?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
comparison: handle preops like "if (++a == b)"
[smatch.git] / check_locking.c
blobc8918455f9baa6f1a8a61ac542c65ec6a05a9d8f
1 /*
2 * Copyright (C) 2009 Dan Carpenter.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 /*
19 * This test checks that locks are held the same across all returns.
20 *
21 * Of course, some functions are designed to only hold the locks on success.
22 * Oh well... We can rewrite it later if we want.
23 *
24 * The list of wine locking functions came from an earlier script written
25 * by Michael Stefaniuc.
26 *
27 */
28
29 #include "parse.h"
30 #include "smatch.h"
31 #include "smatch_extra.h"
32 #include "smatch_slist.h"
33
34 static int my_id;
35
36 static int func_has_transition;
37
38 STATE(locked);
39 STATE(start_state);
40 STATE(unlocked);
41
42 enum action {
43 LOCK,
44 UNLOCK,
45 };
46
47 enum return_type {
48 ret_any,
49 ret_non_zero,
50 ret_zero,
51 ret_negative,
52 ret_positive,
53 };
54
55 #define RETURN_VAL -1
56 #define NO_ARG -2
57
58 struct lock_info {
59 const char *function;
60 enum action action;
61 const char *name;
62 int arg;
63 enum return_type return_type;
64 };
65
66 static struct lock_info wine_lock_table[] = {
67 {"create_window_handle", LOCK, "create_window_handle", RETURN_VAL, ret_non_zero},
68 {"WIN_GetPtr", LOCK, "create_window_handle", RETURN_VAL, ret_non_zero},
69 {"WIN_ReleasePtr", UNLOCK, "create_window_handle", 0, ret_any},
70 {"EnterCriticalSection", LOCK, "CriticalSection", 0, ret_any},
71 {"LeaveCriticalSection", UNLOCK, "CriticalSection", 0, ret_any},
72 {"RtlEnterCriticalSection", LOCK, "RtlCriticalSection", 0, ret_any},
73 {"RtlLeaveCriticalSection", UNLOCK, "RtlCriticalSection", 0, ret_any},
74 {"GDI_GetObjPtr", LOCK, "GDI_Get", 0, ret_non_zero},
75 {"GDI_ReleaseObj", UNLOCK, "GDI_Get", 0, ret_any},
76 {"LdrLockLoaderLock", LOCK, "LdrLockLoaderLock", 2, ret_any},
77 {"LdrUnlockLoaderLock", UNLOCK, "LdrLockLoaderLock", 1, ret_any},
78 {"_lock", LOCK, "_lock", 0, ret_any},
79 {"_unlock", UNLOCK, "_lock", 0, ret_any},
80 {"msiobj_lock", LOCK, "msiobj_lock", 0, ret_any},
81 {"msiobj_unlock", UNLOCK, "msiobj_lock", 0, ret_any},
82 {"RtlAcquirePebLock", LOCK, "PebLock", NO_ARG, ret_any},
83 {"RtlReleasePebLock", UNLOCK, "PebLock", NO_ARG, ret_any},
84 {"server_enter_uninterrupted_section", LOCK, "server_uninterrupted_section", 0, ret_any},
85 {"server_leave_uninterrupted_section", UNLOCK, "server_uninterrupted_section", 0, ret_any},
86 {"RtlLockHeap", LOCK, "RtlLockHeap", 0, ret_any},
87 {"RtlUnlockHeap", UNLOCK, "RtlLockHeap", 0, ret_any},
88 {"_EnterSysLevel", LOCK, "SysLevel", 0, ret_any},
89 {"_LeaveSysLevel", UNLOCK, "SysLevel", 0, ret_any},
90 {"USER_Lock", LOCK, "USER_Lock", NO_ARG, ret_any},
91 {"USER_Unlock", UNLOCK, "USER_Lock", NO_ARG, ret_any},
92 {"wine_tsx11_lock", LOCK, "wine_tsx11_lock", NO_ARG, ret_any},
93 {"wine_tsx11_unlock", UNLOCK, "wine_tsx11_lock", NO_ARG, ret_any},
94 {"wine_tsx11_lock_ptr", LOCK, "wine_tsx11_lock_ptr", NO_ARG, ret_any},
95 {"wine_tsx11_unlock_ptr", UNLOCK, "wine_tsx11_lock_ptr", NO_ARG, ret_any},
96 {"wined3d_mutex_lock", LOCK, "wined3d_mutex_lock", NO_ARG, ret_any},
97 {"wined3d_mutex_unlock", UNLOCK, "wined3d_mutex_lock", NO_ARG, ret_any},
