linux-kernel - Re: [PATCH 1/2 v2] scripts/coccinelle: catch freeing cryptographic structures via kfree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.10.1411191040020.2363@hadrien>
Date:	Wed, 19 Nov 2014 10:41:37 +0100 (CET)
From:	Julia Lawall <julia.lawall@...6.fr>
To:	Konstantin Khlebnikov <k.khlebnikov@...sung.com>
cc:	kexec@...ts.infradead.org, linux-kernel@...r.kernel.org,
	Eric Biederman <ebiederm@...ssion.com>,
	Michal Marek <mmarek@...e.cz>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	Gilles Muller <Gilles.Muller@...6.fr>,
	Nicolas Palix <nicolas.palix@...g.fr>,
	Julia Lawall <Julia.Lawall@...6.fr>,
	linux-crypto@...r.kernel.org,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: [PATCH 1/2 v2] scripts/coccinelle: catch freeing cryptographic
 structures via kfree

> +// Comments: There are false positives in crypto/ where they are
> actually freed.

I didn't really understand this comment.  I ran the semantic patch and got
around 10 results, but it wasn't clear to me how to see which were false
positives.

I would suggest to extend the rule a little bit to include information
about where the allocation call is:

///
/// Structures allocated by crypto_alloc_* must be freed using crypto_free_*.
/// This finds freeing them by kfree.
///
// Confidence: Moderate
// Copyright: (C) 2014 Konstantin Khlebnikov,  GPLv2.
// Comments: There are false positives in crypto/ where they are actually freed.
// Keywords: crypto, kfree
// Options: --no-includes --include-headers

virtual org
virtual report
virtual context

@r depends on context || org || report@
expression x;
position p1;
@@

(
 x = crypto_alloc_base@p1(...)
|
 x = crypto_alloc_cipher@p1(...)
|
 x = crypto_alloc_ablkcipher@p1(...)
|
 x = crypto_alloc_aead@p1(...)
|
 x = crypto_alloc_instance@p1(...)
|
 x = crypto_alloc_instance2@p1(...)
|
 x = crypto_alloc_comp@p1(...)
|
 x = crypto_alloc_pcomp@p1(...)
|
 x = crypto_alloc_hash@p1(...)
|
 x = crypto_alloc_ahash@p1(...)
|
 x = crypto_alloc_shash@p1(...)
|
 x = crypto_alloc_rng@p1(...)
)

@pb@
expression r.x;
position p;
@@

* kfree@p(x)

@script:python depends on org@
p << pb.p;
p1 << r.p1;
@@

msg="WARNING: invalid free of crypto_alloc_* allocated data"
coccilib.org.print_todo(p[0], msg)
coccilib.org.print_link(p1[0], "allocation")

@script:python depends on report@
p << pb.p;
p1 << r.p1;
@@

msg="WARNING: invalid free of crypto_alloc_* allocated data, allocated on line %s" % (p1[0].line)
coccilib.report.print_report(p[0], msg)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/