[cocci] Detecting misused expressions with SmPL?

[cocci] Detecting misused expressions with SmPL?

[Markus Elfring]

Hello,

I noticed another contribution by Dan Carpenter.

[PATCH 1/2] iio: adc: ti-ads1298: Fix error code in probe()
https://lore.kernel.org/lkml/5f393a87-ca8b-4e68-a6f4-a79f75a91ccb@moroto.mountain/
https://lkml.org/lkml/2024/2/22/175


I became curious how good such a known source code search pattern
could be expressed by the means of the semantic patch language
also together with the software combination “Coccinelle 1.1.1-00739-g68c580f1”
for the implementation of a function like “ads1298_probe”.
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/log/drivers/iio/adc/ti-ads1298.c

Unfortunately, I stumble on the following test result for another
small SmPL script.


@find@
expression e;
position p;
@@
 if (IS_ERR(e))
 {
    if@p (PTR_ERR(e) != -ENODEV)
    {
       ... when != e
       ;
    }
    ...
 }

@display@
position find.p;
@@
 if@p (...)
 {
*     ...
      ;
 }


Markus_Elfring@Sonne:…/Projekte/Coccinelle/janitor> spatch --parse-cocci show_questionable_PTR_ERR_usage.cocci
…
No rules apply.  Perhaps your semantic patch doesn't contain any +/-/* code, or you have a failed dependency.  If the problem is not clear, try --debug-parse-cocci.


I observed that help information is displayed instead of a corresponding
representation of debug data if I try the mentioned program parameter out.

Will there any further software improvements become possible?

Regards,
Markus

Re: [cocci] Detecting misused expressions with SmPL?

[Julia Lawall]

[-- Attachment #1: Type: text/plain, Size: 1717 bytes --]



On Thu, 22 Feb 2024, Markus Elfring wrote:

> Hello,
>
> I noticed another contribution by Dan Carpenter.
>
> [PATCH 1/2] iio: adc: ti-ads1298: Fix error code in probe()
> https://lore.kernel.org/lkml/5f393a87-ca8b-4e68-a6f4-a79f75a91ccb@moroto.mountain/
> https://lkml.org/lkml/2024/2/22/175
>
>
> I became curious how good such a known source code search pattern
> could be expressed by the means of the semantic patch language
> also together with the software combination “Coccinelle 1.1.1-00739-g68c580f1”
> for the implementation of a function like “ads1298_probe”.
> https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/log/drivers/iio/adc/ti-ads1298.c
>
> Unfortunately, I stumble on the following test result for another
> small SmPL script.
>
>
> @find@
> expression e;
> position p;
> @@
>  if (IS_ERR(e))
>  {
>     if@p (PTR_ERR(e) != -ENODEV)
>     {
>        ... when != e
>        ;
>     }
>     ...
>  }
>
> @display@
> position find.p;
> @@
>  if@p (...)
>  {
> *     ...
>       ;
>  }
>
>
> Markus_Elfring@Sonne:…/Projekte/Coccinelle/janitor> spatch --parse-cocci show_questionable_PTR_ERR_usage.cocci
> …
> No rules apply.  Perhaps your semantic patch doesn't contain any +/-/* code, or you have a failed dependency.  If the problem is not clear, try --debug-parse-cocci.
>
>
> I observed that help information is displayed instead of a corresponding
> representation of debug data if I try the mentioned program parameter out.
>
> Will there any further software improvements become possible?

What do you expect the ... with the * in front of it to match?  I think it
will match a single expression.

The fact that no * is detected does seem like a problem.

julia

Re: [cocci] Detecting misused expressions with SmPL?

[Markus Elfring]

> What do you expect the ... with the * in front of it to match?

I hope that the application of a SmPL asterisk can point a bit of source code out
for further development considerations also at this place.


> I think it will match a single expression.

It is expected that a questionable passed parameter to a call of
the function “PTR_ERR” should be presented.
But I do not want to exclude the possibility that more source code
would be similarly affected as mentioned in the published patch.

Unfortunately, it seems that the shown SmPL code exclusion needs to be enclosed by
curly brackets so far.
I am unsure how a single statement like “return dev_err_probe(…);”
could be matched then (without repeating it explicitly).


> The fact that no * is detected does seem like a problem.

I would appreciate adjustments accordingly.

Regards,
Markus

Re: [cocci] Detecting misused expressions with SmPL?

[Markus Elfring]

> What do you expect the ... with the * in front of it to match?

Would you get further development ideas from the comparison with the following
SmPL script variant?


@find@
expression e, x;
position p;
statement s;
@@
 if@p (PTR_ERR(e) != -ENODEV)
(     return ... (..., PTR_ERR(x), ...);
&     s
)

@display@
expression find.e != find.x;
position find.p;
statement find.s;
@@
 if@p (PTR_ERR(e) != -ENODEV)
*     s


Markus_Elfring@Sonne:…/Projekte/Linux/next-analyses> git checkout next-20240221 && time spatch drivers/iio/adc/ti-ads1298.c …/Projekte/Coccinelle/janitor/show_questionable_PTR_ERR_usage2.cocci
…
real    0m0,208s
user    0m0,184s
sys     0m0,017s


Regards,
Markus

Re: [cocci] Detecting misused expressions with SmPL?

[Markus Elfring]

> Would you get further development ideas from the comparison with the following
> SmPL script variant?
…
> @display@
> expression find.e != find.x;
…

Markus_Elfring@Sonne:…/Projekte/Linux/next-analyses> git checkout next-20240221 && spatch drivers/remoteproc/qcom_q6v5.c …/Projekte/Coccinelle/janitor/show_questionable_PTR_ERR_usage2.cocci
…
@@ -333,8 +333,6 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v
        q6v5->qmp = qmp_get(&pdev->dev);
        if (IS_ERR(q6v5->qmp)) {
                if (PTR_ERR(q6v5->qmp) != -ENODEV)
-                       return dev_err_probe(&pdev->dev, PTR_ERR(q6v5->qmp),
-                                            "failed to acquire load state\n");
                q6v5->qmp = NULL;
        } else if (!q6v5->load_state) {
                if (!load_state)


How does such a diff output fit to the specified SmPL constraint?

Regards,
Markus

Re: [cocci] Searching for code within block by SmPL ellipsis?

[Markus Elfring]

> The fact that no * is detected does seem like a problem.

Will variations of a source code search approach (like the following)
including the usage of a combination of SmPL asterisk and ellipsis
between curly brackets become supported?

@display@
@@
 {
* ...
  ;
 }


Regards,
Markus

Re: [cocci] Searching for code within block by SmPL ellipsis?

[Julia Lawall]

On Sun, 25 Feb 2024, Markus Elfring wrote:

> > The fact that no * is detected does seem like a problem.
>
> Will variations of a source code search approach (like the following)
> including the usage of a combination of SmPL asterisk and ellipsis
> between curly brackets become supported?
>
> @display@
> @@
>  {
> * ...
>   ;
>  }

Thank you for the smaller example.

julia