98 {"X11DRV_DIB_Lock", LOCK, "X11DRV_DIB_Lock", 0, ret_any},
99 {"X11DRV_DIB_Unlock", UNLOCK, "X11DRV_DIB_Lock", 0, ret_any},
100 };
101
102 static struct lock_info kernel_lock_table[] = {
103 {"lock_kernel", LOCK, "BKL", NO_ARG, ret_any},
104 {"unlock_kernel", UNLOCK, "BKL", NO_ARG, ret_any},
105
106 {"spin_lock", LOCK, "spin_lock", 0, ret_any},
107 {"spin_unlock", UNLOCK, "spin_lock", 0, ret_any},
108 {"spin_lock_nested", LOCK, "spin_lock", 0, ret_any},
109 {"_spin_lock", LOCK, "spin_lock", 0, ret_any},
110 {"_spin_unlock", UNLOCK, "spin_lock", 0, ret_any},
111 {"_spin_lock_nested", LOCK, "spin_lock", 0, ret_any},
112 {"__spin_lock", LOCK, "spin_lock", 0, ret_any},
113 {"__spin_unlock", UNLOCK, "spin_lock", 0, ret_any},
114 {"__spin_lock_nested", LOCK, "spin_lock", 0, ret_any},
115 {"raw_spin_lock", LOCK, "spin_lock", 0, ret_any},
116 {"raw_spin_unlock", UNLOCK, "spin_lock", 0, ret_any},
117 {"_raw_spin_lock", LOCK, "spin_lock", 0, ret_any},
118 {"_raw_spin_lock_nested", LOCK, "spin_lock", 0, ret_any},
119 {"_raw_spin_unlock", UNLOCK, "spin_lock", 0, ret_any},
120 {"__raw_spin_lock", LOCK, "spin_lock", 0, ret_any},
121 {"__raw_spin_unlock", UNLOCK, "spin_lock", 0, ret_any},
122
123 {"spin_lock_irq", LOCK, "spin_lock", 0, ret_any},
124 {"spin_unlock_irq", UNLOCK, "spin_lock", 0, ret_any},
125 {"_spin_lock_irq", LOCK, "spin_lock", 0, ret_any},
126 {"_spin_unlock_irq", UNLOCK, "spin_lock", 0, ret_any},
127 {"__spin_lock_irq", LOCK, "spin_lock", 0, ret_any},
128 {"__spin_unlock_irq", UNLOCK, "spin_lock", 0, ret_any},
129 {"_raw_spin_lock_irq", LOCK, "spin_lock", 0, ret_any},
130 {"_raw_spin_unlock_irq", UNLOCK, "spin_lock", 0, ret_any},
131 {"__raw_spin_unlock_irq", UNLOCK, "spin_lock", 0, ret_any},
132 {"spin_lock_irqsave", LOCK, "spin_lock", 0, ret_any},
133 {"spin_unlock_irqrestore", UNLOCK, "spin_lock", 0, ret_any},
134 {"_spin_lock_irqsave", LOCK, "spin_lock", 0, ret_any},
135 {"_spin_unlock_irqrestore", UNLOCK, "spin_lock", 0, ret_any},
136 {"__spin_lock_irqsave", LOCK, "spin_lock", 0, ret_any},
137 {"__spin_unlock_irqrestore", UNLOCK, "spin_lock", 0, ret_any},
138 {"_raw_spin_lock_irqsave", LOCK, "spin_lock", 0, ret_any},
139 {"_raw_spin_unlock_irqrestore", UNLOCK, "spin_lock", 0, ret_any},
140 {"__raw_spin_lock_irqsave", LOCK, "spin_lock", 0, ret_any},
141 {"__raw_spin_unlock_irqrestore", UNLOCK, "spin_lock", 0, ret_any},
142 {"spin_lock_irqsave_nested", LOCK, "spin_lock", 0, ret_any},
143 {"_spin_lock_irqsave_nested", LOCK, "spin_lock", 0, ret_any},
144 {"__spin_lock_irqsave_nested", LOCK, "spin_lock", 0, ret_any},
145 {"_raw_spin_lock_irqsave_nested", LOCK, "spin_lock", 0, ret_any},
146 {"spin_lock_bh", LOCK, "spin_lock", 0, ret_any},
147 {"spin_unlock_bh", UNLOCK, "spin_lock", 0, ret_any},
148 {"_spin_lock_bh", LOCK, "spin_lock", 0, ret_any},
149 {"_spin_unlock_bh", UNLOCK, "spin_lock", 0, ret_any},
150 {"__spin_lock_bh", LOCK, "spin_lock", 0, ret_any},
151 {"__spin_unlock_bh", UNLOCK, "spin_lock", 0, ret_any},
152
153 {"spin_trylock", LOCK, "spin_lock", 0, ret_non_zero},
154 {"_spin_trylock", LOCK, "spin_lock", 0, ret_non_zero},
155 {"__spin_trylock", LOCK, "spin_lock", 0, ret_non_zero},
156 {"raw_spin_trylock", LOCK, "spin_lock", 0, ret_non_zero},
