e71ec0bc06
Currently use_after_iter.cocci generates false positives for code of the
following form:
~~~
list_for_each_entry(d, &ddata->irq_list, node) {
if (irq == d->irq)
break;
}
if (list_entry_is_head(d, &ddata->irq_list, node))
return IRQ_NONE;
~~~
[This specific example comes from drivers/power/supply/cpcap-battery.c]
Most list macros use list_entry_is_head() as loop exit condition meaning it
is not unsafe to reuse pos (a.k.a. d) in the code above.
Let's avoid reporting these cases.
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
154 lines
3.9 KiB
Plaintext
154 lines
3.9 KiB
Plaintext
// SPDX-License-Identifier: GPL-2.0-only
|
|
/// If list_for_each_entry, etc complete a traversal of the list, the iterator
|
|
/// variable ends up pointing to an address at an offset from the list head,
|
|
/// and not a meaningful structure. Thus this value should not be used after
|
|
/// the end of the iterator.
|
|
//#False positives arise when there is a goto in the iterator and the
|
|
//#reported reference is at the label of this goto. Some flag tests
|
|
//#may also cause a report to be a false positive.
|
|
///
|
|
// Confidence: Moderate
|
|
// Copyright: (C) 2012 Julia Lawall, INRIA/LIP6.
|
|
// Copyright: (C) 2012 Gilles Muller, INRIA/LIP6.
|
|
// URL: http://coccinelle.lip6.fr/
|
|
// Comments:
|
|
// Options: --no-includes --include-headers
|
|
|
|
virtual context
|
|
virtual org
|
|
virtual report
|
|
|
|
@r exists@
|
|
identifier c,member;
|
|
expression E,x;
|
|
iterator name list_for_each_entry;
|
|
iterator name list_for_each_entry_reverse;
|
|
iterator name list_for_each_entry_continue;
|
|
iterator name list_for_each_entry_continue_reverse;
|
|
iterator name list_for_each_entry_from;
|
|
iterator name list_for_each_entry_safe;
|
|
iterator name list_for_each_entry_safe_continue;
|
|
iterator name list_for_each_entry_safe_from;
|
|
iterator name list_for_each_entry_safe_reverse;
|
|
iterator name hlist_for_each_entry;
|
|
iterator name hlist_for_each_entry_continue;
|
|
iterator name hlist_for_each_entry_from;
|
|
iterator name hlist_for_each_entry_safe;
|
|
statement S;
|
|
position p1,p2;
|
|
type T;
|
|
@@
|
|
|
|
(
|
|
list_for_each_entry@p1(c,...,member) { ... when != break;
|
|
when forall
|
|
when strict
|
|
}
|
|
|
|
|
list_for_each_entry_reverse@p1(c,...,member) { ... when != break;
|
|
when forall
|
|
when strict
|
|
}
|
|
|
|
|
list_for_each_entry_continue@p1(c,...,member) { ... when != break;
|
|
when forall
|
|
when strict
|
|
}
|
|
|
|
|
list_for_each_entry_continue_reverse@p1(c,...,member) { ... when != break;
|
|
when forall
|
|
when strict
|
|
}
|
|
|
|
|
list_for_each_entry_from@p1(c,...,member) { ... when != break;
|
|
when forall
|
|
when strict
|
|
}
|
|
|
|
|
list_for_each_entry_safe@p1(c,...,member) { ... when != break;
|
|
when forall
|
|
when strict
|
|
}
|
|
|
|
|
list_for_each_entry_safe_continue@p1(c,...,member) { ... when != break;
|
|
when forall
|
|
when strict
|
|
}
|
|
|
|
|
list_for_each_entry_safe_from@p1(c,...,member) { ... when != break;
|
|
when forall
|
|
when strict
|
|
}
|
|
|
|
|
list_for_each_entry_safe_reverse@p1(c,...,member) { ... when != break;
|
|
when forall
|
|
when strict
|
|
}
|
|
)
|
|
...
|
|
(
|
|
list_for_each_entry(c,...) S
|
|
|
|
|
list_for_each_entry_reverse(c,...) S
|
|
|
|
|
list_for_each_entry_continue(c,...) S
|
|
|
|
|
list_for_each_entry_continue_reverse(c,...) S
|
|
|
|
|
list_for_each_entry_from(c,...) S
|
|
|
|
|
list_for_each_entry_safe(c,...) S
|
|
|
|
|
list_for_each_entry_safe(x,c,...) S
|
|
|
|
|
list_for_each_entry_safe_continue(c,...) S
|
|
|
|
|
list_for_each_entry_safe_continue(x,c,...) S
|
|
|
|
|
list_for_each_entry_safe_from(c,...) S
|
|
|
|
|
list_for_each_entry_safe_from(x,c,...) S
|
|
|
|
|
list_for_each_entry_safe_reverse(c,...) S
|
|
|
|
|
list_for_each_entry_safe_reverse(x,c,...) S
|
|
|
|
|
hlist_for_each_entry(c,...) S
|
|
|
|
|
hlist_for_each_entry_continue(c,...) S
|
|
|
|
|
hlist_for_each_entry_from(c,...) S
|
|
|
|
|
hlist_for_each_entry_safe(c,...) S
|
|
|
|
|
list_remove_head(x,c,...)
|
|
|
|
|
list_entry_is_head(c,...)
|
|
|
|
|
sizeof(<+...c...+>)
|
|
|
|
|
&c->member
|
|
|
|
|
T c;
|
|
|
|
|
c = E
|
|
|
|
|
*c@p2
|
|
)
|
|
|
|
@script:python depends on org@
|
|
p1 << r.p1;
|
|
p2 << r.p2;
|
|
@@
|
|
|
|
cocci.print_main("invalid iterator index reference",p2)
|
|
cocci.print_secs("iterator",p1)
|
|
|
|
@script:python depends on report@
|
|
p1 << r.p1;
|
|
p2 << r.p2;
|
|
@@
|
|
|
|
msg = "ERROR: invalid reference to the index variable of the iterator on line %s" % (p1[0].line)
|
|
coccilib.report.print_report(p2[0], msg)
|