Messages in this thread | | | From | Yann Droneaud <> | Date | Mon, 22 Feb 2016 16:24:34 +0100 | Subject | Re: [PATCHv1 1/3] coccinelle: also catch kzfree() issues |
| |
Le lundi 22 février 2016 à 09:20 -0500, Julia Lawall a écrit : > On Mon, 22 Feb 2016, Yann Droneaud wrote: > > > Since commit 3ef0e5ba4673 ('slab: introduce kzfree()'), > > kfree() is no more the only function to be considered. > > > > In particular, kzfree() must not be called on memory > > allocated through devm_*() functions. > > > > Cc: Johannes Weiner <hannes@cmpxchg.org> > > Signed-off-by: Yann Droneaud <ydroneaud@opteya.com> > > --- > > Hi Julia, > > > > As you suggested, I've use disjunctions instead of regular > > expressions (which I managed to use incorrectly: eg. > > without ^...$ they catch other functions than kfree(), > > such as kfree_skb()). > > > > I've think we should also catch krealloc(, size), where size > > is 0, but it's beyond my understanding of coccinelle if size > > is not a plain 0 constant. > > > > Perhaps you could help me for this one. > > Do you have some examples?
I don't have any real world examples (hopefully) and I don't think it's going to catch issues, as it's unlikely someone would write krealloc(ptr, 0) instead of kfree().
> Coccinelle is not very good at tracking > values. You can say something like: > > size = 0 > ... when != size = e > krealloc(...,size) >
It works for the most simple cases I can think of. Thanks a lot !
> I don't know if that would be useful in practice though. >
It will be difficult to shoehorn such construct in the dijunctions added here.
Perhaps we could add a new cocci rules file that would translate such call to krealloc() to kfree():
@@ expression e; expression p; identifier size; @@ size = 0 ... when != size = e - krealloc(p,size) + kfree(p)
@@ expression p; @@ - krealloc(p, 0) + kfree(p)
But I'm not sure it worth it.
> > Regards. > > > > scripts/coccinelle/free/devm_free.cocci | 2 ++ > > scripts/coccinelle/free/kfree.cocci | 18 +++++++++++++++--- > > scripts/coccinelle/free/kfreeaddr.cocci | 6 +++++- > > 3 files changed, 22 insertions(+), 4 deletions(-) > > > > diff --git a/scripts/coccinelle/free/devm_free.cocci > b/scripts/coccinelle/free/devm_free.cocci > > index 3d9349012bb3..83c03adec1c5 100644 > > --- a/scripts/coccinelle/free/devm_free.cocci > > +++ b/scripts/coccinelle/free/devm_free.cocci > > @@ -48,6 +48,8 @@ position p; > > ( > > * kfree@p(x) > > | > > +* kzfree@p(x) > > +| > > * free_irq@p(x) > > | > > * iounmap@p(x) > > diff --git a/scripts/coccinelle/free/kfree.cocci > b/scripts/coccinelle/free/kfree.cocci > > index 577b78056990..ac438da4fd7b 100644 > > --- a/scripts/coccinelle/free/kfree.cocci > > +++ b/scripts/coccinelle/free/kfree.cocci > > @@ -20,7 +20,11 @@ expression E; > > position p1; > > @@ > > > > -kfree@p1(E) > > +( > > +* kfree@p1(E) > > +| > > +* kzfree@p1(E) > > +) > > > > @print expression@ > > constant char [] c; > > @@ -60,7 +64,11 @@ position ok; > > @@ > > > > while (1) { ... > > - kfree@ok(E) > > +( > > +* kfree@ok(E) > > +| > > +* kzfree@ok(E) > > +) > > ... when != break; > > when != goto l; > > when forall > > @@ -74,7 +82,11 @@ statement S; > > position free.p1!=loop.ok,p2!={print.p,sz.p}; > > @@ > > > > -kfree@p1(E,...) > > +( > > +* kfree@p1(E,...) > > +| > > +* kzfree@p1(E,...) > > +) > > ... > > ( > > iter(...,subE,...) S // no use > > diff --git a/scripts/coccinelle/free/kfreeaddr.cocci > b/scripts/coccinelle/free/kfreeaddr.cocci > > index ce8aacc314cb..d46063b1db8b 100644 > > --- a/scripts/coccinelle/free/kfreeaddr.cocci > > +++ b/scripts/coccinelle/free/kfreeaddr.cocci > > @@ -16,7 +16,11 @@ identifier f; > > position p; > > @@ > > > > +( > > * kfree@p(&e->f) > > +| > > +* kzfree@p(&e->f) > > +) > > > > @script:python depends on org@ > > p << r.p; > > @@ -28,5 +32,5 @@ cocci.print_main("kfree",p) > > p << r.p; > > @@ > > > > -msg = "ERROR: kfree of structure field" > > +msg = "ERROR: invalid free of structure field" > > coccilib.report.print_report(p[0],msg) > > -- > > 2.5.0 > > > >
Regards.
-- Yann Droneaud OPTEYA
| |