dad72404063 However in this case, a (potentially old) packaged tarball of gettext contained two older copies of the file.

[mstorsjo]

A different but slightly similar case, where I've run into these errors too, FWIW: On ARM, when compiling with a hardfloat target, Clang does consider a function pointer with __attribute__((pcs("aapcs-vfp"))) different from one without, even if the default still in the end would end up equal to it. I guess the problem there is that Clang doesn't know what the default implicit calling convention is (and that's something that ends up resolved on the LLVM side while lowering code) - while e.g. Clang does know that __cdecl is equivalent to not declaring any calling convention at all.

[aaron.ballman]

In D131351#3718982, @mstorsjo wrote:

A different but slightly similar case, where I've run into these errors too, FWIW: On ARM, when compiling with a hardfloat target, Clang does consider a function pointer with __attribute__((pcs("aapcs-vfp"))) different from one without, even if the default still in the end would end up equal to it. I guess the problem there is that Clang doesn't know what the default implicit calling convention is (and that's something that ends up resolved on the LLVM side while lowering code) - while e.g. Clang does know that __cdecl is equivalent to not declaring any calling convention at all.

I think that one is a bug with the target architecture not properly specifying what the default calling convention is that case. My guess is they're falling back on cdecl as the default calling convention in the frontend when they should be looking at the target.

[aaron.ballman]

In D131351#3718728, @mizvekov wrote:

In D131351#3718725, @aaron.ballman wrote:

However, we don't care about the type mismatch when doing a redeclaration or when dropping the attribute, as in:

__attribute__((noreturn)) void my_exit(void);
void (*handler)(void) = my_exit; // Silently drops the attribute

_Noreturn void my_exit(void) { // No concerns about the type mismatch on redeclaration because we inherit __attribute__((noreturn))
}

so maybe we shouldn't worry about it here.

Are you sure? If the function types don't match in C++, I would expect that to become a different overload, not a redeclaration, right?

The changes here only impact C so it shouldn't be a big deal, but we do not create an overload set for them in C with the overloadable attribute: https://godbolt.org/z/1ETe6ff5s

I tracked down the noreturn behavior and this turns out to be intentional for the past ten years and is a result of a bug report I can't see: https://github.com/llvm/llvm-project/blob/main/clang/lib/Sema/SemaOverload.cpp#L1526 (https://github.com/llvm/llvm-project/commit/48c69106e4ce1 was what added the functionality.)

clang-tools-extra/test/clang-tidy/checkers/bugprone/signal-handler-minimal.c

 // RUN: %check_clang_tidy %s bugprone-signal-handler %t \
 // RUN: -config='{CheckOptions: \
 // RUN:  [{key: bugprone-signal-handler.AsyncSafeFunctionSet, value: "minimal"}]}' \
 // RUN: -- -isystem %clang_tidy_headers
 
 #include "signal.h"
 #include "stdlib.h"
 #include "string.h"
 #include "unistd.h"
 
 void handler_bad1(int) {
   _exit(0);
   // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: standard function '_exit' may not be asynchronous-safe; calling it from a signal handler may be dangerous [bugprone-signal-handler]
 }
 
-void handler_bad2(void *dst, const void *src) {
+void handler_bad2(int) {
+  void *dst;
+  const void *src;
   memcpy(dst, src, 10);
   // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: standard function 'memcpy' may not be asynchronous-safe; calling it from a signal handler may be dangerous [bugprone-signal-handler]
 }
 
 void handler_good(int) {
   abort();
   _Exit(0);
   quick_exit(0);
   signal(0, SIG_DFL);
 }
 
 void test(void) {
   signal(SIGINT, handler_bad1);
   signal(SIGINT, handler_bad2);
   signal(SIGINT, handler_good);
 }

clang-tools-extra/test/clang-tidy/checkers/bugprone/signal-handler.c

 // RUN: %check_clang_tidy %s bugprone-signal-handler %t -- -- -isystem %clang_tidy_headers
 
 #include "signal.h"
 #include "stdlib.h"
 #include "stdio.h"
 #include "system-other.h"
 
