Messages in this thread | | | Date | Wed, 17 Jun 2020 22:42:58 +0200 (CEST) | From | Julia Lawall <> | Subject | Re: [Cocci] [PATCH v3] coccinelle: api: add kzfree script |
| |
On Mon, 15 Jun 2020, Denis Efremov wrote:
> Check for memset()/memzero_explicit() followed by kfree()/vfree()/kvfree(). > > Signed-off-by: Denis Efremov <efremov@linux.com> > --- > Changes in v2: > - memset_explicit() added > - kvfree_sensitive() added > - forall added to r1 > - ... between memset and kfree added > Changes in v3: > - Explicit filter for definitions instead of !(file in "...") conditions > - type T added to match casts > - memzero_explicit() patterns fixed > - additional rule "cond" added to filter false-positives > > scripts/coccinelle/api/kzfree.cocci | 90 +++++++++++++++++++++++++++++ > 1 file changed, 90 insertions(+) > create mode 100644 scripts/coccinelle/api/kzfree.cocci > > diff --git a/scripts/coccinelle/api/kzfree.cocci b/scripts/coccinelle/api/kzfree.cocci > new file mode 100644 > index 000000000000..4758ca5a781e > --- /dev/null > +++ b/scripts/coccinelle/api/kzfree.cocci > @@ -0,0 +1,90 @@ > +// SPDX-License-Identifier: GPL-2.0-only > +/// > +/// Use kzfree, kvfree_sensitive rather than memset or > +/// memzero_explicit followed by kfree > +/// > +// Confidence: High > +// Copyright: (C) 2020 Denis Efremov ISPRAS > +// Options: --no-includes --include-headers > +// > +// Keywords: kzfree, kvfree_sensitive > +// > + > +virtual context > +virtual patch > +virtual org > +virtual report > + > +@initialize:python@ > +@@ > +# kmalloc_oob_in_memset uses memset to explicitly trigger out-of-bounds access > +filter = frozenset(['kmalloc_oob_in_memset', 'kzfree', 'kvfree_sensitive']) > + > +def relevant(p): > + return not (filter & {el.current_element for el in p}) > + > +@cond@ > +position ok; > +@@ > + > +if (...) > + \(memset@ok\|memzero_explicit@ok\)(...); > + > +@r depends on !patch forall@ > +expression E; > +position p : script:python() { relevant(p) }; > +position m != cond.ok; > +type T; > +@@ > + > +( > +* memset@m((T)E, 0, ...); > +| > +* memzero_explicit@m((T)E, ...); > +) > + ... when != E > + when strict > +* \(kfree\|vfree\|kvfree\)(E)@p; > + > +@rp_memzero depends on patch@ > +expression E, size; > +position p : script:python() { relevant(p) }; > +type T; > +@@ > + > +- memzero_explicit((T)E, size)@p; > + ... when != E > + when strict > +- \(kfree\|vfree\|kvfree\)(E); > ++ kvfree_sensitive(E, size); > + > +@rp_memset depends on patch@ > +expression E, size; > +position p : script:python() { relevant(p) }; > +type T; > +@@ > + > +- memset((T)E, size)@p;
This is missing a 0 argument.
> + ... when != E > + when strict > +( > +- kfree(E); > ++ kzfree(E); > +| > +- \(vfree\|kvfree\)(E); > ++ kvfree_sensitive(E, size); > +)
I'm not sure why you want kzfree in the first case, but kvfree_sensitive in the second case.
julia
> + > +@script:python depends on report@ > +p << r.p; > +@@ > + > +coccilib.report.print_report(p[0], > + "WARNING: opportunity for kzfree/kvfree_sensitive") > + > +@script:python depends on org@ > +p << r.p; > +@@ > + > +coccilib.org.print_todo(p[0], > + "WARNING: opportunity for kzfree/kvfree_sensitive") > -- > 2.26.2 > > _______________________________________________ > Cocci mailing list > Cocci@systeme.lip6.fr > https://systeme.lip6.fr/mailman/listinfo/cocci >
| |