aboutsummaryrefslogtreecommitdiffstats
path: root/scripts/coccinelle/null
diff options
context:
space:
mode:
Diffstat (limited to 'scripts/coccinelle/null')
-rw-r--r--scripts/coccinelle/null/deref_null.cocci282
-rw-r--r--scripts/coccinelle/null/eno.cocci20
-rw-r--r--scripts/coccinelle/null/kmerr.cocci72
3 files changed, 374 insertions, 0 deletions
diff --git a/scripts/coccinelle/null/deref_null.cocci b/scripts/coccinelle/null/deref_null.cocci
new file mode 100644
index 000000000000..cdac6cfcce92
--- /dev/null
+++ b/scripts/coccinelle/null/deref_null.cocci
@@ -0,0 +1,282 @@
1///
2/// A variable is dereference under a NULL test.
3/// Even though it is know to be NULL.
4///
5// Confidence: Moderate
6// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2.
7// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2.
8// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2.
9// URL: http://coccinelle.lip6.fr/
10// Comments: -I ... -all_includes can give more complete results
11// Options:
12
13virtual context
14virtual org
15virtual report
16
17@ifm@
18expression *E;
19statement S1,S2;
20position p1;
21@@
22
23if@p1 ((E == NULL && ...) || ...) S1 else S2
24
25// The following two rules are separate, because both can match a single
26// expression in different ways
27@pr1 expression@
28expression *ifm.E;
29identifier f;
30position p1;
31@@
32
33 (E != NULL && ...) ? <+...E->f@p1...+> : ...
34
35@pr2 expression@
36expression *ifm.E;
37identifier f;
38position p2;
39@@
40
41(
42 (E != NULL) && ... && <+...E->f@p2...+>
43|
44 (E == NULL) || ... || <+...E->f@p2...+>
45|
46 sizeof(<+...E->f@p2...+>)
47)
48
49// For org and report modes
50
51@r depends on !context && (org || report) exists@
52expression subE <= ifm.E;
53expression *ifm.E;
54expression E1,E2;
55identifier f;
56statement S1,S2,S3,S4;
57iterator iter;
58position p!={pr1.p1,pr2.p2};
59position ifm.p1;
60@@
61
62if@p1 ((E == NULL && ...) || ...)
63{
64 ... when != if (...) S1 else S2
65(
66 iter(subE,...) S4 // no use
67|
68 list_remove_head(E2,subE,...)
69|
70 subE = E1
71|
72 for(subE = E1;...;...) S4
73|
74 subE++
75|
76 ++subE
77|
78 --subE
79|
80 subE--
81|
82 &subE
83|
84 E->f@p // bad use
85)
86 ... when any
87 return ...;
88}
89else S3
90
91@script:python depends on !context && !org && report@
92p << r.p;
93p1 << ifm.p1;
94x << ifm.E;
95@@
96
97msg="ERROR: %s is NULL but dereferenced." % (x)
98coccilib.report.print_report(p[0], msg)
99cocci.include_match(False)
100
101@script:python depends on !context && org && !report@
102p << r.p;
103p1 << ifm.p1;
104x << ifm.E;
105@@
106
107msg="ERROR: %s is NULL but dereferenced." % (x)
108msg_safe=msg.replace("[","@(").replace("]",")")
109cocci.print_main(msg_safe,p)
110cocci.include_match(False)
111
112@s depends on !context && (org || report) exists@
113expression subE <= ifm.E;
114expression *ifm.E;
115expression E1,E2;
116identifier f;
117statement S1,S2,S3,S4;
118iterator iter;
119position p!={pr1.p1,pr2.p2};
120position ifm.p1;
121@@
122
123if@p1 ((E == NULL && ...) || ...)
124{
125 ... when != if (...) S1 else S2
126(
127 iter(subE,...) S4 // no use
128|
129 list_remove_head(E2,subE,...)
130|
131 subE = E1
132|
133 for(subE = E1;...;...) S4
134|
135 subE++
136|
137 ++subE
138|
139 --subE
140|
141 subE--
142|
143 &subE
144|
145 E->f@p // bad use
146)
147 ... when any
148}
149else S3
150
151@script:python depends on !context && !org && report@
152p << s.p;
153p1 << ifm.p1;
154x << ifm.E;
155@@
156
157msg="ERROR: %s is NULL but dereferenced." % (x)
158coccilib.report.print_report(p[0], msg)
159
160@script:python depends on !context && org && !report@
161p << s.p;
162p1 << ifm.p1;
163x << ifm.E;
164@@
165
166msg="ERROR: %s is NULL but dereferenced." % (x)
167msg_safe=msg.replace("[","@(").replace("]",")")
168cocci.print_main(msg_safe,p)
169
170// For context mode
171
172@depends on context && !org && !report exists@
173expression subE <= ifm.E;
174expression *ifm.E;
175expression E1,E2;
176identifier f;
177statement S1,S2,S3,S4;
178iterator iter;
179position p!={pr1.p1,pr2.p2};
180position ifm.p1;
181@@
182
183if@p1 ((E == NULL && ...) || ...)
