/// Find a use after free.
//# Values of variables may imply that some
//# execution paths are not possible, resulting in false positives.
//# Another source of false positives are macros such as
//# SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument
///
// Confidence: Moderate
// Copyright: (C) 2010-2012 Nicolas Palix.  GPLv2.
// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6.  GPLv2.
// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6.  GPLv2.
// URL: http://coccinelle.lip6.fr/
// Comments:
// Options: --no-includes --include-headers

virtual org
virtual report

@free@
expression E;
position p1;
@@

(
* kfree@p1(E)
|
* kzfree@p1(E)
)

@print expression@
constant char [] c;
expression free.E,E2;
type T;
position p;
identifier f;
@@

(
 f(...,c,...,(T)E@p,...)
|
 E@p == E2
|
 E@p != E2
|
 E2 == E@p
|
 E2 != E@p
|
 !E@p
|
 E@p || ...
)

@sz@
expression free.E;
position p;
@@

 sizeof(<+...E@p...+>)

@loop exists@
expression E;
identifier l;
position ok;
@@

while (1) { ...
(
* kfree@ok(E)
|
* kzfree@ok(E)
)
  ... when != break;
      when != goto l;
      when forall
}

@r exists@
expression free.E, subE<=free.E, E2;
expression E1;
iterator iter;
statement S;
position free.p1!=loop.ok,p2!={print.p,sz.p};
@@

(
* kfree@p1(E,...)
|
* kzfree@p1(E,...)
)
...
(
 iter(...,subE,...) S // no use
|
 list_remove_head(E1,subE,...)
|
 subE = E2
|
 subE++
|
 ++subE
|
 --subE
|
 subE--
|
 &subE
|
 BUG(...)
|
 BUG_ON(...)
|
 return_VALUE(...)
|
 return_ACPI_STATUS(...)
|
 E@p2 // bad use
)

@script:python depends on org@
p1 << free.p1;
p2 << r.p2;
@@

cocci.print_main("kfree",p1)
cocci.print_secs("ref",p2)

@script:python depends on report@
p1 << free.p1;
p2 << r.p2;
@@

msg = "ERROR: reference preceded by free on line %s" % (p1[0].line)
coccilib.report.print_report(p2[0],msg)
t-next.git/tree/drivers/usb/dwc3/debug.h?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>tree</a><a class='active' href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/dwc3/debug.h?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>commit</a><a href='/cgit.cgi/linux/net-next.git/diff/drivers/usb/dwc3/debug.h?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>diff</a></td><td class='form'><form class='right' method='get' action='/cgit.cgi/linux/net-next.git/log/drivers/usb/dwc3/debug.h'>
<input type='hidden' name='id' value='19ca2c8fecb1592d623fe5e82d6796f8d446268d'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/cgit.cgi/linux/net-next.git/commit/?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>root</a>/<a href='/cgit.cgi/linux/net-next.git/commit/drivers?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>drivers</a>/<a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>usb</a>/<a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/dwc3?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>dwc3</a>/<a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/dwc3/debug.h?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>debug.h</a></div><div class='content'><div class='cgit-panel'><b>diff options</b><form method='get'><input type='hidden' name='id' value='19ca2c8fecb1592d623fe5e82d6796f8d446268d'/><table><tr><td colspan='2'/></tr><tr><td class='label'>context:</td><td class='ctrl'><select name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Linus Torvalds &lt;torvalds@linux-foundation.org&gt;</td><td class='right'>2017-01-24 12:21:51 -0800</td></tr>
<tr><th>committer</th><td>Linus Torvalds &lt;torvalds@linux-foundation.org&gt;</td><td class='right'>2017-01-24 12:21:51 -0800</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/dwc3/debug.h?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>19ca2c8fecb1592d623fe5e82d6796f8d446268d</a> (<a href='/cgit.cgi/linux/net-next.git/patch/drivers/usb/dwc3/debug.h?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>0756e115d125846f46b302085307768f069434a1</a> /<a href='/cgit.cgi/linux/net-next.git/tree/drivers/usb/dwc3/debug.h?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>drivers/usb/dwc3/debug.h</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/dwc3/debug.h?id=a4685d2f58e2230d4e27fb2ee581d7ea35e5d046'>a4685d2f58e2230d4e27fb2ee581d7ea35e5d046</a> (<a href='/cgit.cgi/linux/net-next.git/diff/drivers/usb/dwc3/debug.h?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d&amp;id2=a4685d2f58e2230d4e27fb2ee581d7ea35e5d046'>diff</a>)</td></tr><tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/dwc3/debug.h?id=880a38547ff08715ce4f1daf9a4bb30c87676e68'>880a38547ff08715ce4f1daf9a4bb30c87676e68</a> (<a href='/cgit.cgi/linux/net-next.git/diff/drivers/usb/dwc3/debug.h?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d&amp;id2=880a38547ff08715ce4f1daf9a4bb30c87676e68'>diff</a>)</td></tr></table>
<div class='commit-subject'>Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace</div><div class='commit-msg'>Pull namespace fix from Eric Biederman:
 "This has a single brown bag fix.

  The possible deadlock with dec_pid_namespaces that I had thought was
  fixed earlier turned out only to have been moved. So instead of being
  cleaver this change takes ucounts_lock with irqs disabled. So
  dec_ucount can be used from any context without fear of deadlock.

  The items accounted for dec_ucount and inc_ucount are all
  comparatively heavy weight objects so I don't exepct this will have
  any measurable performance impact"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
  userns: Make ucounts lock irq-safe
</div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/?id=19ca2c8fecb1592d623fe5e82d6796f8d446268d'>Diffstat</a> (limited to 'drivers/usb/dwc3/debug.h')</div><table summary='diffstat' class='diffstat'>