Re: [cocci] [PATCH] coccinelle: free: add a checker for `__cleanup(kfree)` usage

[Markus Elfring <Markus.Elfring@web.de>]

> Using __cleanup(kfree) will pass the stack address of the annotated
> local variable to kfree functions.

I got the impression that this wording approach is improvable.
This attribute probably needs a pointer to an object which was
dynamically allocated.

How do you think about to handle an attribute parameter?


Would you like to support operation modes for coccicheck scripts
in a consistent way?


>                                    This will lead to invalid
> deallocation issues. Inspired by CVE-2026-45959 and similar bugs
> recently detected.

Thanks for such background information.


…
> +++ b/scripts/coccinelle/free/cleanup-free.cocci
> @@ -0,0 +1,94 @@
…
> +/// Find __cleanup(kfree)
> +/// Using __cleanup(kfree) will pass the stack address of the annotated
> +/// local variable to kfree, causing an invalid free.

Would an other wording variant become more helpful?


> +/// I.e., `T v __cleanup(kfree);` --> `kfree(&v);`
> +/// Such usage is impossible to be correct.
…
> +// Suggesting using __free for the functions with a DEFINE_FREE definition.
> +// Update this list when new DEFINE_FREE definitions are added.
> +@free@
> +attribute name __cleanup;
> +symbol kfree, kfree_sensitive, kvfree, kvfree_atomic;
> +type T;
> +identifier v, n;
> +position p;
> +@@
> +
> +(
> +  T v __cleanup@p(
> +(
> +  n
> +&
> +(
> +  kfree \| kfree_sensitive \| kvfree \| kvfree_atomic
> +)

How do you think about to specify relevant function names
on separate lines for such an SmPL conjunction?

Can symbol lists be converted into corresponding case distinctions?

Regards,
Markus