cocci.inria.fr archive mirror
 help / color / mirror / Atom feed
From: Denis Efremov <efremov@linux.com>
To: Julia Lawall <julia.lawall@inria.fr>
Cc: cocci@systeme.lip6.fr, linux-kernel@vger.kernel.org
Subject: Re: [Cocci] [PATCH] coccinelle: api: add kzfree script
Date: Thu, 4 Jun 2020 20:22:13 +0300	[thread overview]
Message-ID: <65dee3e0-7df9-5b38-fe4c-5de3f70380a0@linux.com> (raw)
In-Reply-To: <alpine.DEB.2.21.2006041749520.2577@hadrien>

> Could you send an example of some C code on which the result is not
> suitable?

I've updated the pattern to handle false positives:

@ifok@
position p;
expression *E;
@@

(
  if (...) {
    ...
    memset(E, 0, ...)@p;
    ...
  }
|
  if (...) {
    ...
  } else {
    ...
    memset(E, 0, ...)@p;
    ...
  }
)

// Ignore kzfree definition
// Ignore kasan test
@r depends on !patch && !(file in "lib/test_kasan.c") && !(file in "mm/slab_common.c")@
expression *E;
position p != ifok.p;
@@

* memset(E, 0, ...)@p;
  ... when != E
      when != if (...) { ... E ... }
      when != for (...;...;...) { ... E ... }
      when != while (...) { ... E ... }
      when strict
* kfree(E);


Example of false positives:

void test_memset_under_if(void)
{
   char *p = malloc(10, GFP_KERNEL);
   if (p % 5) {
      p[5] = 1;
   } else {
      memset(p, 0, 10);
   }
   kfree(p);
}

void test_memset_under_if(void)
{
   int i;
   char *p = malloc(10, GFP_KERNEL);
   for (i = 0; i < 10; ++i) {
      memset(p, 0, 10);
   }
   kfree(p);
}

void test_E_in_if(void)
{
   char *p = malloc(10, GFP_KERNEL);
   memset(p, 0, 10); // when != E is not enough
   if (10) {        // when != if (...) { ... E ... } is required
      p[5] = 1;
   }
   kfree(p);
}

void test_E_in_for(void)
{
   char *p = malloc(10, GFP_KERNEL);
   memset(p, 0, 10);
   for(;;) {
      p[5] = 1;
   }
   kfree(p);
}

void test_E_in_while(void)
{
   char *p = malloc(10, GFP_KERNEL);
   memset(p, 0, 10);
   while(1) {
      p[6] = 2;
   }
   kfree(p);
}

void test_E_in_struct(void)
{
   struct t { int a[3]; };
   struct t *p = malloc(10 * sizeof(struct(struct t)), GFP_KERNEL);
   memset(p, 0, 10);
   for(;;) {
      if (1) {
        p->a[2] = 1; // I give up on this
        p->a[0] = 10;
      }
   }
   kfree(p);
}

After all it seems reasonable to me to add forall and memset_explicit rather
than handle all these false positives. Something like this for v2?

@r depends on !patch && !(file in "lib/test_kasan.c") && !(file in "mm/slab_common.c") forall@
expression *E;
position p;
@@

* \(memset\|memset_explicit\)(E, 0, ...);
  ... when != E
* kfree(E)@p;

Do I need to add "when strict" with forall or it's already enabled in this case?
Do I need to enable forall for pathing "-/+"?

Thanks,
Denis
_______________________________________________
Cocci mailing list
Cocci@systeme.lip6.fr
https://systeme.lip6.fr/mailman/listinfo/cocci

  reply	other threads:[~2020-06-04 17:22 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-04 14:08 [Cocci] [PATCH] coccinelle: api: add kzfree script Denis Efremov
2020-06-04 14:15 ` Julia Lawall
2020-06-04 15:39   ` Denis Efremov
2020-06-04 15:51     ` Julia Lawall
2020-06-04 17:22       ` Denis Efremov [this message]
2020-06-04 17:28         ` Julia Lawall
2020-06-04 16:27 ` Joe Perches
2020-06-04 17:30   ` Denis Efremov
2020-06-04 17:36     ` Joe Perches
2020-06-14 19:42   ` Denis Efremov
2020-06-14 20:01     ` Joe Perches
2020-06-15 12:03     ` Dan Carpenter
2020-06-15 13:51       ` Denis Efremov
2020-06-04 20:48 ` [Cocci] [PATCH v2] " Denis Efremov
2020-06-04 20:57   ` Julia Lawall
2020-06-04 21:03     ` Denis Efremov
2020-06-04 21:25     ` Denis Efremov
2020-06-06  8:16       ` Julia Lawall
2020-06-14 21:54 ` [Cocci] [PATCH v3] " Denis Efremov
2020-06-17 20:42   ` Julia Lawall
2020-06-17 21:42     ` Denis Efremov
2020-07-07 21:35   ` Julia Lawall
2020-07-17 11:57 ` [Cocci] [PATCH v4] " Denis Efremov
2020-07-17 20:39   ` Julia Lawall
2020-08-10 23:45     ` Eric Biggers
2020-08-11  7:12       ` Denis Efremov
2020-08-11  7:49 ` [Cocci] [PATCH] coccinelle: api: update kzfree script to kfree_sensitive Denis Efremov
2020-08-26  8:12   ` Denis Efremov
2020-09-12 15:08   ` Julia Lawall
2020-06-04 15:20 [Cocci] [PATCH] coccinelle: api: add kzfree script Markus Elfring
2020-06-04 15:56 ` Julia Lawall

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=65dee3e0-7df9-5b38-fe4c-5de3f70380a0@linux.com \
    --to=efremov@linux.com \
    --cc=cocci@systeme.lip6.fr \
    --cc=julia.lawall@inria.fr \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).