login
Search
The following series adds new semantic patches (SPs) in scripts/coccinelle. Existing SPs are reorganized accordingly. Nicolas Palix (18): Coccinelle: Add null/eno.cocci Coccinelle: Add null/kmerr.cocci Coccinelle: Move deref_null.cocci to a more appropriate directory Coccinelle: Add locks/call_kern.cocci Coccinelle: Add locks/double_lock.cocci Coccinelle: Add locks/mini_lock.cocci Coccinelle: Add iterators/fen.cocci Coccinelle: Add iterators/itnull.cocci Coccinelle: Add iterators/list_entry_update.cocci Coccinelle: Add free/kfree.cocci Coccinelle: Add api/kstrdup.cocci Coccinelle: Add api/memdup.cocci Coccinelle: Add api/memdup_user Coccinelle: Move err_cast.cocci to the api directory Coccinelle: Move resource_size.cocci to the api directory Coccinelle: Move alloc directory into api directory Coccinelle: Add misc/doubleinit.cocci Coccinelle: Add misc/ifcol.cocci scripts/coccinelle/alloc/drop_kmalloc_cast.cocci | 67 ----- scripts/coccinelle/alloc/kzalloc-simple.cocci | 86 ------ .../coccinelle/api/alloc/drop_kmalloc_cast.cocci | 67 +++++ scripts/coccinelle/api/alloc/kzalloc-simple.cocci | 86 ++++++ scripts/coccinelle/api/err_cast.cocci | 56 ++++ scripts/coccinelle/api/kstrdup.cocci | 39 +++ scripts/coccinelle/api/memdup.cocci | 40 +++ scripts/coccinelle/api/memdup_user.cocci | 35 +++ scripts/coccinelle/api/resource_size.cocci | 93 ++++++ scripts/coccinelle/deref_null.cocci | 293 -------------------- scripts/coccinelle/err_cast.cocci | 56 ---- scripts/coccinelle/free/kfree.cocci | 116 ++++++++ scripts/coccinelle/iterators/fen.cocci | 64 +++++ scripts/coccinelle/iterators/itnull.cocci | 58 ++++ .../coccinelle/iterators/list_entry_update.cocci | 62 ++++ scripts/coccinelle/locks/call_kern.cocci | 74 +++++ ...
The various basic memory allocation functions don't return ERR_PTR Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/null/eno.cocci | 20 ++++++++++++++++++++ 1 files changed, 20 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/null/eno.cocci diff --git a/scripts/coccinelle/null/eno.cocci b/scripts/coccinelle/null/eno.cocci new file mode 100644 index 0000000..4c9c52b --- /dev/null +++ b/scripts/coccinelle/null/eno.cocci @@ -0,0 +1,20 @@ +/// The various basic memory allocation functions don't return ERR_PTR +/// +// Confidence: High +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual patch + +@@ +expression x,E; +@@ + +x = \(kmalloc\|kzalloc\|kcalloc\|kmem_cache_alloc\|kmem_cache_zalloc\|kmem_cache_alloc_node\|kmalloc_node\|kzalloc_node\)(...) +... when != x = E +- IS_ERR(x) ++ !x -- 1.7.0.4 --
Find double locks. False positives may occur when some paths cannot occur at execution, due to the values of variables, and when there is an intervening function call that releases the lock. Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/locks/double_lock.cocci | 92 ++++++++++++++++++++++++++++ 1 files changed, 92 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/locks/double_lock.cocci diff --git a/scripts/coccinelle/locks/double_lock.cocci b/scripts/coccinelle/locks/double_lock.cocci new file mode 100644 index 0000000..63b24e6 --- /dev/null +++ b/scripts/coccinelle/locks/double_lock.cocci @@ -0,0 +1,92 @@ +/// Find double locks. False positives may occur when some paths cannot +/// occur at execution, due to the values of variables, and when there is +/// an intervening function call that releases the lock. +/// +// Confidence: Moderate +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual org +virtual report + +@locked@ +position p1; +expression E1; +position p; +@@ + +( +mutex_lock@p1 +| +mutex_trylock@p1 +| +spin_lock@p1 +| +spin_trylock@p1 +| +read_lock@p1 +| +read_trylock@p1 +| +write_lock@p1 +| +write_trylock@p1 +) (E1@p,...); + +@balanced@ +position p1 != locked.p1; +position locked.p; +identifier lock,unlock; +expression x <= locked.E1; +expression E,locked.E1; +expression E2; +@@ + +if (E) { + <+... when != E1 + lock(E1@p,...) + ...+> +} +... when != E1 + when != \(x = E2\|&x\) + when forall +if (E) { + <+... when != E1 + unlock@p1(E1,...) + ...+> +} + +@r depends on !balanced exists@ +expression x <= locked.E1; +expression locked.E1; +expression E2; +identifier lock; +position ...
