From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 692C7C43217 for ; Thu, 3 Nov 2022 06:31:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inria.fr; s=dc; h=date:from:to:cc:in-reply-to:message-id:references: mime-version:subject:reply-to:sender:list-id:list-help: list-subscribe:list-unsubscribe:list-post:list-owner: list-archive; bh=8l0CQTM9ypXNWiw0zCbDPA1te+kKB1KXHppBD2iO0Sw=; b=jVwNb3ZPbWM0Rjti1s4OC3b6//m2KlER6t3pa+gOGLnrtRP1j9DQrZRI qRg4diheAtJfPEpuvj3XAe0RDPJc2Zks1RkTm2wNdltKDp+cSrRbDZvnG 9fitvy3nz1SVfltXN/1cfzkxO2pfreVijo52jDgl0VccWrOffM9eHHLF9 8=; Received-SPF: SoftFail (mail2-relais-roc.national.inria.fr: domain of cocci-owner@inria.fr is inclined to not designate 128.93.162.160 as permitted sender) identity=mailfrom; client-ip=128.93.162.160; receiver=mail2-relais-roc.national.inria.fr; envelope-from="cocci-owner@inria.fr"; x-sender="cocci-owner@inria.fr"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:192.134.164.0/24 mx ~all" Received-SPF: None (mail2-relais-roc.national.inria.fr: no sender authenticity information available from domain of postmaster@sympa.inria.fr) identity=helo; client-ip=128.93.162.160; receiver=mail2-relais-roc.national.inria.fr; envelope-from="cocci-owner@inria.fr"; x-sender="postmaster@sympa.inria.fr"; x-conformance=spf_only Authentication-Results: mail2-relais-roc.national.inria.fr; spf=SoftFail smtp.mailfrom=cocci-owner@inria.fr; spf=None smtp.helo=postmaster@sympa.inria.fr; dkim=pass (signature verified) header.i=@inria.fr X-IronPort-AV: E=Sophos;i="5.95,235,1661810400"; d="scan'208";a="72743294" Received: from prod-listesu18.inria.fr (HELO sympa.inria.fr) ([128.93.162.160]) by mail2-relais-roc.national.inria.fr with ESMTP; 03 Nov 2022 07:31:56 +0100 Received: by sympa.inria.fr (Postfix, from userid 20132) id 2B800E7389; Thu, 3 Nov 2022 07:31:56 +0100 (CET) Received: from mail3-relais-sop.national.inria.fr (mail3-relais-sop.national.inria.fr [192.134.164.104]) by sympa.inria.fr (Postfix) with ESMTPS id 324CFE7385 for ; Thu, 3 Nov 2022 07:31:49 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inria.fr; s=dc; h=date:from:to:cc:subject:in-reply-to:message-id: references:mime-version; bh=8l0CQTM9ypXNWiw0zCbDPA1te+kKB1KXHppBD2iO0Sw=; b=K90GIjx5EFgDXEMSv5IMsuP3RcoiGN24rxzUEBGw1ap0xF2ts9jq5mob bHsykEiLyZLvCkLiQjw747PTIralmTLN3wiaPTTl4a337XdLjSwHG0yNN lSy0AC9O4+Pbk/WbOV9P4Xk+SnIDR0BrooRTaV4dhf1E09U2lsTElX2Ch U=; X-IronPort-AV: E=Sophos;i="5.95,235,1661810400"; d="scan'208";a="36318700" Received: from 51.123.68.85.rev.sfr.net (HELO hadrien) ([85.68.123.51]) by mail3-relais-sop.national.inria.fr with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Nov 2022 07:31:48 +0100 Date: Thu, 3 Nov 2022 07:31:47 +0100 (CET) From: Julia Lawall X-X-Sender: jll@hadrien To: "Jason A. Donenfeld" cc: Kees Cook , cocci@inria.fr, Linus Torvalds , Alexey Dobriyan , akpm@linux-foundation.org, linux-kernel@vger.kernel.org, mm-commits@vger.kernel.org, masahiroy@kernel.org, gregkh@linuxfoundation.org, andriy.shevchenko@linux.intel.com, Stephen Rothwell In-Reply-To: Message-ID: References: <20221020000356.177CDC433C1@smtp.kernel.org> <202210201151.ECC19BC97A@keescook> User-Agent: Alpine 2.22 (DEB 394 2020-01-19) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Subject: Re: [cocci] [PATCH -mm] -funsigned-char, x86: make struct p4_event_bind::cntr signed array Reply-To: Julia Lawall X-Loop: cocci@inria.fr X-Sequence: 702 Errors-To: cocci-owner@inria.fr Precedence: list Precedence: bulk Sender: cocci-request@inria.fr X-no-archive: yes List-Id: List-Help: List-Subscribe: List-Unsubscribe: List-Post: List-Owner: List-Archive: Archived-At: On Thu, 3 Nov 2022, Jason A. Donenfeld wrote: > On Wed, Nov 02, 2022 at 06:17:04PM +0100, Julia Lawall wrote: > > > > > > On Wed, 26 Oct 2022, Jason