17a92c046SSascha Wildner/// Find a use after free. 27a92c046SSascha Wildner//# Values of variables may imply that some 37a92c046SSascha Wildner//# execution paths are not possible, resulting in false positives. 47a92c046SSascha Wildner//# Another source of false positives are macros 57a92c046SSascha Wildner//# that do not actually evaluate their argument 67a92c046SSascha Wildner/// 77a92c046SSascha Wildner// Confidence: Moderate 87a92c046SSascha Wildner// Copyright: (C) 2010 Nicolas Palix, DIKU. GPLv2. 97a92c046SSascha Wildner// Copyright: (C) 2010 Julia Lawall, DIKU. GPLv2. 107a92c046SSascha Wildner// Copyright: (C) 2010 Gilles Muller, INRIA/LiP6. GPLv2. 117a92c046SSascha Wildner// URL: http://coccinelle.lip6.fr/ 127a92c046SSascha Wildner// Comments: 131f80e4b0SSascha Wildner// Options: -no_includes -include_headers -D report 14*cfa4e38fSSascha Wildner// 15*cfa4e38fSSascha Wildner// Applies to kernel code. 167a92c046SSascha Wildner 177a92c046SSascha Wildnervirtual org 187a92c046SSascha Wildnervirtual report 197a92c046SSascha Wildner 207a92c046SSascha Wildner@free@ 217a92c046SSascha Wildnerexpression E; 227a92c046SSascha Wildnerposition p1; 237a92c046SSascha Wildner@@ 247a92c046SSascha Wildner 251f80e4b0SSascha Wildner\(contigfree@p1(E,...)\|kfree@p1(E,...)\|objcache_put@p1(...,E)\|mpipe_free@p1(...,E)\|zfree@p1(...,E)\) 267a92c046SSascha Wildner 277a92c046SSascha Wildner@print expression@ 287a92c046SSascha Wildnerconstant char *c; 297a92c046SSascha Wildnerexpression free.E,E2; 307a92c046SSascha Wildnertype T; 317a92c046SSascha Wildnerposition p; 327a92c046SSascha Wildneridentifier f; 337a92c046SSascha Wildner@@ 347a92c046SSascha Wildner 357a92c046SSascha Wildner( 367a92c046SSascha Wildner f(...,c,...,(T)E@p,...) 377a92c046SSascha Wildner| 387a92c046SSascha Wildner E@p == E2 397a92c046SSascha Wildner| 407a92c046SSascha Wildner E@p != E2 417a92c046SSascha Wildner| 427a92c046SSascha Wildner !E@p 437a92c046SSascha Wildner| 447a92c046SSascha Wildner E@p || ... 457a92c046SSascha Wildner) 467a92c046SSascha Wildner 477a92c046SSascha Wildner@sz@ 487a92c046SSascha Wildnerexpression free.E; 497a92c046SSascha Wildnerposition p; 507a92c046SSascha Wildner@@ 517a92c046SSascha Wildner 527a92c046SSascha Wildner sizeof(<+...E@p...+>) 537a92c046SSascha Wildner 547a92c046SSascha Wildner@loop exists@ 557a92c046SSascha Wildnerexpression E; 567a92c046SSascha Wildneridentifier l; 577a92c046SSascha Wildnerposition ok; 587a92c046SSascha Wildner@@ 597a92c046SSascha Wildner 607a92c046SSascha Wildnerwhile (1) { ... 611f80e4b0SSascha Wildner \(contigfree@ok(E,...)\|kfree@ok(E,...)\|objcache_put@ok(...,E)\|mpipe_free@ok(...,E)\|zfree@ok(...,E)\) 627a92c046SSascha Wildner ... when != break; 637a92c046SSascha Wildner when != goto l; 647a92c046SSascha Wildner when forall 657a92c046SSascha Wildner} 667a92c046SSascha Wildner 677a92c046SSascha Wildner@r exists@ 687a92c046SSascha Wildnerexpression free.E, subE<=free.E, E2; 697a92c046SSascha Wildnerexpression E1; 707a92c046SSascha Wildneriterator iter; 717a92c046SSascha Wildnerstatement S; 727a92c046SSascha Wildnerposition free.p1!=loop.ok,p2!={print.p,sz.p}; 737a92c046SSascha Wildner@@ 747a92c046SSascha Wildner 751f80e4b0SSascha Wildner\(contigfree@p1(E,...)\|kfree@p1(E,...)\|objcache_put@p1(...,E)\|mpipe_free@p1(...,E)\|zfree@p1(...,E)\) 767a92c046SSascha Wildner... 777a92c046SSascha Wildner( 787a92c046SSascha Wildner iter(...,subE,...) S // no use 797a92c046SSascha Wildner| 807a92c046SSascha Wildner list_remove_head(E1,subE,...) 817a92c046SSascha Wildner| 827a92c046SSascha Wildner subE = E2 837a92c046SSascha Wildner| 847a92c046SSascha Wildner subE++ 857a92c046SSascha Wildner| 867a92c046SSascha Wildner ++subE 877a92c046SSascha Wildner| 887a92c046SSascha Wildner --subE 897a92c046SSascha Wildner| 907a92c046SSascha Wildner subE-- 917a92c046SSascha Wildner| 927a92c046SSascha Wildner &subE 937a92c046SSascha Wildner| 947a92c046SSascha Wildner return_VALUE(...) 957a92c046SSascha Wildner| 967a92c046SSascha Wildner return_ACPI_STATUS(...) 977a92c046SSascha Wildner| 987a92c046SSascha Wildner E@p2 // bad use 997a92c046SSascha Wildner) 1007a92c046SSascha Wildner 1017a92c046SSascha Wildner@script:python depends on org@ 1027a92c046SSascha Wildnerp1 << free.p1; 1037a92c046SSascha Wildnerp2 << r.p2; 1047a92c046SSascha Wildner@@ 1057a92c046SSascha Wildner 1067a92c046SSascha Wildnercocci.print_main("kfree",p1) 1077a92c046SSascha Wildnercocci.print_secs("ref",p2) 1087a92c046SSascha Wildner 1097a92c046SSascha Wildner@script:python depends on report@ 1107a92c046SSascha Wildnerp1 << free.p1; 1117a92c046SSascha Wildnerp2 << r.p2; 1127a92c046SSascha Wildner@@ 1137a92c046SSascha Wildner 1147a92c046SSascha Wildnermsg = "reference preceded by free on line %s" % (p1[0].line) 1157a92c046SSascha Wildnercoccilib.report.print_report(p2[0],msg) 116