FM / api

/usr/src/linux-headers-5.15.0-181/scripts/coccinelle/api/

/usr/src/linux-headers-5.15.0-181/scripts/coccinelle/api

Name	Size	Mode	Actions
alloc/	-	0755	rm
debugfs/	-	0755	rm
atomic_as_refcounter.cocci	2272	0644	edit dl rm
check_bq27xxx_data.cocci	3538	0644	edit dl rm
device_attr_show.cocci	1104	0644	edit dl rm
d_find_alias.cocci	1309	0644	edit dl rm
err_cast.cocci	1114	0644	edit dl rm
kfree_mismatch.cocci	5691	0644	edit dl rm
kfree_sensitive.cocci	1951	0644	edit dl rm
kstrdup.cocci	2478	0644	edit dl rm
kvmalloc.cocci	6287	0644	edit dl rm
memdup.cocci	1367	0644	edit dl rm
memdup_user.cocci	2645	0644	edit dl rm
platform_get_irq.cocci	1248	0644	edit dl rm
platform_no_drv_owner.cocci	3902	0644	edit dl rm
pm_runtime.cocci	2428	0644	edit dl rm
resource_size.cocci	2132	0644	edit dl rm
simple_open.cocci	1244	0644	edit dl rm
stream_open.cocci	7880	0644	edit dl rm
vma_pages.cocci	1519	0644	edit dl rm

Edit: /usr/src/linux-headers-5.15.0-181/scripts/coccinelle/api/kfree_sensitive.cocci (1951B)

virtual context
virtual patch
virtual org
virtual report

@initialize:python@
@@
# kmalloc_oob_in_memset uses memset to explicitly trigger out-of-bounds access
filter = frozenset(['kmalloc_oob_in_memset',
		    'kfree_sensitive', 'kvfree_sensitive'])

def relevant(p):
    return not (filter & {el.current_element for el in p})

@cond@
position ok;
@@

if (...)
  \(memset@ok\|memzero_explicit@ok\)(...);

@r depends on !patch forall@
expression E;
position p : script:python() { relevant(p) };
position m != cond.ok;
type T;
@@

(
* memset@m((T)E, 0, ...);
|
* memzero_explicit@m((T)E, ...);
)
  ... when != E
      when strict
* \(kfree\|vfree\|kvfree\)(E)@p;

@rp_memzero depends on patch@
expression E, size;
position p : script:python() { relevant(p) };
position m != cond.ok;
type T;
@@

- memzero_explicit@m((T)E, size);
  ... when != E
      when strict
(
- kfree(E)@p;
+ kfree_sensitive(E);
|
- \(vfree\|kvfree\)(E)@p;
+ kvfree_sensitive(E, size);
)

@rp_memset depends on patch@
expression E, size;
position p : script:python() { relevant(p) };
position m != cond.ok;
type T;
@@

- memset@m((T)E, 0, size);
  ... when != E
      when strict
(
- kfree(E)@p;
+ kfree_sensitive(E);
|
- \(vfree\|kvfree\)(E)@p;
+ kvfree_sensitive(E, size);
)

@script:python depends on report@
p << r.p;
m << r.m;
@@

msg = "WARNING opportunity for kfree_sensitive/kvfree_sensitive (memset at line %s)"
coccilib.report.print_report(p[0], msg % (m[0].line))

@script:python depends on org@
p << r.p;
m << r.m;
@@

msg = "WARNING opportunity for kfree_sensitive/kvfree_sensitive (memset at line %s)"
coccilib.org.print_todo(p[0], msg % (m[0].line))

// SPDX-License-Identifier: GPL-2.0-only /// /// Use kfree_sensitive, kvfree_sensitive rather than memset or /// memzero_explicit followed by kfree. /// // Confidence: High // Copyright: (C) 2020 Denis Efremov ISPRAS // Options: --no-includes --include-headers // // Keywords: kfree_sensitive, kvfree_sensitive // virtual context virtual patch virtual org virtual report @initialize:python@ @@ # kmalloc_oob_in_memset uses memset to explicitly trigger out-of-bounds access filter = frozenset(['kmalloc_oob_in_memset', 'kfree_sensitive', 'kvfree_sensitive']) def relevant(p): return not (filter & {el.current_element for el in p}) @cond@ position ok; @@ if (...) \(memset@ok\|memzero_explicit@ok\)(...); @r depends on !patch forall@ expression E; position p : script:python() { relevant(p) }; position m != cond.ok; type T; @@ ( * memset@m((T)E, 0, ...); | * memzero_explicit@m((T)E, ...); ) ... when != E when strict * \(kfree\|vfree\|kvfree\)(E)@p; @rp_memzero depends on patch@ expression E, size; position p : script:python() { relevant(p) }; position m != cond.ok; type T; @@ - memzero_explicit@m((T)E, size); ... when != E when strict ( - kfree(E)@p; + kfree_sensitive(E); | - \(vfree\|kvfree\)(E)@p; + kvfree_sensitive(E, size); ) @rp_memset depends on patch@ expression E, size; position p : script:python() { relevant(p) }; position m != cond.ok; type T; @@ - memset@m((T)E, 0, size); ... when != E when strict ( - kfree(E)@p; + kfree_sensitive(E); | - \(vfree\|kvfree\)(E)@p; + kvfree_sensitive(E, size); ) @script:python depends on report@ p << r.p; m << r.m; @@ msg = "WARNING opportunity for kfree_sensitive/kvfree_sensitive (memset at line %s)" coccilib.report.print_report(p[0], msg % (m[0].line)) @script:python depends on org@ p << r.p; m << r.m; @@ msg = "WARNING opportunity for kfree_sensitive/kvfree_sensitive (memset at line %s)" coccilib.org.print_todo(p[0], msg % (m[0].line))