From: <wen.yang99@zte•com.cn>
To: <Markus.Elfring@web•de>, <julia.lawall@lip6•fr>
Cc: wang.yi59@zte•com.cn, linux-pm@vger•kernel.org,
rjw@rjwysocki•net, daniel.lezcano@linaro•org,
kernel-janitors@vger•kernel.org, linux-kernel@vger•kernel.org,
oss@buserror•net, paulus@samba•org, xue.zhihong@zte•com.cn,
linuxppc-dev@lists•ozlabs.org, cheng.shengyu@zte•com.cn
Subject: Re: Coccinelle: Checking of_node_put() calls with SmPL
Date: Thu, 11 Jul 2019 14:35:45 +0800 (CST) [thread overview]
Message-ID: <201907111435459627761@zte.com.cn> (raw)
In-Reply-To: <9d515026-5b74-cf0c-0c64-4fe242d4104e@web.de>
[-- Attachment #1.1: Type: text/plain, Size: 1622 bytes --]
> > we developed a coccinelle script to detect such problems.
>
> Would you find the implementation of the function “dt_init_idle_driver”
> suspicious according to discussed source code search patterns?
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/cpuidle/dt_idle_states.c?id=e9a83bd2322035ed9d7dcf35753d3f984d76c6a5#n208
> https://elixir.bootlin.com/linux/v5.2/source/drivers/cpuidle/dt_idle_states.c#L208
>
>
> > This script is still being improved.
>
> Will corresponding software development challenges become more interesting?
Hello Markus,
This is the simplified code pattern for it:
172 for (i = 0; ; i++) {
173 state_node = of_parse_phandle(...); ---> Obtain here
...
177 match_id = of_match_node(matches, state_node);
178 if (!match_id) {
179 err = -ENODEV;
180 break; ---> Jump out of the loop without releasing it
181 }
182
183 if (!of_device_is_available(state_node)) {
184 of_node_put(state_node);
185 continue; ---> Release the object references within a loop
186 }
...
208 of_node_put(state_node); --> Release the object references within a loop
209 }
210
211 of_node_put(state_node); --> There may be double free here.
This code pattern is very interesting and the coccinelle software should also recognize this pattern.
Regards,
Wen
next prev parent reply other threads:[~2019-07-11 6:39 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1562670768-23178-1-git-send-email-wen.yang99@zte.com.cn>
2019-07-09 11:12 ` [PATCH 1/2] powerpc/83xx: fix use-after-free in mpc831x_usb_cfg() Wen Yang
2019-07-10 7:19 ` [1/2] " Markus Elfring
2019-07-10 7:33 ` wen.yang99
2019-07-10 9:24 ` Markus Elfring
2019-07-10 15:15 ` Coccinelle: Checking of_node_put() calls with SmPL Markus Elfring
2019-07-11 6:35 ` wen.yang99 [this message]
2019-07-11 6:46 ` Julia Lawall
2019-07-11 9:33 ` Markus Elfring
2019-07-11 9:04 ` Markus Elfring
2019-07-11 14:41 ` Tyrel Datwyler
2019-07-09 11:12 ` [PATCH 2/2] powerpc/83xx: cleanup error paths in mpc831x_usb_cfg() Wen Yang
2019-07-09 16:14 ` [PATCH 0/2] fix use-after-free in mpc831x_usb_cfg() and do some cleanups Markus Elfring
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201907111435459627761@zte.com.cn \
--to=wen.yang99@zte$(echo .)com.cn \
--cc=Markus.Elfring@web$(echo .)de \
--cc=cheng.shengyu@zte$(echo .)com.cn \
--cc=daniel.lezcano@linaro$(echo .)org \
--cc=julia.lawall@lip6$(echo .)fr \
--cc=kernel-janitors@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-pm@vger$(echo .)kernel.org \
--cc=linuxppc-dev@lists$(echo .)ozlabs.org \
--cc=oss@buserror$(echo .)net \
--cc=paulus@samba$(echo .)org \
--cc=rjw@rjwysocki$(echo .)net \
--cc=wang.yi59@zte$(echo .)com.cn \
--cc=xue.zhihong@zte$(echo .)com.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox