M7350v1_en_gpl

This commit is contained in:
T
2024-09-09 08:52:07 +00:00
commit f9cc65cfda
65988 changed files with 26357421 additions and 0 deletions

View File

@@ -0,0 +1,67 @@
/// Find missing clk_puts.
///
//# This only signals a missing clk_put when there is a clk_put later
//# in the same function.
//# False positives can be due to loops.
//
// Confidence: Moderate
// Copyright: (C) 2012 Julia Lawall, INRIA/LIP6. GPLv2.
// Copyright: (C) 2012 Gilles Muller, INRIA/LiP6. GPLv2.
// URL: http://coccinelle.lip6.fr/
// Comments:
// Options:
virtual context
virtual org
virtual report
@clk@
expression e;
statement S,S1;
int ret;
position p1,p2,p3;
@@
e = clk_get@p1(...)
... when != clk_put(e)
if (<+...e...+>) S
... when any
when != clk_put(e)
when != if (...) { ... clk_put(e); ... }
(
if (ret == 0) S1
|
if (...)
{ ...
return 0; }
|
if (...)
{ ...
return <+...e...+>; }
|
*if@p2 (...)
{ ... when != clk_put(e)
when forall
return@p3 ...; }
)
... when any
clk_put(e);
@script:python depends on org@
p1 << clk.p1;
p2 << clk.p2;
p3 << clk.p3;
@@
cocci.print_main("clk_get",p1)
cocci.print_secs("if",p2)
cocci.print_secs("needed clk_put",p3)
@script:python depends on report@
p1 << clk.p1;
p2 << clk.p2;
p3 << clk.p3;
@@
msg = "ERROR: missing clk_put; clk_get on line %s and execution via conditional on line %s" % (p1[0].line,p2[0].line)
coccilib.report.print_report(p3[0],msg)

View File

@@ -0,0 +1,71 @@
/// Find uses of standard freeing functons on values allocated using devm_
/// functions. Values allocated using the devm_functions are freed when
/// the device is detached, and thus the use of the standard freeing
/// function would cause a double free.
/// See Documentation/driver-model/devres.txt for more information.
///
/// A difficulty of detecting this problem is that the standard freeing
/// function might be called from a different function than the one
/// containing the allocation function. It is thus necessary to make the
/// connection between the allocation function and the freeing function.
/// Here this is done using the specific argument text, which is prone to
/// false positives. There is no rule for the request_region and
/// request_mem_region variants because this heuristic seems to be a bit
/// less reliable in these cases.
///
// Confidence: Moderate
// Copyright: (C) 2011 Julia Lawall, INRIA/LIP6. GPLv2.
// Copyright: (C) 2011 Gilles Muller, INRIA/LiP6. GPLv2.
// URL: http://coccinelle.lip6.fr/
// Comments:
// Options: -no_includes -include_headers
virtual org
virtual report
virtual context
@r depends on context || org || report@
expression x;
@@
(
x = devm_kzalloc(...)
|
x = devm_request_irq(...)
|
x = devm_ioremap(...)
|
x = devm_ioremap_nocache(...)
|
x = devm_ioport_map(...)
)
@pb@
expression r.x;
position p;
@@
(
* kfree@p(x)
|
* free_irq@p(x)
|
* iounmap@p(x)
|
* ioport_unmap@p(x)
)
@script:python depends on org@
p << pb.p;
@@
msg="WARNING: invalid free of devm_ allocated data"
coccilib.org.print_todo(p[0], msg)
@script:python depends on report@
p << pb.p;
@@
msg="WARNING: invalid free of devm_ allocated data"
coccilib.report.print_report(p[0], msg)

View File

@@ -0,0 +1,67 @@
/// Find missing iounmaps.
///
//# This only signals a missing iounmap when there is an iounmap later
//# in the same function.
//# False positives can be due to loops.
//
// Confidence: Moderate
// Copyright: (C) 2012 Julia Lawall, INRIA/LIP6. GPLv2.
// Copyright: (C) 2012 Gilles Muller, INRIA/LiP6. GPLv2.
// URL: http://coccinelle.lip6.fr/
// Comments:
// Options:
virtual context
virtual org
virtual report
@iom@
expression e;
statement S,S1;
int ret;
position p1,p2,p3;
@@
e = \(ioremap@p1\|ioremap_nocache@p1\)(...)
... when != iounmap(e)
if (<+...e...+>) S
... when any
when != iounmap(e)
when != if (...) { ... iounmap(e); ... }
(
if (ret == 0) S1
|
if (...)
{ ...
return 0; }
|
if (...)
{ ...
return <+...e...+>; }
|
*if@p2 (...)
{ ... when != iounmap(e)
when forall
return@p3 ...; }
)
... when any
iounmap(e);
@script:python depends on org@
p1 << iom.p1;
p2 << iom.p2;
p3 << iom.p3;
@@
cocci.print_main("ioremap",p1)
cocci.print_secs("if",p2)
cocci.print_secs("needed iounmap",p3)
@script:python depends on report@
p1 << iom.p1;
p2 << iom.p2;
p3 << iom.p3;
@@
msg = "ERROR: missing iounmap; ioremap on line %s and execution via conditional on line %s" % (p1[0].line,p2[0].line)
coccilib.report.print_report(p3[0],msg)

View File

@@ -0,0 +1,121 @@
/// Find a use after free.
//# Values of variables may imply that some
//# execution paths are not possible, resulting in false positives.
//# Another source of false positives are macros such as
//# SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument
///
// Confidence: Moderate
// Copyright: (C) 2010-2012 Nicolas Palix. GPLv2.
// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6. GPLv2.
// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6. GPLv2.
// URL: http://coccinelle.lip6.fr/
// Comments:
// Options: -no_includes -include_headers
virtual org
virtual report
@free@
expression E;
position p1;
@@
kfree@p1(E)
@print expression@
constant char [] c;
expression free.E,E2;
type T;
position p;
identifier f;
@@
(
f(...,c,...,(T)E@p,...)
|
E@p == E2
|
E@p != E2
|
E2 == E@p
|
E2 != E@p
|
!E@p
|
E@p || ...
)
@sz@
expression free.E;
position p;
@@
sizeof(<+...E@p...+>)
@loop exists@
expression E;
identifier l;
position ok;
@@
while (1) { ...
kfree@ok(E)
... when != break;
when != goto l;
when forall
}
@r exists@
expression free.E, subE<=free.E, E2;
expression E1;
iterator iter;
statement S;
position free.p1!=loop.ok,p2!={print.p,sz.p};
@@
kfree@p1(E,...)
...
(
iter(...,subE,...) S // no use
|
list_remove_head(E1,subE,...)
|
subE = E2
|
subE++
|
++subE
|
--subE
|
subE--
|
&subE
|
BUG(...)
|
BUG_ON(...)
|
return_VALUE(...)
|
return_ACPI_STATUS(...)
|
E@p2 // bad use
)
@script:python depends on org@
p1 << free.p1;
p2 << r.p2;
@@
cocci.print_main("kfree",p1)
cocci.print_secs("ref",p2)
@script:python depends on report@
p1 << free.p1;
p2 << r.p2;
@@
msg = "ERROR: reference preceded by free on line %s" % (p1[0].line)
coccilib.report.print_report(p2[0],msg)