From: Julia Lawall <julia.lawall@inria.fr>
To: Denis Efremov <efremov@linux.com>
Cc: cocci@systeme.lip6.fr, linux-kernel@vger.kernel.org
Subject: Re: [Cocci] [PATCH v3] coccinelle: api: add kzfree script
Date: Wed, 17 Jun 2020 22:42:58 +0200 (CEST) [thread overview]
Message-ID: <alpine.DEB.2.22.394.2006172241551.3083@hadrien> (raw)
In-Reply-To: <20200614215414.40034-1-efremov@linux.com>
On Mon, 15 Jun 2020, Denis Efremov wrote:
> Check for memset()/memzero_explicit() followed by kfree()/vfree()/kvfree().
>
> Signed-off-by: Denis Efremov <efremov@linux.com>
> ---
> Changes in v2:
> - memset_explicit() added
> - kvfree_sensitive() added
> - forall added to r1
> - ... between memset and kfree added
> Changes in v3:
> - Explicit filter for definitions instead of !(file in "...") conditions
> - type T added to match casts
> - memzero_explicit() patterns fixed
> - additional rule "cond" added to filter false-positives
>
> scripts/coccinelle/api/kzfree.cocci | 90 +++++++++++++++++++++++++++++
> 1 file changed, 90 insertions(+)
> create mode 100644 scripts/coccinelle/api/kzfree.cocci
>
> diff --git a/scripts/coccinelle/api/kzfree.cocci b/scripts/coccinelle/api/kzfree.cocci
> new file mode 100644
> index 000000000000..4758ca5a781e
> --- /dev/null
> +++ b/scripts/coccinelle/api/kzfree.cocci
> @@ -0,0 +1,90 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +///
> +/// Use kzfree, kvfree_sensitive rather than memset or
> +/// memzero_explicit followed by kfree
> +///
> +// Confidence: High
> +// Copyright: (C) 2020 Denis Efremov ISPRAS
> +// Options: --no-includes --include-headers
> +//
> +// Keywords: kzfree, kvfree_sensitive
> +//
> +
> +virtual context
> +virtual patch
> +virtual org
> +virtual report
> +
> +@initialize:python@
> +@@
> +# kmalloc_oob_in_memset uses memset to explicitly trigger out-of-bounds access
> +filter = frozenset(['kmalloc_oob_in_memset', 'kzfree', 'kvfree_sensitive'])
> +
> +def relevant(p):
> + return not (filter & {el.current_element for el in p})
> +
> +@cond@
> +position ok;
> +@@
> +
> +if (...)
> + \(memset@ok\|memzero_explicit@ok\)(...);
> +
> +@r depends on !patch forall@
> +expression E;
> +position p : script:python() { relevant(p) };
> +position m != cond.ok;
> +type T;
> +@@
> +
> +(
> +* memset@m((T)E, 0, ...);
> +|
> +* memzero_explicit@m((T)E, ...);
> +)
> + ... when != E
> + when strict
> +* \(kfree\|vfree\|kvfree\)(E)@p;
> +
> +@rp_memzero depends on patch@
> +expression E, size;
> +position p : script:python() { relevant(p) };
> +type T;
> +@@
> +
> +- memzero_explicit((T)E, size)@p;
> + ... when != E
> + when strict
> +- \(kfree\|vfree\|kvfree\)(E);
> ++ kvfree_sensitive(E, size);
> +
> +@rp_memset depends on patch@
> +expression E, size;
> +position p : script:python() { relevant(p) };
> +type T;
> +@@
> +
> +- memset((T)E, size)@p;
This is missing a 0 argument.
> + ... when != E
> + when strict
> +(
> +- kfree(E);
> ++ kzfree(E);
> +|
> +- \(vfree\|kvfree\)(E);
> ++ kvfree_sensitive(E, size);
> +)
I'm not sure why you want kzfree in the first case, but kvfree_sensitive
in the second case.
julia
> +
> +@script:python depends on report@
> +p << r.p;
> +@@
> +
> +coccilib.report.print_report(p[0],
> + "WARNING: opportunity for kzfree/kvfree_sensitive")
> +
> +@script:python depends on org@
> +p << r.p;
> +@@
> +
> +coccilib.org.print_todo(p[0],
> + "WARNING: opportunity for kzfree/kvfree_sensitive")
> --
> 2.26.2
>
> _______________________________________________
> Cocci mailing list
> Cocci@systeme.lip6.fr
> https://systeme.lip6.fr/mailman/listinfo/cocci
>
next prev parent reply other threads:[~2020-06-17 20:43 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-04 14:08 [PATCH] coccinelle: api: add kzfree script Denis Efremov
2020-06-04 14:15 ` Julia Lawall
2020-06-04 15:39 ` Denis Efremov
2020-06-04 15:51 ` Julia Lawall
2020-06-04 17:22 ` Denis Efremov
2020-06-04 17:28 ` Julia Lawall
2020-06-04 16:27 ` Joe Perches
2020-06-04 17:30 ` Denis Efremov
2020-06-04 17:36 ` Joe Perches
2020-06-14 19:42 ` Denis Efremov
2020-06-14 20:01 ` Joe Perches
2020-06-15 12:03 ` Dan Carpenter
2020-06-15 13:51 ` Denis Efremov
2020-06-04 20:48 ` [PATCH v2] " Denis Efremov
2020-06-04 20:57 ` [Cocci] " Julia Lawall
2020-06-04 21:03 ` Denis Efremov
2020-06-04 21:25 ` Denis Efremov
2020-06-06 8:16 ` Julia Lawall
2020-06-14 21:54 ` [PATCH v3] " Denis Efremov
2020-06-17 20:42 ` Julia Lawall [this message]
2020-06-17 21:42 ` [Cocci] " Denis Efremov
2020-07-07 21:35 ` Julia Lawall
2020-07-17 11:57 ` [PATCH v4] " Denis Efremov
2020-07-17 20:39 ` Julia Lawall
2020-08-10 23:45 ` Eric Biggers
2020-08-11 7:12 ` Denis Efremov
2020-08-11 7:49 ` [PATCH] coccinelle: api: update kzfree script to kfree_sensitive Denis Efremov
2020-08-26 8:12 ` Denis Efremov
2020-09-12 15:08 ` Julia Lawall
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.22.394.2006172241551.3083@hadrien \
--to=julia.lawall@inria.fr \
--cc=cocci@systeme.lip6.fr \
--cc=efremov@linux.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).