coccinelle: catchup on memory allocation functions
v2 cover coccinelle: catchup on memory allocation functions
Hi,
Please find updated patches that remove coccicheck's blindness regarding the following functions:
- kzfree()
- krealloc()
- __krealloc()
- devm_kmalloc()
- devm_kvasprintf()
- devm_kasprintf()
- devm_kmalloc_array()
- devm_kcalloc()
- devm_kstrdup()
- devm_kmemdup()
- devm_get_free_pages()
- free_pages()
- free_page()
Changes since v1 [1]:
- add kzfree() to ifnullfree.cocci
- added acked-by
(note: v1 was a single patch update to v0)
Changes since v0 [2]:
- don't use regular expression in kfree.cocci
[1] http://lkml.kernel.org/r/1456150168-24028-1-git-send-email-ydroneaud at opteya.com
[2] http://lkml.kernel.org/r/cover.1455638829.git.ydroneaud at opteya.com
Regards.
Yann Droneaud (3):
coccinelle: also catch kzfree() issues
coccinelle: recognize more devm_* memory allocation functions
coccinelle: catch krealloc() on devm_*() allocated memory
scripts/coccinelle/free/devm_free.cocci | 26 ++++++++++++++++++++++++++ scripts/coccinelle/free/ifnullfree.cocci | 4 +++- scripts/coccinelle/free/kfree.cocci | 18 +++++++++++++++--- scripts/coccinelle/free/kfreeaddr.cocci | 6 +++++- 4 files changed, 49 insertions(+), 5 deletions(-)
Signature · 1 line
2.7.4
PATCH v2 1/3 coccinelle: also catch kzfree() issues
Since commit 3ef0e5ba4673 ('slab: introduce kzfree()'), kfree() is no more the only function to be considered:kzfree() should be recognized too.
In particular, kzfree() must not be called on memory allocated through devm_*() functions.
--- scripts/coccinelle/free/devm_free.cocci | 2 ++ scripts/coccinelle/free/ifnullfree.cocci | 4 +++- scripts/coccinelle/free/kfree.cocci | 18 +++++++++++++++--- scripts/coccinelle/free/kfreeaddr.cocci | 6 +++++- 4 files changed, 25 insertions(+), 5 deletions(-)
scripts/coccinelle/free/devm_free.cocci +2 -0
@@ -48,6 +48,8 @@ position p; ( * kfree at p(x) | +* kzfree at p(x) +| * free_irq at p(x) | * iounmap at p(x)
scripts/coccinelle/free/ifnullfree.cocci +3 -1
@@ -20,6 +20,8 @@ expression E; ( kfree(E); | + kzfree(E); +| debugfs_remove(E); | debugfs_remove_recursive(E);
@@ -39,7 +41,7 @@ position p; @@ * if (E != NULL) -* \(kfree at p\|debugfs_remove at p\|debugfs_remove_recursive at p\| +* \(kfree at p\|kzfree at p\|debugfs_remove at p\|debugfs_remove_recursive at p\| * usb_free_urb at p\|kmem_cache_destroy at p\|mempool_destroy at p\| * dma_pool_destroy at p\)(E);
scripts/coccinelle/free/kfree.cocci +15 -3
@@ -20,7 +20,11 @@ expression E; position p1; @@ -kfree at p1(E) +( +* kfree at p1(E) +| +* kzfree at p1(E) +) @print expression@ constant char [] c;
@@ -60,7 +64,11 @@ position ok; @@ while (1) { ... - kfree at ok(E) +( +* kfree at ok(E) +| +* kzfree at ok(E) +) ... when != break; when != goto l; when forall
@@ -74,7 +82,11 @@ statement S; position free.p1!=loop.ok,p2!={print.p,sz.p}; @@ -kfree at p1(E,...) +( +* kfree at p1(E,...) +| +* kzfree at p1(E,...) +) ... ( iter(...,subE,...) S // no use
scripts/coccinelle/free/kfreeaddr.cocci +5 -1