157 {"_raw_spin_trylock", LOCK, "spin_lock", 0, ret_non_zero},
158 {"spin_trylock_irq", LOCK, "spin_lock", 0, ret_non_zero},
159 {"spin_trylock_irqsave", LOCK, "spin_lock", 0, ret_non_zero},
160 {"spin_trylock_bh", LOCK, "spin_lock", 0, ret_non_zero},
161 {"_spin_trylock_bh", LOCK, "spin_lock", 0, ret_non_zero},
162 {"__spin_trylock_bh", LOCK, "spin_lock", 0, ret_non_zero},
163 {"__raw_spin_trylock", LOCK, "spin_lock", 0, ret_non_zero},
164 {"_atomic_dec_and_lock", LOCK, "spin_lock", 1, ret_non_zero},
165
166 {"read_lock", LOCK, "read_lock", 0, ret_any},
167 {"read_unlock", UNLOCK, "read_lock", 0, ret_any},
168 {"_read_lock", LOCK, "read_lock", 0, ret_any},
169 {"_read_unlock", UNLOCK, "read_lock", 0, ret_any},
170 {"__read_lock", LOCK, "read_lock", 0, ret_any},
171 {"__read_unlock", UNLOCK, "read_lock", 0, ret_any},
172 {"_raw_read_lock", LOCK, "read_lock", 0, ret_any},
173 {"_raw_read_unlock", UNLOCK, "read_lock", 0, ret_any},
174 {"read_lock_irq", LOCK, "read_lock", 0, ret_any},
175 {"read_unlock_irq" , UNLOCK, "read_lock", 0, ret_any},
176 {"_read_lock_irq", LOCK, "read_lock", 0, ret_any},
177 {"_read_unlock_irq", UNLOCK, "read_lock", 0, ret_any},
178 {"__read_lock_irq", LOCK, "read_lock", 0, ret_any},
179 {"__read_unlock_irq", UNLOCK, "read_lock", 0, ret_any},
180 {"read_lock_irqsave", LOCK, "read_lock", 0, ret_any},
181 {"read_unlock_irqrestore", UNLOCK, "read_lock", 0, ret_any},
182 {"_read_lock_irqsave", LOCK, "read_lock", 0, ret_any},
183 {"_read_unlock_irqrestore", UNLOCK, "read_lock", 0, ret_any},
184 {"__read_lock_irqsave", LOCK, "read_lock", 0, ret_any},
185 {"__read_unlock_irqrestore", UNLOCK, "read_lock", 0, ret_any},
186 {"read_lock_bh", LOCK, "read_lock", 0, ret_any},
187 {"read_unlock_bh", UNLOCK, "read_lock", 0, ret_any},
188 {"_read_lock_bh", LOCK, "read_lock", 0, ret_any},
189 {"_read_unlock_bh", UNLOCK, "read_lock", 0, ret_any},
190 {"__read_lock_bh", LOCK, "read_lock", 0, ret_any},
191 {"__read_unlock_bh", UNLOCK, "read_lock", 0, ret_any},
192 {"_raw_read_lock_bh", LOCK, "read_lock", 0, ret_any},
193 {"_raw_read_unlock_bh", UNLOCK, "read_lock", 0, ret_any},
194
195 {"generic__raw_read_trylock", LOCK, "read_lock", 0, ret_non_zero},
196 {"read_trylock", LOCK, "read_lock", 0, ret_non_zero},
197 {"_read_trylock", LOCK, "read_lock", 0, ret_non_zero},
198 {"raw_read_trylock", LOCK, "read_lock", 0, ret_non_zero},
199 {"_raw_read_trylock", LOCK, "read_lock", 0, ret_non_zero},
200 {"__raw_read_trylock", LOCK, "read_lock", 0, ret_non_zero},
201 {"__read_trylock", LOCK, "read_lock", 0, ret_non_zero},
202
203 {"write_lock", LOCK, "write_lock", 0, ret_any},
204 {"write_unlock", UNLOCK, "write_lock", 0, ret_any},
205 {"_write_lock", LOCK, "write_lock", 0, ret_any},
206 {"_write_unlock", UNLOCK, "write_lock", 0, ret_any},
207 {"__write_lock", LOCK, "write_lock", 0, ret_any},
208 {"__write_unlock", UNLOCK, "write_lock", 0, ret_any},
209 {"write_lock_irq", LOCK, "write_lock", 0, ret_any},
210 {"write_unlock_irq", UNLOCK, "write_lock", 0, ret_any},
211 {"_write_lock_irq", LOCK, "write_lock", 0, ret_any},
212 {"_write_unlock_irq", UNLOCK, "write_lock", 0, ret_any},
213 {"__write_lock_irq", LOCK, "write_lock", 0, ret_any},
214 {"__write_unlock_irq", UNLOCK, "write_lock", 0, ret_any},
