[PATCH v2] misra: deviate C library-style functions from Misra C:2012 rule 11.8

[PATCH v2] misra: deviate C library-style functions from Misra C:2012 rule 11.8

[Dmytro Prokopchuk1]

bsearch(), memchr(), strchr(), strpbrk(), strrchr() and strstr() all
accept a const pointer/object but return a non-const pointer to the
matched element or byte, matching their standard C library interfaces.
The casts in these implementations strip const so that callers searching
a non-const object get back a mutable pointer. Fixing this would require
changing the public API, so document these uses as deviations instead.

Update docs/misra/rules.rst to note that this class of double-use
library functions is deviated on a per-function basis.

Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@epam.com>
---
Changes in v2:
- dropped memchr_inv() from the deviation (not a standard function)
- anchored the file patterns and grouped the xen/lib files, as
  suggested by Nicola
- narrowed the justification to the casts in the function bodies

Link to v1:
https://patchew.org/Xen/4abcb11ef287170ced74935cbee60c90058c1307.1790671787.git.dmytro._5Fprokopchuk1@epam.com/
---
 automation/eclair_analysis/ECLAIR/deviations.ecl | 8 ++++++++
 docs/misra/deviations.rst                        | 9 +++++++++
 docs/misra/rules.rst                             | 6 +++++-
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl b/automation/eclair_analysis/ECLAIR/deviations.ecl
index 6cdb10a129..ed8bad0cb0 100644
--- a/automation/eclair_analysis/ECLAIR/deviations.ecl
+++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
@@ -450,6 +450,14 @@ write or not"
 -config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(file(hvm_guestcopy)&&text(^.*__hvm_copy.*HVMCOPY_to_guest doesn't modify.*$)))"}
 -doc_end
 
+-doc_begin="Functions bsearch(), memchr(), strchr(), strpbrk(), strrchr() and
+strstr() accept a const pointer/object and return a non-const pointer to the
+matched element or byte, matching their standard C library interfaces. The
+casts in these implementations strip const so that a search of a non-const
+object yields a mutable pointer. This use is deemed safe."
+-config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(file(^xen/include/xen/bsearch\\.h$||^xen/lib/(memchr|strchr|strpbrk|strrchr|strstr)\\.c$)))"}
+-doc_end
+
 -doc_begin="This construct is used to check if the type is scalar, and for this purpose the use of 0 as a null pointer constant is deliberate."
 -config=MC3A2.R11.9,reports+={deliberate, "any_area(any_loc(any_exp(macro(^__ACCESS_ONCE$))))"
 }
diff --git a/docs/misra/deviations.rst b/docs/misra/deviations.rst
index 6bcc2adf95..68de2d8dd1 100644
--- a/docs/misra/deviations.rst
+++ b/docs/misra/deviations.rst
@@ -436,6 +436,15 @@ Deviations related to MISRA C:2012 Rules:
        readability.
      - Tagged as `safe` for ECLAIR.
 
+   * - R11.8
+     - Functions bsearch(), memchr(), strchr(), strpbrk(), strrchr() and
+       strstr() accept a const pointer/object and return a non-const pointer
+       to the matched element or byte, matching their standard C library
+       interfaces. The casts in these implementations strip const so that a
+       search of a non-const object yields a mutable pointer. This use is
+       deemed safe.
+     - Tagged as `safe` for ECLAIR.
+
    * - R11.9
      - __ACCESS_ONCE uses an integer, which happens to be zero, as a
        compile time check. The typecheck uses a cast. The usage of zero or other
diff --git a/docs/misra/rules.rst b/docs/misra/rules.rst
index a59cf1782e..00378c474e 100644
--- a/docs/misra/rules.rst
+++ b/docs/misra/rules.rst
@@ -473,7 +473,11 @@ maintainers if you want to suggest a change.
    * - `Rule 11.8 <https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite/-/blob/master/R_11_08.c>`_
      - Required
      - A cast shall not remove any const or volatile qualification from the type pointed to by a pointer
-     -
+     - Some standard C library-style functions are inherently double-use,
+       accepting a const argument and returning a non-const pointer into
+       it so that callers searching a non-const object get back a
+       mutable pointer. The casts that implement this are deviated per
+       function.
 
    * - `Rule 11.9 <https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite/-/blob/master/R_11_09.c>`_
      - Required
-- 
2.43.0

Re: [PATCH v2] misra: deviate C library-style functions from Misra C:2012 rule 11.8

[Jan Beulich]

On 19.10.2026 12:41, Dmytro Prokopchuk1 wrote:
> bsearch(), memchr(), strchr(), strpbrk(), strrchr() and strstr() all
> accept a const pointer/object but return a non-const pointer to the
> matched element or byte, matching their standard C library interfaces.
> The casts in these implementations strip const so that callers searching
> a non-const object get back a mutable pointer. Fixing this would require
> changing the public API, so document these uses as deviations instead.

Imo "public API" is misleading here, as it could mean "public interface",
which isn't affected here at all. Then ...

> Update docs/misra/rules.rst to note that this class of double-use
> library functions is deviated on a per-function basis.
> 
> Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@epam.com>

Acked-by: Jan Beulich <jbeulich@suse.com>

Albeit there another minor remark:

> --- a/automation/eclair_analysis/ECLAIR/deviations.ecl
> +++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
> @@ -450,6 +450,14 @@ write or not"
>  -config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(file(hvm_guestcopy)&&text(^.*__hvm_copy.*HVMCOPY_to_guest doesn't modify.*$)))"}
>  -doc_end
>  
> +-doc_begin="Functions bsearch(), memchr(), strchr(), strpbrk(), strrchr() and
> +strstr() accept a const pointer/object and return a non-const pointer to the
> +matched element or byte, matching their standard C library interfaces. The
> +casts in these implementations strip const so that a search of a non-const
> +object yields a mutable pointer. This use is deemed safe."
> +-config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(file(^xen/include/xen/bsearch\\.h$||^xen/lib/(memchr|strchr|strpbrk|strrchr|strstr)\\.c$)))"}
> +-doc_end

Can't we fold strchr and strrchr here, e.g. as simple as (memchr|str+chr|strpbrk|strstr)?

