linux-kernel - Re: [Cocci] [PATCH v2] coccinelle: api: add kzfree script

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 6 Jun 2020 10:16:35 +0200 (CEST)
From:   Julia Lawall <julia.lawall@...ia.fr>
To:     Denis Efremov <efremov@...ux.com>
cc:     Joe Perches <joe@...ches.com>, cocci@...teme.lip6.fr,
        linux-kernel@...r.kernel.org
Subject: Re: [Cocci] [PATCH v2] coccinelle: api: add kzfree script



On Fri, 5 Jun 2020, Denis Efremov wrote:

> It looks like a good idea to add type cast, like:
>
> +// Ignore kzfree definition
> +// Ignore kasan test
> +@r depends on !patch && !(file in "lib/test_kasan.c") && !(file in "mm/slab_common.c") forall@
> +expression *E;
> +position p;
> +type T;
> +@@
> +
> +* \(memset\|memset_explicit\)((T)E, 0, ...);
> +  ... when != E
> +      when strict
> +* \(kfree\|vfree\|kvfree\)(E)@p;
> +
>
> and to exclude file "mm/util.c" because it will contain the definition of
> kvfree_sensitive().
>
> I will wait for your recommendation about commented lines and will send v3 after.

Instead of the file in things, maybe it would be simpler to say:

position p : script:ocaml() { not (List.mem (List.hd p).current_element ["kzfree";"..."]) };

Or:

@initialize:ocaml@
@@

let relevant p =
   not (List.mem (List.hd p).current_element ["kzfree";"..."])

and then

position p : script:ocaml() { relevant p };

Or the python counterpart.  It's true that the script is probably not
relevant to those files at all, but listing the specific functions would
avoid the need for the comments and make the issue more clear.

It's just a suggestion.  If you prefer the file in solution, that's ok
too.

julia