Many iterators have the property that the first argument is always bound to a real list element, never NULL. False positives arise for some iterators that do not have this property, or in cases when the loop cursor is reassigned. The latter should only happen when the matched code is on the way to a loop exit (break, goto, or return). Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/iterators/itnull.cocci | 58 +++++++++++++++++++++++++++++ 1 files changed, 58 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/iterators/itnull.cocci diff --git a/scripts/coccinelle/iterators/itnull.cocci b/scripts/coccinelle/iterators/itnull.cocci new file mode 100644 index 0000000..baa4297 --- /dev/null +++ b/scripts/coccinelle/iterators/itnull.cocci @@ -0,0 +1,58 @@ +/// Many iterators have the property that the first argument is always bound +/// to a real list element, never NULL. False positives arise for some +/// iterators that do not have this property, or in cases when the loop +/// cursor is reassigned. The latter should only happen when the matched +/// code is on the way to a loop exit (break, goto, or return). +/// +// Confidence: Moderate +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual patch + +@@ +iterator I; +expression x,E,E1,E2; +statement S,S1,S2; +@@ + +I(x,...) { <... +( +- if (x == NULL && ...) S +| +- if (x != NULL || ...) + S +| +- (x == NULL) || + E +| +- (x != NULL) && + E +| +- (x == NULL && ...) ? E1 : + E2 +| +- (x != NULL || ...) ? + E1 +- : E2 +| +- if (x == NULL && ...) S1 else + S2 +| +- if (x != NULL || ...) + S1 +- else S2 +| ++ BAD( + x == NULL ++ ) +| ++ BAD( + x != NULL ++ ) +) + ...> } \ No newline ...
This semantic patch looks for kmalloc etc that are not followed by a NULL check. It only gives a report in the case where there is some error handling code later in the function, which may be helpful in determining what the error handling code for the call to kmalloc etc should be. Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/null/kmerr.cocci | 72 +++++++++++++++++++++++++++++++++++ 1 files changed, 72 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/null/kmerr.cocci diff --git a/scripts/coccinelle/null/kmerr.cocci b/scripts/coccinelle/null/kmerr.cocci new file mode 100644 index 0000000..949bf65 --- /dev/null +++ b/scripts/coccinelle/null/kmerr.cocci @@ -0,0 +1,72 @@ +/// This semantic patch looks for kmalloc etc that are not followed by a +/// NULL check. It only gives a report in the case where there is some +/// error handling code later in the function, which may be helpful +/// in determining what the error handling code for the call to kmalloc etc +/// should be. +/// +// Confidence: High +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual context +virtual org +virtual report + +@withtest@ +expression x; +position p; +identifier f,fld; +@@ + +x@p = f(...); +... when != x->fld +\(x == NULL \| x != NULL\) + +@fixed depends on context && !org && !report@ +expression x,x1; +position p1 != withtest.p; +statement S; +position any withtest.p; +identifier f; +@@ + +*x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...); +... +*x1@p = f(...); +if (!x1) S + +// ------------------------------------------------------------------------ + +@rfixed depends on (org || report) && !context exists@ +expression x,x1; +position p1 != withtest.p; +position ...