 // The function should be classified as standard function even if there is
 // declaration the in source file.
 // FIXME: The detection works only if the first declaration is in system
 // header.
 int printf(const char *, ...);
 typedef void (*sighandler_t)(int);
 sighandler_t signal(int signum, sighandler_t handler);
 
 void f_extern(void);
+void f_extern_handler(int);
 
 void handler_printf(int) {
   printf("1234");
   // CHECK-NOTES: :[[@LINE-1]]:3: warning: standard function 'printf' may not be asynchronous-safe; calling it from a signal handler may be dangerous [bugprone-signal-handler]
   // CHECK-NOTES: :[[@LINE-2]]:3: note: function 'printf' called here from 'handler_printf'
   // CHECK-NOTES: :[[@LINE+4]]:18: note: function 'handler_printf' registered here as signal handler
 }
 

 
 void test_other(void) {
   signal(SIGINT, handler_abort);
   signal(SIGINT, handler_signal);
 
   signal(SIGINT, _Exit);
   signal(SIGINT, other_call);
   // CHECK-NOTES: :[[@LINE-1]]:18: warning: standard function 'other_call' may not be asynchronous-safe; using it as a signal handler may be dangerous [bugprone-signal-handler]
-  signal(SIGINT, f_extern);
-  // CHECK-NOTES: :[[@LINE-1]]:18: warning: cannot verify that external function 'f_extern' is asynchronous-safe; using it as a signal handler may be dangerous [bugprone-signal-handler]
+  signal(SIGINT, f_extern_handler);
+  // CHECK-NOTES: :[[@LINE-1]]:18: warning: cannot verify that external function 'f_extern_handler' is asynchronous-safe; using it as a signal handler may be dangerous [bugprone-signal-handler]
 
   signal(SIGINT, SIG_IGN);
   signal(SIGINT, SIG_DFL);
 }

clang/docs/ReleaseNotes.rst

 - Clang will now check compile-time determinable string literals as format strings.
   Fixes `Issue 55805: <https://github.com/llvm/llvm-project/issues/55805>`_.
 - ``-Wformat`` now recognizes ``%b`` for the ``printf``/``scanf`` family of
   functions and ``%B`` for the ``printf`` family of functions. Fixes
   `Issue 56885: <https://github.com/llvm/llvm-project/issues/56885>`_.
 - ``-Wbitfield-constant-conversion`` now diagnoses implicit truncation when 1 is
   assigned to a 1-bit signed integer bitfield. This fixes
   `Issue 53253 <https://github.com/llvm/llvm-project/issues/53253>`_.
+- ``-Wincompatible-function-pointer-types`` now defaults to an error in all C
+  language modes. It may be downgraded to a warning with
+  ``-Wno-error=incompatible-function-pointer-types`` or disabled entirely with
+  ``-Wno-implicit-function-pointer-types``.
 
 Non-comprehensive list of changes in this release
 -------------------------------------------------
 
 New Compiler Flags
 ------------------
 
 Deprecated Compiler Flags

clang/include/clang/Basic/DiagnosticSemaKinds.td

def err_typecheck_convert_incompatible_pointer : Error<
   "initializing with expression of different type}0,1"
   "|%diff{sending $ to parameter of type $|"
   "sending to parameter of different type}0,1"
   "|%diff{casting $ to type $|casting between types}0,1}2"
   "%select{|; dereference with *|"
   "; take the address with &|"
   "; remove *|"
   "; remove &}3">;
-def ext_typecheck_convert_incompatible_function_pointer : ExtWarn<
-  "incompatible function pointer types "
-  "%select{%diff{assigning to $ from $|assigning to different types}0,1"
-  "|%diff{passing $ to parameter of type $|"
-  "passing to parameter of different type}0,1"
-  "|%diff{returning $ from a function with result type $|"
-  "returning from function with different return type}0,1"
-  "|%diff{converting $ to type $|converting between types}0,1"
-  "|%diff{initializing $ with an expression of type $|"
-  "initializing with expression of different type}0,1"
-  "|%diff{sending $ to parameter of type $|"
-  "sending to parameter of different type}0,1"
-  "|%diff{casting $ to type $|casting between types}0,1}2"
-  "%select{|; dereference with *|"
-  "; take the address with &|"
-  "; remove *|"
-  "; remove &}3">,
-  InGroup<IncompatibleFunctionPointerTypes>;
 def err_typecheck_convert_incompatible_function_pointer : Error<
   "incompatible function pointer types "
   "%select{%diff{assigning to $ from $|assigning to different types}0,1"
   "|%diff{passing $ to parameter of type $|"
   "passing to parameter of different type}0,1"
   "|%diff{returning $ from a function with result type $|"
   "returning from function with different return type}0,1"
   "|%diff{converting $ to type $|converting between types}0,1"
   "|%diff{initializing $ with an expression of type $|"
   "initializing with expression of different type}0,1"
   "|%diff{sending $ to parameter of type $|"
   "sending to parameter of different type}0,1"
   "|%diff{casting $ to type $|casting between types}0,1}2"
   "%select{|; dereference with *|"
   "; take the address with &|"
   "; remove *|"
   "; remove &}3">;
+def ext_typecheck_convert_incompatible_function_pointer : ExtWarn<
+  err_typecheck_convert_incompatible_function_pointer.Text>,
+  InGroup<IncompatibleFunctionPointerTypes>, DefaultError;
 def ext_typecheck_convert_discards_qualifiers : ExtWarn<
   "%select{%diff{assigning to $ from $|assigning to different types}0,1"
   "|%diff{passing $ to parameter of type $|"
   "passing to parameter of different type}0,1"
   "|%diff{returning $ from a function with result type $|"
   "returning from function with different return type}0,1"
   "|%diff{converting $ to type $|converting between types}0,1"
   "|%diff{initializing $ with an expression of type $|"

