31 Aug, 2010

10 commits

  • Find a use after free. Values of variables may imply that some
    execution paths are not possible, resulting in false positives.
    Another source of false positives are macros such as
    SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • list_for_each_entry uses its first argument to get from one element of
    the list to the next, so it is usually not a good idea to reassign it.
    The first rule finds such a reassignment and the second rule checks
    that there is a path from the reassignment back to the top of the loop.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • Many iterators have the property that the first argument is always bound
    to a real list element, never NULL. False positives arise for some
    iterators that do not have this property, or in cases when the loop
    cursor is reassigned. The latter should only happen when the matched
    code is on the way to a loop exit (break, goto, or return).

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • for_each_node iterators only exit normally when the loop cursor is
    NULL, so there is no point to call of_node_put on the final value.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • Find missing unlocks. This semantic match considers the specific case
    where the unlock is missing from an if branch, and there is a lock
    before the if and an unlock after the if. False positives are due to
    cases where the if branch represents a case where the function is
    supposed to exit with the lock held, or where there is some preceding
    function call that releases the lock.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • Find double locks. False positives may occur when some paths cannot
    occur at execution, due to the values of variables, and when there is
    an intervening function call that releases the lock.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • Find functions that refer to GFP_KERNEL but are called with locks held.
    The proposed change of converting the GFP_KERNEL is not necessarily the
    correct one. It may be desired to unlock the lock, or to not call the
    function under the lock in the first place.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • deref_null.cocci is moved to the 'null' directory
    which contains other null related rules.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • This semantic patch looks for kmalloc etc that are not followed by a
    NULL check. It only gives a report in the case where there is some
    error handling code later in the function, which may be helpful
    in determining what the error handling code for the call to kmalloc etc
    should be.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • The various basic memory allocation functions don't return ERR_PTR

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     

02 Jul, 2010

1 commit

  • during a check of the current git head of the linux kernel with the
    static code analysis tool cppcheck
    (http://sourceforge.net/apps/mediawiki/cppcheck/index.php?title=Main_Page)
    the tool discovered a resource leak in linux-2.6/scripts/dtc/fstree.c.

    Please refer the attached patch, that fixes the issue.

    Fixes https://bugzilla.kernel.org/show_bug.cgi?id=15363
    Signed-off-by: Martin Ettl
    Cc: David Gibson
    Signed-off-by: Michal Marek

    Martin Ettl
     

29 Jun, 2010

2 commits


28 Jun, 2010

1 commit

  • This patch makes it possible to use the Coccinelle checker with the C
    variable of the build system. To check only newly edited code, the
    following command may be used:

    'make C={1,2} CHECK="scripts/coccicheck"'

    This runs every semantic patch in scripts/coccinelle by default. The
    COCCI variable may additionally be used to only apply a single
    semantic patch.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     

12 Jun, 2010

8 commits

  • Michal Marek
     
  • Add a Coccinelle file to identify the dereferences of NULL variables

    This semantic patch identifies when a variable is known to be NULL
    after a test, but it is still dereferenced later.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • Add a Coccinelle file to use the ERR_CAST function

    Before the release 2.6.25, one had to use ERR_PTR(PTR_ERR(...)) to
    convert the pointer type of an error. Since then, the function
    ERR_CAST has been available for that purpose.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • This semantic patch replaces explicit computations
    of resource size by a call to resource_size.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • This semantic patch replaces a pair of calls to kmalloc and memset
    by a single call to kzalloc.

    It only looks for simple cases to avoid false positives.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • The purpose of this semantic patch is to remove
    useless casts, as mentioned in the Linux documentation.
    See Chapter 14 in Documentation/CodingStyle for more information.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • The purpose of this file is to document how to use Coccinelle and its
    spatch tool to check the Linux kernel.

    It gives information on where and how to retrieve Coccinelle, and how
    to use it with the Coccinelle scripts integrated in the Linux kernel.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Signed-off-by: Michal Marek

    Nicolas Palix
     
  • A 'coccicheck' target is added. It can be called with four different
    modes. Each one generates a different kind of output, i.e. context,
    patch, org, report, according to the corresponding mode to be
    activated.

    The new target calls the 'coccicheck' front-end in the 'scripts'
    directory with the MODE argument. Every SmPL file in the
    subdirectories of 'scripts/coccinelle' is then given to the front-end
    and applied to the entire source tree.

    The four modes behave as follows:

    'report' generates a list in the following format:
    file:line:column-column: message

    'patch' proposes a fix, when possible.

    'context' highlights lines of interest and their context in a
    diff-like style. Lines of interest are indicated with '-'.

    'org' generates a report in the Org mode format of Emacs.

    Signed-off-by: Nicolas Palix
    Signed-off-by: Julia Lawall
    Acked-by: Sam Ravnborg
    Acked-by: Joerg Roedel
    Signed-off-by: Michal Marek

    Nicolas Palix
     

04 Jun, 2010

1 commit


03 Jun, 2010

3 commits

  • os user writes:
    From the last comment, arch makefile will override vmlinux. It seems
    vmlinux will not be checked by `make'. But from my test, although
    `all:' will be re-defined in arch Makefile (ARM arch), vmlinux will
    still be checked and the commands associated will be executed. Should
    we use another word instead of "overridden"?

    Reported-by: os user
    Signed-off-by: Michal Marek

    Michal Marek
     
  • Quite a few Kconfig symbols contain lowercase letters. The current
    checkkconfigsymbols.sh code only contains A-Z in the regexp it uses to
    find config symbols in source code, so it comes up with the wrong symbol
    to look for in Kconfig files and then generates false positives when it
    doesn't find that wrong symbol. For example checking drivers/net
    generates a false positive for MAC89 because the the actual config
    option is MAC89x0.