215 {"write_lock_irqsave", LOCK, "write_lock", 0, ret_any},
216 {"write_unlock_irqrestore", UNLOCK, "write_lock", 0, ret_any},
217 {"_write_lock_irqsave", LOCK, "write_lock", 0, ret_any},
218 {"_write_unlock_irqrestore", UNLOCK, "write_lock", 0, ret_any},
219 {"__write_lock_irqsave", LOCK, "write_lock", 0, ret_any},
220 {"__write_unlock_irqrestore", UNLOCK, "write_lock", 0, ret_any},
221 {"write_lock_bh", LOCK, "write_lock", 0, ret_any},
222 {"write_unlock_bh", UNLOCK, "write_lock", 0, ret_any},
223 {"_write_lock_bh", LOCK, "write_lock", 0, ret_any},
224 {"_write_unlock_bh", UNLOCK, "write_lock", 0, ret_any},
225 {"__write_lock_bh", LOCK, "write_lock", 0, ret_any},
226 {"__write_unlock_bh", UNLOCK, "write_lock", 0, ret_any},
227 {"_raw_write_lock", LOCK, "write_lock", 0, ret_any},
228 {"__raw_write_lock", LOCK, "write_lock", 0, ret_any},
229 {"_raw_write_unlock", UNLOCK, "write_lock", 0, ret_any},
230 {"__raw_write_unlock", UNLOCK, "write_lock", 0, ret_any},
231
232 {"write_trylock", LOCK, "write_lock", 0, ret_non_zero},
233 {"_write_trylock", LOCK, "write_lock", 0, ret_non_zero},
234 {"raw_write_trylock", LOCK, "write_lock", 0, ret_non_zero},
235 {"_raw_write_trylock", LOCK, "write_lock", 0, ret_non_zero},
236 {"__write_trylock", LOCK, "write_lock", 0, ret_non_zero},
237 {"__raw_write_trylock", LOCK, "write_lock", 0, ret_non_zero},
238
239 {"down", LOCK, "sem", 0, ret_any},
240 {"up", UNLOCK, "sem", 0, ret_any},
241 {"down_trylock", LOCK, "sem", 0, ret_zero},
242 {"down_interruptible", LOCK, "sem", 0, ret_zero},
243
244 {"mutex_lock", LOCK, "mutex", 0, ret_any},
245 {"mutex_unlock", UNLOCK, "mutex", 0, ret_any},
246 {"mutex_lock_nested", LOCK, "mutex", 0, ret_any},
247
248 {"mutex_lock_interruptible", LOCK, "mutex", 0, ret_zero},
249 {"mutex_lock_interruptible_nested", LOCK, "mutex", 0, ret_zero},
250 {"mutex_lock_killable", LOCK, "mutex", 0, ret_zero},
251 {"mutex_lock_killable_nested", LOCK, "mutex", 0, ret_zero},
252
253 {"mutex_trylock", LOCK, "mutex", 0, ret_non_zero},
254
255 {"raw_local_irq_disable", LOCK, "irq", NO_ARG, ret_any},
256 {"raw_local_irq_enable", UNLOCK, "irq", NO_ARG, ret_any},
257 {"spin_lock_irq", LOCK, "irq", NO_ARG, ret_any},
258 {"spin_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
259 {"_spin_lock_irq", LOCK, "irq", NO_ARG, ret_any},
260 {"_spin_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
261 {"__spin_lock_irq", LOCK, "irq", NO_ARG, ret_any},
262 {"__spin_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
263 {"_raw_spin_lock_irq", LOCK, "irq", NO_ARG, ret_any},
264 {"_raw_spin_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
265 {"__raw_spin_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
266 {"spin_trylock_irq", LOCK, "irq", NO_ARG, ret_non_zero},
267 {"read_lock_irq", LOCK, "irq", NO_ARG, ret_any},
268 {"read_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
269 {"_read_lock_irq", LOCK, "irq", NO_ARG, ret_any},
270 {"_read_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
271 {"__read_lock_irq", LOCK, "irq", NO_ARG, ret_any},
272 {"__read_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
273 {"write_lock_irq", LOCK, "irq", NO_ARG, ret_any},
274 {"write_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
