Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
In-Reply-To: <1504258820-2122-1-git-send-email-elena.reshetova@intel.com>
References: <1504258820-2122-1-git-send-email-elena.reshetova@intel.com>
From:   Kees Cook <keescook@chromium.org>
Date:   Thu, 14 Jun 2018 16:58:07 -0700
Message-ID: <CAGXu5jK-6fNvaEiX1Wvp98BKv+uF17KdFyPQKi5hgE-Jz3-+Tg@mail.gmail.com>
Subject: Re: [PATCH] Coccinelle: add atomic_as_refcounter script
To:     Elena Reshetova <elena.reshetova@intel.com>,
        Masahiro Yamada <yamada.masahiro@socionext.com>
Cc:     Julia Lawall <julia.lawall@lip6.fr>,
        LKML <linux-kernel@vger.kernel.org>, cocci@systeme.lip6.fr,
        Gilles Muller <Gilles.Muller@lip6.fr>,
        Nicolas Palix <nicolas.palix@imag.fr>,
        Michal Marek <mmarek@suse.com>,
        Hans Liljestrand <ishkamiel@gmail.co>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, Sep 1, 2017 at 2:40 AM, Elena Reshetova
<elena.reshetova@intel.com> wrote:
> atomic_as_refcounter.cocci script allows detecting
> cases when refcount_t type and API should be used
> instead of atomic_t.
>
> Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
> Acked-by: Julia Lawall <julia.lawall@lip6.fr>

Reviewed-by: Kees Cook <keescook@chromium.org>

Oops, I think this got lost. Who can take this patch? I thought Julia
ran the scripts/coccinelle/ tree, but looking at git log, it looks
more like it's Masahiro? Either way, let's get this in the tree. Who
can take it?

Thanks!

-Kees

> ---
>  scripts/coccinelle/api/atomic_as_refcounter.cocci | 131 ++++++++++++++++++++++
>  1 file changed, 131 insertions(+)
>  create mode 100644 scripts/coccinelle/api/atomic_as_refcounter.cocci
>
> diff --git a/scripts/coccinelle/api/atomic_as_refcounter.cocci b/scripts/coccinelle/api/atomic_as_refcounter.cocci
> new file mode 100644
> index 0000000..bfa880d
> --- /dev/null
> +++ b/scripts/coccinelle/api/atomic_as_refcounter.cocci
> @@ -0,0 +1,131 @@
> +// Check if refcount_t type and API should be used
> +// instead of atomic_t type when dealing with refcounters
> +//
> +// Copyright (c) 2016-2017, Elena Reshetova, Intel Corporation
> +//
> +// Confidence: Moderate
> +// URL: http://coccinelle.lip6.fr/
> +// Options: --include-headers --very-quiet
> +
> +virtual report
> +
> +@r1 exists@
> +identifier a, x;
> +position p1, p2;
> +identifier fname =~ ".*free.*";
> +identifier fname2 =~ ".*destroy.*";
> +identifier fname3 =~ ".*del.*";
> +identifier fname4 =~ ".*queue_work.*";
> +identifier fname5 =~ ".*schedule_work.*";
> +identifier fname6 =~ ".*call_rcu.*";
> +
> +@@
> +
> +(
> + atomic_dec_and_test@p1(&(a)->x)
> +|
> + atomic_dec_and_lock@p1(&(a)->x, ...)
> +|
> + atomic_long_dec_and_lock@p1(&(a)->x, ...)
> +|
> + atomic_long_dec_and_test@p1(&(a)->x)
> +|
> + atomic64_dec_and_test@p1(&(a)->x)
> +|
> + local_dec_and_test@p1(&(a)->x)
> +)
> +...
> +(
> + fname@p2(a, ...);
> +|
> + fname2@p2(...);
> +|
> + fname3@p2(...);
> +|
> + fname4@p2(...);
> +|
> + fname5@p2(...);
> +|
> + fname6@p2(...);
> +)
> +
> +
> +@script:python depends on report@
> +p1 << r1.p1;
> +p2 << r1.p2;
> +@@
> +msg = "atomic_dec_and_test variation before object free at line %s."
> +coccilib.report.print_report(p1[0], msg % (p2[0].line))
> +
> +@r4 exists@
> +identifier a, x, y;
> +position p1, p2;
> +identifier fname =~ ".*free.*";
> +
> +@@
> +
> +(
> + atomic_dec_and_test@p1(&(a)->x)
> +|
> + atomic_dec_and_lock@p1(&(a)->x, ...)
> +|
> + atomic_long_dec_and_lock@p1(&(a)->x, ...)
> +|
> + atomic_long_dec_and_test@p1(&(a)->x)
> +|
> + atomic64_dec_and_test@p1(&(a)->x)
> +|
> + local_dec_and_test@p1(&(a)->x)
> +)
> +...
> +y=a
> +...
> +fname@p2(y, ...);
> +
> +
> +@script:python depends on report@
> +p1 << r4.p1;
> +p2 << r4.p2;
> +@@
> +msg = "atomic_dec_and_test variation before object free at line %s."
> +coccilib.report.print_report(p1[0], msg % (p2[0].line))
> +
> +@r2 exists@
> +identifier a, x;
> +position p1;
> +@@
> +
> +(
> +atomic_add_unless(&(a)->x,-1,1)@p1
> +|
> +atomic_long_add_unless(&(a)->x,-1,1)@p1
> +|
> +atomic64_add_unless(&(a)->x,-1,1)@p1
> +)
> +
> +@script:python depends on report@
> +p1 << r2.p1;
> +@@
> +msg = "atomic_add_unless"
> +coccilib.report.print_report(p1[0], msg)
> +
> +@r3 exists@
> +identifier x;
> +position p1;
> +@@
> +
> +(
> +x = atomic_add_return@p1(-1, ...);
> +|
> +x = atomic_long_add_return@p1(-1, ...);
> +|
> +x = atomic64_add_return@p1(-1, ...);
> +)
> +
> +@script:python depends on report@
> +p1 << r3.p1;
> +@@
> +msg = "x = atomic_add_return(-1, ...)"
> +coccilib.report.print_report(p1[0], msg)
> +
> +
> --
> 2.7.4
>


-- 
Kees Cook
Pixel Security