[cocci] metavariables in added attribute arguments

[Kees Cook <keescook@chromium.org>]

Hello,

I am trying to annotate structures with a new attribute that identifies
which struct member contains the count of elements for a given flexible
array member:

struct foo {
	...
	size_t element_count;
	...
	int element_array[];
};

becomes:

struct foo {
	...
	size_t element_count;
	...
	int element_array[] __counted_by(element_count);
};

From the grammar doc, I found this note: "Attribute metavariables are
only allowed in context or minus code, and not in added code". I would
expect that to only apply to the name of the attribute itself, but
that's not what I'm trying to do. Here is the .cocci file:

// Options: --include-headers

@allocated@
identifier STRUCT, ARRAY, COUNTER, CALC;
expression COUNT;
struct STRUCT *PTR;
identifier ALLOC =~ "(devm_)?[kv][cvzm]alloc";
@@

(
        CALC = struct_size(PTR, ARRAY, COUNT);
        ...
        PTR = ALLOC(..., CALC, ...);
|
        PTR = ALLOC(..., struct_size(PTR, ARRAY, COUNT), ...);
)
        ...
        PTR->COUNTER = COUNT;

@annotate@
type COUNTER_TYPE, ARRAY_TYPE;
identifier allocated.STRUCT;
identifier allocated.ARRAY;
identifier allocated.COUNTER;
attribute name __counted_by;
@@

 struct STRUCT {
        ...
        COUNTER_TYPE COUNTER;
        ...
        ARRAY_TYPE ARRAY[]
+       __counted_by(COUNTER)
        ;
 };

This fails like so:

$ cocci element_count.cocci net/packet/af_packet.c
plus: parse error: 
  File "element_count.cocci", line 33, column 15, charpos = 593
  around = 'COUNTER',
  whole content = +     __counted_by(COUNTER)

But I can produce (nonsense) output if I change the replacement to:

	ARRAY_TYPE ARRAY[
+	COUNTER
	]
+	__counted_by
	;

Explicitly using "attribute name __counted_by;" didn't seem to help.
What am I missing?

Thanks!

-Kees

-- 
Kees Cook