xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'for-5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux

Browse Source 
Pull coccinelle updates from Julia Lawall.

* 'for-5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux:
  coccinelle: api: add kfree_mismatch script
  coccinelle: iterators: Add for_each_child.cocci script
  scripts: coccicheck: Change default condition for parallelism
  scripts: coccicheck: Add quotes to improve portability
  coccinelle: api: kfree_sensitive: print memset position
  coccinelle: misc: add flexible_array.cocci script
  coccinelle: api: add kvmalloc script
  scripts: coccicheck: Change default value for parallelism
  coccinelle: misc: add excluded_middle.cocci script
  scripts: coccicheck: Improve error feedback when coccicheck fails
  coccinelle: api: update kzfree script to kfree_sensitive
  coccinelle: misc: add uninitialized_var.cocci script
  coccinelle: ifnullfree: add vfree(), kvfree*() functions
  coccinelle: api: add kobj_to_dev.cocci script
  coccinelle: add patch rule for dma_alloc_coherent
  scripts: coccicheck: Add chain mode to list of modes
This commit is contained in:
Linus Torvalds
2020-10-18 14:20:35 -07:00
parent 1912b04e0f edc05fe555
commit f66179ca7a
11 changed files with 1118 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
scripts/coccinelle/api/alloc/zalloc-simple.cocci
View File

@@ -127,6 +127,16 @@ statement S;
if ((x==NULL) || ...) S
- memset((T2)x,0,E1);
@depends on patch@
type T, T2;
expression x;
expression E1,E2,E3,E4;
statement S;
@@
x = (T)dma_alloc_coherent(E1, E2, E3, E4);
if ((x==NULL) || ...) S
- memset((T2)x, 0, E2);
//----------------------------------------------------------
// For org mode
//----------------------------------------------------------
@@ -199,9 +209,9 @@ statement S;
position p;
@@
x = (T)dma_alloc_coherent@p(E2,E1,E3,E4);
x = (T)dma_alloc_coherent@p(E1,E2,E3,E4);
if ((x==NULL) || ...) S
memset((T2)x,0,E1);
memset((T2)x,0,E2);
@script:python depends on org@
p << r2.p;
@@ -217,7 +227,7 @@ p << r2.p;
x << r2.x;
@@
msg="WARNING: dma_alloc_coherent use in %s already zeroes out memory, so memset is not needed" % (x)
msg="WARNING: dma_alloc_coherent used in %s already zeroes out memory, so memset is not needed" % (x)
coccilib.report.print_report(p[0], msg)
//-----------------------------------------------------------------

