1/// Find a use after free. 2//# Values of variables may imply that some 3//# execution paths are not possible, resulting in false positives. 4//# Another source of false positives are macros such as 5//# SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument 6/// 7// Confidence: Moderate 8// Copyright: (C) 2010-2012 Nicolas Palix. GPLv2. 9// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6. GPLv2. 10// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6. GPLv2. 11// URL: http://coccinelle.lip6.fr/ 12// Comments: 13// Options: --no-includes --include-headers 14 15virtual org 16virtual report 17 18@free@ 19expression E; 20position p1; 21@@ 22 23( 24* kfree@p1(E) 25| 26* kzfree@p1(E) 27) 28 29@print expression@ 30constant char [] c; 31expression free.E,E2; 32type T; 33position p; 34identifier f; 35@@ 36 37( 38 f(...,c,...,(T)E@p,...) 39| 40 E@p == E2 41| 42 E@p != E2 43| 44 E2 == E@p 45| 46 E2 != E@p 47| 48 !E@p 49| 50 E@p || ... 51) 52 53@sz@ 54expression free.E; 55position p; 56@@ 57 58 sizeof(<+...E@p...+>) 59 60@loop exists@ 61expression E; 62identifier l; 63position ok; 64@@ 65 66while (1) { ... 67( 68* kfree@ok(E) 69| 70* kzfree@ok(E) 71) 72 ... when != break; 73 when != goto l; 74 when forall 75} 76 77@r exists@ 78expression free.E, subE<=free.E, E2; 79expression E1; 80iterator iter; 81statement S; 82position free.p1!=loop.ok,p2!={print.p,sz.p}; 83@@ 84 85( 86* kfree@p1(E,...) 87| 88* kzfree@p1(E,...) 89) 90... 91( 92 iter(...,subE,...) S // no use 93| 94 list_remove_head(E1,subE,...) 95| 96 subE = E2 97| 98 subE++ 99| 100 ++subE 101| 102 --subE 103| 104 subE-- 105| 106 &subE 107| 108 BUG(...) 109| 110 BUG_ON(...) 111| 112 return_VALUE(...) 113| 114 return_ACPI_STATUS(...) 115| 116 E@p2 // bad use 117) 118 119@script:python depends on org@ 120p1 << free.p1; 121p2 << r.p2; 122@@ 123 124cocci.print_main("kfree",p1) 125cocci.print_secs("ref",p2) 126 127@script:python depends on report@ 128p1 << free.p1; 129p2 << r.p2; 130@@ 131 132msg = "ERROR: reference preceded by free on line %s" % (p1[0].line) 133coccilib.report.print_report(p2[0],msg) 134