github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

coccinelle: free: add a checker for __cleanup(kfree) usage

Browse Source 
Using __cleanup(kfree) will pass the stack address of the annotated
local variable to kfree functions. This will lead to invalid
deallocation issues. Inspired by CVE-2026-45959 and similar bugs
recently detected.

Signed-off-by: Ella Ma <alansnape3058@gmail.com>
Signed-off-by: Julia Lawall <julia.lawall@inria.fr>
This commit is contained in:
Ella Ma 2026-10-07 18:43:16 +02:00 committed by Julia Lawall
parent afb17ae1db
commit 7af2a51f19
1 changed files with 112 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

112
scripts/coccinelle/free/cleanup-free.cocci Normal file
View File

@ -0,0 +1,112 @@
// SPDX-License-Identifier: GPL-2.0-only
///
/// Find __cleanup(kfree)
/// Using __cleanup(kfree) will pass the stack address of the annotated
/// local variable to kfree, causing an invalid free.
/// I.e., `T v __cleanup(kfree);` --> `kfree(&v);`
/// Such usage is impossible to be correct.
///
// Confidence: High
// Copyright: (C) 2026 Ella Ma
// Options: --no-includes --include-headers
virtual report
virtual org
// Suggesting using __free for the functions with a DEFINE_FREE definition.
// Update this list when new DEFINE_FREE definitions are added.
@free@
attribute name __cleanup;
symbol kfree, kfree_sensitive, kvfree, kvfree_atomic, free_percpu;
type T;
identifier v, n;
position p;
@@
(
T v __cleanup@p(
(
n
&
(
kfree \| kfree_sensitive \| kvfree \| kvfree_atomic \| free_percpu
)
)
);
|
T v __cleanup@p(
(
n
&
(
kfree \| kfree_sensitive \| kvfree \| kvfree_atomic \| free_percpu
)
)
) = ...;
)
@script:python depends on report@
p << free.p;
n << free.n;
@@
msg = f"ERROR: __cleanup({n}) will cause an invalid free: the stack address of the annotated variable will be passed to {n}; declare the variable using __free({n}) to cause the pointee to be freed"
coccilib.report.print_report(p[0], msg)
@script:python depends on org@
p << free.p;
n << free.n;
@@
msg = f"ERROR: __cleanup({n}) will cause an invalid free: the stack address of the annotated variable will be passed to {n}; declare the variable using __free({n}) to cause the pointee to be freed"
coccilib.org.print_todo(p[0], msg)
// Reporting __cleanup usage for the functions without a DEFINE_FREE definition.
// The following list only contains frequently used functions. Supplement it if
// necessary.
@cleanup@
attribute name __cleanup;
symbol vfree, vfree_atomic, kfree_const;
type T;
identifier v, n;
position p;
@@
(
T v __cleanup@p(
(
n
&
(
vfree \| vfree_atomic \| kfree_const
)
)
);
|
T v __cleanup@p(
(
n
&
(
vfree \| vfree_atomic \| kfree_const
)
)
) = ...;
)
@script:python depends on report@
p << cleanup.p;
n << cleanup.n;
@@
msg = f"ERROR: __cleanup({n}) will cause an invalid free: the stack address of the annotated variable will be passed to {n}"
coccilib.report.print_report(p[0], msg)
@script:python depends on org@
p << cleanup.p;
n << cleanup.n;
@@
msg = f"ERROR: __cleanup({n}) will cause an invalid free: the stack address of the annotated variable will be passed to {n}"
coccilib.org.print_todo(p[0], msg)