Commit e3243e2a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux 

Pull coccinelle updates from Julia Lawall:
 "New semantic patches and semantic patch improvements from Denis
  Efremov"

* 'for-5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux:
  coccinelle: api: filter out memdup_user definitions
  coccinelle: api: extend memdup_user rule with vmemdup_user()
  coccinelle: api: extend memdup_user transformation with GFP_USER
  coccinelle: api: add kzfree script
  coccinelle: misc: add array_size_dup script to detect missed overflow checks
  coccinelle: api/kstrdup: fix coccinelle position
  coccinelle: api: add device_attr_show script
parents 1e21b5c7 d05f94ad

scripts/coccinelle/api/device_attr_show.cocci

0 → 100644
+55 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

///

/// From Documentation/filesystems/sysfs.txt:

///  show() must not use snprintf() when formatting the value to be

///  returned to user space. If you can guarantee that an overflow

///  will never happen you can use sprintf() otherwise you must use

///  scnprintf().

///

// Confidence: High

// Copyright: (C) 2020 Denis Efremov ISPRAS

// Options: --no-includes --include-headers

//



virtual report

virtual org

virtual context

virtual patch



@r depends on !patch@

identifier show, dev, attr, buf;

position p;

@@



ssize_t show(struct device *dev, struct device_attribute *attr, char *buf)

{

	<...

*	return snprintf@p(...);

	...>

}



@rp depends on patch@

identifier show, dev, attr, buf;

@@



ssize_t show(struct device *dev, struct device_attribute *attr, char *buf)

{

	<...

	return

-		snprintf

+		scnprintf

			(...);

	...>

}



@script: python depends on report@

p << r.p;

@@



coccilib.report.print_report(p[0], "WARNING: use scnprintf or sprintf")



@script: python depends on org@

p << r.p;

@@



coccilib.org.print_todo(p[0], "WARNING: use scnprintf or sprintf")

scripts/coccinelle/api/kstrdup.cocci

+1 −1
Original line number Diff line number Diff line
@@ -66,7 +66,7 @@ position p1,p2; 


*   x = strlen(from) + 1;

    ... when != \( x = E1 \| from = E1 \)

*   to = \(kmalloc@p1\|kzalloc@p2\)(x,flag);

*   to = \(kmalloc@p1\|kzalloc@p1\)(x,flag);

    ... when != \(x = E2 \| from = E2 \| to = E2 \)

    if (to==NULL || ...) S

    ... when != \(x = E3 \| from = E3 \| to = E3 \)

scripts/coccinelle/api/kzfree.cocci

0 → 100644
+101 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

///

/// Use kzfree, kvfree_sensitive rather than memset or

/// memzero_explicit followed by kfree

///

// Confidence: High

// Copyright: (C) 2020 Denis Efremov ISPRAS

// Options: --no-includes --include-headers

//

// Keywords: kzfree, kvfree_sensitive

//



virtual context

virtual patch

virtual org

virtual report



@initialize:python@

@@

# kmalloc_oob_in_memset uses memset to explicitly trigger out-of-bounds access

filter = frozenset(['kmalloc_oob_in_memset', 'kzfree', 'kvfree_sensitive'])



def relevant(p):

    return not (filter & {el.current_element for el in p})



@cond@

position ok;

@@



if (...)

  \(memset@ok\|memzero_explicit@ok\)(...);



@r depends on !patch forall@

expression E;

position p : script:python() { relevant(p) };

position m != cond.ok;

type T;

@@



(

* memset@m((T)E, 0, ...);

|

* memzero_explicit@m((T)E, ...);

)

  ... when != E

      when strict

* \(kfree\|vfree\|kvfree\)(E)@p;



@rp_memzero depends on patch@

expression E, size;

position p : script:python() { relevant(p) };

position m != cond.ok;

type T;

@@



- memzero_explicit@m((T)E, size);

  ... when != E

      when strict

// TODO: uncomment when kfree_sensitive will be merged.

// Only this case is commented out because developers

// may not like patches like this since kzfree uses memset

// internally (not memzero_explicit).