clang/test/CodeGen/attributes.c

-// RUN: %clang_cc1 -no-opaque-pointers -emit-llvm -Wno-strict-prototypes -fcf-protection=branch -triple i386-linux-gnu %s -o - | FileCheck %s
+// RUN: %clang_cc1 -no-opaque-pointers -emit-llvm -Wno-strict-prototypes -Wno-incompatible-function-pointer-types -fcf-protection=branch -triple i386-linux-gnu %s -o - | FileCheck %s
 
 // CHECK: @t5 = weak{{.*}} global i32 2
 int t5 __attribute__((weak)) = 2;
 
 // CHECK: @t13 ={{.*}} global %struct.s0 zeroinitializer, section "SECT"
 struct s0 { int x; };
 struct s0 t13 __attribute__((section("SECT"))) = { 0 };
 

clang/test/CodeGen/overloadable.c

-// RUN: %clang_cc1 -no-opaque-pointers -triple %itanium_abi_triple -emit-llvm %s -o - | FileCheck %s
+// RUN: %clang_cc1 -no-opaque-pointers -triple %itanium_abi_triple -Wno-incompatible-function-pointer-types -emit-llvm %s -o - | FileCheck %s
 // CHECK: _Z1fPA10_1X
 // CHECK: _Z1fPFvvE
 
 int __attribute__((overloadable)) f(int x) { return x; }
 float __attribute__((overloadable)) f(float x) { return x; }
 double __attribute__((overloadable)) f(double x) { return x; }
 double _Complex __attribute__((overloadable)) f(double _Complex x) { return x; }
 typedef short v4hi __attribute__ ((__vector_size__ (8)));

clang/test/Sema/aarch64-svepcs.c

 void __attribute__((aarch64_sve_pcs)) foo2(void) {} // expected-error {{function declared 'aarch64_sve_pcs' here was previously declared 'cdecl'}}
 
 void foo3(void);                                    // expected-note {{previous declaration is here}}
 void __attribute__((aarch64_sve_pcs)) foo3(void) {} // expected-error {{function declared 'aarch64_sve_pcs' here was previously declared without calling convention}}
 
 typedef int (*fn_ty)(void);
 typedef int __attribute__((aarch64_sve_pcs)) (*aasvepcs_fn_ty)(void);
 void foo4(fn_ty ptr1, aasvepcs_fn_ty ptr2) {
-  ptr1 = ptr2; // expected-warning {{incompatible function pointer types}}
+  ptr1 = ptr2; // expected-error {{incompatible function pointer types}}
 }

clang/test/Sema/aarch64-vpcs.c

 void __attribute__((aarch64_vector_pcs)) foo2(void) {} // expected-error {{function declared 'aarch64_vector_pcs' here was previously declared 'cdecl'}}
 
 void foo3(void);                                       // expected-note {{previous declaration is here}}
 void __attribute__((aarch64_vector_pcs)) foo3(void) {} // expected-error {{function declared 'aarch64_vector_pcs' here was previously declared without calling convention}}
 
 typedef int (*fn_ty)(void);
 typedef int __attribute__((aarch64_vector_pcs)) (*aavpcs_fn_ty)(void);
 void foo4(fn_ty ptr1, aavpcs_fn_ty ptr2) {
-  ptr1 = ptr2; // expected-warning {{incompatible function pointer types}}
+  ptr1 = ptr2; // expected-error {{incompatible function pointer types}}
 }

clang/test/Sema/arm-cmse.c

 // RUN: %clang_cc1 -triple thumbv8m.base-none-eabi -mcmse -Wno-strict-prototypes -verify %s
 
 typedef void (*callback_ns_1t)(void) __attribute__((cmse_nonsecure_call));
 typedef void (*callback_1t)(void);
 typedef void (*callback_ns_2t)(void) __attribute__((cmse_nonsecure_call));
 typedef void (*callback_2t)(void);
 
