mirror of
https://github.com/torvalds/linux.git
synced 2026-11-07 06:17:02 +01:00
Coccinelle patches for 7.4-rc1
This contains three new semantic patches * From Joe Perches for using the typed devm_kmalloc_obj-family of allocations * From Ella Ma for detecting invalid use of __cleanup * From Alejandro Colomar for adding uses of ARRAY_END Signed-off-by: Julia Lawall <julia.lawall@inria.fr> -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEnGZC8gbRfLXdcpA0F+92B3f5RZ0FAmrnzJEACgkQF+92B3f5 RZ1bUhAAgfljTSX4tonrNyH7bSPa3QeGQmx16G5pDsn2CdLiVWN6w9Qn8L+vT81i P3/67FUzl1/bRxB0JcY2GADr+0eSde4fYwGo3PswEmpa/B4QHc/I3fqnt+1oE+9y oipS7ZlO7ZRTrdEx55Q9X6EMG/Dvvie+C8It2IBaSmNvfAGkfyjztQ27L2p4jBM2 k3s2itN2k7p45h5ucXbBQn2hLl4LfS1PvuOG1jPMmQ6+xHTmT6jUyKVbj6gaUqfZ hB/trnKA8GrSUcS27Be/lyGO+sFc+wASzOWaqJxJjGShdWQfwX43qcMT8REj2GOy nO9jnRixIQ/d9bfJbXzGlJYMEQzEyciKdVf6RRrYATWIuiujYlPRVjJ3SxcJnmWT sCwJxQT03C0nRd0jRkPY+Dn5QXlrdtkoOTlq20knqHBUEklFB6gX8kYSiP1O7S4W sa+0eqZmyduoN382wH3eDHSccku07F0Hcejp6CMJHIW/udjwj23lQ5NTh6RRDPl0 wm6O/xms9dDLawbd9HnpF3AsywQ6eb10EVgstT/7YpaGCh6vHvoV0vnstTMy6PsE QKVq1ePLVmGMfVugjxBENkVmxteLjoqUgxNJE/S4EqlypNhQ637HxBKvnPIgFW7S id5KNRMKljcRsUaZgSJyCQNzljkh0e93K/5EHaysfgJ3d0Un/g8= =pRgC -----END PGP SIGNATURE----- Merge tag 'cocci-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux Pull Coccinelle updates from Julia Lawall: "This contains three new semantic patches - use the typed devm_kmalloc_obj-family of allocations (Joe Perches) - detect invalid use of __cleanup (Ella Ma) - add uses of ARRAY_END (Alejandro Colomar)" * tag 'cocci-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux: coccinelle: free: add a checker for `__cleanup(kfree)` usage coccinelle: Add devm_kmalloc_objs conversion script scripts/coccinelle: improve efficiency of array_end.cocci scripts/coccinelle: Add script for using ARRAY_END()
This commit is contained in:
Linus Torvalds
commit
05441d697f
136
scripts/coccinelle/api/devm_kmalloc_objs.cocci
Normal file
136
scripts/coccinelle/api/devm_kmalloc_objs.cocci
Normal file
|
|
@ -0,0 +1,136 @@
|
|||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
/// Use devm_kmalloc_obj family of macros for allocations
|
||||
///
|
||||
// Confidence: High
|
||||
// Options: --include-headers-for-types --all-includes --include-headers --keep-comments
|
||||
|
||||
virtual patch
|
||||
|
||||
@initialize:python@
|
||||
@@
|
||||
import sys
|
||||
|
||||
def alloc_array(name):
|
||||
func = "FAILED_RENAME"
|
||||
if name == "devm_kmalloc_array":
|
||||
func = "devm_kmalloc_objs"
|
||||
elif name == "devm_kvmalloc_array":
|
||||
func = "devm_kvmalloc_objs"
|
||||
elif name == "devm_kcalloc":
|
||||
func = "devm_kzalloc_objs"
|
||||
elif name == "devm_kvcalloc":
|
||||
func = "devm_kvzalloc_objs"
|
||||
else:
|
||||
print(f"Unknown transform for {name}", file=sys.stderr)
|
||||
return func
|
||||
|
||||
// This excludes anything that is assigning to or from integral types or
|
||||
// string literals. Everything else gets the sizeof() extracted for the
|
||||
// kmalloc_obj() type/var argument. sizeof(void *) is also excluded because
|
||||
// it will need case-by-case double-checking to make sure the right type is
|
||||
// being assigned.