//(

//- kfree(E)@p;

//+ kfree_sensitive(E);

//|

- \(vfree\|kvfree\)(E)@p;

+ kvfree_sensitive(E, size);

//)



@rp_memset depends on patch@

expression E, size;

position p : script:python() { relevant(p) };

position m != cond.ok;

type T;

@@



- memset@m((T)E, 0, size);

  ... when != E

      when strict

(

- kfree(E)@p;

+ kzfree(E);

|

- \(vfree\|kvfree\)(E)@p;

+ kvfree_sensitive(E, size);

)



@script:python depends on report@

p << r.p;

@@



coccilib.report.print_report(p[0],

  "WARNING: opportunity for kzfree/kvfree_sensitive")



@script:python depends on org@

p << r.p;

@@



coccilib.org.print_todo(p[0],

  "WARNING: opportunity for kzfree/kvfree_sensitive")

scripts/coccinelle/api/memdup_user.cocci

+61 −3
Original line number Diff line number Diff line
@@ -15,12 +15,22 @@ virtual context 
virtual org

virtual report



@initialize:python@

@@

filter = frozenset(['memdup_user', 'vmemdup_user'])



def relevant(p):

    return not (filter & {el.current_element for el in p})



@depends on patch@

expression from,to,size;

identifier l1,l2;

position p : script:python() { relevant(p) };

@@



-  to = \(kmalloc\|kzalloc\)(size,GFP_KERNEL);

-  to = \(kmalloc@p\|kzalloc@p\)

-		(size,\(GFP_KERNEL\|GFP_USER\|

-		      \(GFP_KERNEL\|GFP_USER\)|__GFP_NOWARN\));

+  to = memdup_user(from,size);

   if (

-      to==NULL
@@ -37,13 +47,49 @@ identifier l1,l2; 
-    ...+>

-  }



@depends on patch@

expression from,to,size;

identifier l1,l2;

position p : script:python() { relevant(p) };

@@



-  to = \(kvmalloc@p\|kvzalloc@p\)(size,\(GFP_KERNEL\|GFP_USER\));

+  to = vmemdup_user(from,size);

   if (

-      to==NULL

+      IS_ERR(to)

                 || ...) {

   <+... when != goto l1;

-  -ENOMEM

+  PTR_ERR(to)

   ...+>

   }

-  if (copy_from_user(to, from, size) != 0) {

-    <+... when != goto l2;

-    -EFAULT

-    ...+>

-  }



@r depends on !patch@

expression from,to,size;

position p;

position p : script:python() { relevant(p) };

statement S1,S2;

@@



*  to = \(kmalloc@p\|kzalloc@p\)(size,GFP_KERNEL);

*  to = \(kmalloc@p\|kzalloc@p\)

		(size,\(GFP_KERNEL\|GFP_USER\|

		      \(GFP_KERNEL\|GFP_USER\)|__GFP_NOWARN\));

   if (to==NULL || ...) S1

   if (copy_from_user(to, from, size) != 0)

   S2



@rv depends on !patch@

expression from,to,size;

position p : script:python() { relevant(p) };

statement S1,S2;

@@



*  to = \(kvmalloc@p\|kvzalloc@p\)(size,\(GFP_KERNEL\|GFP_USER\));

   if (to==NULL || ...) S1

   if (copy_from_user(to, from, size) != 0)

   S2
@@ -59,3 +105,15 @@ p << r.p; 
@@



coccilib.report.print_report(p[0], "WARNING opportunity for memdup_user")



@script:python depends on org@

p << rv.p;

@@



coccilib.org.print_todo(p[0], "WARNING opportunity for vmemdup_user")



@script:python depends on report@

p << rv.p;

@@



coccilib.report.print_report(p[0], "WARNING opportunity for vmemdup_user")

scripts/coccinelle/misc/array_size_dup.cocci

0 → 100644
+209 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

///

/// Check for array_size(), array3_size(), struct_size() duplicates.

/// These patterns are detected:

///  1. An opencoded expression is used before array_size() to compute the same size

///  2. An opencoded expression is used after array_size() to compute the same size

/// From security point of view only first case is relevant. These functions

/// perform arithmetic overflow check. Thus, if we use an opencoded expression

/// before a call to the *_size() function we can miss an overflow.

///

// Confidence: High

// Copyright: (C) 2020 Denis Efremov ISPRAS

// Options: --no-includes --include-headers --no-loops



virtual context

virtual report

virtual org



@as@

expression E1, E2;

@@



array_size(E1, E2)



@as_next@

expression subE1 <= as.E1;

expression subE2 <= as.E2;

expression as.E1, as.E2, E3;

assignment operator aop;

position p1, p2;

@@



* E1 * E2@p1

  ... when != \(subE1\|subE2\) aop E3

      when != &\(subE1\|subE2\)

* array_size(E1, E2)@p2



@script:python depends on report@

p1 << as_next.p1;

p2 << as_next.p2;

@@



msg = "WARNING: array_size is used later (line %s) to compute the same size" % (p2[0].line)

coccilib.report.print_report(p1[0], msg)



@script:python depends on org@

p1 << as_next.p1;

p2 << as_next.p2;

