From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755941AbcH1TiO (ORCPT ); Sun, 28 Aug 2016 15:38:14 -0400 Received: from mail3-relais-sop.national.inria.fr ([192.134.164.104]:20808 "EHLO mail3-relais-sop.national.inria.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751041AbcH1TiN (ORCPT ); Sun, 28 Aug 2016 15:38:13 -0400 X-IronPort-AV: E=Sophos;i="5.28,592,1464645600"; d="scan'208";a="191310491" Date: Sun, 28 Aug 2016 21:38:09 +0200 (CEST) From: Julia Lawall X-X-Sender: jll@hadrien To: Nicolas Iooss cc: Joe Perches , alsa-devel@alsa-project.org, Dan Capenter , Liam Girdwood , Mark Brown , linux-kernel@vger.kernel.org Subject: Re: Misuses of ** ? (was Re: [PATCH 1/1] ASoC: Intel: Atom: add a missing star in a memcpy call) In-Reply-To: Message-ID: References: <20160828173945.27721-1-nicolas.iooss_linux@m4x.org> <1472406636.26978.95.camel@perches.com> User-Agent: Alpine 2.10 (DEB 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, 28 Aug 2016, Nicolas Iooss wrote: > On 28/08/16 19:50, Joe Perches wrote: > > On Sun, 2016-08-28 at 19:39 +0200, Nicolas Iooss wrote: > >> In sst_prepare_and_post_msg(), when a response is received in "block", > >> the following code gets executed: > >> > >> *data = kzalloc(block->size, GFP_KERNEL); > >> memcpy(data, (void *) block->data, block->size); > > > > Yuck, thanks. > > > > Julia, Dan, could cocci or smatch help find any other > > similar misuses here? > > In fact I have found this bug with a GCC plugin I have written after I > discovered an issue with a printf format string in brcmfmac driver > (https://lkml.org/lkml/2016/8/23/193 fixes this one). This GCC plugin > uses an approach which has many false positives but it helped me detect > real bugs such as the one you replied to, and > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ae6c33ba6e37eea3012fe2640b22400ef3f2d0f3 > a few days ago. > > In case you are curious about what the plugin looks like (it is very > dirty but might be useful for future work I won't have time to do), I > published it on > https://gist.github.com/anonymous/36dd40dcbeeb83964e66b65be7a96136 . > This huge patch contains the plugin code in > scripts/gcc-plugins/deref_checker_plugin.c, many dirty work-arounds to > filter false positive matches, a really-dirty way of handling memcpy > optimisations done by gcc, and fixes to possible bugs (which can be > found by searching "/* BUG? */", I have not yet had time to find out > whether they are real bugs or false positives too). > > I hope this will help in the work of eliminating bugs in the kernel :) I tried the following semantic patch, that is quite general, and the fixed issue was the only report. @@ expression x,y,sz; identifier f,g; @@ * *x = f(sz,...); ... * g(x,y,sz); julia