275 {"_write_lock_irq", LOCK, "irq", NO_ARG, ret_any},
276 {"_write_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
277 {"__write_lock_irq", LOCK, "irq", NO_ARG, ret_any},
278 {"__write_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
279
280 {"arch_local_irq_save", LOCK, "irqsave", RETURN_VAL, ret_any},
281 {"arch_local_irq_restore", UNLOCK, "irqsave", 0, ret_any},
282 {"__raw_local_irq_save", LOCK, "irqsave", RETURN_VAL, ret_any},
283 {"raw_local_irq_restore", UNLOCK, "irqsave", 0, ret_any},
284 {"spin_lock_irqsave_nested", LOCK, "irqsave", RETURN_VAL, ret_any},
285 {"spin_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
286 {"spin_lock_irqsave", LOCK, "irqsave", 1, ret_any},
287 {"spin_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
288 {"_spin_lock_irqsave_nested", LOCK, "irqsave", RETURN_VAL, ret_any},
289 {"_spin_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
290 {"_spin_lock_irqsave", LOCK, "irqsave", 1, ret_any},
291 {"_spin_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
292 {"__spin_lock_irqsave_nested", LOCK, "irqsave", 1, ret_any},
293 {"__spin_lock_irqsave", LOCK, "irqsave", 1, ret_any},
294 {"__spin_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
295 {"_raw_spin_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
296 {"_raw_spin_lock_irqsave", LOCK, "irqsave", 1, ret_any},
297 {"_raw_spin_unlock_irqrestore",UNLOCK, "irqsave", 1, ret_any},
298 {"__raw_spin_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
299 {"__raw_spin_unlock_irqrestore",UNLOCK, "irqsave", 1, ret_any},
300 {"_raw_spin_lock_irqsave_nested", LOCK, "irqsave", RETURN_VAL, ret_any},
301 {"spin_trylock_irqsave", LOCK, "irqsave", 1, ret_non_zero},
302 {"read_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
303 {"read_lock_irqsave", LOCK, "irqsave", 1, ret_any},
304 {"read_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
305 {"_read_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
306 {"_read_lock_irqsave", LOCK, "irqsave", 1, ret_any},
307 {"_read_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
308 {"__read_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
309 {"__read_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
310 {"write_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
311 {"write_lock_irqsave", LOCK, "irqsave", 1, ret_any},
312 {"write_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
313 {"_write_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
314 {"_write_lock_irqsave", LOCK, "irqsave", 1, ret_any},
315 {"_write_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
316 {"__write_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
317 {"__write_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
318
319 {"local_bh_disable", LOCK, "bottom_half", NO_ARG, ret_any},
320 {"_local_bh_disable", LOCK, "bottom_half", NO_ARG, ret_any},
321 {"__local_bh_disable", LOCK, "bottom_half", NO_ARG, ret_any},
322 {"local_bh_enable", UNLOCK, "bottom_half", NO_ARG, ret_any},
323 {"_local_bh_enable", UNLOCK, "bottom_half", NO_ARG, ret_any},
324 {"__local_bh_enable", UNLOCK, "bottom_half", NO_ARG, ret_any},
325 {"spin_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
