From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755010AbcBVOUS (ORCPT ); Mon, 22 Feb 2016 09:20:18 -0500 Received: from mail2-relais-roc.national.inria.fr ([192.134.164.83]:33873 "EHLO mail2-relais-roc.national.inria.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752480AbcBVOUQ (ORCPT ); Mon, 22 Feb 2016 09:20:16 -0500 X-IronPort-AV: E=Sophos;i="5.22,484,1449529200"; d="scan'208";a="204131621" Date: Mon, 22 Feb 2016 09:20:03 -0500 (EST) From: Julia Lawall X-X-Sender: jll@hadrien To: Yann Droneaud cc: Gilles Muller , Nicolas Palix , Michal Marek , Tejun Heo , Greg Kroah-Hartman , Johannes Weiner , cocci@systeme.lip6.fr, linux-kernel@vger.kernel.org Subject: Re: [PATCHv1 1/3] coccinelle: also catch kzfree() issues In-Reply-To: <1456150168-24028-1-git-send-email-ydroneaud@opteya.com> Message-ID: References: <326298cef17f5109dc7b08094901aa1c69be83d5.1455638829.git.ydroneaud@opteya.com> <1456150168-24028-1-git-send-email-ydroneaud@opteya.com> User-Agent: Alpine 2.10 (DEB 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 22 Feb 2016, Yann Droneaud wrote: > Since commit 3ef0e5ba4673 ('slab: introduce kzfree()'), > kfree() is no more the only function to be considered. > > In particular, kzfree() must not be called on memory > allocated through devm_*() functions. > > Cc: Johannes Weiner > Signed-off-by: Yann Droneaud > --- > Hi Julia, > > As you suggested, I've use disjunctions instead of regular > expressions (which I managed to use incorrectly: eg. > without ^...$ they catch other functions than kfree(), > such as kfree_skb()). > > I've think we should also catch krealloc(, size), where size > is 0, but it's beyond my understanding of coccinelle if size > is not a plain 0 constant. > > Perhaps you could help me for this one. Do you have some examples? Coccinelle is not very good at tracking values. You can say something like: size = 0 ... when != size = e krealloc(...,size) I don't know if that would be useful in practice though. > Regards. > > scripts/coccinelle/free/devm_free.cocci | 2 ++ > scripts/coccinelle/free/kfree.cocci | 18 +++++++++++++++--- > scripts/coccinelle/free/kfreeaddr.cocci | 6 +++++- > 3 files changed, 22 insertions(+), 4 deletions(-) > > diff --git a/scripts/coccinelle/free/devm_free.cocci b/scripts/coccinelle/free/devm_free.cocci > index 3d9349012bb3..83c03adec1c5 100644 > --- a/scripts/coccinelle/free/devm_free.cocci > +++ b/scripts/coccinelle/free/devm_free.cocci > @@ -48,6 +48,8 @@ position p; > ( > * kfree@p(x) > | > +* kzfree@p(x) > +| > * free_irq@p(x) > | > * iounmap@p(x) > diff --git a/scripts/coccinelle/free/kfree.cocci b/scripts/coccinelle/free/kfree.cocci > index 577b78056990..ac438da4fd7b 100644 > --- a/scripts/coccinelle/free/kfree.cocci > +++ b/scripts/coccinelle/free/kfree.cocci > @@ -20,7 +20,11 @@ expression E; > position p1; > @@ > > -kfree@p1(E) > +( > +* kfree@p1(E) > +| > +* kzfree@p1(E) > +) > > @print expression@ > constant char [] c; > @@ -60,7 +64,11 @@ position ok; > @@ > > while (1) { ... > - kfree@ok(E) > +( > +* kfree@ok(E) > +| > +* kzfree@ok(E) > +) > ... when != break; > when != goto l; > when forall > @@ -74,7 +82,11 @@ statement S; > position free.p1!=loop.ok,p2!={print.p,sz.p}; > @@ > > -kfree@p1(E,...) > +( > +* kfree@p1(E,...) > +| > +* kzfree@p1(E,...) > +) > ... > ( > iter(...,subE,...) S // no use > diff --git a/scripts/coccinelle/free/kfreeaddr.cocci b/scripts/coccinelle/free/kfreeaddr.cocci > index ce8aacc314cb..d46063b1db8b 100644 > --- a/scripts/coccinelle/free/kfreeaddr.cocci > +++ b/scripts/coccinelle/free/kfreeaddr.cocci > @@ -16,7 +16,11 @@ identifier f; > position p; > @@ > > +( > * kfree@p(&e->f) > +| > +* kzfree@p(&e->f) > +) > > @script:python depends on org@ > p << r.p; > @@ -28,5 +32,5 @@ cocci.print_main("kfree",p) > p << r.p; > @@ > > -msg = "ERROR: kfree of structure field" > +msg = "ERROR: invalid free of structure field" > coccilib.report.print_report(p[0],msg) > -- > 2.5.0 > >