Jan

Re: [PATCH v2] misra: deviate C library-style functions from Misra C:2012 rule 11.8

[Nicola Vetrini]

On 2026-10-19 12:41, Dmytro Prokopchuk1 wrote:
> bsearch(), memchr(), strchr(), strpbrk(), strrchr() and strstr() all
> accept a const pointer/object but return a non-const pointer to the
> matched element or byte, matching their standard C library interfaces.
> The casts in these implementations strip const so that callers 
> searching
> a non-const object get back a mutable pointer. Fixing this would 
> require
> changing the public API, so document these uses as deviations instead.
> 
> Update docs/misra/rules.rst to note that this class of double-use
> library functions is deviated on a per-function basis.
> 
> Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@epam.com>

Reviewed-by: Nicola Vetrini <nicola.vetrini@bugseng.com> # 
automation/eclair_analysis/.*

> ---
> Changes in v2:
> - dropped memchr_inv() from the deviation (not a standard function)
> - anchored the file patterns and grouped the xen/lib files, as
>   suggested by Nicola
> - narrowed the justification to the casts in the function bodies
> 
> Link to v1:
> https://patchew.org/Xen/4abcb11ef287170ced74935cbee60c90058c1307.1790671787.git.dmytro._5Fprokopchuk1@epam.com/
> ---
>  automation/eclair_analysis/ECLAIR/deviations.ecl | 8 ++++++++
>  docs/misra/deviations.rst                        | 9 +++++++++
>  docs/misra/rules.rst                             | 6 +++++-
>  3 files changed, 22 insertions(+), 1 deletion(-)
> 
> diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl 
> b/automation/eclair_analysis/ECLAIR/deviations.ecl
> index 6cdb10a129..ed8bad0cb0 100644
> --- a/automation/eclair_analysis/ECLAIR/deviations.ecl
> +++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
> @@ -450,6 +450,14 @@ write or not"
>  
> -config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(file(hvm_guestcopy)&&text(^.*__hvm_copy.*HVMCOPY_to_guest 
> doesn't modify.*$)))"}
>  -doc_end
> 
> +-doc_begin="Functions bsearch(), memchr(), strchr(), strpbrk(), 
> strrchr() and
> +strstr() accept a const pointer/object and return a non-const pointer 
> to the
> +matched element or byte, matching their standard C library interfaces. 
> The
> +casts in these implementations strip const so that a search of a 
> non-const
> +object yields a mutable pointer. This use is deemed safe."
> +-config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(file(^xen/include/xen/bsearch\\.h$||^xen/lib/(memchr|strchr|strpbrk|strrchr|strstr)\\.c$)))"}
> +-doc_end
> +
>  -doc_begin="This construct is used to check if the type is scalar, and 
> for this purpose the use of 0 as a null pointer constant is 
> deliberate."
>  -config=MC3A2.R11.9,reports+={deliberate, 
> "any_area(any_loc(any_exp(macro(^__ACCESS_ONCE$))))"
>  }
> diff --git a/docs/misra/deviations.rst b/docs/misra/deviations.rst
> index 6bcc2adf95..68de2d8dd1 100644
> --- a/docs/misra/deviations.rst
> +++ b/docs/misra/deviations.rst
> @@ -436,6 +436,15 @@ Deviations related to MISRA C:2012 Rules:
>         readability.
>       - Tagged as `safe` for ECLAIR.
> 
> +   * - R11.8
> +     - Functions bsearch(), memchr(), strchr(), strpbrk(), strrchr() 
> and
> +       strstr() accept a const pointer/object and return a non-const 
> pointer
> +       to the matched element or byte, matching their standard C 
> library
> +       interfaces. The casts in these implementations strip const so 
> that a
> +       search of a non-const object yields a mutable pointer. This use 
> is
> +       deemed safe.
> +     - Tagged as `safe` for ECLAIR.
> +
>     * - R11.9
>       - __ACCESS_ONCE uses an integer, which happens to be zero, as a
>         compile time check. The typecheck uses a cast. The usage of 
> zero or other
> diff --git a/docs/misra/rules.rst b/docs/misra/rules.rst
> index a59cf1782e..00378c474e 100644
> --- a/docs/misra/rules.rst
> +++ b/docs/misra/rules.rst
> @@ -473,7 +473,11 @@ maintainers if you want to suggest a change.
>     * - `Rule 11.8 
> <https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite/-/blob/master/R_11_08.c>`_
>       - Required
>       - A cast shall not remove any const or volatile qualification 
> from the type pointed to by a pointer
> -     -
> +     - Some standard C library-style functions are inherently 
> double-use,
> +       accepting a const argument and returning a non-const pointer 
> into
> +       it so that callers searching a non-const object get back a
> +       mutable pointer. The casts that implement this are deviated per
> +       function.
> 
>     * - `Rule 11.9 
> <https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite/-/blob/master/R_11_09.c>`_
>       - Required

-- 
Nicola Vetrini, B.Sc.
Software Engineer
BUGSENG (https://bugseng.com)
LinkedIn: https://www.linkedin.com/in/nicola-vetrini-a42471253