 void foo(callback_ns_1t nsfptr, // expected-error{{functions may not be declared with 'cmse_nonsecure_call' attribute}}
          callback_1t fptr) __attribute__((cmse_nonsecure_call))
 {
-  callback_1t fp1 = nsfptr; // expected-warning{{incompatible function pointer types initializing 'callback_1t'}}
-  callback_ns_1t fp2 = fptr; // expected-warning{{incompatible function pointer types initializing 'callback_ns_1t'}}
+  callback_1t fp1 = nsfptr; // expected-error{{incompatible function pointer types initializing 'callback_1t'}}
+  callback_ns_1t fp2 = fptr; // expected-error{{incompatible function pointer types initializing 'callback_ns_1t'}}
   callback_2t fp3 = fptr;
   callback_ns_2t fp4 = nsfptr;
 }
 
 static void bar(void) __attribute__((cmse_nonsecure_entry)) // expected-warning{{'cmse_nonsecure_entry' cannot be applied to functions with internal linkage}}
 {
 }
 

clang/test/Sema/attr-nocf_check.c

 
 // No variable or parameter declaration
 __attribute__((nocf_check)) int i;                              // expected-warning {{'nocf_check' attribute only applies to function}}
 void testNoCfCheckImpl(double __attribute__((nocf_check)) i) {} // expected-warning {{'nocf_check' attribute only applies to function}}
 
 // Allow attributed function pointers as well as casting between attributed
 // and non-attributed function pointers.
 void testNoCfCheckMismatch(FuncPointer f) {
-  FuncPointerWithNoCfCheck fNoCfCheck = f; // expected-warning {{incompatible function pointer types}}
+  FuncPointerWithNoCfCheck fNoCfCheck = f; // expected-error {{incompatible function pointer types}}
   (*fNoCfCheck)();                         // no-warning
 }
 
 // 'nocf_check' Attribute has no parameters.
 int testNoCfCheckParams(void) __attribute__((nocf_check(1))); // expected-error {{'nocf_check' attribute takes no arguments}}

clang/test/Sema/block-return.c

static int funk(char *s) {
   if (^{} == ((void*)0))
     return 1;
   else
     return 0;
 }
 void next(void);
 void foo4(void) {
   int (^xx)(const char *s) = ^(char *s) { return 1; }; // expected-error {{incompatible block pointer types initializing 'int (^)(const char *)' with an expression of type 'int (^)(char *)'}}
-  int (*yy)(const char *s) = funk; // expected-warning {{incompatible function pointer types initializing 'int (*)(const char *)' with an expression of type 'int (char *)'}}
+  int (*yy)(const char *s) = funk; // expected-error {{incompatible function pointer types initializing 'int (*)(const char *)' with an expression of type 'int (char *)'}}
 
   int (^nested)(char *s) = ^(char *str) { void (^nest)(void) = ^(void) { printf("%s\n", str); }; next(); return 1; };
 }
 
 typedef void (^bptr)(void);
 
 bptr foo5(int j) {
   __block int i;

clang/test/Sema/c2x-func-prototype.c

 // RUN: %clang_cc1 -fsyntax-only -verify=c2x -std=c2x %s
 // RUN: %clang_cc1 -Wno-strict-prototypes -fsyntax-only -verify -std=c17 %s
 // RUN: %clang_cc1 -fsyntax-only -fno-knr-functions -std=c99 -verify=c2x %s
 // expected-no-diagnostics
 
 void func(); // c2x-note {{'func' declared here}}
 typedef void (*fp)();
 
 void other_func(int i);
 
 void call(void) {
   func(1, 2, 3); // c2x-error {{too many arguments to function call, expected 0, have 3}}
   fp call_me = func;
   call_me(1, 2, 3); // c2x-error {{too many arguments to function call, expected 0, have 3}}
 
-  fp nope = other_func; // c2x-warning {{incompatible function pointer types initializing 'fp' (aka 'void (*)(void)') with an expression of type 'void (int)'}}
+  fp nope = other_func; // c2x-error {{incompatible function pointer types initializing 'fp' (aka 'void (*)(void)') with an expression of type 'void (int)'}}
 }
 