|
||||
@direct depends on patch && !(file in "tools") && !(file in "samples")@
|
||||
typedef u8, u16, u32, u64;
|
||||
typedef __u8, __u16, __u32, __u64;
|
||||
typedef uint8_t, uint16_t, uint32_t, uint64_t;
|
||||
typedef uchar, ushort, uint, ulong;
|
||||
typedef __le16, __le32, __le64;
|
||||
typedef __be16, __be32, __be64;
|
||||
typedef wchar_t;
|
||||
type INTEGRAL = {u8,__u8,uint8_t,char,unsigned char,uchar,wchar_t,
|
||||
u16,__u16,uint16_t,unsigned short,ushort,
|
||||
u32,__u32,uint32_t,unsigned int,uint,
|
||||
u64,__u64,uint64_t,unsigned long,ulong,
|
||||
__le16,__le32,__le64,__be16,__be32,__be64};
|
||||
char [] STRING;
|
||||
INTEGRAL *BYTES;
|
||||
INTEGRAL **BYTES_PTRS;
|
||||
type TYPE;
|
||||
expression VAR;
|
||||
expression GFP;
|
||||
expression COUNT;
|
||||
expression FLEX;
|
||||
expression E;
|
||||
expression DEV;
|
||||
identifier ALLOC =~ "^devm_kv?[mz]alloc$";
|
||||
fresh identifier ALLOC_OBJ = ALLOC ## "_obj";
|
||||
fresh identifier ALLOC_FLEX = ALLOC ## "_flex";
|
||||
identifier ALLOC_ARRAY = {devm_kmalloc_array,devm_kvmalloc_array,devm_kcalloc,devm_kvcalloc};
|
||||
fresh identifier ALLOC_OBJS = script:python(ALLOC_ARRAY) { alloc_array(ALLOC_ARRAY) };
|
||||
@@
|
||||
|
||||
(
|
||||
- VAR = ALLOC(DEV,(sizeof(*VAR)), GFP)
|
||||
+ VAR = ALLOC_OBJ(DEV,*VAR, GFP)
|
||||
|
|
||||
ALLOC(DEV,(\(sizeof(STRING)\|sizeof(INTEGRAL)\|sizeof(INTEGRAL *)\)), GFP)
|
||||
|
|
||||
BYTES = ALLOC(DEV,(sizeof(E)), GFP)
|
||||
|
|
||||
BYTES = ALLOC(DEV,(sizeof(TYPE)), GFP)
|
||||
|
|
||||
BYTES_PTRS = ALLOC(DEV,(sizeof(E)), GFP)
|
||||
|
|
||||
BYTES_PTRS = ALLOC(DEV,(sizeof(TYPE)), GFP)
|
||||
|
|
||||
ALLOC(DEV,(sizeof(void *)), GFP)
|
||||
|
|
||||
- ALLOC(DEV,(sizeof(E)), GFP)
|
||||
+ ALLOC_OBJ(DEV, E, GFP)
|
||||
|
|
||||
- ALLOC(DEV,(sizeof(TYPE)), GFP)
|
||||
+ ALLOC_OBJ(DEV,TYPE, GFP)
|
||||
|
|
||||
ALLOC_ARRAY(DEV,COUNT, (\(sizeof(STRING)\|sizeof(INTEGRAL)\|sizeof(INTEGRAL *)\)), GFP)
|
||||
|
|
||||
BYTES = ALLOC_ARRAY(DEV, COUNT, (sizeof(E)), GFP)
|
||||
|
|
||||
BYTES = ALLOC_ARRAY(DEV,COUNT, (sizeof(TYPE)), GFP)
|
||||
|
|
||||
BYTES_PTRS = ALLOC_ARRAY(DEV, COUNT, (sizeof(E)), GFP)
|
||||
|
|
||||
BYTES_PTRS = ALLOC_ARRAY(DEV, COUNT, (sizeof(TYPE)), GFP)
|
||||
|
|
||||
ALLOC_ARRAY(DEV, (\(sizeof(STRING)\|sizeof(INTEGRAL)\|sizeof(INTEGRAL *)\)), COUNT, GFP)
|
||||
|
|
||||
BYTES = ALLOC_ARRAY(DEV, (sizeof(E)), COUNT, GFP)
|
||||
|
|
||||
BYTES = ALLOC_ARRAY(DEV, (sizeof(TYPE)), COUNT, GFP)
|
||||
|
|
||||
BYTES_PTRS = ALLOC_ARRAY(DEV, (sizeof(E)), COUNT, GFP)
|
||||
|
|
||||
BYTES_PTRS = ALLOC_ARRAY(DEV, (sizeof(TYPE)), COUNT, GFP)
|
||||
|
|
||||
ALLOC_ARRAY(DEV, COUNT, (sizeof(void *)), GFP)
|
||||
|
|
||||
ALLOC_ARRAY(DEV, (sizeof(void *)), COUNT, GFP)
|
||||
|
|
||||
- ALLOC_ARRAY(DEV, COUNT, (sizeof(E)), GFP)
|
||||
+ ALLOC_OBJS(DEV, E, COUNT, GFP)
|
||||
|
|
||||
- ALLOC_ARRAY(DEV, COUNT, (sizeof(TYPE)), GFP)
|
||||
+ ALLOC_OBJS(DEV, TYPE, COUNT, GFP)
|
||||
|
|
||||
- ALLOC_ARRAY(DEV, (sizeof(E)), COUNT, GFP)