228
scripts/coccinelle/api/kfree_mismatch.cocci Normal file
View File

@@ -0,0 +1,228 @@
// SPDX-License-Identifier: GPL-2.0-only
///
/// Check that kvmalloc'ed memory is freed by kfree functions,
/// vmalloc'ed by vfree functions and kvmalloc'ed by kvfree
/// functions.
///
// Confidence: High
// Copyright: (C) 2020 Denis Efremov ISPRAS
// Options: --no-includes --include-headers
//
virtual patch
virtual report
virtual org
virtual context
@alloc@
expression E, E1;
position kok, vok;
@@
(
if (...) {
...
E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\|
kmalloc_node\|kzalloc_node\|kmalloc_array\|
kmalloc_array_node\|kcalloc_node\)(...)@kok
...
} else {
...
E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|
vzalloc_node\|vmalloc_exec\|vmalloc_32\|
vmalloc_32_user\|__vmalloc\|__vmalloc_node_range\|
__vmalloc_node\)(...)@vok
...
}
|
E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\|kmalloc_node\|kzalloc_node\|
kmalloc_array\|kmalloc_array_node\|kcalloc_node\)(...)@kok
... when != E = E1
when any
if (E == NULL) {
...
E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|
vzalloc_node\|vmalloc_exec\|vmalloc_32\|
vmalloc_32_user\|__vmalloc\|__vmalloc_node_range\|
__vmalloc_node\)(...)@vok
...
}
)
@free@
expression E;
position fok;
@@
E = \(kvmalloc\|kvzalloc\|kvcalloc\|kvzalloc_node\|kvmalloc_node\|
kvmalloc_array\)(...)
...
kvfree(E)@fok
@vfree depends on !patch@
expression E;
position a != alloc.kok;
position f != free.fok;
@@
* E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\|kmalloc_node\|
* kzalloc_node\|kmalloc_array\|kmalloc_array_node\|
* kcalloc_node\)(...)@a
... when != if (...) { ... E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|vzalloc_node\|vmalloc_exec\|vmalloc_32\|vmalloc_32_user\|__vmalloc\|__vmalloc_node_range\|__vmalloc_node\)(...); ... }
when != is_vmalloc_addr(E)
when any
* \(vfree\|vfree_atomic\|kvfree\)(E)@f
@depends on patch exists@
expression E;
position a != alloc.kok;
position f != free.fok;
@@
E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\|kmalloc_node\|
kzalloc_node\|kmalloc_array\|kmalloc_array_node\|
kcalloc_node\)(...)@a
... when != if (...) { ... E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|vzalloc_node\|vmalloc_exec\|vmalloc_32\|vmalloc_32_user\|__vmalloc\|__vmalloc_node_range\|__vmalloc_node\)(...); ... }
when != is_vmalloc_addr(E)
when any
- \(vfree\|vfree_atomic\|kvfree\)(E)@f
+ kfree(E)
@kfree depends on !patch@
expression E;
position a != alloc.vok;
position f != free.fok;
@@
* E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|vzalloc_node\|
* vmalloc_exec\|vmalloc_32\|vmalloc_32_user\|__vmalloc\|
* __vmalloc_node_range\|__vmalloc_node\)(...)@a
... when != is_vmalloc_addr(E)
when any
* \(kfree\|kfree_sensitive\|kvfree\)(E)@f
@depends on patch exists@
expression E;
position a != alloc.vok;
position f != free.fok;
@@
E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|vzalloc_node\|
vmalloc_exec\|vmalloc_32\|vmalloc_32_user\|__vmalloc\|
__vmalloc_node_range\|__vmalloc_node\)(...)@a
... when != is_vmalloc_addr(E)
when any
- \(kfree\|kvfree\)(E)@f
+ vfree(E)
@kvfree depends on !patch@
expression E;
position a, f;
@@
* E = \(kvmalloc\|kvzalloc\|kvcalloc\|kvzalloc_node\|kvmalloc_node\|
* kvmalloc_array\)(...)@a
... when != is_vmalloc_addr(E)
when any
* \(kfree\|kfree_sensitive\|vfree\|vfree_atomic\)(E)@f
@depends on patch exists@
expression E;
@@
E = \(kvmalloc\|kvzalloc\|kvcalloc\|kvzalloc_node\|kvmalloc_node\|
kvmalloc_array\)(...)
... when != is_vmalloc_addr(E)
when any
- \(kfree\|vfree\)(E)
+ kvfree(E)
@kvfree_switch depends on !patch@
expression alloc.E;
position f;
@@
... when != is_vmalloc_addr(E)
when any
* \(kfree\|kfree_sensitive\|vfree\|vfree_atomic\)(E)@f
@depends on patch exists@
expression alloc.E;
position f;
@@
... when != is_vmalloc_addr(E)
when any
(
- \(kfree\|vfree\)(E)@f
+ kvfree(E)
|
- kfree_sensitive(E)@f
+ kvfree_sensitive(E)
)
@script: python depends on report@
a << vfree.a;
f << vfree.f;
@@
msg = "WARNING kmalloc is used to allocate this memory at line %s" % (a[0].line)
coccilib.report.print_report(f[0], msg)
@script: python depends on org@
a << vfree.a;
f << vfree.f;
@@
msg = "WARNING kmalloc is used to allocate this memory at line %s" % (a[0].line)
coccilib.org.print_todo(f[0], msg)
@script: python depends on report@
a << kfree.a;
f << kfree.f;
@@
msg = "WARNING vmalloc is used to allocate this memory at line %s" % (a[0].line)
coccilib.report.print_report(f[0], msg)
@script: python depends on org@
a << kfree.a;
f << kfree.f;
@@
msg = "WARNING vmalloc is used to allocate this memory at line %s" % (a[0].line)
coccilib.org.print_todo(f[0], msg)
@script: python depends on report@
a << kvfree.a;
f << kvfree.f;
@@
msg = "WARNING kvmalloc is used to allocate this memory at line %s" % (a[0].line)
coccilib.report.print_report(f[0], msg)
@script: python depends on org@
a << kvfree.a;
f << kvfree.f;
@@
msg = "WARNING kvmalloc is used to allocate this memory at line %s" % (a[0].line)
coccilib.org.print_todo(f[0], msg)
@script: python depends on report@
ka << alloc.kok;
va << alloc.vok;
f << kvfree_switch.f;
@@
msg = "WARNING kmalloc (line %s) && vmalloc (line %s) are used to allocate this memory" % (ka[0].line, va[0].line)
coccilib.report.print_report(f[0], msg)
@script: python depends on org@
ka << alloc.kok;
va << alloc.vok;
f << kvfree_switch.f;
@@
msg = "WARNING kmalloc (line %s) && vmalloc (line %s) are used to allocate this memory" % (ka[0].line, va[0].line)
coccilib.org.print_todo(f[0], msg)