 // Ensure these function declarations do not merge in C2x.
 void redecl1();      // c2x-note {{previous declaration is here}}
 void redecl1(int i); // c2x-error {{conflicting types for 'redecl1'}}
 
 void redecl2(int i); // c2x-note {{previous declaration is here}}
 void redecl2();      // c2x-error {{conflicting types for 'redecl2'}}

clang/test/Sema/callingconv-ms_abi.c

 // RUN: %clang_cc1 -fsyntax-only -verify -triple x86_64-pc-win32 %s
 
 void __attribute__((ms_abi)) foo(void);
 void (*pfoo)(void) = foo;
 
 void __attribute__((sysv_abi)) bar(void);
-void (*pbar)(void) = bar; // expected-warning{{incompatible function pointer types}}
+void (*pbar)(void) = bar; // expected-error{{incompatible function pointer types}}
 
-void (__attribute__((sysv_abi)) *pfoo2)(void) = foo; // expected-warning{{incompatible function pointer types}}
+void (__attribute__((sysv_abi)) *pfoo2)(void) = foo; // expected-error{{incompatible function pointer types}}

clang/test/Sema/callingconv-sysv_abi.c

 // RUN: %clang_cc1 -fsyntax-only -verify -triple x86_64-pc-linux-gnu %s
 
 void __attribute__((ms_abi)) foo(void);
-void (*pfoo)(void) = foo; // expected-warning{{incompatible function pointer types}}
+void (*pfoo)(void) = foo; // expected-error{{incompatible function pointer types}}
 
 void __attribute__((sysv_abi)) bar(void);
 void (*pbar)(void) = bar;
 
-void (__attribute__((ms_abi)) *pbar2)(void) = bar; // expected-warning{{incompatible function pointer types}}
+void (__attribute__((ms_abi)) *pbar2)(void) = bar; // expected-error{{incompatible function pointer types}}

clang/test/Sema/callingconv.c

 void __attribute__((cdecl)) ctest0() {}
 
 void __attribute__((cdecl(1))) ctest1(float x) {} // expected-error {{'cdecl' attribute takes no arguments}}
 
 void (__attribute__((fastcall)) *pfoo)(float*) = foo;
 
 void (__attribute__((stdcall)) *pbar)(float*) = bar;
 
-void (__attribute__((cdecl)) *ptest1)(void) = test1; // expected-warning {{incompatible function pointer types}}
+void (__attribute__((cdecl)) *ptest1)(void) = test1; // expected-error {{incompatible function pointer types}}
 
 void (*pctest0)() = ctest0;
 
 void ctest2() {}
 void (__attribute__((cdecl)) *pctest2)() = ctest2;
 
 typedef void (__attribute__((fastcall)) *Handler) (float *);
 Handler H = foo;

clang/test/Sema/incompatible-function-pointer-types.c

-// RUN: %clang_cc1 -fsyntax-only %s -Wincompatible-pointer-types -verify
-// RUN: %clang_cc1 -fsyntax-only %s -Wincompatible-function-pointer-types -verify
+// RUN: %clang_cc1 -fsyntax-only %s -Wincompatible-pointer-types -verify=hard,expected
+// RUN: %clang_cc1 -fsyntax-only %s -Wno-error=incompatible-pointer-types -verify=soft,expected
+// RUN: %clang_cc1 -fsyntax-only %s -Wincompatible-function-pointer-types -verify=hard,expected
+// RUN: %clang_cc1 -fsyntax-only %s -Wno-error=incompatible-function-pointer-types -verify=soft,expected
 
 // This test ensures that the subgroup of -Wincompatible-pointer-types warnings
 // that concern function pointers can be promoted (or not promoted) to an error
 // *separately* from the other -Wincompatible-pointer-type warnings.
 typedef int (*MyFnTyA)(int *, char *);
 
 int bar(char *a, int *b) { return 0; }
 int foo(MyFnTyA x) { return 0; } // expected-note {{passing argument to parameter 'x' here}}
 
 void baz(void) {
-  foo(&bar); // expected-warning {{incompatible function pointer types passing 'int (*)(char *, int *)' to parameter of type 'MyFnTyA' (aka 'int (*)(int *, char *)')}}
+  foo(&bar); // soft-warning {{incompatible function pointer types passing 'int (*)(char *, int *)' to parameter of type 'MyFnTyA' (aka 'int (*)(int *, char *)')}} \
+                hard-error {{incompatible function pointer types passing 'int (*)(char *, int *)' to parameter of type 'MyFnTyA' (aka 'int (*)(int *, char *)')}}
 }

clang/test/Sema/initialize-noreturn.c

 // RUN: %clang_cc1 %s -fsyntax-only -Wno-strict-prototypes -verify
 // rdar://10095762
 
 typedef void (*Fn_noret)(void) __attribute__((noreturn));
 typedef void (*Fn_ret)(void);
 