deref_null.cocci is moved to the 'null' directory which contains other null related rules. Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/deref_null.cocci | 293 ------------------------------ scripts/coccinelle/null/deref_null.cocci | 293 ++++++++++++++++++++++++++++++ 2 files changed, 293 insertions(+), 293 deletions(-) delete mode 100644 scripts/coccinelle/deref_null.cocci create mode 100644 scripts/coccinelle/null/deref_null.cocci diff --git a/scripts/coccinelle/deref_null.cocci b/scripts/coccinelle/deref_null.cocci deleted file mode 100644 index 9969d76..0000000 --- a/scripts/coccinelle/deref_null.cocci +++ /dev/null @@ -1,293 +0,0 @@ -/// -/// A variable is dereference under a NULL test. -/// Even though it is know to be NULL. -/// -// Confidence: Moderate -// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. -// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. -// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. -// URL: http://coccinelle.lip6.fr/ -// Comments: -I ... -all_includes can give more complete results -// Options: - -virtual context -virtual patch -virtual org -virtual report - -@initialize:python depends on !context && patch && !org && !report@ - -import sys -print >> sys.stderr, "This semantic patch does not support the 'patch' mode." - -@depends on patch@ -@@ - -this_rule_should_never_matches(); - -@ifm depends on !patch@ -expression *E; -statement S1,S2; -position p1; -@@ - -if@p1 ((E == NULL && ...) || ...) S1 else S2 - -// The following two rules are separate, because both can match a single -// expression in different ways -@pr1 depends on !patch expression@ -expression *ifm.E; -identifier f; -position p1; -@@ - - (E != NULL && ...) ? <+...E->f@p1...+> : ... - -@pr2 depends on !patch expression@ -expression *ifm.E; -identifier f; -position p2; -@@ - -( - (E != NULL) && ... && <+...E->f@p2...+> -| - (E == NULL) || ... || ...
Find functions that refer to GFP_KERNEL but are called with locks held. The proposed change of converting the GFP_KERNEL is not necessarily the correct one. It may be desired to unlock the lock, or to not call the function under the lock in the first place. Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/locks/call_kern.cocci | 74 ++++++++++++++++++++++++++++++ 1 files changed, 74 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/locks/call_kern.cocci diff --git a/scripts/coccinelle/locks/call_kern.cocci b/scripts/coccinelle/locks/call_kern.cocci new file mode 100644 index 0000000..00af534 --- /dev/null +++ b/scripts/coccinelle/locks/call_kern.cocci @@ -0,0 +1,74 @@ +/// Find functions that refer to GFP_KERNEL but are called with locks held. +/// The proposed change of converting the GFP_KERNEL is not necessarily the +/// correct one. It may be desired to unlock the lock, or to not call the +/// function under the lock in the first place. +/// +// Confidence: Moderate +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual patch + +@gfp exists@ +identifier fn; +position p; +@@ + +fn(...) { + ... when != read_unlock_irq(...) + when != write_unlock_irq(...) + when != read_unlock_irqrestore(...) + when != write_unlock_irqrestore(...) + when != spin_unlock(...) + when != spin_unlock_irq(...) + when != spin_unlock_irqrestore(...) + when != local_irq_enable(...) + when any + GFP_KERNEL@p + ... when any +} + +@locked@ +identifier ...
