[PATCH 4/4] automation/eclair: deviate MISRA C Rule 11.8 for xfree() and vfree()

[Dmytro Prokopchuk1 <dmytro_prokopchuk1@xxxxxxxx>]

Livepatch passes const-qualified pointers from struct payload to xfree()
and vfree(), which take a 'void *' argument. The cast that removes the
const qualifier is a violation of MISRA C Rule 11.8.

Such casts are safe. The deallocation functions neither read nor write
the content of the object being freed, and the object is not accessed
after it has been freed. Deviate the rule for casts that are direct
arguments of calls to xfree() and vfree().

No functional changes.

Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@xxxxxxxx>
---
 automation/eclair_analysis/ECLAIR/deviations.ecl | 7 +++++++
 docs/misra/deviations.rst                        | 7 +++++++
 docs/misra/rules.rst                             | 3 ++-
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/automation/eclair_analysis/ECLAIR/deviations.ecl 
b/automation/eclair_analysis/ECLAIR/deviations.ecl
index c7a800c62f..2fce0d0f68 100644
--- a/automation/eclair_analysis/ECLAIR/deviations.ecl
+++ b/automation/eclair_analysis/ECLAIR/deviations.ecl
@@ -451,6 +451,13 @@ write or not"
 
-config=MC3A2.R11.8,reports+={safe,"any_area(any_loc(file(hvm_guestcopy)&&text(^.*__hvm_copy.*HVMCOPY_to_guest
 doesn't modify.*$)))"}
 -doc_end
 
+-doc_begin="Casting away the const qualifier from the argument of the memory
+deallocation functions xfree() and vfree() is safe. These functions neither
+read nor write the content of the object being freed, and the object is not
+accessed after it has been freed."
+-config=MC3A2.R11.8,casts+={safe, 
"context(skip_to(__expr_non_syntactic_or_paren_contexts, 
call_child(name(xfree||vfree), arg)))"}
+-doc_end
+
 -doc_begin="This construct is used to check if the type is scalar, and for 
this purpose the use of 0 as a null pointer constant is deliberate."
 -config=MC3A2.R11.9,reports+={deliberate, 
"any_area(any_loc(any_exp(macro(^__ACCESS_ONCE$))))"
 }
diff --git a/docs/misra/deviations.rst b/docs/misra/deviations.rst
index 76be6b3251..d8d074ae1a 100644
--- a/docs/misra/deviations.rst
+++ b/docs/misra/deviations.rst
@@ -440,6 +440,13 @@ Deviations related to MISRA C:2012 Rules:
        readability.
      - Tagged as `safe` for ECLAIR.
 
+   * - R11.8
+     - Casting away the const qualifier from the argument of the memory
+       deallocation functions xfree() and vfree() is safe. These functions
+       neither read nor write the content of the object being freed, and the
+       object is not accessed after it has been freed.
+     - Tagged as `safe` for ECLAIR.
+
    * - R11.9
      - __ACCESS_ONCE uses an integer, which happens to be zero, as a
        compile time check. The typecheck uses a cast. The usage of zero or 
other
diff --git a/docs/misra/rules.rst b/docs/misra/rules.rst
index 5f9fe4c860..deff947c4f 100644
--- a/docs/misra/rules.rst
+++ b/docs/misra/rules.rst
@@ -475,7 +475,8 @@ maintainers if you want to suggest a change.
    * - `Rule 11.8 
<https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite/-/blob/master/R_11_08.c>`_
      - Required
      - A cast shall not remove any const or volatile qualification from the 
type pointed to by a pointer
-     -
+     - Casts removing the const qualifier from the argument of the memory
+       deallocation functions xfree() and vfree() are permitted.
 
    * - `Rule 11.9 
<https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/Example-Suite/-/blob/master/R_11_09.c>`_
      - Required
-- 
2.43.0