 typedef void (*Fn_noret_noproto)() __attribute__((noreturn));
 typedef void (*Fn_ret_noproto)();
 
 void foo(void);
 void foo_noret(void)  __attribute__((noreturn));
 
 void foo_noproto();
 void foo_noret_noproto()  __attribute__((noreturn));
 
 void test() {
-  Fn_noret fn2 = &foo; // expected-warning {{incompatible function pointer types initializing 'Fn_noret'}}
-  Fn_noret fn3 = &foo_noret; 
-  Fn_ret fn4 = &foo_noret; 
+  Fn_noret fn2 = &foo; // expected-error {{incompatible function pointer types initializing 'Fn_noret'}}
+  Fn_noret fn3 = &foo_noret;
+  Fn_ret fn4 = &foo_noret;
   Fn_ret fn5 = &foo;
 
-  Fn_noret_noproto fn6 = &foo_noproto; // expected-warning {{incompatible function pointer types initializing 'Fn_noret_noproto'}}
-  Fn_noret_noproto fn7 = &foo_noret_noproto; 
-  Fn_ret_noproto fn8 = &foo_noret_noproto; 
+  Fn_noret_noproto fn6 = &foo_noproto; // expected-error {{incompatible function pointer types initializing 'Fn_noret_noproto'}}
+  Fn_noret_noproto fn7 = &foo_noret_noproto;
+  Fn_ret_noproto fn8 = &foo_noret_noproto;
   Fn_ret_noproto fn9 = &foo_noproto;
 }
 

clang/test/Sema/noescape.c

 // RUN: %clang_cc1 -fsyntax-only -verify %s
 
 void escapefunc(int *);
 void noescapefunc(__attribute__((noescape)) int *);
 void (*escapefuncptr)(int *);
 void (*noescapefuncptr)(__attribute__((noescape)) int *);
 
 void func_ne(__attribute__((noescape)) int *, int *);
 void func_en(int *, __attribute__((noescape)) int *);
 
 void (*funcptr_ee)(int *, int *);
 void (*funcptr_nn)(__attribute__((noescape)) int *, __attribute__((noescape)) int *);
 
 void test0(int c) {
   escapefuncptr = &escapefunc;
   escapefuncptr = &noescapefunc;
-  noescapefuncptr = &escapefunc; // expected-warning {{incompatible function pointer types assigning to 'void (*)(__attribute__((noescape)) int *)' from 'void (*)(int *)'}}
+  noescapefuncptr = &escapefunc; // expected-error {{incompatible function pointer types assigning to 'void (*)(__attribute__((noescape)) int *)' from 'void (*)(int *)'}}
   noescapefuncptr = &noescapefunc;
 
   escapefuncptr = c ? &escapefunc : &noescapefunc;
-  noescapefuncptr = c ? &escapefunc : &noescapefunc; // expected-warning {{incompatible function pointer types assigning to 'void (*)(__attribute__((noescape)) int *)' from 'void (*)(int *)'}}
+  noescapefuncptr = c ? &escapefunc : &noescapefunc; // expected-error {{incompatible function pointer types assigning to 'void (*)(__attribute__((noescape)) int *)' from 'void (*)(int *)'}}
 
   funcptr_ee = c ? &func_ne : &func_en;
-  funcptr_nn = c ? &func_ne : &func_en; // expected-warning {{incompatible function pointer types assigning to 'void (*)(__attribute__((noescape)) int *, __attribute__((noescape)) int *)' from 'void (*)(int *, int *)'}}
+  funcptr_nn = c ? &func_ne : &func_en; // expected-error {{incompatible function pointer types assigning to 'void (*)(__attribute__((noescape)) int *, __attribute__((noescape)) int *)' from 'void (*)(int *, int *)'}}
 }

clang/test/Sema/overloadable.c

 void fn_type_conversions() {
   void foo(void *c) __attribute__((overloadable));
   void foo(char *c) __attribute__((overloadable));
   void (*ptr1)(void *) = &foo;
   void (*ptr2)(char *) = &foo;
   void (*ambiguous)(int *) = &foo; // expected-error{{initializing 'void (*)(int *)' with an expression of incompatible type '<overloaded function type>'}} expected-note@-4{{candidate function}} expected-note@-3{{candidate function}}
   void *vp_ambiguous = &foo; // expected-error{{initializing 'void *' with an expression of incompatible type '<overloaded function type>'}} expected-note@-5{{candidate function}} expected-note@-4{{candidate function}}
 