Use kstrdup rather than duplicating its implementation Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/api/kstrdup.cocci | 39 ++++++++++++++++++++++++++++++++++ 1 files changed, 39 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/api/kstrdup.cocci diff --git a/scripts/coccinelle/api/kstrdup.cocci b/scripts/coccinelle/api/kstrdup.cocci new file mode 100644 index 0000000..e0805ad --- /dev/null +++ b/scripts/coccinelle/api/kstrdup.cocci @@ -0,0 +1,39 @@ +/// Use kstrdup rather than duplicating its implementation +/// +// Confidence: High +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual patch + +@@ +expression from,to; +expression flag,E1,E2; +statement S; +@@ + +- to = kmalloc(strlen(from) + 1,flag); ++ to = kstrdup(from, flag); + ... when != \(from = E1 \| to = E1 \) + if (to==NULL || ...) S + ... when != \(from = E2 \| to = E2 \) +- strcpy(to, from); + +@@ +expression x,from,to; +expression flag,E1,E2,E3; +statement S; +@@ + +- x = strlen(from) + 1; + ... when != \( x = E1 \| from = E1 \) +- to = \(kmalloc\|kzalloc\)(x,flag); ++ to = kstrdup(from, flag); + ... when != \(x = E2 \| from = E2 \| to = E2 \) + if (to==NULL || ...) S + ... when != \(x = E3 \| from = E3 \| to = E3 \) +- memcpy(to, from, x); -- 1.7.0.4 --
Use kmemdup rather than duplicating its implementation Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/api/memdup.cocci | 40 +++++++++++++++++++++++++++++++++++ 1 files changed, 40 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/api/memdup.cocci diff --git a/scripts/coccinelle/api/memdup.cocci b/scripts/coccinelle/api/memdup.cocci new file mode 100644 index 0000000..b5d7220 --- /dev/null +++ b/scripts/coccinelle/api/memdup.cocci @@ -0,0 +1,40 @@ +/// Use kmemdup rather than duplicating its implementation +/// +// Confidence: High +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual patch + +@r1@ +expression from,to; +expression flag; +position p; +@@ + + to = \(kmalloc@p\|kzalloc@p\)(strlen(from) + 1,flag); + +@r2@ +expression x,from,to; +expression flag,E1; +position p; +@@ + + x = strlen(from) + 1; + ... when != \( x = E1 \| from = E1 \) + to = \(kmalloc@p\|kzalloc@p\)(x,flag); + +@@ +expression from,to,size,flag; +position p != {r1.p,r2.p}; +statement S; +@@ + +- to = \(kmalloc@p\|kzalloc@p\)(size,flag); ++ to = kmemdup(from,size,flag); + if (to==NULL || ...) S +- memcpy(to, from, size); -- 1.7.0.4 --
Use kmemdup_user rather than duplicating its implementation This is a little bit restricted to reduce false positives Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/api/memdup_user.cocci | 35 ++++++++++++++++++++++++++++++ 1 files changed, 35 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/api/memdup_user.cocci diff --git a/scripts/coccinelle/api/memdup_user.cocci b/scripts/coccinelle/api/memdup_user.cocci new file mode 100644 index 0000000..72ce012 --- /dev/null +++ b/scripts/coccinelle/api/memdup_user.cocci @@ -0,0 +1,35 @@ +/// Use kmemdup_user rather than duplicating its implementation +/// This is a little bit restricted to reduce false positives +/// +// Confidence: High +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual patch + +@@ +expression from,to,size,flag; +position p; +identifier l1,l2; +@@ + +- to = \(kmalloc@p\|kzalloc@p\)(size,flag); ++ to = memdup_user(from,size); + if ( +- to==NULL ++ IS_ERR(to) + || ...) { + <+... when != goto l1; +- -ENOMEM ++ PTR_ERR(to) + ...+> + } +- if (copy_from_user(to, from, size) != 0) { +- <+... when != goto l2; +- -EFAULT +- ...+> +- } -- 1.7.0.4 --
Find a use after free. Values of variables may imply that some execution paths are not possible, resulting in false positives. Another source of false positives are macros such as SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/free/kfree.cocci | 116 +++++++++++++++++++++++++++++++++++ 1 files changed, 116 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/free/kfree.cocci diff --git a/scripts/coccinelle/free/kfree.cocci b/scripts/coccinelle/free/kfree.cocci new file mode 100644 index 0000000..c13a539 --- /dev/null +++ b/scripts/coccinelle/free/kfree.cocci @@ -0,0 +1,116 @@ +/// Find a use after free. Values of variables may imply that some +/// execution paths are not possible, resulting in false positives. +/// Another source of false positives are macros such as +/// SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument +/// +// Confidence: Moderate +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual org +virtual report + +@free@ +expression E; +position p1; +@@ + +kfree@p1(E) + +@print expression@ +constant char *c; +expression free.E,E2; +type T; +position p; +identifier f; +@@ + +( + f(...,c,...,(T)E@p,...) +| + E@p == E2 +| + E@p != E2 +| + !E@p +| + E@p || ... +) + +@sz@ +expression free.E; +position p; +@@ + + sizeof(<+...E@p...