[Cocci] linux: bad logic in repetitive tests

[Cocci] linux: bad logic in repetitive tests

[Joe Perches]

There is a block of if tests against the same variable
in include/linux/mtd/pfow.h that likely is defective

        if (prog_status & 0x3)
                ...
        else if (prog_status & 0x2)
                ...
        else (prog_status & 0x1)
                ...

If the first test is true the subsequent 2 tests aren't
possible.

Likely the first test should be something like

	if ((prog_status & 0x03) == 0x03)

Is there a way for cocci to find this style of bitwise
logic defect?



_______________________________________________
Cocci mailing list
Cocci@systeme.lip6.fr
https://systeme.lip6.fr/mailman/listinfo/cocci

Re: [Cocci] linux: bad logic in repetitive tests

[Julia Lawall]

On Mon, 30 Mar 2020, Joe Perches wrote:

> There is a block of if tests against the same variable
> in include/linux/mtd/pfow.h that likely is defective
>
>         if (prog_status & 0x3)
>                 ...
>         else if (prog_status & 0x2)
>                 ...
>         else (prog_status & 0x1)
>                 ...
>
> If the first test is true the subsequent 2 tests aren't
> possible.
>
> Likely the first test should be something like
>
> 	if ((prog_status & 0x03) == 0x03)
>
> Is there a way for cocci to find this style of bitwise
> logic defect?

I guess this occurs rarely enough that just looking for a succession of
bit and tests on the same variable would be good enough to narrow it down
to something manageable to check by hand.  It could also be possible to
use python.ocaml to actually check the extracted bits, but that could be
more work than is useful, if there are not many occurrences.

julia
_______________________________________________
Cocci mailing list
Cocci@systeme.lip6.fr
https://systeme.lip6.fr/mailman/listinfo/cocci

Re: [Cocci] linux: bad logic in repetitive tests

[Joe Perches]

On Tue, 2020-03-31 at 10:50 +0200, Julia Lawall wrote:
> On Mon, 30 Mar 2020, Joe Perches wrote:
> 
> > There is a block of if tests against the same variable
> > in include/linux/mtd/pfow.h that likely is defective
> > 
> >         if (prog_status & 0x3)
> >                 ...
> >         else if (prog_status & 0x2)
> >                 ...
> >         else (prog_status & 0x1)
> >                 ...
> > 
> > If the first test is true the subsequent 2 tests aren't
> > possible.
> > 
> > Likely the first test should be something like
> > 
> > 	if ((prog_status & 0x03) == 0x03)
> > 
> > Is there a way for cocci to find this style of bitwise
> > logic defect?
> 
> I guess this occurs rarely enough that just looking for a succession of
> bit and tests on the same variable would be good enough to narrow it down
> to something manageable to check by hand.

I suppose, but I think misuse of the and'ed bits
by #define is the most likely defect as it's
very difficult to verify visually.

Hard to otherwise quantify.

_______________________________________________
Cocci mailing list
Cocci@systeme.lip6.fr
https://systeme.lip6.fr/mailman/listinfo/cocci

Re: [Cocci] linux: bad logic in repetitive tests

[Julia Lawall]

On Tue, 31 Mar 2020, Joe Perches wrote:

> On Tue, 2020-03-31 at 10:50 +0200, Julia Lawall wrote:
> > On Mon, 30 Mar 2020, Joe Perches wrote:
> >
> > > There is a block of if tests against the same variable
> > > in include/linux/mtd/pfow.h that likely is defective
> > >
> > >         if (prog_status & 0x3)
> > >                 ...
> > >         else if (prog_status & 0x2)
> > >                 ...
> > >         else (prog_status & 0x1)
> > >                 ...
> > >
> > > If the first test is true the subsequent 2 tests aren't
> > > possible.
> > >
> > > Likely the first test should be something like
> > >
> > > 	if ((prog_status & 0x03) == 0x03)
> > >
> > > Is there a way for cocci to find this style of bitwise
> > > logic defect?
> >
> > I guess this occurs rarely enough that just looking for a succession of
> > bit and tests on the same variable would be good enough to narrow it down
> > to something manageable to check by hand.
>
> I suppose, but I think misuse of the and'ed bits
> by #define is the most likely defect as it's
> very difficult to verify visually.
>
> Hard to otherwise quantify.

OK, I see that the pattern of a sequence of bit ands is actually quite
common.  It should be possible to make something more automatic.

julia
_______________________________________________
Cocci mailing list
Cocci@systeme.lip6.fr
https://systeme.lip6.fr/mailman/listinfo/cocci