Re: [cocci] Checking evaluation of another SmPL script

On Sat, 23 May 2026, Markus Elfring wrote:

> Hello,
>
> I would like to try another small SmPL script out.
>
>
> Example:
> // See also:
> // [PATCH] pNFS: Fix use-after-free in pnfs_update_layout()
> // https://lore.kernel.org/linux-nfs/[email protected]/
>
> // https://elixir.bootlin.com/linux/v7.1-rc4/source/fs/nfs/pnfs.c#L2128-L2385
> @display@
> identifier i;
> expression e;
> @@
> *pnfs_put_layout_hdr(i);
>  ... when != i = e
> *trace_pnfs_update_layout(..., i, ...)
>
>
> Markus_Elfring@Sonne:…/Projekte/Coccinelle/janitor> /usr/bin/spatch --version
> spatch version 1.3.1 compiled with OCaml version 4.14.3
> …
>
> Markus_Elfring@Sonne:…/Projekte/Linux/next-analyses> /usr/bin/spatch --no-loops …/Projekte/Coccinelle/janitor/show_UAF_1.cocci fs/nfs/pnfs.c
> …
> @@ -2169,9 +2169,6 @@ pnfs_update_layout(struct inode *ino,
>
>  lookup_again:
>         if (!nfs4_valid_open_stateid(ctx->state)) {
> -               trace_pnfs_update_layout(ino, pos, count,
> -                                        iomode, lo, lseg,
> -                                        PNFS_UPDATE_LAYOUT_INVALID_OPEN);
>                 lseg = ERR_PTR(-EIO);
>                 goto out;
>         }
> @@ -2216,7 +2213,6 @@ lookup_again:
>                                            TASK_KILLABLE));
>                 if (IS_ERR(lseg))
>                         goto out_put_layout_hdr;
> -               pnfs_put_layout_hdr(lo);
>                 goto lookup_again;
>         }
>
> @@ -2229,11 +2225,7 @@ lookup_again:
>                 dprintk("%s wait for layoutreturn\n", __func__);
>                 lseg = ERR_PTR(pnfs_prepare_to_retry_layoutget(lo));
>                 if (!IS_ERR(lseg)) {
> -                       pnfs_put_layout_hdr(lo);
>                         dprintk("%s retrying\n", __func__);
> -                       trace_pnfs_update_layout(ino, pos, count, iomode, lo,
> -                                                lseg,
> -                                                PNFS_UPDATE_LAYOUT_RETRY);
>                         goto lookup_again;
>                 }
>                 trace_pnfs_update_layout(ino, pos, count, iomode, lo, lseg,
> @@ -2268,7 +2260,6 @@ lookup_again:
>                                                 TASK_KILLABLE));
>                         if (IS_ERR(lseg))
>                                 goto out_put_layout_hdr;
> -                       pnfs_put_layout_hdr(lo);
>                         dprintk("%s retrying\n", __func__);
>                         goto lookup_again;
>                 }
> @@ -2285,7 +2276,6 @@ lookup_again:
>                                         PNFS_UPDATE_LAYOUT_INVALID_OPEN);
>                         nfs4_schedule_stateid_recovery(server, ctx->state);
>                         pnfs_clear_first_layoutget(lo);
> -                       pnfs_put_layout_hdr(lo);
>                         goto lookup_again;
>                 }
>                 spin_lock(&ino->i_lock);
> @@ -2356,7 +2346,6 @@ lookup_again:
>                                 pnfs_clear_first_layoutget(lo);
>                         trace_pnfs_update_layout(ino, pos, count,
>                                 iomode, lo, lseg, PNFS_UPDATE_LAYOUT_RETRY);
> -                       pnfs_put_layout_hdr(lo);
>                         goto lookup_again;
>                 }
>         } else {
>
>
> I find some generated diff hunks inappropriate for the mentioned source code
> search pattern.
> How can such questionable data be avoided here?

Due to the goto, they all look fine to me.  What did you intend?

If you consider that some output is unsuitable, it would help a lot if you
would indicate which output you are concerned about, and not just dump
the whole thing and hopw taht the reader will figure it out in the same
way you did.

julia

>
> Regards,
> Markus
>