Re: [cocci] Checking data structure member accesses after function return value assignments?

On Wed, 21 Jan 2026, Markus Elfring wrote:

> > Another SmPL script variant can be tried out:
> > @refined_display@
> > expression action;
> > expression * pointer;
> > identifier member;
> > @@
> > *pointer = action(...);
> >  (
> >  <+...
> > *pointer->member
> >  ...+>
> >  );
>
> Another test result:
> Markus_Elfring@Sonne:…/Projekte/Linux/next-analyses> time /usr/bin/spatch --timeout 23 -j4 --chunksize 1 --no-loops -dir . …/Projekte/Coccinelle/janitor/show_questionable_statement_combination7.cocci > …/Projekte/Bau/Linux/scripts/Coccinelle/show_questionable_statement_combination7-20260120.diff 2> …/Projekte/Bau/Linux/scripts/Coccinelle/show_questionable_statement_combination7-errors-20260120.txt
>
> real    56m58,910s
> user    215m49,097s
> sys     2m22,875s
>
>
> The generated data would indicate then that 6018 source files of the software
> “Linux next-20260120” would contain implementation details for further
> development considerations.
> It seems that this source code search approach is “too simple” so far.
> How would you like to improve it for the avoidance of unwanted false positives?

Lots of research papers have worked on this problem.  You can find the
definition and see if it returns NULL.  YOu can find other calls to the
function and see if they test for NULL.  But you may always get false
positives, because there may be some combinations of arguments that can
never lead to a failure.

julia