@@ -16,7 +16,11 @@ identifier f; position p; @@ +( * kfree at p(&e->f) +| +* kzfree at p(&e->f) +) @script:python depends on org@ p << r.p;
@@ -28,5 +32,5 @@ cocci.print_main("kfree",p) p << r.p; @@ -msg = "ERROR: kfree of structure field" +msg = "ERROR: invalid free of structure field" coccilib.report.print_report(p[0],msg)
Signature · 1 line
2.7.4
Re: [PATCH v2 1/3] coccinelle: also catch kzfree() issues
Quoted 9 lines · Yann Droneaud
Since commit
3ef0e5ba4673('slab: introducekzfree()'),kfree()is no more the only function to be considered:kzfree()should be recognized too.In particular,
kzfree()must not be called on memory allocated through devm_*() functions.Cc Johannes Weiner <[email protected]>Signed-off-by Yann Droneaud <[email protected]>
Quoted 112 lines
--- scripts/coccinelle/free/devm_free.cocci | 2 ++ scripts/coccinelle/free/ifnullfree.cocci | 4 +++- scripts/coccinelle/free/kfree.cocci | 18 +++++++++++++++--- scripts/coccinelle/free/kfreeaddr.cocci | 6 +++++- 4 files changed, 25 insertions(+), 5 deletions(-)scripts/coccinelle/free/devm_free.cocci +2
-0@@ -48,6 +48,8 @@ position p; ( * kfree at p(x) | +* kzfree at p(x) +| * free_irq at p(x) | * iounmap at p(x)scripts/coccinelle/free/ifnullfree.cocci +3
-1@@ -20,6 +20,8 @@ expression E; ( kfree(E); | + kzfree(E); +| debugfs_remove(E); | debugfs_remove_recursive(E);@@ -39,7 +41,7 @@ position p; @@ * if (E != NULL) -* \(kfree at p\|debugfs_remove at p\|debugfs_remove_recursive at p\| +* \(kfree at p\|kzfree at p\|debugfs_remove at p\|debugfs_remove_recursive at p\| * usb_free_urb at p\|kmem_cache_destroy at p\|mempool_destroy at p\| * dma_pool_destroy at p\)(E);scripts/coccinelle/free/kfree.cocci +15
-3@@ -20,7 +20,11 @@ expression E; position p1; @@ -kfree at p1(E) +( +* kfree at p1(E) +| +* kzfree at p1(E) +) @print expression@ constant char [] c;@@ -60,7 +64,11 @@ position ok; @@ while (1) { ... - kfree at ok(E) +( +* kfree at ok(E) +| +* kzfree at ok(E) +) ... when != break; when != goto l; when forall@@ -74,7 +82,11 @@ statement S; position free.p1!=loop.ok,p2!={print.p,sz.p}; @@ -kfree at p1(E,...) +( +* kfree at p1(E,...) +| +* kzfree at p1(E,...) +) ( iter(...,subE,...) S // no usescripts/coccinelle/free/kfreeaddr.cocci +5
-2@@ -16,7 +16,11 @@ identifier f; position p; @@ +( * kfree at p(&e->f) +| +* kzfree at p(&e->f) +) @script:python depends on org@ p << r.p;@@ -28,5 +32,5 @@ cocci.print_main("kfree",p) p << r.p; @@ -msg = "ERROR: kfree of structure field" +msg = "ERROR: invalid free of structure field" coccilib.report.print_report(p[0],msg) --2.7.4
Re: [PATCH v2 1/3] coccinelle: also catch kzfree() issues
Quoted 8 lines · Julia Lawall
Quoted 4 lines · Yann Droneaud
Since commit
3ef0e5ba4673('slab: introducekzfree()'),kfree()is no more the only function to be considered:kzfree()should be recognized too.
Quoted 7 lines
Quoted 5 lines
In particular,
kzfree()must not be called on memory allocated through devm_*() functions.Cc Johannes Weiner <[email protected]>Signed-off-by Yann Droneaud <[email protected]>Acked-by Julia Lawall <[email protected]>
Hi Julia,
does your ACK apply to the other two patches as well?
