> +// Comments: There are false positives in crypto/ where they are > actually freed. I didn't really understand this comment. I ran the semantic patch and got around 10 results, but it wasn't clear to me how to see which were false positives. I would suggest to extend the rule a little bit to include information about where the allocation call is: /// /// Structures allocated by crypto_alloc_* must be freed using crypto_free_*. /// This finds freeing them by kfree. /// // Confidence: Moderate // Copyright: (C) 2014 Konstantin Khlebnikov, GPLv2. // Comments: There are false positives in crypto/ where they are actually freed. // Keywords: crypto, kfree // Options: --no-includes --include-headers virtual org virtual report virtual context @r depends on context || org || report@ expression x; position p1; @@ ( x = crypto_alloc_base at p1(...) | x = crypto_alloc_cipher at p1(...) | x = crypto_alloc_ablkcipher at p1(...) | x = crypto_alloc_aead at p1(...) | x = crypto_alloc_instance at p1(...) | x = crypto_alloc_instance2 at p1(...) | x = crypto_alloc_comp at p1(...) | x = crypto_alloc_pcomp at p1(...) | x = crypto_alloc_hash at p1(...) | x = crypto_alloc_ahash at p1(...) | x = crypto_alloc_shash at p1(...) | x = crypto_alloc_rng at p1(...) ) @pb@ expression r.x; position p; @@ * kfree at p(x) @script:python depends on org@ p << pb.p; p1 << r.p1; @@ msg="WARNING: invalid free of crypto_alloc_* allocated data" coccilib.org.print_todo(p[0], msg) coccilib.org.print_link(p1[0], "allocation") @script:python depends on report@ p << pb.p; p1 << r.p1; @@ msg="WARNING: invalid free of crypto_alloc_* allocated data, allocated on line %s" % (p1[0].line) coccilib.report.print_report(p[0], msg)