|
||||
+ ALLOC_OBJS(DEV, E, COUNT, GFP)
|
||||
|
|
||||
- ALLOC_ARRAY(DEV, (sizeof(TYPE)), COUNT, GFP)
|
||||
+ ALLOC_OBJS(DEV, TYPE, COUNT, GFP)
|
||||
|
|
||||
- ALLOC(DEV, struct_size(VAR, FLEX, COUNT), GFP)
|
||||
+ ALLOC_FLEX(DEV, *VAR, FLEX, COUNT, GFP)
|
||||
|
|
||||
- ALLOC(DEV, struct_size_t(TYPE, FLEX, COUNT), GFP)
|
||||
+ ALLOC_FLEX(DEV, TYPE, FLEX, COUNT, GFP)
|
||||
)
|
||||
|
||||
@drop_gfp_kernel depends on patch && !(file in "tools") && !(file in "samples")@
|
||||
identifier ALLOC = {devm_kmalloc_obj,devm_kmalloc_objs,devm_kmalloc_flex,
|
||||
devm_kzalloc_obj,devm_kzalloc_objs,devm_kzalloc_flex,
|
||||
devm_kvmalloc_obj,devm_kvmalloc_objs,devm_kvmalloc_flex,
|
||||
devm_kvzalloc_obj,devm_kvzalloc_objs,devm_kvzalloc_flex};
|
||||
@@
|
||||
|
||||
ALLOC(...
|
||||
- , GFP_KERNEL
|
||||
)
|
||||
112
scripts/coccinelle/free/cleanup-free.cocci
Normal file
112
scripts/coccinelle/free/cleanup-free.cocci
Normal file
|
|
@ -0,0 +1,112 @@
|
|||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
///
|
||||
/// Find __cleanup(kfree)
|
||||
/// Using __cleanup(kfree) will pass the stack address of the annotated
|
||||
/// local variable to kfree, causing an invalid free.
|
||||
/// I.e., `T v __cleanup(kfree);` --> `kfree(&v);`
|
||||
/// Such usage is impossible to be correct.
|
||||
///
|
||||
// Confidence: High
|
||||
// Copyright: (C) 2026 Ella Ma
|
||||
// Options: --no-includes --include-headers
|
||||
|
||||
virtual report
|
||||
virtual org
|
||||
|
||||
// Suggesting using __free for the functions with a DEFINE_FREE definition.
|
||||
// Update this list when new DEFINE_FREE definitions are added.
|
||||
@free@
|
||||
attribute name __cleanup;
|
||||
symbol kfree, kfree_sensitive, kvfree, kvfree_atomic, free_percpu;
|
||||
type T;
|
||||
identifier v, n;
|
||||
position p;
|
||||
@@
|
||||
|
||||
(
|
||||
T v __cleanup@p(
|
||||
(
|
||||
n
|
||||
&
|
||||
(
|
||||
kfree \| kfree_sensitive \| kvfree \| kvfree_atomic \| free_percpu
|
||||
)
|
||||
)
|
||||
);
|
||||
|
|
||||
T v __cleanup@p(
|
||||
(
|
||||
n
|
||||
&
|
||||
(
|
||||
kfree \| kfree_sensitive \| kvfree \| kvfree_atomic \| free_percpu
|
||||
)
|
||||
)
|
||||
) = ...;
|
||||
)
|
||||
|
||||
@script:python depends on report@
|
||||
p << free.p;
|
||||
n << free.n;
|
||||
@@
|
||||
|
||||
msg = f"ERROR: __cleanup({n}) will cause an invalid free: the stack address of the annotated variable will be passed to {n}; declare the variable using __free({n}) to cause the pointee to be freed"
|
||||
coccilib.report.print_report(p[0], msg)
|
||||
|
||||
@script:python depends on org@
|
||||
p << free.p;
|
||||
n << free.n;
|
||||
@@
|
||||
|
||||
msg = f"ERROR: __cleanup({n}) will cause an invalid free: the stack address of the annotated variable will be passed to {n}; declare the variable using __free({n}) to cause the pointee to be freed"
|
||||
coccilib.org.print_todo(p[0], msg)
|
||||
|
||||
|
||||
// Reporting __cleanup usage for the functions without a DEFINE_FREE definition.
