linux-kernel - Re: [PATCH 1/3] coccinelle: also catch kzfree() issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.10.1602161815190.2685@hadrien>
Date:	Tue, 16 Feb 2016 18:16:53 +0100 (CET)
From:	Julia Lawall <julia.lawall@...6.fr>
To:	Yann Droneaud <ydroneaud@...eya.com>
cc:	Gilles Muller <Gilles.Muller@...6.fr>,
	Nicolas Palix <nicolas.palix@...g.fr>,
	Michal Marek <mmarek@...e.com>, Tejun Heo <tj@...nel.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	cocci@...teme.lip6.fr, linux-kernel@...r.kernel.org,
	Johannes Weiner <hannes@...xchg.org>
Subject: Re: [PATCH 1/3] coccinelle: also catch kzfree() issues



On Tue, 16 Feb 2016, Yann Droneaud wrote:

> Since commit 3ef0e5ba4673 ('slab: introduce kzfree()'),
> kfree() is no more the only function to be considered.
>
> Cc: Johannes Weiner <hannes@...xchg.org>
> Signed-off-by: Yann Droneaud <ydroneaud@...eya.com>
> ---
>  scripts/coccinelle/free/devm_free.cocci | 2 ++
>  scripts/coccinelle/free/kfree.cocci     | 3 +++
>  scripts/coccinelle/free/kfreeaddr.cocci | 6 +++++-
>  3 files changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/scripts/coccinelle/free/devm_free.cocci b/scripts/coccinelle/free/devm_free.cocci
> index 3d9349012bb3..83c03adec1c5 100644
> --- a/scripts/coccinelle/free/devm_free.cocci
> +++ b/scripts/coccinelle/free/devm_free.cocci
> @@ -48,6 +48,8 @@ position p;
>  (
>  * kfree@p(x)
>  |
> +* kzfree@p(x)
> +|
>  * free_irq@p(x)
>  |
>  * iounmap@p(x)
> diff --git a/scripts/coccinelle/free/kfree.cocci b/scripts/coccinelle/free/kfree.cocci
> index 577b78056990..c3246b47f51f 100644
> --- a/scripts/coccinelle/free/kfree.cocci
> +++ b/scripts/coccinelle/free/kfree.cocci
> @@ -16,6 +16,7 @@ virtual org
>  virtual report
>
>  @free@
> +identifier kfree =~ "kz?free";

Thanks for the suggestions.  However, the regular expression is not such a
good idea.  Coccinelle doesn't make any optimizations based on regulat
expressions.  It would be better to put a disjunction with kfree and
kzfree explicitly, as in the other cases.

julia

>  expression E;
>  position p1;
>  @@
> @@ -54,6 +55,7 @@ position p;
>   sizeof(<+...E@....+>)
>
>  @loop exists@
> +identifier kfree =~ "kz?free";
>  expression E;
>  identifier l;
>  position ok;
> @@ -67,6 +69,7 @@ while (1) { ...
>  }
>
>  @r exists@
> +identifier kfree =~ "kz?free";
>  expression free.E, subE<=free.E, E2;
>  expression E1;
>  iterator iter;
> diff --git a/scripts/coccinelle/free/kfreeaddr.cocci b/scripts/coccinelle/free/kfreeaddr.cocci
> index ce8aacc314cb..d46063b1db8b 100644
> --- a/scripts/coccinelle/free/kfreeaddr.cocci
> +++ b/scripts/coccinelle/free/kfreeaddr.cocci
> @@ -16,7 +16,11 @@ identifier f;
>  position p;
>  @@
>
> +(
>  * kfree@p(&e->f)
> +|
> +* kzfree@p(&e->f)
> +)
>
>  @script:python depends on org@
>  p << r.p;
> @@ -28,5 +32,5 @@ cocci.print_main("kfree",p)
>  p << r.p;
>  @@
>
> -msg = "ERROR: kfree of structure field"
> +msg = "ERROR: invalid free of structure field"
>  coccilib.report.print_report(p[0],msg)
> --
> 2.5.0
>
>