1/// Find a use after free.
2//# Values of variables may imply that some
3//# execution paths are not possible, resulting in false positives.
4//# Another source of false positives are macros such as
5//# SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument
6///
7// Confidence: Moderate
8// Copyright: (C) 2010-2012 Nicolas Palix.  GPLv2.
9// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6.  GPLv2.
10// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6.  GPLv2.
11// URL: http://coccinelle.lip6.fr/
12// Comments:
13// Options: --no-includes --include-headers
14
15virtual org
16virtual report
17
18@free@
19expression E;
20position p1;
21@@
22
23kfree@p1(E)
24
25@print expression@
26constant char [] c;
27expression free.E,E2;
28type T;
29position p;
30identifier f;
31@@
32
33(
34 f(...,c,...,(T)E@p,...)
35|
36 E@p == E2
37|
38 E@p != E2
39|
40 E2 == E@p
41|
42 E2 != E@p
43|
44 !E@p
45|
46 E@p || ...
47)
48
49@sz@
50expression free.E;
51position p;
52@@
53
54 sizeof(<+...E@p...+>)
55
56@loop exists@
57expression E;
58identifier l;
59position ok;
60@@
61
62while (1) { ...
63  kfree@ok(E)
64  ... when != break;
65      when != goto l;
66      when forall
67}
68
69@r exists@
70expression free.E, subE<=free.E, E2;
71expression E1;
72iterator iter;
73statement S;
74position free.p1!=loop.ok,p2!={print.p,sz.p};
75@@
76
77kfree@p1(E,...)
78...
79(
80 iter(...,subE,...) S // no use
81|
82 list_remove_head(E1,subE,...)
83|
84 subE = E2
85|
86 subE++
87|
88 ++subE
89|
90 --subE
91|
92 subE--
93|
94 &subE
95|
96 BUG(...)
97|
98 BUG_ON(...)
99|
100 return_VALUE(...)
101|
102 return_ACPI_STATUS(...)
103|
104 E@p2 // bad use
105)
106
107@script:python depends on org@
108p1 << free.p1;
109p2 << r.p2;
110@@
111
112cocci.print_main("kfree",p1)
113cocci.print_secs("ref",p2)
114
115@script:python depends on report@
116p1 << free.p1;
117p2 << r.p2;
118@@
119
120msg = "ERROR: reference preceded by free on line %s" % (p1[0].line)
121coccilib.report.print_report(p2[0],msg)
122