+>) + +@loop exists@ +expression E; +identifier l; +position ok; +@@ + +while (1) { ... + kfree@ok(E) + ... when != break; + when != goto l; + when forall +} + +@r exists@ +expression free.E, subE<=free.E, E2; +expression E1; +iterator iter; +statement S; +position ...
Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/api/resource_size.cocci | 93 ++++++++++++++++++++++++++++ scripts/coccinelle/resource_size.cocci | 93 ---------------------------- 2 files changed, 93 insertions(+), 93 deletions(-) create mode 100644 scripts/coccinelle/api/resource_size.cocci delete mode 100644 scripts/coccinelle/resource_size.cocci diff --git a/scripts/coccinelle/api/resource_size.cocci b/scripts/coccinelle/api/resource_size.cocci new file mode 100644 index 0000000..1935a58 --- /dev/null +++ b/scripts/coccinelle/api/resource_size.cocci @@ -0,0 +1,93 @@ +/// +/// Use resource_size function on resource object +/// instead of explicit computation. +/// +// Confidence: High +// Copyright: (C) 2009, 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2009, 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2009, 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Options: +// +// Keywords: resource_size +// Version min: 2.6.27 resource_size +// + +virtual context +virtual patch +virtual org +virtual report + +//---------------------------------------------------------- +// For context mode +//---------------------------------------------------------- + +@r_context depends on context && !patch && !org@ +struct resource *res; +@@ + +* (res->end - res->start) + 1 + +//---------------------------------------------------------- +// For patch mode +//---------------------------------------------------------- + +@r_patch depends on !context && patch && !org@ +struct resource *res; +@@ + +- (res->end - res->start) + 1 ++ resource_size(res) + +//---------------------------------------------------------- +// For org mode +//---------------------------------------------------------- + + +@r_org depends on !context && !patch && (org || report)@ +struct resource *res; +position p; +@@ + + (res->end@p - res->start) + ...
Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/api/err_cast.cocci | 56 +++++++++++++++++++++++++++++++++ scripts/coccinelle/err_cast.cocci | 56 --------------------------------- 2 files changed, 56 insertions(+), 56 deletions(-) create mode 100644 scripts/coccinelle/api/err_cast.cocci delete mode 100644 scripts/coccinelle/err_cast.cocci diff --git a/scripts/coccinelle/api/err_cast.cocci b/scripts/coccinelle/api/err_cast.cocci new file mode 100644 index 0000000..2ce1150 --- /dev/null +++ b/scripts/coccinelle/api/err_cast.cocci @@ -0,0 +1,56 @@ +/// +/// Use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(...)) +/// +// Confidence: High +// Copyright: (C) 2009, 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2009, 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2009, 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Options: +// +// Keywords: ERR_PTR, PTR_ERR, ERR_CAST +// Version min: 2.6.25 +// + +virtual context +virtual patch +virtual org +virtual report + + +@ depends on context && !patch && !org && !report@ +expression x; +@@ + +* ERR_PTR(PTR_ERR(x)) + +@ depends on !context && patch && !org && !report @ +expression x; +@@ + +- ERR_PTR(PTR_ERR(x)) ++ ERR_CAST(x) + +@r depends on !context && !patch && (org || report)@ +expression x; +position p; +@@ + + ERR_PTR@p(PTR_ERR(x)) + +@script:python depends on org@ +p << r.p; +x << r.x; +@@ + +msg="WARNING ERR_CAST can be used with %s" % (x) +msg_safe=msg.replace("[","@(").replace("]",")") +coccilib.org.print_todo(p[0], msg_safe) + +@script:python depends on report@ +p << r.p; +x << r.x; +@@ + +msg="WARNING: ERR_CAST can be used with %s" % (x) +coccilib.report.print_report(p[0], msg) diff --git a/scripts/coccinelle/err_cast.cocci b/scripts/coccinelle/err_cast.cocci deleted file mode 100644 index 2ce1150..0000000 --- a/scripts/coccinelle/err_cast.cocci +++ ...
