scripts/coccinelle/iterators/use_after_iter.cocci

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /// If list_for_each_entry, etc complete a traversal of the list, the iterator
   3 /// variable ends up pointing to an address at an offset from the list head,
   4 /// and not a meaningful structure.  Thus this value should not be used after
   5 /// the end of the iterator.
   6 //#False positives arise when there is a goto in the iterator and the
   7 //#reported reference is at the label of this goto.  Some flag tests
   8 //#may also cause a report to be a false positive.
   9 ///
  10 // Confidence: Moderate
  11 // Copyright: (C) 2012 Julia Lawall, INRIA/LIP6.
  12 // Copyright: (C) 2012 Gilles Muller, INRIA/LIP6.
  13 // URL: http://coccinelle.lip6.fr/
  14 // Comments:
  15 // Options: --no-includes --include-headers
  16
  17 virtual context
  18 virtual org
  19 virtual report
  20
  21 @r exists@
  22 identifier c,member;
  23 expression E,x;
  24 iterator name list_for_each_entry;
  25 iterator name list_for_each_entry_reverse;
  26 iterator name list_for_each_entry_continue;
  27 iterator name list_for_each_entry_continue_reverse;
  28 iterator name list_for_each_entry_from;
  29 iterator name list_for_each_entry_safe;
  30 iterator name list_for_each_entry_safe_continue;
  31 iterator name list_for_each_entry_safe_from;
  32 iterator name list_for_each_entry_safe_reverse;
  33 iterator name hlist_for_each_entry;
  34 iterator name hlist_for_each_entry_continue;
  35 iterator name hlist_for_each_entry_from;
  36 iterator name hlist_for_each_entry_safe;
  37 statement S;
  38 position p1,p2;
  39 type T;
  40 @@
  41
  42 (
  43 list_for_each_entry@p1(c,...,member) { ... when != break;
  44                                  when forall
  45                                  when strict
  46 }
  47 |
  48 list_for_each_entry_reverse@p1(c,...,member) { ... when != break;
  49                                  when forall
  50                                  when strict
  51 }
  52 |
  53 list_for_each_entry_continue@p1(c,...,member) { ... when != break;
  54                                  when forall
  55                                  when strict
  56 }
  57 |
  58 list_for_each_entry_continue_reverse@p1(c,...,member) { ... when != break;
  59                                  when forall
  60                                  when strict
  61 }
  62 |
  63 list_for_each_entry_from@p1(c,...,member) { ... when != break;
  64                                  when forall
  65                                  when strict
  66 }
  67 |
  68 list_for_each_entry_safe@p1(c,...,member) { ... when != break;
  69                                  when forall
  70                                  when strict
  71 }
  72 |
  73 list_for_each_entry_safe_continue@p1(c,...,member) { ... when != break;
  74                                  when forall
  75                                  when strict
  76 }
  77 |
  78 list_for_each_entry_safe_from@p1(c,...,member) { ... when != break;
  79                                  when forall
  80                                  when strict
  81 }
  82 |
  83 list_for_each_entry_safe_reverse@p1(c,...,member) { ... when != break;
  84                                  when forall
  85                                  when strict
  86 }
  87 )
  88 ...
  89 (
  90 list_for_each_entry(c,...) S
  91 |
  92 list_for_each_entry_reverse(c,...) S
  93 |
  94 list_for_each_entry_continue(c,...) S
  95 |
  96 list_for_each_entry_continue_reverse(c,...) S
  97 |
  98 list_for_each_entry_from(c,...) S
  99 |
 100 list_for_each_entry_safe(c,...) S
 101 |
 102 list_for_each_entry_safe(x,c,...) S
 103 |
 104 list_for_each_entry_safe_continue(c,...) S
 105 |
 106 list_for_each_entry_safe_continue(x,c,...) S
 107 |
 108 list_for_each_entry_safe_from(c,...) S
 109 |
 110 list_for_each_entry_safe_from(x,c,...) S
 111 |
 112 list_for_each_entry_safe_reverse(c,...) S
 113 |
 114 list_for_each_entry_safe_reverse(x,c,...) S
 115 |
 116 hlist_for_each_entry(c,...) S
 117 |
 118 hlist_for_each_entry_continue(c,...) S
 119 |
 120 hlist_for_each_entry_from(c,...) S
 121 |
 122 hlist_for_each_entry_safe(c,...) S
 123 |
 124 list_remove_head(x,c,...)
 125 |
 126 sizeof(<+...c...+>)
 127 |
 128  &c->member
 129 |
 130 T c;
 131 |
 132 c = E
 133 |
 134 *c@p2
 135 )
 136
 137 @script:python depends on org@
 138 p1 << r.p1;
 139 p2 << r.p2;
 140 @@
 141
 142 cocci.print_main("invalid iterator index reference",p2)
 143 cocci.print_secs("iterator",p1)
 144
 145 @script:python depends on report@
 146 p1 << r.p1;
 147 p2 << r.p2;
 148 @@
 149
 150 msg = "ERROR: invalid reference to the index variable of the iterator on line %s" % (p1[0].line)
 151 coccilib.report.print_report(p2[0], msg)