From: Denis Efremov <efremov@linux.com>
To: Julia Lawall <julia.lawall@inria.fr>
Cc: cocci@systeme.lip6.fr, linux-kernel@vger.kernel.org
Subject: Re: [Cocci] [PATCH] coccinelle: api: add kzfree script
Date: Thu, 4 Jun 2020 20:22:13 +0300 [thread overview]
Message-ID: <65dee3e0-7df9-5b38-fe4c-5de3f70380a0@linux.com> (raw)
In-Reply-To: <alpine.DEB.2.21.2006041749520.2577@hadrien>
> Could you send an example of some C code on which the result is not
> suitable?
I've updated the pattern to handle false positives:
@ifok@
position p;
expression *E;
@@
(
if (...) {
...
memset(E, 0, ...)@p;
...
}
|
if (...) {
...
} else {
...
memset(E, 0, ...)@p;
...
}
)
// Ignore kzfree definition
// Ignore kasan test
@r depends on !patch && !(file in "lib/test_kasan.c") && !(file in "mm/slab_common.c")@
expression *E;
position p != ifok.p;
@@
* memset(E, 0, ...)@p;
... when != E
when != if (...) { ... E ... }
when != for (...;...;...) { ... E ... }
when != while (...) { ... E ... }
when strict
* kfree(E);
Example of false positives:
void test_memset_under_if(void)
{
char *p = malloc(10, GFP_KERNEL);
if (p % 5) {
p[5] = 1;
} else {
memset(p, 0, 10);
}
kfree(p);
}
void test_memset_under_if(void)
{
int i;
char *p = malloc(10, GFP_KERNEL);
for (i = 0; i < 10; ++i) {
memset(p, 0, 10);
}
kfree(p);
}
void test_E_in_if(void)
{
char *p = malloc(10, GFP_KERNEL);
memset(p, 0, 10); // when != E is not enough
if (10) { // when != if (...) { ... E ... } is required
p[5] = 1;
}
kfree(p);
}
void test_E_in_for(void)
{
char *p = malloc(10, GFP_KERNEL);
memset(p, 0, 10);
for(;;) {
p[5] = 1;
}
kfree(p);
}
void test_E_in_while(void)
{
char *p = malloc(10, GFP_KERNEL);
memset(p, 0, 10);
while(1) {
p[6] = 2;
}
kfree(p);
}
void test_E_in_struct(void)
{
struct t { int a[3]; };
struct t *p = malloc(10 * sizeof(struct(struct t)), GFP_KERNEL);
memset(p, 0, 10);
for(;;) {
if (1) {
p->a[2] = 1; // I give up on this
p->a[0] = 10;
}
}
kfree(p);
}
After all it seems reasonable to me to add forall and memset_explicit rather
than handle all these false positives. Something like this for v2?
@r depends on !patch && !(file in "lib/test_kasan.c") && !(file in "mm/slab_common.c") forall@
expression *E;
position p;
@@
* \(memset\|memset_explicit\)(E, 0, ...);
... when != E
* kfree(E)@p;
Do I need to add "when strict" with forall or it's already enabled in this case?
Do I need to enable forall for pathing "-/+"?
Thanks,
Denis
_______________________________________________
Cocci mailing list
Cocci@systeme.lip6.fr
https://systeme.lip6.fr/mailman/listinfo/cocci
next prev parent reply other threads:[~2020-06-04 17:22 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-04 14:08 [Cocci] [PATCH] coccinelle: api: add kzfree script Denis Efremov
2020-06-04 14:15 ` Julia Lawall
2020-06-04 15:39 ` Denis Efremov
2020-06-04 15:51 ` Julia Lawall
2020-06-04 17:22 ` Denis Efremov [this message]
2020-06-04 17:28 ` Julia Lawall
2020-06-04 16:27 ` Joe Perches
2020-06-04 17:30 ` Denis Efremov
2020-06-04 17:36 ` Joe Perches
2020-06-14 19:42 ` Denis Efremov
2020-06-14 20:01 ` Joe Perches
2020-06-15 12:03 ` Dan Carpenter
2020-06-15 13:51 ` Denis Efremov
2020-06-04 20:48 ` [Cocci] [PATCH v2] " Denis Efremov
2020-06-04 20:57 ` Julia Lawall
2020-06-04 21:03 ` Denis Efremov
2020-06-04 21:25 ` Denis Efremov
2020-06-06 8:16 ` Julia Lawall
2020-06-14 21:54 ` [Cocci] [PATCH v3] " Denis Efremov
2020-06-17 20:42 ` Julia Lawall
2020-06-17 21:42 ` Denis Efremov
2020-07-07 21:35 ` Julia Lawall
2020-07-17 11:57 ` [Cocci] [PATCH v4] " Denis Efremov
2020-07-17 20:39 ` Julia Lawall
2020-08-10 23:45 ` Eric Biggers
2020-08-11 7:12 ` Denis Efremov
2020-08-11 7:49 ` [Cocci] [PATCH] coccinelle: api: update kzfree script to kfree_sensitive Denis Efremov
2020-08-26 8:12 ` Denis Efremov
2020-09-12 15:08 ` Julia Lawall
2020-06-04 15:20 [Cocci] [PATCH] coccinelle: api: add kzfree script Markus Elfring
2020-06-04 15:56 ` Julia Lawall
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=65dee3e0-7df9-5b38-fe4c-5de3f70380a0@linux.com \
--to=efremov@linux.com \
--cc=cocci@systeme.lip6.fr \
--cc=julia.lawall@inria.fr \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).