1// SPDX-License-Identifier: GPL-2.0-only
  2/// Use memdup_user rather than duplicating its implementation
  3/// This is a little bit restricted to reduce false positives
  4///
  5// Confidence: High
  6// Copyright: (C) 2010-2012 Nicolas Palix.
  7// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6.
  8// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6.
  9// URL: https://coccinelle.gitlabpages.inria.fr/website
 10// Comments:
 11// Options: --no-includes --include-headers
 12
 13virtual patch
 14virtual context
 15virtual org
 16virtual report
 17
 18@initialize:python@
 19@@
 20filter = frozenset(['memdup_user', 'vmemdup_user'])
 21
 22def relevant(p):
 23    return not (filter & {el.current_element for el in p})
 24
 25@depends on patch@
 26expression from,to,size;
 27identifier l1,l2;
 28position p : script:python() { relevant(p) };
 29@@
 30
 31-  to = \(kmalloc@p\|kzalloc@p\)
 32-		(size,\(GFP_KERNEL\|GFP_USER\|
 33-		      \(GFP_KERNEL\|GFP_USER\)|__GFP_NOWARN\));
 34+  to = memdup_user(from,size);
 35   if (
 36-      to==NULL
 37+      IS_ERR(to)
 38                 || ...) {
 39   <+... when != goto l1;
 40-  -ENOMEM
 41+  PTR_ERR(to)
 42   ...+>
 43   }
 44-  if (copy_from_user(to, from, size) != 0) {
 45-    <+... when != goto l2;
 46-    -EFAULT
 47-    ...+>
 48-  }
 49
 50@depends on patch@
 51expression from,to,size;
 52identifier l1,l2;
 53position p : script:python() { relevant(p) };
 54@@
 55
 56-  to = \(kvmalloc@p\|kvzalloc@p\)(size,\(GFP_KERNEL\|GFP_USER\));
 57+  to = vmemdup_user(from,size);
 58   if (
 59-      to==NULL
 60+      IS_ERR(to)
 61                 || ...) {
 62   <+... when != goto l1;
 63-  -ENOMEM
 64+  PTR_ERR(to)
 65   ...+>
 66   }
 67-  if (copy_from_user(to, from, size) != 0) {
 68-    <+... when != goto l2;
 69-    -EFAULT
 70-    ...+>
 71-  }
 72
 73@r depends on !patch@
 74expression from,to,size;
 75position p : script:python() { relevant(p) };
 76statement S1,S2;
 77@@
 78
 79*  to = \(kmalloc@p\|kzalloc@p\)
 80		(size,\(GFP_KERNEL\|GFP_USER\|
 81		      \(GFP_KERNEL\|GFP_USER\)|__GFP_NOWARN\));
 82   if (to==NULL || ...) S1
 83   if (copy_from_user(to, from, size) != 0)
 84   S2
 85
 86@rv depends on !patch@
 87expression from,to,size;
 88position p : script:python() { relevant(p) };
 89statement S1,S2;
 90@@
 91
 92*  to = \(kvmalloc@p\|kvzalloc@p\)(size,\(GFP_KERNEL\|GFP_USER\));
 93   if (to==NULL || ...) S1
 94   if (copy_from_user(to, from, size) != 0)
 95   S2
 96
 97@script:python depends on org@
 98p << r.p;
 99@@
100
101coccilib.org.print_todo(p[0], "WARNING opportunity for memdup_user")
102
103@script:python depends on report@
104p << r.p;
105@@
106
107coccilib.report.print_report(p[0], "WARNING opportunity for memdup_user")
108
109@script:python depends on org@
110p << rv.p;
111@@
112
113coccilib.org.print_todo(p[0], "WARNING opportunity for vmemdup_user")
114
115@script:python depends on report@
116p << rv.p;
117@@
118
119coccilib.report.print_report(p[0], "WARNING opportunity for vmemdup_user")

 1// SPDX-License-Identifier: GPL-2.0-only
 2/// Use memdup_user rather than duplicating its implementation
 3/// This is a little bit restricted to reduce false positives
 4///
 5// Confidence: High
 6// Copyright: (C) 2010-2012 Nicolas Palix.
 7// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6.
 8// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6.
 9// URL: http://coccinelle.lip6.fr/
10// Comments:
11// Options: --no-includes --include-headers
12
13virtual patch
14virtual context
15virtual org
16virtual report
17
 
 
 
 
 
 
 
18@depends on patch@
19expression from,to,size;
20identifier l1,l2;
 
21@@
22
23-  to = \(kmalloc\|kzalloc\)(size,GFP_KERNEL);
 
 
24+  to = memdup_user(from,size);
25   if (
26-      to==NULL
27+      IS_ERR(to)
28                 || ...) {
29   <+... when != goto l1;
30-  -ENOMEM
31+  PTR_ERR(to)
32   ...+>
33   }
34-  if (copy_from_user(to, from, size) != 0) {
35-    <+... when != goto l2;
36-    -EFAULT
37-    ...+>
38-  }
39
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
40@r depends on !patch@
41expression from,to,size;
42position p;
43statement S1,S2;
44@@
45
46*  to = \(kmalloc@p\|kzalloc@p\)(size,GFP_KERNEL);
 
 
 
 
 
 
 
 
 
 
 
 
 
47   if (to==NULL || ...) S1
48   if (copy_from_user(to, from, size) != 0)
49   S2
50
51@script:python depends on org@
52p << r.p;
53@@
54
55coccilib.org.print_todo(p[0], "WARNING opportunity for memdup_user")
56
57@script:python depends on report@
58p << r.p;
59@@
60
61coccilib.report.print_report(p[0], "WARNING opportunity for memdup_user")