1/// Find a use after free.
  2//# Values of variables may imply that some
  3//# execution paths are not possible, resulting in false positives.
  4//# Another source of false positives are macros such as
  5//# SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument
  6///
  7// Confidence: Moderate
  8// Copyright: (C) 2010-2012 Nicolas Palix.  GPLv2.
  9// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6.  GPLv2.
 10// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6.  GPLv2.
 11// URL: http://coccinelle.lip6.fr/
 12// Comments:
 13// Options: --no-includes --include-headers
 14
 15virtual org
 16virtual report
 17
 18@free@
 19expression E;
 20position p1;
 21@@
 22
 23(
 24* kfree@p1(E)
 25|
 26* kzfree@p1(E)
 27)
 28
 29@print expression@
 30constant char [] c;
 31expression free.E,E2;
 32type T;
 33position p;
 34identifier f;
 35@@
 36
 37(
 38 f(...,c,...,(T)E@p,...)
 39|
 40 E@p == E2
 41|
 42 E@p != E2
 43|
 44 E2 == E@p
 45|
 46 E2 != E@p
 47|
 48 !E@p
 49|
 50 E@p || ...
 51)
 52
 53@sz@
 54expression free.E;
 55position p;
 56@@
 57
 58 sizeof(<+...E@p...+>)
 59
 60@loop exists@
 61expression E;
 62identifier l;
 63position ok;
 64@@
 65
 66while (1) { ...
 67(
 68* kfree@ok(E)
 69|
 70* kzfree@ok(E)
 71)
 72  ... when != break;
 73      when != goto l;
 74      when forall
 75}
 76
 77@r exists@
 78expression free.E, subE<=free.E, E2;
 79expression E1;
 80iterator iter;
 81statement S;
 82position free.p1!=loop.ok,p2!={print.p,sz.p};
 83@@
 84
 85(
 86* kfree@p1(E,...)
 87|
 88* kzfree@p1(E,...)
 89)
 90...
 91(
 92 iter(...,subE,...) S // no use
 93|
 94 list_remove_head(E1,subE,...)
 95|
 96 subE = E2
 97|
 98 subE++
 99|
100 ++subE
101|
102 --subE
103|
104 subE--
105|
106 &subE
107|
108 BUG(...)
109|
110 BUG_ON(...)
111|
112 return_VALUE(...)
113|
114 return_ACPI_STATUS(...)
115|
116 E@p2 // bad use
117)
118
119@script:python depends on org@
120p1 << free.p1;
121p2 << r.p2;
122@@
123
124cocci.print_main("kfree",p1)
125cocci.print_secs("ref",p2)
126
127@script:python depends on report@
128p1 << free.p1;
129p2 << r.p2;
130@@
131
132msg = "ERROR: reference preceded by free on line %s" % (p1[0].line)
133coccilib.report.print_report(p2[0],msg)

  1// SPDX-License-Identifier: GPL-2.0-only
  2/// Find a use after free.
  3//# Values of variables may imply that some
  4//# execution paths are not possible, resulting in false positives.
  5//# Another source of false positives are macros such as
  6//# SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument
  7///
  8// Confidence: Moderate
  9// Copyright: (C) 2010-2012 Nicolas Palix.
 10// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6.
 11// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6.
 12// URL: https://coccinelle.gitlabpages.inria.fr/website
 13// Comments:
 14// Options: --no-includes --include-headers
 15
 16virtual org
 17virtual report
 18
 19@free@
 20expression E;
 21position p1;
 22@@
 23
 24(
 25 kfree@p1(E)
 26|
 27 kfree_sensitive@p1(E)
 28)
 29
 30@print expression@
 31constant char [] c;
 32expression free.E,E2;
 33type T;
 34position p;
 35identifier f;
 36@@
 37
 38(
 39 f(...,c,...,(T)E@p,...)
 40|
 41 E@p == E2
 42|
 43 E@p != E2
 44|
 45 E2 == E@p
 46|
 47 E2 != E@p
 48|
 49 !E@p
 50|
 51 E@p || ...
 52)
 53
 54@sz@
 55expression free.E;
 56position p;
 57@@
 58
 59 sizeof(<+...E@p...+>)
 60
 61@loop exists@
 62expression E;
 63identifier l;
 64position ok;
 65@@
 66
 67while (1) { ...
 68(
 69 kfree@ok(E)
 70|
 71 kfree_sensitive@ok(E)
 72)
 73  ... when != break;
 74      when != goto l;
 75      when forall
 76}
 77
 78@r exists@
 79expression free.E, subE<=free.E, E2;
 80expression E1;
 81iterator iter;
 82statement S;
 83position free.p1!=loop.ok,p2!={print.p,sz.p};
 84@@
 85
 86(
 87 kfree@p1(E,...)
 88|
 89 kfree_sensitive@p1(E,...)
 90)
 91...
 92(
 93 iter(...,subE,...) S // no use
 94|
 95 list_remove_head(E1,subE,...)
 96|
 97 subE = E2
 98|
 99 subE++
100|
101 ++subE
102|
103 --subE
104|
105 subE--
106|
107 &subE
108|
109 BUG(...)
110|
111 BUG_ON(...)
112|
113 return_VALUE(...)
114|
115 return_ACPI_STATUS(...)
116|
117 E@p2 // bad use
118)
119
120@script:python depends on org@
121p1 << free.p1;
122p2 << r.p2;
123@@
124
125cocci.print_main("kfree",p1)
126cocci.print_secs("ref",p2)
127
128@script:python depends on report@
129p1 << free.p1;
130p2 << r.p2;
131@@
132
133msg = "ERROR: reference preceded by free on line %s" % (p1[0].line)
134coccilib.report.print_report(p2[0],msg)