184{
185 ... when != if (...) S1 else S2
186(
187 iter(subE,...) S4 // no use
188|
189 list_remove_head(E2,subE,...)
190|
191 subE = E1
192|
193 for(subE = E1;...;...) S4
194|
195 subE++
196|
197 ++subE
198|
199 --subE
200|
201 subE--
202|
203 &subE
204|
205* E->f@p // bad use
206)
207 ... when any
208 return ...;
209}
210else S3
211
212// The following three rules are duplicates of ifm, pr1 and pr2 respectively.
213// It is need because the previous rule as already made a "change".
214
215@ifm1@
216expression *E;
217statement S1,S2;
218position p1;
219@@
220
221if@p1 ((E == NULL && ...) || ...) S1 else S2
222
223@pr11 expression@
224expression *ifm1.E;
225identifier f;
226position p1;
227@@
228
229 (E != NULL && ...) ? <+...E->f@p1...+> : ...
230
231@pr12 expression@
232expression *ifm1.E;
233identifier f;
234position p2;
235@@
236
237(
238 (E != NULL) && ... && <+...E->f@p2...+>
239|
240 (E == NULL) || ... || <+...E->f@p2...+>
241|
242 sizeof(<+...E->f@p2...+>)
243)
244
245@depends on context && !org && !report exists@
246expression subE <= ifm1.E;
247expression *ifm1.E;
248expression E1,E2;
249identifier f;
250statement S1,S2,S3,S4;
251iterator iter;
252position p!={pr11.p1,pr12.p2};
253position ifm1.p1;
254@@
255
256if@p1 ((E == NULL && ...) || ...)
257{
258 ... when != if (...) S1 else S2
259(
260 iter(subE,...) S4 // no use
261|
262 list_remove_head(E2,subE,...)
263|
264 subE = E1
265|
266 for(subE = E1;...;...) S4
267|
268 subE++
269|
270 ++subE
271|
272 --subE
273|
274 subE--
275|
276 &subE
277|
278* E->f@p // bad use
279)
280 ... when any
281}
282else S3
diff --git a/scripts/coccinelle/null/eno.cocci b/scripts/coccinelle/null/eno.cocci
new file mode 100644
index 000000000000..4c9c52b9c413
--- /dev/null
+++ b/scripts/coccinelle/null/eno.cocci
@@ -0,0 +1,20 @@
1/// The various basic memory allocation functions don't return ERR_PTR
2///
3// Confidence: High
4// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2.
5// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2.
6// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2.
7// URL: http://coccinelle.lip6.fr/
8// Comments:
9// Options: -no_includes -include_headers
10
11virtual patch
12
13@@
14expression x,E;
15@@
16
17x = \(kmalloc\|kzalloc\|kcalloc\|kmem_cache_alloc\|kmem_cache_zalloc\|kmem_cache_alloc_node\|kmalloc_node\|kzalloc_node\)(...)
18... when != x = E
19- IS_ERR(x)
20+ !x
diff --git a/scripts/coccinelle/null/kmerr.cocci b/scripts/coccinelle/null/kmerr.cocci
new file mode 100644
index 000000000000..949bf656c64c
--- /dev/null
+++ b/scripts/coccinelle/null/kmerr.cocci
@@ -0,0 +1,72 @@
1/// This semantic patch looks for kmalloc etc that are not followed by a
2/// NULL check. It only gives a report in the case where there is some
3/// error handling code later in the function, which may be helpful
4/// in determining what the error handling code for the call to kmalloc etc
5/// should be.
6///
7// Confidence: High
8// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2.
9// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2.
10// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2.
11// URL: http://coccinelle.lip6.fr/
12// Comments:
13// Options: -no_includes -include_headers
14
15virtual context
16virtual org
17virtual report
18
19@withtest@
20expression x;
21position p;
22identifier f,fld;
23@@
24
25x@p = f(...);
26... when != x->fld
27\(x == NULL \| x != NULL\)
28
29@fixed depends on context && !org && !report@
30expression x,x1;
31position p1 != withtest.p;
32statement S;
33position any withtest.p;
34identifier f;
35@@
36
37*x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
38...
39*x1@p = f(...);
40if (!x1) S
41
42// ------------------------------------------------------------------------
43
44@rfixed depends on (org || report) && !context exists@
45expression x,x1;
46position p1 != withtest.p;
47position p2;
48statement S;
49position any withtest.p;
50identifier f;
51@@
52
53x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
54...
55x1@p = f@p2(...);
56if (!x1) S
57
58@script:python depends on org@
59p1 << rfixed.p1;
60p2 << rfixed.p2;
61@@
62
63cocci.print_main("alloc call",p1)
64cocci.print_secs("possible model",p2)
65
66@script:python depends on report@
67p1 << rfixed.p1;
68p2 << rfixed.p2;
69@@
70
71msg = "alloc with no test, possible model on line %s" % (p2[0].line)
72coccilib.report.print_report(p1[0],msg)
generated by cgit v1.2.2 (git 2.25.0) at 2025-04-24 02:53:43 -0400