Re: [PATCHv1 1/3] coccinelle: also catch kzfree() issues

[Yann Droneaud]

Le lundi 22 fÃvrier 2016 Ã 09:20 -0500, Julia Lawall a ÃcritÂ:
> On Mon, 22 Feb 2016, Yann Droneaud wrote:
> 
> > Since commit 3ef0e5ba4673 ('slab: introduce kzfree()'),
> > kfree() is no more the only function to be considered.
> >
> > In particular, kzfree() must not be called on memory
> > allocated through devm_*() functions.
> >
> > Cc: Johannes Weiner <hannes@xxxxxxxxxxx>
> > Signed-off-by: Yann Droneaud <ydroneaud@xxxxxxxxxx>
> > ---
> > Hi Julia,
> >
> > As you suggested, I've use disjunctions instead of regular
> > expressions (which I managed to use incorrectly: eg.
> > without ^...$ they catch other functions than kfree(),
> > such as kfree_skb()).
> >
> > I've think we should also catch krealloc(, size), where size
> > is 0, but it's beyond my understanding of coccinelle if size
> > is not a plain 0 constant.
> >
> > Perhaps you could help me for this one.
> 
> Do you have some examples?

I don't have any real world examples (hopefully) and I don't think it's
going to catch issues, as it's unlikely someone would write
krealloc(ptr, 0) instead of kfree().

> Â Coccinelle is not very good at tracking
> values. You can say something like:
> 
> size = 0
> ... when != size = e
> krealloc(...,size)
> 

It works for the most simple cases I can think of. Thanks a lot !

> I don't know if that would be useful in practice though.
> 

It will be difficult to shoehorn such construct in the dijunctions
added here.

Perhaps we could add a new cocci rules file that would translate such
call to krealloc() to kfree():

@@
expression e;
expression p;
identifier size;
@@
 size = 0
 ... when != size = e
-ÂÂkrealloc(p,size)
+ÂÂkfree(p)


@@
expression p;
@@
-ÂÂkrealloc(p, 0)
+ÂÂkfree(p)

But I'm not sure it worth it.

> > Regards.
> >
> >Â scripts/coccinelle/free/devm_free.cocci |Â 2 ++
> >Â scripts/coccinelle/free/kfree.cocciÂÂÂÂ | 18 +++++++++++++++---
> >Â scripts/coccinelle/free/kfreeaddr.cocci |Â 6 +++++-
> >Â 3 files changed, 22 insertions(+), 4 deletions(-)
> >
> > diff --git a/scripts/coccinelle/free/devm_free.cocci
> b/scripts/coccinelle/free/devm_free.cocci
> > index 3d9349012bb3..83c03adec1c5 100644
> > --- a/scripts/coccinelle/free/devm_free.cocci
> > +++ b/scripts/coccinelle/free/devm_free.cocci
> > @@ -48,6 +48,8 @@ position p;
> >Â (
> >Â * kfree@p(x)
> >Â |
> > +* kzfree@p(x)
> > +|
> >Â * free_irq@p(x)
> >Â |
> >Â * iounmap@p(x)
> > diff --git a/scripts/coccinelle/free/kfree.cocci
> b/scripts/coccinelle/free/kfree.cocci
> > index 577b78056990..ac438da4fd7b 100644
> > --- a/scripts/coccinelle/free/kfree.cocci
> > +++ b/scripts/coccinelle/free/kfree.cocci
> > @@ -20,7 +20,11 @@ expression E;
> >Â position p1;
> >Â @@
> >
> > -kfree@p1(E)
> > +(
> > +* kfree@p1(E)
> > +|
> > +* kzfree@p1(E)
> > +)
> >
> >Â @print expression@
> >Â constant char [] c;
> > @@ -60,7 +64,11 @@ position ok;
> >Â @@
> >
> >Â while (1) { ...
> > -Â kfree@ok(E)
> > +(
> > +* kfree@ok(E)
> > +|
> > +* kzfree@ok(E)
> > +)
> >ÂÂÂ ... when != break;
> >ÂÂÂÂÂÂÂ when != goto l;
> >ÂÂÂÂÂÂÂ when forall
> > @@ -74,7 +82,11 @@ statement S;
> >Â position free.p1!=loop.ok,p2!={print.p,sz.p};
> >Â @@
> >
> > -kfree@p1(E,...)
> > +(
> > +* kfree@p1(E,...)
> > +|
> > +* kzfree@p1(E,...)
> > +)
> >Â ...
> >Â (
> >ÂÂ iter(...,subE,...) S // no use
> > diff --git a/scripts/coccinelle/free/kfreeaddr.cocci
> b/scripts/coccinelle/free/kfreeaddr.cocci
> > index ce8aacc314cb..d46063b1db8b 100644
> > --- a/scripts/coccinelle/free/kfreeaddr.cocci
> > +++ b/scripts/coccinelle/free/kfreeaddr.cocci
> > @@ -16,7 +16,11 @@ identifier f;
> >Â position p;
> >Â @@
> >
> > +(
> >Â * kfree@p(&e->f)
> > +|
> > +* kzfree@p(&e->f)
> > +)
> >
> >Â @script:python depends on org@
> >Â p << r.p;
> > @@ -28,5 +32,5 @@ cocci.print_main("kfree",p)
> >Â p << r.p;
> >Â @@
> >
> > -msg = "ERROR: kfree of structure field"
> > +msg = "ERROR: invalid free of structure field"
> >Â coccilib.report.print_report(p[0],msg)
> > --
> > 2.5.0
> >
> >

Regards.

--Â
Yann Droneaud
OPTEYA