Messages in this thread | | | Subject | Re: Misuses of ** ? (was Re: [PATCH 1/1] ASoC: Intel: Atom: add a missing star in a memcpy call) | From | Joe Perches <> | Date | Sun, 28 Aug 2016 14:54:44 -0700 |
| |
On Sun, 2016-08-28 at 23:40 +0200, Julia Lawall wrote: > On Sun, 28 Aug 2016, Joe Perches wrote: > > On Sun, 2016-08-28 at 21:38 +0200, Julia Lawall wrote: > > > On Sun, 28 Aug 2016, Nicolas Iooss wrote: > > > > On 28/08/16 19:50, Joe Perches wrote: > > > > > On Sun, 2016-08-28 at 19:39 +0200, Nicolas Iooss wrote: > > > > >> In sst_prepare_and_post_msg(), when a response is received in "block", > > > > >> the following code gets executed: > > > > >> > > > > >> *data = kzalloc(block->size, GFP_KERNEL); > > > > >> memcpy(data, (void *) block->data, block->size); > > > > > > > > > > Yuck, thanks. > > > > > > > > > > Julia, Dan, could cocci or smatch help find any other > > > > > similar misuses here? > > [] > > > I tried the following semantic patch, that is quite general, and the fixed > > > issue was the only report. > > > > > > @@ > > > expression x,y,sz; > > > identifier f,g; > > > @@ > > > > > > * *x = f(sz,...); > > > ... > > > * g(x,y,sz); > > > > Hi Julia, > > > > This would find exactly the same form, but I think > > the question is are there assignments of a **pp > > that should have been *pp > > > > Something like: > > > > @@ > > type P; > > P **pp; > > @@ > > > > * pp = \|\|(..., sizeof(P), ...)
> I didn't get anything for this. Did you mean for the left hand side of > the assignment to be pp or *pp? Is the issue that the type is wrong?
Yes, the issue here is the type may be wrong.
A function passed a ** and assigned like:
type function foo(type **bar) { ... bar = baz(); ... }
bar is rarely correct and *bar is generally correct.
I suppose the example would have been clearer with something
- pp = foo; + *pp = foo;
Also, any function that calls another function with implicit casts to void * from a specific type **pp after an assignment to *pp could be suspect.
| |