alloc contains various semantic patches related to the allocation APIs Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/alloc/drop_kmalloc_cast.cocci | 67 --------------- scripts/coccinelle/alloc/kzalloc-simple.cocci | 86 -------------------- .../coccinelle/api/alloc/drop_kmalloc_cast.cocci | 67 +++++++++++++++ scripts/coccinelle/api/alloc/kzalloc-simple.cocci | 86 ++++++++++++++++++++ 4 files changed, 153 insertions(+), 153 deletions(-) delete mode 100644 scripts/coccinelle/alloc/drop_kmalloc_cast.cocci delete mode 100644 scripts/coccinelle/alloc/kzalloc-simple.cocci create mode 100644 scripts/coccinelle/api/alloc/drop_kmalloc_cast.cocci create mode 100644 scripts/coccinelle/api/alloc/kzalloc-simple.cocci diff --git a/scripts/coccinelle/alloc/drop_kmalloc_cast.cocci b/scripts/coccinelle/alloc/drop_kmalloc_cast.cocci deleted file mode 100644 index 7d4771d..0000000 --- a/scripts/coccinelle/alloc/drop_kmalloc_cast.cocci +++ /dev/null @@ -1,67 +0,0 @@ -/// -/// Casting (void *) value returned by kmalloc is useless -/// as mentioned in Documentation/CodingStyle, Chap 14. -/// -// Confidence: High -// Copyright: 2009,2010 Nicolas Palix, DIKU. GPLv2. -// URL: http://coccinelle.lip6.fr/ -// Options: -no_includes -include_headers -// -// Keywords: kmalloc, kzalloc, kcalloc -// Version min: < 2.6.12 kmalloc -// Version min: < 2.6.12 kcalloc -// Version min: 2.6.14 kzalloc -// - -virtual context -virtual patch -virtual org -virtual report - -//---------------------------------------------------------- -// For context mode -//---------------------------------------------------------- - -@depends on context@ -type T; -@@ - -* (T *) - \(kmalloc\|kzalloc\|kcalloc\)(...) - -//---------------------------------------------------------- -// For patch mode -//---------------------------------------------------------- - -@depends on patch@ -type T; -@@ - -- (T *) - ...
