1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
virtual after_start
@initialize:python@
@@
seen = set()
def add_if_not_present (source, f, file):
if (f, file) not in seen:
seen.add((f, file))
it = Iteration()
if file != None:
it.set_files([file])
it.add_virtual_rule(after_start)
it.add_virtual_identifier(err_ptr_function, f)
it.register()
@r depends on !after_start exists@
identifier fn;
position p;
@@
fn@p(...) { <+... return (ERR_PTR(...)); ...+> }
@statfns@
identifier r.fn;
position r.p;
@@
static fn@p(...) { ... }
@script:python depends on statfns@
fn << r.fn;
p << r.p;
@@
add_if_not_present("ERR_PTR", fn, p[0].file)
@script:python depends on !statfns@
fn << r.fn;
p << r.p;
@@
add_if_not_present("ERR_PTR", fn, None)
// -----------------------------------------------------------------------
// iterate
@s depends on after_start exists@
identifier virtual.err_ptr_function, fn;
position p;
@@
fn@p(...) { <+... return err_ptr_function(...); ...+> }
@statfns_call@
identifier s.fn;
position s.p;
@@
static fn@p(...) { ... }
@script:python depends on statfns_call@
fn << s.fn;
p << s.p;
err_ptr_function << virtual.err_ptr_function;
@@
add_if_not_present(err_ptr_function, fn, p[0].file)
@script:python depends on !statfns_call@
fn << s.fn;
p << s.p;
err_ptr_function << virtual.err_ptr_function;
@@
add_if_not_present(err_ptr_function,fn, None)
// -----------------------------------------------------------------------
// find bugs
@e depends on after_start exists@
identifier virtual.err_ptr_function;
expression x;
identifier fld;
position p1,p2;
@@
(
IS_ERR(x = err_ptr_function(...))
|
x@p1 = err_ptr_function(...)
)
... when != IS_ERR(x)
(
(IS_ERR(x) ||...)
|
x@p2->fld
)
@script:python@
p1 << e.p1;
p2 << e.p2;
@@
cocci.print_main("def",p1)
cocci.print_secs("ref",p2)
|
