1// SPDX-License-Identifier: GPL-2.0-only
  2/// Find a use after free.
  3//# Values of variables may imply that some
  4//# execution paths are not possible, resulting in false positives.
  5//# Another source of false positives are macros such as
  6//# SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument
  7///
  8// Confidence: Moderate
  9// Copyright: (C) 2010-2012 Nicolas Palix.
 10// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6.
 11// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6.
 12// URL: http://coccinelle.lip6.fr/
 13// Comments:
 14// Options: --no-includes --include-headers
 15
 16virtual org
 17virtual report
 18
 19@free@
 20expression E;
 21position p1;
 22@@
 23
 24(
 25 kfree@p1(E)
 26|
 27 kfree_sensitive@p1(E)
 28)
 29
 30@print expression@
 31constant char [] c;
 32expression free.E,E2;
 33type T;
 34position p;
 35identifier f;
 36@@
 37
 38(
 39 f(...,c,...,(T)E@p,...)
 40|
 41 E@p == E2
 42|
 43 E@p != E2
 44|
 45 E2 == E@p
 46|
 47 E2 != E@p
 48|
 49 !E@p
 50|
 51 E@p || ...
 52)
 53
 54@sz@
 55expression free.E;
 56position p;
 57@@
 58
 59 sizeof(<+...E@p...+>)
 60
 61@loop exists@
 62expression E;
 63identifier l;
 64position ok;
 65@@
 66
 67while (1) { ...
 68(
 69 kfree@ok(E)
 70|
 71 kfree_sensitive@ok(E)
 72)
 73  ... when != break;
 74      when != goto l;
 75      when forall
 76}
 77
 78@r exists@
 79expression free.E, subE<=free.E, E2;
 80expression E1;
 81iterator iter;
 82statement S;
 83position free.p1!=loop.ok,p2!={print.p,sz.p};
 84@@
 85
 86(
 87 kfree@p1(E,...)
 88|
 89 kfree_sensitive@p1(E,...)
 90)
 91...
 92(
 93 iter(...,subE,...) S // no use
 94|
 95 list_remove_head(E1,subE,...)
 96|
 97 subE = E2
 98|
 99 subE++
100|
101 ++subE
102|
103 --subE
104|
105 subE--
106|
107 &subE
108|
109 BUG(...)
110|
111 BUG_ON(...)
112|
113 return_VALUE(...)
114|
115 return_ACPI_STATUS(...)
116|
117 E@p2 // bad use
118)
119
120@script:python depends on org@
121p1 << free.p1;
122p2 << r.p2;
123@@
124
125cocci.print_main("kfree",p1)
126cocci.print_secs("ref",p2)
127
128@script:python depends on report@
129p1 << free.p1;
130p2 << r.p2;
131@@
132
133msg = "ERROR: reference preceded by free on line %s" % (p1[0].line)
134coccilib.report.print_report(p2[0],msg)

 
  1/// Find a use after free.
  2//# Values of variables may imply that some
  3//# execution paths are not possible, resulting in false positives.
  4//# Another source of false positives are macros such as
  5//# SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument
  6///
  7// Confidence: Moderate
  8// Copyright: (C) 2010-2012 Nicolas Palix.  GPLv2.
  9// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6.  GPLv2.
 10// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6.  GPLv2.
 11// URL: http://coccinelle.lip6.fr/
 12// Comments:
 13// Options: --no-includes --include-headers
 14
 15virtual org
 16virtual report
 17
 18@free@
 19expression E;
 20position p1;
 21@@
 22
 23kfree@p1(E)
 
 
 
 
 24
 25@print expression@
 26constant char [] c;
 27expression free.E,E2;
 28type T;
 29position p;
 30identifier f;
 31@@
 32
 33(
 34 f(...,c,...,(T)E@p,...)
 35|
 36 E@p == E2
 37|
 38 E@p != E2
 39|
 40 E2 == E@p
 41|
 42 E2 != E@p
 43|
 44 !E@p
 45|
 46 E@p || ...
 47)
 48
 49@sz@
 50expression free.E;
 51position p;
 52@@
 53
 54 sizeof(<+...E@p...+>)
 55
 56@loop exists@
 57expression E;
 58identifier l;
 59position ok;
 60@@
 61
 62while (1) { ...
 63  kfree@ok(E)
 
 
 
 
 64  ... when != break;
 65      when != goto l;
 66      when forall
 67}
 68
 69@r exists@
 70expression free.E, subE<=free.E, E2;
 71expression E1;
 72iterator iter;
 73statement S;
 74position free.p1!=loop.ok,p2!={print.p,sz.p};
 75@@
 76
 77kfree@p1(E,...)
 
 
 
 
 78...
 79(
 80 iter(...,subE,...) S // no use
 81|
 82 list_remove_head(E1,subE,...)
 83|
 84 subE = E2
 85|
 86 subE++
 87|
 88 ++subE
 89|
 90 --subE
 91|
 92 subE--
 93|
 94 &subE
 95|
 96 BUG(...)
 97|
 98 BUG_ON(...)
 99|
100 return_VALUE(...)
101|
102 return_ACPI_STATUS(...)
103|
104 E@p2 // bad use
105)
106
107@script:python depends on org@
108p1 << free.p1;
109p2 << r.p2;
110@@
111
112cocci.print_main("kfree",p1)
113cocci.print_secs("ref",p2)
114
115@script:python depends on report@
116p1 << free.p1;
117p2 << r.p2;
118@@
119
120msg = "ERROR: reference preceded by free on line %s" % (p1[0].line)
121coccilib.report.print_report(p2[0],msg)