Re: [cocci] Checking evaluation of another SmPL script

On Sun, 24 May 2026, Markus Elfring wrote:

> >> How will development ideas evolve accordingly?
> >
> > I don't know what the above is supposed to do.  The semantic patch looks
> > completely wrong to detect a use after free.  One would expect thta a
> > detection of use after free would mention free somewhere.
>
> The following SmPL script variant expresses a known implementation detail explicitly.
>
>
> @display@
> identifier i;
> expression e;
> @@
> *i = malloc(...);
>  ... when != i = e
> *free(i);
> *i->x = e
>
>
>
> >                                                            But the
> > obtained result looks completely correct for the provided semantic patch
> > (as well as a hypothetical semantic patch that would check for use after
> > free).
> The result for this reduced test shows so far that a single diff hunk
> is generated (while additional ones occurred according to the bigger implementation
> of the function “pnfs_update_layout”).
> Function sizes probably influence hunk generation.
> Will such case distinctions become more interesting?

If you want me to comment on something, you have to include both the
semantic patch and the C code.  I can't guess whether you have used again
the C code that you provided in a previous email (where obtaining a single
huk seemed fine).  Please also provide precise information about the
result you expect.

julia