-  void (*specific1)(int *) = (void (*)(void *))&foo; // expected-warning{{incompatible function pointer types initializing 'void (*)(int *)' with an expression of type 'void (*)(void *)'}}
+  void (*specific1)(int *) = (void (*)(void *))&foo; // expected-error{{incompatible function pointer types initializing 'void (*)(int *)' with an expression of type 'void (*)(void *)'}}
   void *specific2 = (void (*)(void *))&foo;
 
   void disabled(void *c) __attribute__((overloadable, enable_if(0, "")));
   void disabled(int *c) __attribute__((overloadable, enable_if(c, "")));
   void disabled(char *c) __attribute__((overloadable, enable_if(1, "The function name lies.")));
   // To be clear, these should all point to the last overload of 'disabled'
   void (*dptr1)(char *c) = &disabled;
-  void (*dptr2)(void *c) = &disabled; // expected-warning{{incompatible function pointer types initializing 'void (*)(void *)' with an expression of type '<overloaded function type>'}} expected-note@-5{{candidate function made ineligible by enable_if}} expected-note@-4{{candidate function made ineligible by enable_if}} expected-note@-3{{candidate function has type mismatch at 1st parameter (expected 'void *' but has 'char *')}}
-  void (*dptr3)(int *c) = &disabled; // expected-warning{{incompatible function pointer types initializing 'void (*)(int *)' with an expression of type '<overloaded function type>'}} expected-note@-6{{candidate function made ineligible by enable_if}} expected-note@-5{{candidate function made ineligible by enable_if}} expected-note@-4{{candidate function has type mismatch at 1st parameter (expected 'int *' but has 'char *')}}
+  void (*dptr2)(void *c) = &disabled; // expected-error{{incompatible function pointer types initializing 'void (*)(void *)' with an expression of type '<overloaded function type>'}} expected-note@-5{{candidate function made ineligible by enable_if}} expected-note@-4{{candidate function made ineligible by enable_if}} expected-note@-3{{candidate function has type mismatch at 1st parameter (expected 'void *' but has 'char *')}}
+  void (*dptr3)(int *c) = &disabled; // expected-error{{incompatible function pointer types initializing 'void (*)(int *)' with an expression of type '<overloaded function type>'}} expected-note@-6{{candidate function made ineligible by enable_if}} expected-note@-5{{candidate function made ineligible by enable_if}} expected-note@-4{{candidate function has type mismatch at 1st parameter (expected 'int *' but has 'char *')}}
 
   void *specific_disabled = &disabled;
 }
 
 void incompatible_pointer_type_conversions() {
   char charbuf[1];
   unsigned char ucharbuf[1];
   int intbuf[1];

clang/test/Sema/pass-object-size.c

 
 // char* inestead of void* is intentional
 void IsOverloaded(char *p) overloaded; // expected-note{{passing argument to parameter 'p' here}} expected-note 2 {{type mismatch}}
 
 void FunctionPtrs(void) {
   void (*p)(void *) = NotOverloaded; //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}
   void (*p2)(void *) = &NotOverloaded; //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}
 
-  void (*p3)(void *) = IsOverloaded; //expected-warning{{incompatible function pointer types initializing 'void (*)(void *)' with an expression of type '<overloaded function type>'}}
-  void (*p4)(void *) = &IsOverloaded; //expected-warning{{incompatible function pointer types initializing 'void (*)(void *)' with an expression of type '<overloaded function type>'}}
+  void (*p3)(void *) = IsOverloaded; //expected-error{{incompatible function pointer types initializing 'void (*)(void *)' with an expression of type '<overloaded function type>'}}
+  void (*p4)(void *) = &IsOverloaded; //expected-error{{incompatible function pointer types initializing 'void (*)(void *)' with an expression of type '<overloaded function type>'}}
 
   void (*p5)(char *) = IsOverloaded;
   void (*p6)(char *) = &IsOverloaded;
 
   TakeFn(NotOverloaded); //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}
   TakeFn(&NotOverloaded); //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}
 
   TakeFnOvl(NotOverloaded); //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}

clang/test/Sema/preserve-call-conv.c

 // RUN: %clang_cc1 %s -fsyntax-only -triple x86_64-unknown-unknown -verify
 // RUN: %clang_cc1 %s -fsyntax-only -triple arm64-unknown-unknown -verify
 // RUN: %clang_cc1 %s -fsyntax-only -triple x86_64-unknown-windows-msvc -verify
 // RUN: %clang_cc1 %s -fsyntax-only -triple aarch64-unknown-windows-msvc -verify
 // RUN: %clang_cc1 %s -fsyntax-only -triple thumbv7-unknown-windows-msvc -verify
 
 typedef void typedef_fun_t(int);
 
 void __attribute__((preserve_most)) foo(void *ptr) {
 }
 
 void __attribute__((preserve_most(1))) foo1(void *ptr) { // expected-error {{'preserve_most' attribute takes no arguments}}
 }
 
 void (__attribute__((preserve_most)) *pfoo1)(void *) = foo;
 
