From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932799AbbI1Kzd (ORCPT ); Mon, 28 Sep 2015 06:55:33 -0400 Received: from mailout3.w1.samsung.com ([210.118.77.13]:49746 "EHLO mailout3.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932721AbbI1Kzb (ORCPT ); Mon, 28 Sep 2015 06:55:31 -0400 X-AuditID: cbfec7f4-f79c56d0000012ee-57-56091ca01551 From: Andrzej Hajda To: julia.lawall@lip6.fr Cc: Andrzej Hajda , Bartlomiej Zolnierkiewicz , Marek Szyprowski , Gilles Muller , Michal Marek , Nicolas Palix , kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org, cocci@systeme.lip6.fr, elfring@users.sourceforge.net Subject: [PATCH v2] coccinelle: assign signed result to unsigned variable Date: Mon, 28 Sep 2015 12:54:47 +0200 Message-id: <1443437687-16559-1-git-send-email-a.hajda@samsung.com> X-Mailer: git-send-email 1.9.1 In-reply-to: References: X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrPLMWRmVeSWpSXmKPExsVy+t/xq7oLZDjDDL5flLO4te4cq8XGGetZ LX5sWs1mcb5zObPF7J+XmCyWPTjNaLH1lrTF5V1z2CzWHrnLbjGndRabxbGXy5kcuD2OHWtl 9ti7Jcujb8sqRo/1W66yeDxadp/Fo+lUO6vH501yAexRXDYpqTmZZalF+nYJXBlzTnUwF5yU rLj6Yi9bA+N20S5GTg4JAROJPatvMkPYYhIX7q1n62Lk4hASWMoocfj1fCaQhJBAE5PEuS0O IDabgKbE38032UBsEQEJiadX5oI1MAv8ZJJ4vf0LK0hCWMBTYvX1GWBTWQRUJS5+nQpkc3Dw CjhLzJ6aDbFMTuLksclg5ZwClhKzz69jgdhlIXHp3nfWCYy8CxgZVjGKppYmFxQnpeca6hUn 5haX5qXrJefnbmKEBOOXHYyLj1kdYhTgYFTi4Z2hzhEmxJpYVlyZe4hRgoNZSYTXSZQzTIg3 JbGyKrUoP76oNCe1+BCjNAeLkjjv3F3vQ4QE0hNLUrNTUwtSi2CyTBycUg2M3e4L45i+FhfV rGBvPVPIU9W2RGDFvJWbuX/uCo+uT1+adj2+JWKC9gTzf3U9LbsTt8d7OnhyLw3SqXSfIHd9 hoVT4Yfty+45nNd7Jhl9u83uwrV/JlHOpw6vXfNI6mjcd/OnpRtdHxt0xHI/3tq3ReviGxPn q1Nfudmub+1YUur9d7lK6PFdSizFGYmGWsxFxYkAp7NFQ0ICAAA= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Assigning signed function result to unsigned variable can indicate error. To decrease number of false positives patch looks if after assignment there is also check for negative values of the result. Signed-off-by: Andrzej Hajda --- Hi Julia, Thanks for the hint. Now it looks much better. Summarizing this patch has found 20 problems and has 22 false positives [1][2]. unsigned_lesser_than_zero.cocci patch posted earlier has found 40 problems [3][4], and about 80 false positives if I remember correctly. Few patches were rejected, as developers likes code for testing variable range, even if its result is always true/false [5][6], but most of kernel patches are real bug fixes. Both patches tries to address similar issues, maybe it would be good to merge them? Especially as their results overlap. Additionally I thought about adding detecting range checks in unsigned_lesser_than_zero.cocci, to decrease number of false positives. Of course it could then miss real bugs. What do you think about it? [1]: http://permalink.gmane.org/gmane.linux.kernel/2046131 [2]: http://permalink.gmane.org/gmane.linux.kernel/2048070 [3]: http://permalink.gmane.org/gmane.comp.freedesktop.xorg.drivers.intel/70031 [4]: http://permalink.gmane.org/gmane.linux.power-management.general/66143 [5]: http://permalink.gmane.org/gmane.linux.kernel.mm/138902 [6]: http://libdivecomputer.org/pipermail/devel/2014-July/000329.html Regards Andrzej --- .../tests/assign_signed_to_unsigned.cocci | 45 ++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 scripts/coccinelle/tests/assign_signed_to_unsigned.cocci diff --git a/scripts/coccinelle/tests/assign_signed_to_unsigned.cocci b/scripts/coccinelle/tests/assign_signed_to_unsigned.cocci new file mode 100644 index 0000000..efa4e83 --- /dev/null +++ b/scripts/coccinelle/tests/assign_signed_to_unsigned.cocci @@ -0,0 +1,45 @@ +/// Assigning signed function result to unsigned variable can indicate error. +/// To decrease number of false positives patch looks if after assignment +/// there is also check for negative values of the result. +/// +// Confidence: High +// Copyright: (C) 2015 Andrzej Hajda, Samsung Electronics Co., Ltd. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Options: --include-headers --all-includes + +virtual context +virtual org +virtual report + +@r@ +typedef bool, u8, u16, u32, u64, s8, s16, s32, s64; +{char, short, int, long, long long, s8, s16, s32, s64} vs; +{unsigned char, unsigned short, unsigned int, unsigned long, unsigned long long, + size_t, bool, u8, u16, u32, u64} vu; +position p; +identifier f; +statement S1, S2; +expression e; +@@ + +*vu@p = f(...)@vs; +... when != vu = e; +if ( \( vu < 0 \| vu <= 0 \) ) S1 else S2 + +@script:python depends on r && org@ +p << r.p; +f << r.f; +vu << r.vu; +@@ + +msg = "WARNING: Assigning signed result to unsigned variable: %s = %s(...)" % (vu, f) +coccilib.org.print_todo(p[0], msg) + +@script:python depends on r && report@ +p << r.p; +f << r.f; +vu << r.vu; +@@ + +msg = "WARNING: Assigning signed result to unsigned variable: %s = %s(...)" % (vu, f) +coccilib.report.print_report(p[0], msg) -- 1.9.1