Re: [cocci] __free() attribute inhibits matching?

[Kees Cook <kees@kernel.org>]

On Wed, Mar 19, 2025 at 08:44:38AM +0100, Julia Lawall wrote:
> On Tue, 18 Mar 2025, Kees Cook wrote:
> > On Tue, Mar 18, 2025 at 06:56:40PM +0100, Julia Lawall wrote:
> > > I think you want
> > >
> > > Expression *m;
> > >
> > > A->@m b
> > >
> > > B would be an identifier
> >
> > But how does "B" get correctly type restricted? (Or in my example,
> > "NAME"?)
> >
> > I tried:
> >
> > @direct depends on !(file in "tools") && !(file in "samples")@
> > type TYPE;
> > TYPE *P;
> > TYPE *MEMBER;
> > TYPE INST;
> > identifier NAME;
> > expression COMP;
> > identifier ALLOC =~ "^kv?[mz]alloc";
> > fresh identifier ALLOC_OBJ = ALLOC ## "_obj";
> > @@
> >
> >        \(\(P\|COMP.@MEMBER NAME\|COMP->@MEMBER NAME\) \& VAR\)
> > -       = ALLOC((\(sizeof(*VAR)\|sizeof(TYPE)\|sizeof(INST)\)), GFP);
> > +       = ALLOC_OBJ(*VAR, GFP);
> >
> > This parses, but don't match (from crypto/asymmetric_keys/x509_cert_parser.c):
> >
> > 	cert->pub = kzalloc(sizeof(struct public_key), GFP_KERNEL);
> >
> > But does match (via "P"):
> >
> > 	cert = kzalloc(sizeof(struct x509_certificate), GFP_KERNEL);
> 
> What is the command line, eg --all-includes?  You can try
> --verbose-includes to see what is happening with #include "x509_parser.h"

Okay, my hiccups continue.

I do not seem to be able to mix a "type" metavariable with anything else.
For example, instead of these rules repeated:

@direct depends on patch@
type TYPE;
TYPE INST;
identifier PTR;
expression GFP;
expression TYPED;
identifier ALLOC =~ "^kv?[mz]alloc$";
fresh identifier ALLOC_OBJ = ALLOC ## "_obj";
@@

(
        TYPE *PTR
-       = ALLOC((sizeof(*PTR)), GFP);
+       = ALLOC_OBJ(*PTR, GFP);
|
        TYPE *PTR
-       = ALLOC((sizeof(INST)), GFP);
+       = ALLOC_OBJ(INST, GFP);
|
        TYPE *PTR
-       = ALLOC((sizeof(TYPE)), GFP);
+       = ALLOC_OBJ(TYPE, GFP);
)

I wanted to write it as:

        TYPE *PTR
-       = ALLOC((sizeof(\(\(*PTR\|INST\|TYPE\) \& TYPED\))), GFP);
+       = ALLOC_OBJ(TYPED, GFP);

But this doesn't let me even put "TYPE" in the \( \) at all, much less
put it into the TYPED expression:

minus: parse error: 
  File "scripts/coccinelle/api/kmalloc_objs.cocci", line 55, column 34, charpos = 1235
  around = 'TYPE',
  whole content = -     = ALLOC((sizeof(\(\(*PTR\|INST\|TYPE\) \& TYPED\))), GFP);

How do I collapse these three into 1 rule?

-- 
Kees Cook