-void (__attribute__((cdecl)) *pfoo2)(void *) = foo; // expected-warning {{incompatible function pointer types initializing 'void (*)(void *) __attribute__((cdecl))' with an expression of type 'void (void *) __attribute__((preserve_most))'}}
-void (*pfoo3)(void *) = foo; // expected-warning {{incompatible function pointer types initializing 'void (*)(void *)' with an expression of type 'void (void *) __attribute__((preserve_most))'}}
+void (__attribute__((cdecl)) *pfoo2)(void *) = foo; // expected-error {{incompatible function pointer types initializing 'void (*)(void *) __attribute__((cdecl))' with an expression of type 'void (void *) __attribute__((preserve_most))'}}
+void (*pfoo3)(void *) = foo; // expected-error {{incompatible function pointer types initializing 'void (*)(void *)' with an expression of type 'void (void *) __attribute__((preserve_most))'}}
 
 typedef_fun_t typedef_fun_foo; // expected-note {{previous declaration is here}}
 void __attribute__((preserve_most)) typedef_fun_foo(int x) { } // expected-error {{function declared 'preserve_most' here was previously declared without calling convention}}
 
 struct type_test_foo {} __attribute__((preserve_most));  // expected-warning {{'preserve_most' attribute only applies to functions and methods}}
 
 void __attribute__((preserve_all)) boo(void *ptr) {
 }
 
 void __attribute__((preserve_all(1))) boo1(void *ptr) { // expected-error {{'preserve_all' attribute takes no arguments}}
 }
 
 void (__attribute__((preserve_all)) *pboo1)(void *) = boo;
 
-void (__attribute__((cdecl)) *pboo2)(void *) = boo; // expected-warning {{incompatible function pointer types initializing 'void (*)(void *) __attribute__((cdecl))' with an expression of type 'void (void *) __attribute__((preserve_all))'}}
-void (*pboo3)(void *) = boo; // expected-warning {{incompatible function pointer types initializing 'void (*)(void *)' with an expression of type 'void (void *) __attribute__((preserve_all))'}}
+void (__attribute__((cdecl)) *pboo2)(void *) = boo; // expected-error {{incompatible function pointer types initializing 'void (*)(void *) __attribute__((cdecl))' with an expression of type 'void (void *) __attribute__((preserve_all))'}}
+void (*pboo3)(void *) = boo; // expected-error {{incompatible function pointer types initializing 'void (*)(void *)' with an expression of type 'void (void *) __attribute__((preserve_all))'}}
 
 typedef_fun_t typedef_fun_boo; // expected-note {{previous declaration is here}}
 void __attribute__((preserve_all)) typedef_fun_boo(int x) { } // expected-error {{function declared 'preserve_all' here was previously declared without calling convention}}
 
 struct type_test_boo {} __attribute__((preserve_all));  // expected-warning {{'preserve_all' attribute only applies to functions and methods}}

clang/test/SemaObjC/comptypes-legal.m

 typedef id FuncSignature (NSObject *arg1, Derived *arg2);
 
 @interface Derived: NSObject
 + (void)registerFunc:(FuncSignature *)function; // expected-note{{passing argument to parameter 'function' here}}
 @end
 
 void foo(void)
 {
-  // GCC currently allows this (it has some fiarly new support for covariant return types and contravariant argument types).
+  // GCC currently allows this (it has some fairly new support for covariant return types and contravariant argument types).
   // Since registerFunc: expects a Derived object as it's second argument, I don't know why this would be legal.
-  [Derived registerFunc: ExternFunc];  // expected-warning{{incompatible function pointer types sending 'NSObject *(NSObject *, NSObject *)' to parameter of type 'FuncSignature *' (aka 'id (*)(NSObject *, Derived *)')}}
+  [Derived registerFunc: ExternFunc];  // expected-error{{incompatible function pointer types sending 'NSObject *(NSObject *, NSObject *)' to parameter of type 'FuncSignature *' (aka 'id (*)(NSObject *, Derived *)')}}
 }
 
 // rdar://10751015
 @protocol NSCopying @end
 @interface I
 - (void) Meth : (id <NSCopying>)aKey; // expected-note {{passing argument to parameter 'aKey' here}}
 @end