Find duplicate field initializations. This has a high rate of false positives due to #ifdefs, which Coccinelle is not aware of in a structure initialization. Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/misc/doubleinit.cocci | 53 ++++++++++++++++++++++++++++++ 1 files changed, 53 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/misc/doubleinit.cocci diff --git a/scripts/coccinelle/misc/doubleinit.cocci b/scripts/coccinelle/misc/doubleinit.cocci new file mode 100644 index 0000000..55d7dc1 --- /dev/null +++ b/scripts/coccinelle/misc/doubleinit.cocci @@ -0,0 +1,53 @@ +/// Find duplicate field initializations. This has a high rate of false +/// positives due to #ifdefs, which Coccinelle is not aware of in a structure +/// initialization. +/// +// Confidence: Low +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual org +virtual report + +@r@ +identifier I, s, fld; +position p0,p; +expression E; +@@ + +struct I s =@p0 { ... .fld@p = E, ...}; + +@s@ +identifier I, s, r.fld; +position r.p0,p; +expression E; +@@ + +struct I s =@p0 { ... .fld@p = E, ...}; + +@script:python depends on org@ +p0 << r.p0; +fld << r.fld; +ps << s.p; +pr << r.p; +@@ + +if int(ps[0].line) < int(pr[0].line) or (int(ps[0].line) == int(pr[0].line) and int(ps[0].column) < int(pr[0].column)): + cocci.print_main(fld,p0) + cocci.print_secs("s",ps) + cocci.print_secs("r",pr) + +@script:python depends on report@ +p0 << r.p0; +fld << r.fld; +ps << s.p; +pr << r.p; +@@ + +if int(ps[0].line) < int(pr[0].line) or (int(ps[0].line) == int(pr[0].line) and int(ps[0].column) < int(pr[0].column)): + msg = "%s: first occurrence %s, second occurrence %s" % (fld,ps[0].line,pr[0].line) + ...
Find missing unlocks. This semantic match considers the specific case where the unlock is missing from an if branch, and there is a lock before the if and an unlock after the if. False positives are due to cases where the if branch represents a case where the function is supposed to exit with the lock held, or where there is some preceding function call that releases the lock. Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/locks/mini_lock.cocci | 95 ++++++++++++++++++++++++++++++ 1 files changed, 95 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/locks/mini_lock.cocci diff --git a/scripts/coccinelle/locks/mini_lock.cocci b/scripts/coccinelle/locks/mini_lock.cocci new file mode 100644 index 0000000..7641a29 --- /dev/null +++ b/scripts/coccinelle/locks/mini_lock.cocci @@ -0,0 +1,95 @@ +/// Find missing unlocks. This semantic match considers the specific case +/// where the unlock is missing from an if branch, and there is a lock +/// before the if and an unlock after the if. False positives are due to +/// cases where the if branch represents a case where the function is +/// supposed to exit with the lock held, or where there is some preceding +/// function call that releases the lock. +/// +// Confidence: Moderate +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual org +virtual report + +@prelocked@ +position p1,p; +expression E1; +@@ + +( +mutex_lock@p1 +| +mutex_trylock@p1 +| +spin_lock@p1 +| +spin_trylock@p1 +| +read_lock@p1 +| +read_trylock@p1 +| +write_lock@p1 +| +write_trylock@p1 +| +read_lock_irq@p1 +| +write_lock_irq@p1 +| +read_lock_irqsave@p1 +| +write_lock_irqsave@p1 +| +spin_lock_irq@p1 +| +spin_lock_irqsave@p1 +) ...
