1/// Find a use after free.
2//# Values of variables may imply that some
3//# execution paths are not possible, resulting in false positives.
4//# Another source of false positives are macros such as
5//# SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument
6///
7// Confidence: Moderate
8// Copyright: (C) 2010-2012 Nicolas Palix.  GPLv2.
9// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6.  GPLv2.
10// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6.  GPLv2.
11// URL: http://coccinelle.lip6.fr/
12// Comments:
13// Options: --no-includes --include-headers
14
15virtual org
16virtual report
17
18@free@
19expression E;
20position p1;
21@@
22
23(
24* kfree@p1(E)
25|
26* kzfree@p1(E)
27)
28
29@print expression@
30constant char [] c;
31expression free.E,E2;
32type T;
33position p;
34identifier f;
35@@
36
37(
38 f(...,c,...,(T)E@p,...)
39|
40 E@p == E2
41|
42 E@p != E2
43|
44 E2 == E@p
45|
46 E2 != E@p
47|
48 !E@p
49|
50 E@p || ...
51)
52
53@sz@
54expression free.E;
55position p;
56@@
57
58 sizeof(<+...E@p...+>)
59
60@loop exists@
61expression E;
62identifier l;
63position ok;
64@@
65
66while (1) { ...
67(
68* kfree@ok(E)
69|
70* kzfree@ok(E)
71)
72  ... when != break;
73      when != goto l;
74      when forall
75}
76
77@r exists@
78expression free.E, subE<=free.E, E2;
79expression E1;
80iterator iter;
81statement S;
82position free.p1!=loop.ok,p2!={print.p,sz.p};
83@@
84
85(
86* kfree@p1(E,...)
87|
88* kzfree@p1(E,...)
89)
90...
91(
92 iter(...,subE,...) S // no use
93|
94 list_remove_head(E1,subE,...)
95|
96 subE = E2
97|
98 subE++
99|
100 ++subE
101|
102 --subE
103|
104 subE--
105|
106 &subE
107|
108 BUG(...)
109|
110 BUG_ON(...)
111|
112 return_VALUE(...)
113|
114 return_ACPI_STATUS(...)
115|
116 E@p2 // bad use
117)
118
119@script:python depends on org@
120p1 << free.p1;
121p2 << r.p2;
122@@
123
124cocci.print_main("kfree",p1)
125cocci.print_secs("ref",p2)
126
127@script:python depends on report@
128p1 << free.p1;
129p2 << r.p2;
130@@
131
132msg = "ERROR: reference preceded by free on line %s" % (p1[0].line)
133coccilib.report.print_report(p2[0],msg)
134