Thanks,
Michal
Re: [PATCH v2 1/3] coccinelle: also catch kzfree() issues
Quoted 12 lines · Michal Marek
Quoted 11 lines · Julia Lawall
Quoted 7 lines · Yann Droneaud
Since commit
3ef0e5ba4673('slab: introducekzfree()'),kfree()is no more the only function to be considered:kzfree()should be recognized too.In particular,
kzfree()must not be called on memory allocated through devm_*() functions.
Quoted 8 lines
Quoted 4 lines
Quoted 2 lines
Cc Johannes Weiner <[email protected]>Signed-off-by Yann Droneaud <[email protected]>Acked-by Julia Lawall <[email protected]>Hi Julia,
does your ACK apply to the other two patches as well?
Sorry, I seem to have missed the other two. I have reviewed them now, and the ack applies to all three. Thanks for checking on it.
julia
Re: [PATCH v2 1/3] coccinelle: also catch kzfree() issues
Dne 20.6.2016 v 22:21 Julia Lawall napsal(a):
Quoted 19 lines · Michal Marek
Quoted 16 lines · Julia Lawall
Quoted 14 lines · Yann Droneaud
Quoted 10 lines
Since commit
3ef0e5ba4673('slab: introducekzfree()'),kfree()is no more the only function to be considered:kzfree()should be recognized too.In particular,
kzfree()must not be called on memory allocated through devm_*() functions.Cc Johannes Weiner <[email protected]>Signed-off-by Yann Droneaud <[email protected]>
Quoted 8 lines
Quoted 5 lines
Quoted 1 line
Acked-by Julia Lawall <[email protected]>Hi Julia,
does your ACK apply to the other two patches as well?
Sorry, I seem to have missed the other two. I have reviewed them now, and the ack applies to all three. Thanks for checking on it.
Np. Applied to kbuild.git#misc now.
Michal
Re: [PATCH v2 1/3] coccinelle: also catch kzfree() issues
Hi,
Le mardi 21 juin 2016 ? 11:43 +0200, Michal Marek a ?crit?:
Quoted 24 lines
Dne 20.6.2016 v 22:21 Julia Lawall napsal(a):
Quoted 22 lines · Michal Marek
Quoted 9 lines · Julia Lawall
Quoted 9 lines · Yann Droneaud
Quoted 8 lines
Since commit
3ef0e5ba4673('slab: introducekzfree()'),kfree()is no more the only function to be considered:kzfree()should be recognized too.In particular,
kzfree()must not be called on memory allocated through devm_*() functions.Quoted 8 lines
Quoted 4 lines
Quoted 2 lines
Cc Johannes Weiner <[email protected]>Signed-off-by Yann Droneaud <[email protected]>Acked-by Julia Lawall <[email protected]>Hi Julia,
does your ACK apply to the other two patches as well?
Sorry, I seem to have missed the other two.??I have reviewed them now, and the ack applies to all three.??Thanks for checking on it.
Back in February, those two other patches were already Acked-by:
http://lkml.kernel.org/r/alpine.DEB.2.10.1602161818100.2685 at hadrien
http://lkml.kernel.org/r/alpine.DEB.2.10.1602161819340.2685 at hadrien
I've (re)sent them with added Acked-by:, and thought it would not require further Acked-by:.
Anyway, this one was new and required proper review. Thanks a lot.
Quoted 2 lines
Np. Applied to kbuild.git#misc now.
Thanks a lot.
--?