    Fix this by also adding a-z to the regexp.

    Signed-off-by: Roland Dreier
    Signed-off-by: Andrew Morton
    Signed-off-by: Michal Marek

    Roland Dreier
     
  • scripts/kconfig/nconf is generated by 'make nconfig',
    add it into .gitignore.

    Signed-off-by: WANG Cong
    Signed-off-by: Michal Marek

    Américo Wang
     

27 May, 2010

1 commit


06 May, 2010

1 commit

  • I'm looking Makefile in the -mm branch (dated 2010-04-28-16-53) and
    seeing what looks like a bug in the checking of scm-identifier. The
    "ifneq ($scm-identifier)" seems to always execute "ifeq
    ($(LOCALVERSION,)) ...". This patch fixes the checking of
    scm-identifier.

    Signed-off-by: Greg Thelen
    Acked-by: David Rientjes
    Signed-off-by: Michal Marek

    Greg Thelen
     

14 Apr, 2010

6 commits

  • There's a button in gconfig to "Show all options", but I think
    normally we are not interested in those configs which have no
    prompt and thus can't be changed, so here I add a new button to
    show hidden options which have prompts.

    Signed-off-by: Li Zefan
    Signed-off-by: Michal Marek

    Li Zefan
     
  • Usage:
    Press to show all config symbols which have prompts.

    Quote Tim Bird:

    | I've been bitten by this numerous times. I most often
    | use ftrace on ARM, but when I go back to x86, I almost
    | always go through a sequence of searching for the
    | function graph tracer in the menus, then realizing it's
    | completely missing until I disable CC_OPTIMIZE_FOR_SIZE.
    |
    | Is there any way to have the menu item appear, but be
    | unsettable unless the SIZE option is disabled? I'm
    | not a Kconfig guru...

    I myself found this useful too. For example, I need to test
    ftrace/tracing and want to be sure all the tracing features are
    enabled, so I enter the "Tracers" menu, and press to
    see if there is any config hidden.

    I also noticed gconfig and xconfig have a button "Show all options",
    but that's a bit too much, and I think normally what we are not
    interested in those configs which have no prompt thus can't be
    changed by users.

    Exmaple:

    --- Tracers
    -*- Kernel Function Tracer
    - - Kernel Function Graph Tracer
    [*] Interrupts-off Latency Tracer
    - - Preemption-off Latency Tracer
    [*] Sysprof Tracer

    Here you can see 2 tracers are not selectable, and then can find
    out how to make them selectable.

    Signed-off-by: Li Zefan
    Signed-off-by: Michal Marek

    Li Zefan
     
  • This option is a no-op, so remove it.

    Signed-off-by: Li Zefan
    Signed-off-by: Michal Marek

    Li Zefan
     
  • Just use sym_get_type() and prop_get_type_name().

    Signed-off-by: Li Zefan
    Signed-off-by: Michal Marek

    Li Zefan
     
  • zconfdump(), which is used for debugging, can't recognize P_SELECT,
    P_RANGE and P_MENU (if associated with a symbol, aka "menuconfig"),
    and output something like this:

    config X86
    boolean
    default y
    unknown prop 6!
    unknown prop 6!
    unknown prop 6!
    ...

    Signed-off-by: Li Zefan
    Signed-off-by: Michal Marek

    Li Zefan
     
  • - fix a typo in documentation
    - fix a typo in a printk on error
    - fix comments in dialog_inputbox()

    Signed-off-by: Li Zefan
    Signed-off-by: Michal Marek

    Li Zefan
     

08 Apr, 2010

1 commit


23 Mar, 2010

4 commits

  • Expand the dependency set used for the initrd to include the
    CONFIG_INITRAMFS_SOURCE file and the generator script itself.
    Otherwise changing the initramfs file list does not rebuild the CPIO.

    Signed-off-by: Jason Gunthorpe
    Signed-off-by: Michal Marek

    Jason Gunthorpe
     
  • A symbol's value won't be recalc-ed until we save config file or
    enter the menu where the symbol sits.

    So If I enable OPTIMIZE_FOR_SIZE, and search FUNCTION_GRAPH_TRACER:

    Symbol: FUNCTION_GRAPH_TRACER [=y]
    Prompt: Kernel Function Graph Tracer
    Defined at kernel/trace/Kconfig:140
    Depends on: ... [=y] && (!X86_32 [=y] || !CC_OPTIMIZE_FOR_SIZE [=y])
    ...

    From the dependency it should result in FUNCTION_GRAPH_TRACER=n,
    but it still shows FUNCTION_GRAPH_TRACER=y.

    Signed-off-by: Li Zefan
    Signed-off-by: Michal Marek

    Li Zefan
     
  • Ignore files compressed with lzop.

    Signed-off-by: Philipp Kohlbecher
    Signed-off-by: Michal Marek

    Philipp Kohlbecher
     
  • Minor perlcritic warning:
    headerdep.pl: "return" statement with explicit "undef" at line 84, column 2. See page 199 of PBP. (Severity: 5)

    The rationale according to PBP is that an explicit return of undef
    (contrary to most people's expectations) doesn't
    always evaluate as false. It has to with the fact that perl return value
    depends on context the function is called. If function is used in
    list context, the appropriate return value for false is an empty list;
    whereas in scalar context the return value for false is undefined.
    By just using a "return" both cases are handled.

    In the context of a trivial script this doesn't matter. But one script
    may be cut-paste into later code (most people like me only know 50%
    of perl), that is why perlcritic always complains

    Signed-off-by: Stephen Hemminger
    Signed-off-by: Michal Marek

    Stephen Hemminger
     

11 Mar, 2010

1 commit