Re: [PATCH v2] misra: deviate C library-style functions from Misra C:2012 rule 11.8

[Nicola Vetrini <nicola.vetrini@xxxxxxxxxxx>]

On 2026-10-19 12:41, Dmytro Prokopchuk1 wrote:
> bsearch(), memchr(), strchr(), strpbrk(), strrchr() and strstr() all
> accept a const pointer/object but return a non-const pointer to the
> matched element or byte, matching their standard C library interfaces.
> The casts in these implementations strip const so that callers 
> searching
> a non-const object get back a mutable pointer. Fixing this would 
> require
> changing the public API, so document these uses as deviations instead.
>
> Update docs/misra/rules.rst to note that this class of double-use
> library functions is deviated on a per-function basis.
>
> Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@xxxxxxxx>
Reviewed-by: Nicola Vetrini <nicola.vetrini@xxxxxxxxxxx> # 
automation/eclair_analysis/.*
> ---
> Changes in v2:
> - dropped memchr_inv() from the deviation (not a standard function)
> - anchored the file patterns and grouped the xen/lib files, as
>   suggested by Nicola
> - narrowed the justification to the casts in the function bodies
>
> Link to v1:
> https://patchew.org/Xen/4abcb11ef287170ced74935cbee60c90058c1307.1790671787.git.dmytro._5Fprokopchuk1@xxxxxxxx/
> ---
>  automation/eclair_analysis/ECLAIR/deviations.ecl | 8 ++++++++
>  docs/misra/deviations.rst                        | 9 +++++++++
>  docs/misra/rules.rst                             | 6 +++++-
>  3 files changed, 22 insertions(+), 1 deletion(-)
>
> diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl 
> b/automation/eclair_analysis/ECLAIR/deviations.ecl
> index 6cdb10a129..ed8bad0cb0 100644
> --- a/automation/eclair_analysis/ECLAIR/deviations.ecl
> +++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
> @@ -450,6 +450,14 @@ write or not"
>  
> -config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(file(hvm_guestcopy)&&text(^.*__hvm_copy.*HVMCOPY_to_guest 
> doesn't modify.*$)))"}
>  -doc_end
>
> +-doc_begin="Functions bsearch(), memchr(), strchr(), strpbrk(), 
> strrchr() and
> +strstr() accept a const pointer/object and return a non-const pointer 
> to the
> +matched element or byte, matching their standard C library interfaces. 
> The
> +casts in these implementations strip const so that a search of a 
> non-const
> +object yields a mutable pointer. This use is deemed safe."
> +-config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(file(^xen/include/xen/bsearch\\.h$||^xen/lib/(memchr|strchr|strpbrk|strrchr|strstr)\\.c$)))"}
> +-doc_end
> +
>  -doc_begin="This construct is used to check if the type is scalar, and 
> for this purpose the use of 0 as a null pointer constant is 
> deliberate."
>  -config=MC3A2.R11.9,reports+={deliberate, 
> "any_area(any_loc(any_exp(macro(^__ACCESS_ONCE$))))"
>  }
> diff --git a/docs/misra/deviations.rst b/docs/misra/deviations.rst
> index 6bcc2adf95..68de2d8dd1 100644
> --- a/docs/misra/deviations.rst
> +++ b/docs/misra/deviations.rst
> @@ -436,6 +436,15 @@ Deviations related to MISRA C:2012 Rules:
>         readability.
>       - Tagged as `safe` for ECLAIR.
>
> +   * - R11.8
> +     - Functions bsearch(), memchr(), strchr(), strpbrk(), strrchr() 
> and
> +       strstr() accept a const pointer/object and return a non-const 
> pointer
> +       to the matched element or byte, matching their standard C 
> library
> +       interfaces. The casts in these implementations strip const so 
> that a
> +       search of a non-const object yields a mutable pointer. This use 
> is
> +       deemed safe.
> +     - Tagged as `safe` for ECLAIR.
> +
>     * - R11.9
>       - __ACCESS_ONCE uses an integer, which happens to be zero, as a
>         compile time check. The typecheck uses a cast. The usage of 
> zero or other
> diff --git a/docs/misra/rules.rst b/docs/misra/rules.rst
> index a59cf1782e..00378c474e 100644
> --- a/docs/misra/rules.rst
> +++ b/docs/misra/rules.rst
> @@ -473,7 +473,11 @@ maintainers if you want to suggest a change.
>     * - `Rule 11.8 
> <https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite/-/blob/master/R_11_08.c>`_
>       - Required
>       - A cast shall not remove any const or volatile qualification 
> from the type pointed to by a pointer
> -     -
> +     - Some standard C library-style functions are inherently 
> double-use,
> +       accepting a const argument and returning a non-const pointer 
> into
> +       it so that callers searching a non-const object get back a
> +       mutable pointer. The casts that implement this are deviated per
> +       function.
>
>     * - `Rule 11.9 
> <https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite/-/blob/master/R_11_09.c>`_
>       - Required
--
Nicola Vetrini, B.Sc.
Software Engineer
BUGSENG (https://bugseng.com)
LinkedIn: https://www.linkedin.com/in/nicola-vetrini-a42471253