Re: [PATCH] misra: deviate C library-style functions from Misra C:2012 rule 11.8

[Nicola Vetrini <nicola.vetrini@xxxxxxxxxxx>]

On 2026-09-29 11:03, Dmytro Prokopchuk1 wrote:
> bsearch(), memchr(), memchr_inv(), strchr(), strpbrk(), strrchr() and
> strstr() all accept a const pointer/object but return a non-const 
> pointer
> to the matched element or byte, matching their standard C library
> interfaces. The const qualifier is deliberately stripped so that 
> callers
> searching a non-const object get back a mutable pointer to it. Fixing
> this would require changing the public API, so document these uses as
> deviations instead.
>
> Update docs/misra/rules.rst to note that this class of double-use
> library functions is deviated on a per-function basis.
>
> Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@xxxxxxxx>
> ---
> Test CI pipeline: 
> https://gitlab.com/xen-project/people/dimaprkp4k/xen/-/pipelines/2892411430
> ---
>  automation/eclair_analysis/ECLAIR/deviations.ecl | 9 +++++++++
>  docs/misra/deviations.rst                        | 9 +++++++++
>  docs/misra/rules.rst                             | 5 ++++-
>  3 files changed, 22 insertions(+), 1 deletion(-)
>
> diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl 
> b/automation/eclair_analysis/ECLAIR/deviations.ecl
> index 33d508a2fb..0b87bd1d6f 100644
> --- a/automation/eclair_analysis/ECLAIR/deviations.ecl
> +++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
> @@ -445,6 +445,15 @@ write or not"
>  
> -config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(text(^.*__hvm_copy.*HVMCOPY_to_guest 
> doesn't modify.*$)))"}
>  -doc_end
>
> +-doc_begin="Functions bsearch(), memchr(), memchr_inv(), strchr(), 
> strpbrk(),
> +strrchr() and strstr() accept a const pointer/object and return a 
> non-const
> +pointer to the matched element or byte, matching their standard C 
> library
> +interfaces. The const qualifier is deliberately stripped so that 
> callers
> +searching a non-const object get back a mutable pointer. This use is 
> deemed
> +safe."
> +-config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(file(^xen/include/xen/bsearch\\.h|xen/lib/memchr\\.c|xen/lib/memchr_inv\\.c|xen/lib/strchr\\.c|xen/lib/strpbrk\\.c|xen/lib/strrchr\\.c|xen/lib/strstr\\.c$)))"}
> +-doc_end
> +
I would say that the regex can be more compact than this. (e.g. 
file(^xen/include/bsearch\\.h$||^xen/lib/(memchr|memchr_inv|strchr|strpbrk|strrchr|strstr)\\.c$) 
)
>  -doc_begin="This construct is used to check if the type is scalar, and 
> for this purpose the use of 0 as a null pointer constant is 
> deliberate."
>  -config=MC3A2.R11.9,reports+={deliberate, 
> "any_area(any_loc(any_exp(macro(^__ACCESS_ONCE$))))"
>  }
> diff --git a/docs/misra/deviations.rst b/docs/misra/deviations.rst
> index b048309596..e3ad3545bc 100644
> --- a/docs/misra/deviations.rst
> +++ b/docs/misra/deviations.rst
> @@ -427,6 +427,15 @@ Deviations related to MISRA C:2012 Rules:
>         readability.
>       - Tagged as `safe` for ECLAIR.
>
> +   * - R11.8
> +     - Functions bsearch(), memchr(), memchr_inv(), strchr(), 
> strpbrk(),
> +       strrchr() and strstr() accept a const pointer/object and return 
> a
> +       non-const pointer to the matched element or byte, matching 
> their
> +       standard C library interfaces. The const qualifier is 
> deliberately
> +       stripped so that callers searching a non-const object get back 
> a
> +       mutable pointer. This use is deemed safe.
> +     - Tagged as `safe` for ECLAIR.
> +
>     * - R11.9
>       - __ACCESS_ONCE uses an integer, which happens to be zero, as a
>         compile time check. The typecheck uses a cast. The usage of 
> zero or other
> diff --git a/docs/misra/rules.rst b/docs/misra/rules.rst
> index c9bbab6c08..644e897558 100644
> --- a/docs/misra/rules.rst
> +++ b/docs/misra/rules.rst
> @@ -469,7 +469,10 @@ maintainers if you want to suggest a change.
>     * - `Rule 11.8 
> <https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite/-/blob/master/R_11_08.c>`_
>       - Required
>       - A cast shall not remove any const or volatile qualification 
> from the type pointed to by a pointer
> -     -
> +     - Some standard C library-style functions are inherently 
> double-use,
> +       accepting a const argument and returning a non-const pointer 
> into
> +       it so that callers searching a non-const object get back a
> +       mutable pointer. Such uses are deviated on a per-function 
> basis.
>     * - `Rule 11.9 
> <https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite/-/blob/master/R_11_09.c>`_
>       - Required
--
Nicola Vetrini, B.Sc.
Software Engineer
BUGSENG (https://bugseng.com)
LinkedIn: https://www.linkedin.com/in/nicola-vetrini-a42471253