Yann Droneaud
OPTEYA
Re: [PATCH v2 1/3] coccinelle: also catch kzfree() issues
Quoted 30 lines · Yann Droneaud
Hi,
Le mardi 21 juin 2016 ? 11:43 +0200, Michal Marek a ?crit?:
Quoted 24 lines
Dne 20.6.2016 v 22:21 Julia Lawall napsal(a):
Quoted 22 lines · Michal Marek
Quoted 9 lines · Julia Lawall
Quoted 9 lines · Yann Droneaud
Quoted 8 lines
Since commit
3ef0e5ba4673('slab: introducekzfree()'),kfree()is no more the only function to be considered:kzfree()should be recognized too.In particular,
kzfree()must not be called on memory allocated through devm_*() functions.Quoted 8 lines
Quoted 4 lines
Quoted 2 lines
Cc Johannes Weiner <[email protected]>Signed-off-by Yann Droneaud <[email protected]>Acked-by Julia Lawall <[email protected]>Hi Julia,
does your ACK apply to the other two patches as well?
Sorry, I seem to have missed the other two.??I have reviewed them now, and the ack applies to all three.??Thanks for checking on it.
Back in February, those two other patches were already Acked-by:
Quoted 7 lines
http://lkml.kernel.org/r/alpine.DEB.2.10.1602161818100.2685 at hadrien
http://lkml.kernel.org/r/alpine.DEB.2.10.1602161819340.2685 at hadrienI've (re)sent them with added Acked-by:, and thought it would not require further Acked-by:.
Anyway, this one was new and required proper review. Thanks a lot.
Thanks for the reminder. Since they are comitted now, things are going in the right direction.
julia
PATCH v2 2/3 coccinelle: recognize more devm_* memory allocation functions
In reply to Yann DroneaudUpdates free/devm_free.cocci to recognize functions added by:
- commit 64c862a839a8 ('devres: add kernel standard devm_k.alloc functions')
- commit e31108cad3de ('devres: introduce API "devm_kstrdup"')
- commit 3046365bb470 ('devres: introduce API "devm_kmemdup')
- commit 43339bed7010 ('devres: Add devm_get_free_pages API')
- commit 75f2a4ead5d5 ('devres: Add devm_kasprintf and devm_kvasprintf API')
See also Documentation/driver-model/devres.txt
--- scripts/coccinelle/free/devm_free.cocci | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
scripts/coccinelle/free/devm_free.cocci +20 -0
@@ -29,8 +29,24 @@ expression x; @@ ( + x = devm_kmalloc(...) +| + x = devm_kvasprintf(...) +| + x = devm_kasprintf(...) +| x = devm_kzalloc(...) | + x = devm_kmalloc_array(...) +| + x = devm_kcalloc(...) +| + x = devm_kstrdup(...) +| + x = devm_kmemdup(...) +| + x = devm_get_free_pages(...) +| x = devm_request_irq(...) | x = devm_ioremap(...)
@@ -50,6 +66,10 @@ position p; | * kzfree at p(x) | +* free_pages at p(x, ...) +| +* free_page at p(x) +| * free_irq at p(x) | * iounmap at p(x)
Signature · 1 line
2.7.4
PATCH v2 3/3 coccinelle: catch krealloc() on devm_*() allocated memory
In reply to Yann Droneaudkrealloc() must not be used against devm_*() allocated memory regions:
- if a bigger memory is to be allocated, krealloc() and __krealloc() could return a different pointer than the one given to them, creating a memory region which is not managed, thus it will not be automatically released on device removal.
- if a bigger memory is to be allocated, krealloc() could kfree() the managed memory region which is passed to it. The old pointer is left registered as a resource for the device. On device removal, this dangling pointer will be used and an unrelated memory region could be released.
- if the requested size is equal to 0, krealloc() can also just behave like kfree(). Here too, the old pointer is kept associated with the device. On device removal, this invalid pointer will be used and an unrelated memory region could be released.
For all these reasons, krealloc() must not be used on a pointer returned by devm_*() functions.
--- scripts/coccinelle/free/devm_free.cocci | 4 ++++ 1 file changed, 4 insertions(+)
scripts/coccinelle/free/devm_free.cocci +4 -0
@@ -66,6 +66,10 @@ position p; | * kzfree at p(x) | +* __krealloc at p(x, ...) +| +* krealloc at p(x, ...) +| * free_pages at p(x, ...) | * free_page at p(x)
Signature · 1 line
2.7.4