for_each_node iterators only exit normally when the loop cursor is NULL, so there is no point to call of_node_put on the final value. Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/iterators/fen.cocci | 64 ++++++++++++++++++++++++++++++++ 1 files changed, 64 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/iterators/fen.cocci diff --git a/scripts/coccinelle/iterators/fen.cocci b/scripts/coccinelle/iterators/fen.cocci new file mode 100644 index 0000000..77bc108 --- /dev/null +++ b/scripts/coccinelle/iterators/fen.cocci @@ -0,0 +1,64 @@ +/// These iterators only exit normally when the loop cursor is NULL, so there +/// is no point to call of_node_put on the final value. +/// +// Confidence: High +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual patch + +@@ +iterator name for_each_node_by_name; +expression np,E; +identifier l; +@@ + +for_each_node_by_name(np,...) { + ... when != break; + when != goto l; +} +... when != np = E +- of_node_put(np); + +@@ +iterator name for_each_node_by_type; +expression np,E; +identifier l; +@@ + +for_each_node_by_type(np,...) { + ... when != break; + when != goto l; +} +... when != np = E +- of_node_put(np); + +@@ +iterator name for_each_compatible_node; +expression np,E; +identifier l; +@@ + +for_each_compatible_node(np,...) { + ... when != break; + when != goto l; +} +... when != np = E +- of_node_put(np); + +@@ +iterator name for_each_matching_node; +expression np,E; +identifier l; +@@ + +for_each_matching_node(np,...) { + ... when != break; + when != goto l; +} +... when != np = E +- of_node_put(np); -- 1.7.0.4 --
list_for_each_entry uses its first argument to get from one element of the list to the next, so it is usually not a good idea to reassign it. The first rule finds such a reassignment and the second rule checks that there is a path from the reassignment back to the top of the loop. Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- .../coccinelle/iterators/list_entry_update.cocci | 62 ++++++++++++++++++++ 1 files changed, 62 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/iterators/list_entry_update.cocci diff --git a/scripts/coccinelle/iterators/list_entry_update.cocci b/scripts/coccinelle/iterators/list_entry_update.cocci new file mode 100644 index 0000000..b296747 --- /dev/null +++ b/scripts/coccinelle/iterators/list_entry_update.cocci @@ -0,0 +1,62 @@ +/// list_for_each_entry uses its first argument to get from one element of +/// the list to the next, so it is usually not a good idea to reassign it. +/// The first rule finds such a reassignment and the second rule checks +/// that there is a path from the reassignment back to the top of the loop. +/// +// Confidence: High +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual context +virtual org +virtual report + +@r@ +iterator name list_for_each_entry; +expression x,E; +position p1,p2; +@@ + +list_for_each_entry@p1(x,...) { <... x =@p2 E ...> } + +@depends on context && !org && !report@ +expression x,E; +position r.p1,r.p2; +statement S; +@@ + +*x =@p2 E +... +list_for_each_entry@p1(x,...) S + +// ------------------------------------------------------------------------ + +@back depends on (org || report) && !context exists@ +expression x,E; +position r.p1,r.p2; +statement S; +@@ + +x =@p2 ...
Find confusingly indented code in or after an if. An if branch should be indented. The code following an if should not be indented. Sometimes, code after an if that is indented is actually intended to be part of the if branch. This has a high rate of false positives, because Coccinelle's column calculation does not distinguish between spaces and tabs, so code that is not visually aligned may be considered to be in the same column. Signed-off-by: Nicolas Palix <npalix@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> --- scripts/coccinelle/misc/ifcol.cocci | 48 +++++++++++++++++++++++++++++++++++ 1 files changed, 48 insertions(+), 0 deletions(-) create mode 100644 scripts/coccinelle/misc/ifcol.cocci diff --git a/scripts/coccinelle/misc/ifcol.cocci b/scripts/coccinelle/misc/ifcol.cocci new file mode 100644 index 0000000..b7ed91d --- /dev/null +++ b/scripts/coccinelle/misc/ifcol.cocci @@ -0,0 +1,48 @@ +/// Find confusingly indented code in or after an if. An if branch should +/// be indented. The code following an if should not be indented. +/// Sometimes, code after an if that is indented is actually intended to be +/// part of the if branch. +/// +/// This has a high rate of false positives, because Coccinelle's column +/// calculation does not distinguish between spaces and tabs, so code that +/// is not visually aligned may be considered to be in the same column. +/// +// Confidence: Low +// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. +// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. +// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Comments: +// Options: -no_includes -include_headers + +virtual org +virtual report + +@r disable braces4@ +position p1,p2; +statement S1,S2; +@@ + +( +if (...) { ... } +| +if (...) S1@p1 S2@p2 +) + +@script:python depends on org@ +p1 << r.p1; +p2 << r.p2; +@@ + +if (p1[0].column == p2[0].column): + cocci.print_main("branch",p1) + ...