35
scripts/coccinelle/api/kzfree.cocci → scripts/coccinelle/api/kfree_sensitive.cocci
View File

@@ -1,13 +1,13 @@
// SPDX-License-Identifier: GPL-2.0-only
///
/// Use kzfree, kvfree_sensitive rather than memset or
/// memzero_explicit followed by kfree
/// Use kfree_sensitive, kvfree_sensitive rather than memset or
/// memzero_explicit followed by kfree.
///
// Confidence: High
// Copyright: (C) 2020 Denis Efremov ISPRAS
// Options: --no-includes --include-headers
//
// Keywords: kzfree, kvfree_sensitive
// Keywords: kfree_sensitive, kvfree_sensitive
//
virtual context
@@ -18,7 +18,8 @@ virtual report
@initialize:python@
@@
# kmalloc_oob_in_memset uses memset to explicitly trigger out-of-bounds access
filter = frozenset(['kmalloc_oob_in_memset', 'kzfree', 'kvfree_sensitive'])
filter = frozenset(['kmalloc_oob_in_memset',
'kfree_sensitive', 'kvfree_sensitive'])
def relevant(p):
return not (filter & {el.current_element for el in p})
@@ -56,17 +57,13 @@ type T;
- memzero_explicit@m((T)E, size);
... when != E
when strict
// TODO: uncomment when kfree_sensitive will be merged.
// Only this case is commented out because developers
// may not like patches like this since kzfree uses memset
// internally (not memzero_explicit).
//(
//- kfree(E)@p;
//+ kfree_sensitive(E);
//|
(
- kfree(E)@p;
+ kfree_sensitive(E);
|
- \(vfree\|kvfree\)(E)@p;
+ kvfree_sensitive(E, size);
//)
)
@rp_memset depends on patch@
expression E, size;
@@ -80,7 +77,7 @@ type T;
when strict
(
- kfree(E)@p;
+ kzfree(E);
+ kfree_sensitive(E);
|
- \(vfree\|kvfree\)(E)@p;
+ kvfree_sensitive(E, size);
@@ -88,14 +85,16 @@ type T;
@script:python depends on report@
p << r.p;
m << r.m;
@@
coccilib.report.print_report(p[0],
"WARNING: opportunity for kzfree/kvfree_sensitive")
msg = "WARNING opportunity for kfree_sensitive/kvfree_sensitive (memset at line %s)"
coccilib.report.print_report(p[0], msg % (m[0].line))
@script:python depends on org@
p << r.p;
m << r.m;
@@
coccilib.org.print_todo(p[0],
"WARNING: opportunity for kzfree/kvfree_sensitive")
msg = "WARNING opportunity for kfree_sensitive/kvfree_sensitive (memset at line %s)"
coccilib.org.print_todo(p[0], msg % (m[0].line))

45
scripts/coccinelle/api/kobj_to_dev.cocci Normal file
View File

@@ -0,0 +1,45 @@
// SPDX-License-Identifier: GPL-2.0-only
///
/// Use kobj_to_dev() instead of container_of()
///
// Confidence: High
// Copyright: (C) 2020 Denis Efremov ISPRAS
// Options: --no-includes --include-headers
//
// Keywords: kobj_to_dev, container_of
//
virtual context
virtual report
virtual org
virtual patch
@r depends on !patch@
expression ptr;
symbol kobj;
position p;
@@
* container_of(ptr, struct device, kobj)@p
@depends on patch@
expression ptr;
@@
- container_of(ptr, struct device, kobj)
+ kobj_to_dev(ptr)
@script:python depends on report@
p << r.p;
@@
coccilib.report.print_report(p[0], "WARNING opportunity for kobj_to_dev()")
@script:python depends on org@
p << r.p;
@@
coccilib.org.print_todo(p[0], "WARNING opportunity for kobj_to_dev()")