A. Donenfeld wrote: > > > > > On Wed, Oct 26, 2022 at 03:50:25AM +0200, Jason A. Donenfeld wrote: > > > > The traditional objdump comparison does work, though. It produces a good > > > > > > Another thing that appears to work well is just using Coccinelle > > > scripts. I've had some success just scrolling through the results of: > > > > > > @@ > > > char c; > > > expression E; > > > @@ > > > ( > > > * E > c > > > | > > > * E >= c > > > | > > > * E < c > > > | > > > * E <= c > > > ) > > > > > > That also triggers on explicitly signed chars, and examining those > > > reveals that quite a bit of code in the tree already does do the right > > > thing, which is good. > > > > > > From looking at this and objdump output, it looks like most naked-char > > > usage that isn't for strings is actually already assuming it's unsigned, > > > using it as a byte. I'll continue to churn, and I'm sure I'll miss a few > > > things here and there, but all and all, I don't think this is looking as > > > terrible as I initially feared. > > > > > > I'm CC'ing the Coccinelle people to see if they have any nice ideas on > > > improvements. Specifically, the thing we're trying to identify is: > > > > > > - Usage of vanilla `char`, without a `signed` or `unsigned` qualifier, > > > where: > > > > Try putting > > > > disable optional_qualifier > > > > between the initial @@, to avoid the implicit matching of signed and > > unsigned. > > Hmm, this doesn't quite work. Here are my rules: > > @disable optional_qualifier@ > char c; > expression E; > @@ > ( > * E > c > | > * E >= c > | > * E < c > | > * E <= c > ) > > @disable optional_qualifier@ > char c; > @@ > * c == -1 > > @disable optional_qualifier@ > char c; > @@ > * c = -1 > > This produces, for example: > > diff -u -p ./sound/firewire/bebob/bebob_focusrite.c /tmp/nothing/sound/firewire/bebob/bebob_focusrite.c > --- ./sound/firewire/bebob/bebob_focusrite.c > +++ /tmp/nothing/sound/firewire/bebob/bebob_focusrite.c > @@ -192,7 +192,6 @@ saffirepro_both_clk_src_get(struct snd_b > > /* In a case that this driver cannot handle the value of register. */ > value &= SAFFIREPRO_CLOCK_SOURCE_SELECT_MASK; > - if (value >= SAFFIREPRO_CLOCK_SOURCE_COUNT || map[value] < 0) { > err = -EIO; > goto end; > } > > Except map is defined as: > > const signed char *map; > > So this would be one of those cases that I had hoped `disable > optional_qualifier` would exclude. (I think internally coccinelle might > be assuming `char` is signed, by the way.) OK, I see the problem. Coccinelle isn't taking the "disable optional_qualifier" into account when it checks types on expressions. It would work if you put, eg: char x; ... when any * x < 0 But that would be much slower and less general. I will fix it. > > > > - It's not being used for characters; and > > > - It's doing something that assumes it is signed, such as various > > > types of comparisons or decrements. > > > > I took a quick look at the article, but I'm not completely sure what you > > are getting at here. Could you give some examples of what you do and > > don't want to find? > > > > You don't want the case where c is 'x', for some x? > > Something I would want to find is `if (c < 0)`. Something I wouldn't > want to find is `if (c < '9')`. IOW, I'm looking for code that assumes > `c` is signed, and would become incorrect if `c` suddenly became > unsigned. Most things involving actual characters are fine. But most > things involving signed arithmetic or comparisons with numbers isn't > find. This seems to do what you want: @disable optional_qualifier@ constant char cc; expression e; char c; @@ ( c < cc | * c < e ) It highlights only the two return lines in: int main () { char x; if (x < 'd') return x < 0; else return x < y; } julia > > Jason >