[PATCH 1/2 v2] scripts/coccinelle: catch freeing cryptographic structures via kfree

[Konstantin Khlebnikov]

On Wed, Nov 19, 2014 at 12:41 PM, Julia Lawall <julia.lawall at lip6.fr> wrote:
>> +// Comments: There are false positives in crypto/ where they are
>> actually freed.
>
> I didn't really understand this comment.  I ran the semantic patch and got
> around 10 results, but it wasn't clear to me how to see which were false
> positives.

I mean false positives in code inside directory crypto/ where this
subsystem lives.

./arch/x86/crypto/fpu.c:143:1-6: WARNING: invalid free of
crypto_alloc_* allocated data
./crypto/algapi.c:846:1-6: WARNING: invalid free of crypto_alloc_*
allocated data
./crypto/lrw.c:378:1-6: WARNING: invalid free of crypto_alloc_* allocated data
./crypto/ecb.c:163:1-6: WARNING: invalid free of crypto_alloc_* allocated data
./crypto/ctr.c:242:1-6: WARNING: invalid free of crypto_alloc_* allocated data
./crypto/ctr.c:419:1-6: WARNING: invalid free of crypto_alloc_* allocated data
./crypto/ctr.c:428:1-6: WARNING: invalid free of crypto_alloc_* allocated data
./crypto/pcbc.c:273:1-6: WARNING: invalid free of crypto_alloc_* allocated data
./crypto/cts.c:329:1-6: WARNING: invalid free of crypto_alloc_* allocated data
./crypto/cbc.c:267:1-6: WARNING: invalid free of crypto_alloc_* allocated data
./crypto/xts.c:340:1-6: WARNING: invalid free of crypto_alloc_* allocated data

This is kfree calls on error paths in constructors or in destructors
which actually frees memory when crypto_free_* is called.

>
> I would suggest to extend the rule a little bit to include information
> about where the allocation call is:

Not sure if this is necessary. This part of crypto-api is simple.

>
> ///
> /// Structures allocated by crypto_alloc_* must be freed using crypto_free_*.
> /// This finds freeing them by kfree.
> ///
> // Confidence: Moderate
> // Copyright: (C) 2014 Konstantin Khlebnikov,  GPLv2.
> // Comments: There are false positives in crypto/ where they are actually freed.
> // Keywords: crypto, kfree
> // Options: --no-includes --include-headers
>
> virtual org
> virtual report
> virtual context
>
> @r depends on context || org || report@
> expression x;
> position p1;
> @@
>
> (
>  x = crypto_alloc_base at p1(...)
> |
>  x = crypto_alloc_cipher at p1(...)
> |
>  x = crypto_alloc_ablkcipher at p1(...)
> |
>  x = crypto_alloc_aead at p1(...)
> |
>  x = crypto_alloc_instance at p1(...)
> |
>  x = crypto_alloc_instance2 at p1(...)
> |
>  x = crypto_alloc_comp at p1(...)
> |
>  x = crypto_alloc_pcomp at p1(...)
> |
>  x = crypto_alloc_hash at p1(...)
> |
>  x = crypto_alloc_ahash at p1(...)
> |
>  x = crypto_alloc_shash at p1(...)
> |
>  x = crypto_alloc_rng at p1(...)
> )
>
> @pb@
> expression r.x;
> position p;
> @@
>
> * kfree at p(x)
>
> @script:python depends on org@
> p << pb.p;
> p1 << r.p1;
> @@
>
> msg="WARNING: invalid free of crypto_alloc_* allocated data"
> coccilib.org.print_todo(p[0], msg)
> coccilib.org.print_link(p1[0], "allocation")
>
> @script:python depends on report@
> p << pb.p;
> p1 << r.p1;
> @@
>
> msg="WARNING: invalid free of crypto_alloc_* allocated data, allocated on line %s" % (p1[0].line)
> coccilib.report.print_report(p[0], msg)
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo at vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/