256
scripts/coccinelle/api/kvmalloc.cocci Normal file
View File

@@ -0,0 +1,256 @@
// SPDX-License-Identifier: GPL-2.0-only
///
/// Find if/else condition with kmalloc/vmalloc calls.
/// Suggest to use kvmalloc instead. Same for kvfree.
///
// Confidence: High
// Copyright: (C) 2020 Denis Efremov ISPRAS
// Options: --no-includes --include-headers
//
virtual patch
virtual report
virtual org
virtual context
@initialize:python@
@@
filter = frozenset(['kvfree'])
def relevant(p):
return not (filter & {el.current_element for el in p})
@kvmalloc depends on !patch@
expression E, E1, size;
identifier flags;
binary operator cmp = {<=, <, ==, >, >=};
identifier x;
type T;
position p;
@@
(
* if (size cmp E1 || ...)@p {
...
* E = \(kmalloc\|kzalloc\|kcalloc\|kmalloc_node\|kzalloc_node\|
* kmalloc_array\|kmalloc_array_node\|kcalloc_node\)
* (..., size, \(flags\|GFP_KERNEL\|\(GFP_KERNEL\|flags\)|__GFP_NOWARN\), ...)
...
} else {
...
* E = \(vmalloc\|vzalloc\|vmalloc_node\|vzalloc_node\)(..., size, ...)
...
}
|
* E = \(kmalloc\|kzalloc\|kcalloc\|kmalloc_node\|kzalloc_node\|
* kmalloc_array\|kmalloc_array_node\|kcalloc_node\)
* (..., size, \(flags\|GFP_KERNEL\|\(GFP_KERNEL\|flags\)|__GFP_NOWARN\), ...)
... when != E = E1
when != size = E1
when any
* if (E == NULL)@p {
...
* E = \(vmalloc\|vzalloc\|vmalloc_node\|vzalloc_node\)(..., size, ...)
...
}
|
* T x = \(kmalloc\|kzalloc\|kcalloc\|kmalloc_node\|kzalloc_node\|
* kmalloc_array\|kmalloc_array_node\|kcalloc_node\)
* (..., size, \(flags\|GFP_KERNEL\|\(GFP_KERNEL\|flags\)|__GFP_NOWARN\), ...);
... when != x = E1
when != size = E1
when any
* if (x == NULL)@p {
...
* x = \(vmalloc\|vzalloc\|vmalloc_node\|vzalloc_node\)(..., size, ...)
...
}
)
@kvfree depends on !patch@
expression E;
position p : script:python() { relevant(p) };
@@
* if (is_vmalloc_addr(E))@p {
...
* vfree(E)
...
} else {
... when != krealloc(E, ...)
when any
* \(kfree\|kzfree\)(E)
...
}
@depends on patch@
expression E, E1, size, node;
binary operator cmp = {<=, <, ==, >, >=};
identifier flags, x;
type T;
@@
(
- if (size cmp E1)
- E = kmalloc(size, flags);
- else
- E = vmalloc(size);
+ E = kvmalloc(size, flags);
|
- if (size cmp E1)
- E = kmalloc(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\));
- else
- E = vmalloc(size);
+ E = kvmalloc(size, GFP_KERNEL);
|
- E = kmalloc(size, flags | __GFP_NOWARN);
- if (E == NULL)
- E = vmalloc(size);
+ E = kvmalloc(size, flags);
|
- E = kmalloc(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\));
- if (E == NULL)
- E = vmalloc(size);
+ E = kvmalloc(size, GFP_KERNEL);
|
- T x = kmalloc(size, flags | __GFP_NOWARN);
- if (x == NULL)
- x = vmalloc(size);
+ T x = kvmalloc(size, flags);
|
- T x = kmalloc(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\));
- if (x == NULL)
- x = vmalloc(size);
+ T x = kvmalloc(size, GFP_KERNEL);
|
- if (size cmp E1)
- E = kzalloc(size, flags);
- else
- E = vzalloc(size);
+ E = kvzalloc(size, flags);
|
- if (size cmp E1)
- E = kzalloc(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\));
- else
- E = vzalloc(size);
+ E = kvzalloc(size, GFP_KERNEL);
|