|
||||
// The following list only contains frequently used functions. Supplement it if
|
||||
// necessary.
|
||||
@cleanup@
|
||||
attribute name __cleanup;
|
||||
symbol vfree, vfree_atomic, kfree_const;
|
||||
type T;
|
||||
identifier v, n;
|
||||
position p;
|
||||
@@
|
||||
|
||||
(
|
||||
T v __cleanup@p(
|
||||
(
|
||||
n
|
||||
&
|
||||
(
|
||||
vfree \| vfree_atomic \| kfree_const
|
||||
)
|
||||
)
|
||||
);
|
||||
|
|
||||
T v __cleanup@p(
|
||||
(
|
||||
n
|
||||
&
|
||||
(
|
||||
vfree \| vfree_atomic \| kfree_const
|
||||
)
|
||||
)
|
||||
) = ...;
|
||||
)
|
||||
|
||||
@script:python depends on report@
|
||||
p << cleanup.p;
|
||||
n << cleanup.n;
|
||||
@@
|
||||
|
||||
msg = f"ERROR: __cleanup({n}) will cause an invalid free: the stack address of the annotated variable will be passed to {n}"
|
||||
coccilib.report.print_report(p[0], msg)
|
||||
|
||||
@script:python depends on org@
|
||||
p << cleanup.p;
|
||||
n << cleanup.n;
|
||||
@@
|
||||
|
||||
msg = f"ERROR: __cleanup({n}) will cause an invalid free: the stack address of the annotated variable will be passed to {n}"
|
||||
coccilib.org.print_todo(p[0], msg)
|
||||
73
scripts/coccinelle/misc/array_end.cocci
Normal file
73
scripts/coccinelle/misc/array_end.cocci
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
/// Use ARRAY_END instead of an expression derived from ARRAY_SIZE
|
||||
//
|
||||
// Confidence: High
|
||||
// Copyright: 2026, Alejandro Colomar <alx@kernel.org>
|
||||
// Options: --no-includes --include-headers
|
||||
|
||||
virtual patch
|
||||
virtual context
|
||||
virtual org
|
||||
virtual report
|
||||
|
||||
@depends on context disable zero_multiple_format@
|
||||
type T;
|
||||
T[] a;
|
||||
expression b;
|
||||
@@
|
||||
(
|
||||
* a + ARRAY_SIZE(a)
|
||||
|
|
||||
* &a[0] + ARRAY_SIZE(a)
|
||||
|
|
||||
* &a[ARRAY_SIZE(a)]
|
||||
|
|
||||
* &a[ARRAY_SIZE(a) - b]
|
||||
)
|
||||
|
||||
@depends on patch disable zero_multiple_format@
|
||||
type T;
|
||||
T[] a;
|
||||
expression b;
|
||||
@@
|
||||
(
|
||||
- (a + ARRAY_SIZE(a))
|
||||
+ ARRAY_END(a)
|
||||
|
|
||||
- (&a[0] + ARRAY_SIZE(a))
|
||||
+ ARRAY_END(a)
|
||||
|
|
||||
- (&a[ARRAY_SIZE(a)])
|
||||
+ ARRAY_END(a)
|
||||
|
|
||||
- (&a[ARRAY_SIZE(a) - b])
|
||||
+ ARRAY_END(a) - b
|
||||
)
|
||||
|
||||
@r depends on org || report disable zero_multiple_format@
|
||||
type T;
|
||||
T[] a;
|
||||
expression b;
|
||||
position p;
|
||||
@@
|
||||
(
|
||||
a@p + ARRAY_SIZE(a)
|
||||
|
|
||||
&a[0]@p + ARRAY_SIZE(a)
|
||||
|
|
||||
&a[ARRAY_SIZE(a)]@p
|
||||
|
|
||||
&a[ARRAY_SIZE(a)@p - b]
|
||||
)
|
||||
|
||||
@script:python depends on org@
|
||||
p << r.p;
|
||||
@@
|
||||
|
||||
coccilib.org.print_todo(p[0], "WARNING should use ARRAY_END")
|
||||
|
||||
@script:python depends on report@
|
||||
p << r.p;
|
||||
@@
|
||||
|
||||
coccilib.report.print_report(p[0], "WARNING: opportunity for ARRAY_END")
|
||||
Loading…
Reference in New Issue
Block a user