coccinelle: also catch kzfree() issues
Since commit 3ef0e5ba46 ('slab: introduce kzfree()'),
kfree() is no more the only function to be considered:
kzfree() should be recognized too.
In particular, kzfree() must not be called on memory
allocated through devm_*() functions.
Cc: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Michal Marek <mmarek@suse.com>
			
			
This commit is contained in:
		
							parent
							
								
									7a2358b381
								
							
						
					
					
						commit
						6dd9379e8f
					
				| @ -48,6 +48,8 @@ position p; | ||||
| ( | ||||
| * kfree@p(x) | ||||
| | | ||||
| * kzfree@p(x) | ||||
| | | ||||
| * free_irq@p(x) | ||||
| | | ||||
| * iounmap@p(x) | ||||
|  | ||||
| @ -19,6 +19,8 @@ expression E; | ||||
| - if (E != NULL) | ||||
| ( | ||||
|   kfree(E); | ||||
| | | ||||
|   kzfree(E); | ||||
| | | ||||
|   debugfs_remove(E); | ||||
| | | ||||
| @ -39,7 +41,7 @@ position p; | ||||
| @@ | ||||
| 
 | ||||
| * if (E != NULL) | ||||
| *	\(kfree@p\|debugfs_remove@p\|debugfs_remove_recursive@p\| | ||||
| *	\(kfree@p\|kzfree@p\|debugfs_remove@p\|debugfs_remove_recursive@p\| | ||||
| *         usb_free_urb@p\|kmem_cache_destroy@p\|mempool_destroy@p\| | ||||
| *         dma_pool_destroy@p\)(E); | ||||
| 
 | ||||
|  | ||||
| @ -20,7 +20,11 @@ expression E; | ||||
| position p1; | ||||
| @@ | ||||
| 
 | ||||
| kfree@p1(E) | ||||
| ( | ||||
| * kfree@p1(E) | ||||
| | | ||||
| * kzfree@p1(E) | ||||
| ) | ||||
| 
 | ||||
| @print expression@ | ||||
| constant char [] c; | ||||
| @ -60,7 +64,11 @@ position ok; | ||||
| @@ | ||||
| 
 | ||||
| while (1) { ... | ||||
|   kfree@ok(E) | ||||
| ( | ||||
| * kfree@ok(E) | ||||
| | | ||||
| * kzfree@ok(E) | ||||
| ) | ||||
|   ... when != break; | ||||
|       when != goto l; | ||||
|       when forall | ||||
| @ -74,7 +82,11 @@ statement S; | ||||
| position free.p1!=loop.ok,p2!={print.p,sz.p}; | ||||
| @@ | ||||
| 
 | ||||
| kfree@p1(E,...) | ||||
| ( | ||||
| * kfree@p1(E,...) | ||||
| | | ||||
| * kzfree@p1(E,...) | ||||
| ) | ||||
| ... | ||||
| ( | ||||
|  iter(...,subE,...) S // no use | ||||
|  | ||||
| @ -16,7 +16,11 @@ identifier f; | ||||
| position p; | ||||
| @@ | ||||
| 
 | ||||
| ( | ||||
| * kfree@p(&e->f) | ||||
| | | ||||
| * kzfree@p(&e->f) | ||||
| ) | ||||
| 
 | ||||
| @script:python depends on org@ | ||||
| p << r.p; | ||||
| @ -28,5 +32,5 @@ cocci.print_main("kfree",p) | ||||
| p << r.p; | ||||
| @@ | ||||
| 
 | ||||
| msg = "ERROR: kfree of structure field" | ||||
| msg = "ERROR: invalid free of structure field" | ||||
| coccilib.report.print_report(p[0],msg) | ||||
|  | ||||
		Loading…
	
		Reference in New Issue
	
	Block a user