- E = kzalloc(size, flags | __GFP_NOWARN);
- if (E == NULL)
- E = vzalloc(size);
+ E = kvzalloc(size, flags);
|
- E = kzalloc(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\));
- if (E == NULL)
- E = vzalloc(size);
+ E = kvzalloc(size, GFP_KERNEL);
|
- T x = kzalloc(size, flags | __GFP_NOWARN);
- if (x == NULL)
- x = vzalloc(size);
+ T x = kvzalloc(size, flags);
|
- T x = kzalloc(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\));
- if (x == NULL)
- x = vzalloc(size);
+ T x = kvzalloc(size, GFP_KERNEL);
|
- if (size cmp E1)
- E = kmalloc_node(size, flags, node);
- else
- E = vmalloc_node(size, node);
+ E = kvmalloc_node(size, flags, node);
|
- if (size cmp E1)
- E = kmalloc_node(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\), node);
- else
- E = vmalloc_node(size, node);
+ E = kvmalloc_node(size, GFP_KERNEL, node);
|
- E = kmalloc_node(size, flags | __GFP_NOWARN, node);
- if (E == NULL)
- E = vmalloc_node(size, node);
+ E = kvmalloc_node(size, flags, node);
|
- E = kmalloc_node(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\), node);
- if (E == NULL)
- E = vmalloc_node(size, node);
+ E = kvmalloc_node(size, GFP_KERNEL, node);
|
- T x = kmalloc_node(size, flags | __GFP_NOWARN, node);
- if (x == NULL)
- x = vmalloc_node(size, node);
+ T x = kvmalloc_node(size, flags, node);
|
- T x = kmalloc_node(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\), node);
- if (x == NULL)
- x = vmalloc_node(size, node);
+ T x = kvmalloc_node(size, GFP_KERNEL, node);
|
- if (size cmp E1)
- E = kvzalloc_node(size, flags, node);
- else
- E = vzalloc_node(size, node);
+ E = kvzalloc_node(size, flags, node);
|
- if (size cmp E1)
- E = kvzalloc_node(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\), node);
- else
- E = vzalloc_node(size, node);
+ E = kvzalloc_node(size, GFP_KERNEL, node);
|
- E = kvzalloc_node(size, flags | __GFP_NOWARN, node);
- if (E == NULL)
- E = vzalloc_node(size, node);
+ E = kvzalloc_node(size, flags, node);
|
- E = kvzalloc_node(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\), node);
- if (E == NULL)
- E = vzalloc_node(size, node);
+ E = kvzalloc_node(size, GFP_KERNEL, node);
|
- T x = kvzalloc_node(size, flags | __GFP_NOWARN, node);
- if (x == NULL)
- x = vzalloc_node(size, node);
+ T x = kvzalloc_node(size, flags, node);
|
- T x = kvzalloc_node(size, \(GFP_KERNEL\|GFP_KERNEL|__GFP_NOWARN\), node);
- if (x == NULL)
- x = vzalloc_node(size, node);
+ T x = kvzalloc_node(size, GFP_KERNEL, node);
)
@depends on patch@
expression E;
position p : script:python() { relevant(p) };
@@
- if (is_vmalloc_addr(E))@p
- vfree(E);
- else
- kfree(E);
+ kvfree(E);
@script: python depends on report@
p << kvmalloc.p;
@@
coccilib.report.print_report(p[0], "WARNING opportunity for kvmalloc")
@script: python depends on org@
p << kvmalloc.p;
@@
coccilib.org.print_todo(p[0], "WARNING opportunity for kvmalloc")
@script: python depends on report@
p << kvfree.p;
@@
coccilib.report.print_report(p[0], "WARNING opportunity for kvfree")
@script: python depends on org@
p << kvfree.p;
@@
coccilib.org.print_todo(p[0], "WARNING opportunity for kvfree")