From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754417AbbIXMz0 (ORCPT ); Thu, 24 Sep 2015 08:55:26 -0400 Received: from mailout4.w1.samsung.com ([210.118.77.14]:57839 "EHLO mailout4.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753294AbbIXMzZ (ORCPT ); Thu, 24 Sep 2015 08:55:25 -0400 X-AuditID: cbfec7f4-f79c56d0000012ee-6d-5603f2ba09f9 From: Andrzej Hajda To: Julia Lawall Cc: Andrzej Hajda , Bartlomiej Zolnierkiewicz , Marek Szyprowski , Gilles Muller , Nicolas Palix , Michal Marek , linux-kernel@vger.kernel.org, cocci@systeme.lip6.fr Subject: [PATCH] coccinelle: assign signed result to unsigned variable Date: Thu, 24 Sep 2015 14:54:46 +0200 Message-id: <1443099286-16559-1-git-send-email-a.hajda@samsung.com> X-Mailer: git-send-email 1.9.1 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupgluLIzCtJLcpLzFFi42I5/e/4Nd1dn5jDDNruilrcWneO1WLjjPWs Fj82rWazmP3zEpPFsgenGS0u75rDZrH2yF12izmts9gsjr1czuTA6XHsWCuzx94tWR59W1Yx eqzfcpXF49Gy+ywenzfJBbBFcdmkpOZklqUW6dslcGWseS1esFqo4vjvygbGbv4uRk4OCQET iQ0Pp7FC2GISF+6tZ+ti5OIQEljKKPFz8kVmCKeJSeLKzU2MIFVsApoSfzffBKri4BARUJfo /ZALUsMssJ1J4uiyHnaQGmEBN4lrB7eC2SwCqhJbnx0D28Ar4Cyx/OcKNohtchInj01mncDI vYCRYRWjaGppckFxUnquoV5xYm5xaV66XnJ+7iZGSPh82cG4+JjVIUYBDkYlHl4HLeYwIdbE suLK3EOMEhzMSiK8HO+BQrwpiZVVqUX58UWlOanFhxilOViUxHnn7nofIiSQnliSmp2aWpBa BJNl4uCUamAM+OkhJX/BYu9568nPZv9TPf01vOy7hk9AuA+TbvCFx6r/vbMnlj9h0D3bJNfB y5o/wTRfreBC/urlOW9Cj80uM5vEe0qyWCfi5mfx6L4q+TZfnuCNp/d9ibtavorTmMtv46ll v7zXeem+NN6rEu/9/Vr9+Y3c8hV7T3uX9LU+zV9r5CJd/kCJpTgj0VCLuag4EQDZx6adGwIA AA== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Assigning signed function result to unsigned variable can indicate error. To decrease number of false positives patch looks if after assignment there is also check for negative values of the result. Signed-off-by: Andrzej Hajda --- Hi, This patch tries to catch bugs related to losing possible negative function results and complements my previous patch[1]. I have found about 20 real bugs thanks to it. I will post related kernel patches on LKML. [1]: http://permalink.gmane.org/gmane.linux.kernel/2039591 --- .../tests/assign_signed_to_unsigned.cocci | 48 ++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 scripts/coccinelle/tests/assign_signed_to_unsigned.cocci diff --git a/scripts/coccinelle/tests/assign_signed_to_unsigned.cocci b/scripts/coccinelle/tests/assign_signed_to_unsigned.cocci new file mode 100644 index 0000000..ebd3d3a --- /dev/null +++ b/scripts/coccinelle/tests/assign_signed_to_unsigned.cocci @@ -0,0 +1,48 @@ +/// Assigning signed function result to unsigned variable can indicate error. +/// To decrease number of false positives patch looks if after assignment +/// there is also check for negative values of the result. +/// +// Confidence: High +// Copyright: (C) 2015 Andrzej Hajda, Samsung Electronics Co., Ltd. GPLv2. +// URL: http://coccinelle.lip6.fr/ +// Options: --include-headers --all-includes + +virtual context +virtual org +virtual report + +@rs@ +position p; +typedef bool, u8, u16, u32, u64, s8, s16, s32, s64; +{char, short int, int, long, long long, s8, s16, s32, s64} vs; +{unsigned char, unsigned short, unsigned int, unsigned long, unsigned long long, size_t, bool, u8, u16, u32, u64} vu; +@@ + +vu@p = vs + +@r@ +position rs.p; +identifier v, f; +statement S1, S2; +expression e; +@@ + +*v@p = f(...); +... when != v = e; +if ( \( v < 0 \| v <= 0 \) ) S1 else S2 + +@script:python depends on r && org@ +p << rs.p; +@@ + +msg = "WARNING: Assigning signed result to unsigned variable: %s = %s(...)" % (v, f) +coccilib.org.print_todo(p[0], msg) + +@script:python depends on r && report@ +p << rs.p; +f << r.f; +v << r.v; +@@ + +msg = "WARNING: Assigning signed result to unsigned variable: %s = %s(...)" % (v, f) +coccilib.report.print_report(p[0], msg) -- 1.9.1