@@



msg = "WARNING: array_size is used later (line %s) to compute the same size" % (p2[0].line)

coccilib.org.print_todo(p1[0], msg)



@as_prev@

expression subE1 <= as.E1;

expression subE2 <= as.E2;

expression as.E1, as.E2, E3;

assignment operator aop;

position p1, p2;

@@



* array_size(E1, E2)@p1

  ... when != \(subE1\|subE2\) aop E3

      when != &\(subE1\|subE2\)

* E1 * E2@p2



@script:python depends on report@

p1 << as_prev.p1;

p2 << as_prev.p2;

@@



msg = "WARNING: array_size is already used (line %s) to compute the same size" % (p1[0].line)

coccilib.report.print_report(p2[0], msg)



@script:python depends on org@

p1 << as_prev.p1;

p2 << as_prev.p2;

@@



msg = "WARNING: array_size is already used (line %s) to compute the same size" % (p1[0].line)

coccilib.org.print_todo(p2[0], msg)



@as3@

expression E1, E2, E3;

@@



array3_size(E1, E2, E3)



@as3_next@

expression subE1 <= as3.E1;

expression subE2 <= as3.E2;

expression subE3 <= as3.E3;

expression as3.E1, as3.E2, as3.E3, E4;

assignment operator aop;

position p1, p2;

@@



* E1 * E2 * E3@p1

  ... when != \(subE1\|subE2\|subE3\) aop E4

      when != &\(subE1\|subE2\|subE3\)

* array3_size(E1, E2, E3)@p2



@script:python depends on report@

p1 << as3_next.p1;

p2 << as3_next.p2;

@@



msg = "WARNING: array3_size is used later (line %s) to compute the same size" % (p2[0].line)

coccilib.report.print_report(p1[0], msg)



@script:python depends on org@

p1 << as3_next.p1;

p2 << as3_next.p2;

@@



msg = "WARNING: array3_size is used later (line %s) to compute the same size" % (p2[0].line)

coccilib.org.print_todo(p1[0], msg)



@as3_prev@

expression subE1 <= as3.E1;

expression subE2 <= as3.E2;

expression subE3 <= as3.E3;

expression as3.E1, as3.E2, as3.E3, E4;

assignment operator aop;

position p1, p2;

@@



* array3_size(E1, E2, E3)@p1

  ... when != \(subE1\|subE2\|subE3\) aop E4

      when != &\(subE1\|subE2\|subE3\)

* E1 * E2 * E3@p2



@script:python depends on report@

p1 << as3_prev.p1;

p2 << as3_prev.p2;

@@



msg = "WARNING: array3_size is already used (line %s) to compute the same size" % (p1[0].line)

coccilib.report.print_report(p2[0], msg)



@script:python depends on org@

p1 << as3_prev.p1;

p2 << as3_prev.p2;

@@



msg = "WARNING: array3_size is already used (line %s) to compute the same size" % (p1[0].line)

coccilib.org.print_todo(p2[0], msg)



@ss@

expression E1, E2, E3;

@@



struct_size(E1, E2, E3)



@ss_next@

expression subE3 <= ss.E3;

expression ss.E1, ss.E2, ss.E3, E4;

assignment operator aop;

position p1, p2;

@@



* E1 * E2 + E3@p1

  ... when != subE3 aop E4

      when != &subE3

* struct_size(E1, E2, E3)@p2



@script:python depends on report@

p1 << ss_next.p1;

p2 << ss_next.p2;

@@



msg = "WARNING: struct_size is used later (line %s) to compute the same size" % (p2[0].line)

coccilib.report.print_report(p1[0], msg)



@script:python depends on org@

p1 << ss_next.p1;

p2 << ss_next.p2;

@@



msg = "WARNING: struct_size is used later (line %s) to compute the same size" % (p2[0].line)

coccilib.org.print_todo(p1[0], msg)



@ss_prev@

expression subE3 <= ss.E3;

expression ss.E1, ss.E2, ss.E3, E4;

assignment operator aop;

position p1, p2;

@@



* struct_size(E1, E2, E3)@p1

  ... when != subE3 aop E4

      when != &subE3

* E1 * E2 + E3@p2



@script:python depends on report@

p1 << ss_prev.p1;

p2 << ss_prev.p2;

@@



msg = "WARNING: struct_size is already used (line %s) to compute the same size" % (p1[0].line)

coccilib.report.print_report(p2[0], msg)



@script:python depends on org@

p1 << ss_prev.p1;

p2 << ss_prev.p2;

@@



msg = "WARNING: struct_size is already used (line %s) to compute the same size" % (p1[0].line)

coccilib.org.print_todo(p2[0], msg)