Re: [cocci] spatch 1.1.1 segmentation fault report

[Denis Efremov <efremov@linux.com>]

On 2/7/22 00:00, Julia Lawall wrote:
> 
> 
> On Sun, 6 Feb 2022, Denis Efremov wrote:
> 
>>
>>
>> On 2/6/22 22:48, Julia Lawall wrote:
>>>
>>>
>>> On Sun, 6 Feb 2022, Denis Efremov wrote:
>>>
>>>>
>>>>
>>>> On 2/6/22 21:43, Julia Lawall wrote:
>>>>>
>>>>>
>>>>> On Sun, 6 Feb 2022, Denis Efremov wrote:
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> I'm observing a weird crash with spatch 1.1.1
>>>>>>
>>>>>> $ spatch --version
>>>>>> spatch version 1.1.1 compiled with OCaml version 4.11.2
>>>>>> Flags passed to the configure script: --enable-opt --enable-ocaml --enable-python --enable-pcre-syntax --enable-pcre --prefix /home/work/.opam/4.11.2 --libdir /home/work/.opam/4.11.2/lib
>>>>>> OCaml scripting support: yes
>>>>>> Python scripting support: yes
>>>>>> Syntax of regular expressions: PCRE
>>>>>>
>>>>>> $ cat segfault.cocci
>>>>>> @err@
>>>>>> position p;
>>>>>> @@
>>>>>>
>>>>>> amd_energy_is_visible(...)
>>>>>> {
>>>>>> *       return 0444;@p
>>>>>> }
>>>>>>
>>>>>> @script:python@
>>>>>> p << err.p;
>>>>>> @@
>>>>>>
>>>>>> coccilib.report.print_report(p[0], "found")
>>>>>>
>>>>>> $ mkdir empty_dir # creating empty directory
>>>>>> $ spatch segfault.cocci empty_dir
>>>>>> init_defs_builtins: /home/work/.opam/4.11.2/lib/coccinelle/standard.h
>>>>>> 0 files match
>>>>>> [1]    152475 segmentation fault (core dumped)  spatch segfault.cocci test
>>>>>
>>>>> I tried 1.1.1 with the options --enable-opt --enable-ocaml --enable-python
>>>>> --enable-pcre-syntax --enable-pcre, but it seems to work find for me.
>>>>> Does the problem go away if there is a file in the directory?  If you
>>>>> remove the python code?
>>>>
>>>> It doesn't crash if I run it on the linux kernel sources on commits prior to
>>>> 9049572fb145 hwmon: Remove amd_energy driver
>>>>
>>>>
>>>> $ git checkout 9049572fb145~
>>>> # there is amd_energy_is_visible in drivers/hwmon/amd_energy.c
>>>> # spatch doesn't crash on this commit
>>>>
>>>> $ git checkout 9049572fb145
>>>> # no amd_energy_is_visible in kernel source
>>>> # spatch crashes
>>>>
>>>> If I remove python code then spatch doesn't crash.
>>>
>>> Maybe try with --debug.  Or try without the p[0] in the python code.
>> I removed coccilib.report.print_report(p[0], "found")
> 
> Could you remove the python metavariable p and print something in the
> python code?  Flush standard output to be sure to have a chance to see it
> if it crashes after.  Maybe it would help to see where the crash occurs in
> the core file?


I checked that the problem persist on latest commit
b2a4b9b77157 parsing_c: print correct attributes in pretty_print_c.ml

and bisected the crash to commit 
7b79a2415a8c6e8b1c39a8183bf732fdc6d00453 is the first bad commit
commit 7b79a2415a8c6e8b1c39a8183bf732fdc6d00453
Author: Corentin De Souza <corentin.de-souza@inria.fr>
Date:   Tue May 25 19:21:51 2021 +0200

    parsing_c: detect macro iterators from their bodies
    
    This uses the same strategy as macro statements (see
    https://gitlab.inria.fr/coccinelle/coccinelle/-/merge_requests/92).
    The goal is to do fix https://gitlab.inria.fr/coccinelle/coccinelle/-/issues/24
    
    The next commit will finally fix the assign_expr rule in the parser, removing
    the conflicts it introduced while not breaking test
    assign_deref_funcall_in_macro_it.

 parsing_c/cpp_token_c.ml | 39 ++++++++++++++++++++++++++++++---------
 parsing_c/parser_c.mly   |  3 ++-
 2 files changed, 32 insertions(+), 10 deletions(-)

I removed the @p variable and reduced the cocci file to
@err@
@@

amd_energy_is_visible(...)
{
*       return 0444;
}

@script:python@
@@

and it still crashes.
$ mkdir empty_dir
$ spatch segfault.cocci empty_dir
init_defs_builtins: /home/work/.opam/4.11.2/lib/coccinelle/standard.h
no inferred keywords
[2]    240209 segmentation fault (core dumped)  spatch segfault.cocci empty_dir

$ touch empty_dir/file
$ spatch segfault.cocci empty_dir
init_defs_builtins: /home/work/.opam/4.11.2/lib/coccinelle/standard.h
no inferred keywords
[2]    240269 segmentation fault (core dumped)  spatch segfault.cocci empty_dir

$ echo "void amd_energy_is_visible(void) { return 0444; }" > empty_dir/file
$ spatch segfault.cocci empty_dir
init_defs_builtins: /home/work/.opam/4.11.2/lib/coccinelle/standard.h
no inferred keywords
[2]    240363 segmentation fault (core dumped)  spatch segfault.cocci empty_dir

Regards,
Denis