326 {"spin_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
327 {"_spin_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
328 {"_spin_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
329 {"__spin_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
330 {"__spin_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
331 {"read_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
332 {"read_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
333 {"_read_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
334 {"_read_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
335 {"__read_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
336 {"__read_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
337 {"_raw_read_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
338 {"_raw_read_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
339 {"write_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
340 {"write_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
341 {"_write_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
342 {"_write_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
343 {"__write_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
344 {"__write_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
345 {"spin_trylock_bh", LOCK, "bottom_half", NO_ARG, ret_non_zero},
346 {"_spin_trylock_bh", LOCK, "bottom_half", NO_ARG, ret_non_zero},
347 {"__spin_trylock_bh", LOCK, "bottom_half", NO_ARG, ret_non_zero},
348
349 {"ffs_mutex_lock", LOCK, "mutex", 0, ret_zero},
350 };
351
352 static struct lock_info *lock_table;
353
354 static struct tracker_list *starts_locked;
355 static struct tracker_list *starts_unlocked;
356
357 struct locks_on_return {
358 int line;
359 struct tracker_list *locked;
360 struct tracker_list *unlocked;
361 struct range_list *return_values;
362 };
363 DECLARE_PTR_LIST(return_list, struct locks_on_return);
364 static struct return_list *all_returns;
365
366 static char *make_full_name(const char *lock, const char *var)
367 {
368 static char tmp_buf[512];
369
370 snprintf(tmp_buf, sizeof(tmp_buf), "%s:%s", lock, var);
371 remove_parens(tmp_buf);
372 return alloc_string(tmp_buf);
373 }
374
375 static struct expression *remove_spinlock_check(struct expression *expr)
376 {
377 if (expr->type != EXPR_CALL)
378 return expr;
379 if (expr->fn->type != EXPR_SYMBOL)
380 return expr;
381 if (strcmp(expr->fn->symbol_name->name, "spinlock_check"))
382 return expr;
383 expr = get_argument_from_call_expr(expr->args, 0);
384 return expr;
385 }
386
387 static char *get_full_name(struct expression *expr, int index)
388 {
389 struct expression *arg;
390 char *name = NULL;
391 char *full_name = NULL;
392 struct lock_info *lock = &lock_table[index];
393
394 if (lock->arg == RETURN_VAL) {
395 name = expr_to_var(expr->left);
396 full_name = make_full_name(lock->name, name);
397 } else if (lock->arg == NO_ARG) {
398 full_name = make_full_name(lock->name, "");
399 } else {
400 arg = get_argument_from_call_expr(expr->args, lock->arg);
401 if (!arg)
402 goto free;
403 arg = remove_spinlock_check(arg);
404 name = expr_to_str(arg);
405 if (!name)
406 goto free;
407 full_name = make_full_name(lock->name, name);
408 }
409 free:
410 free_string(name);
411 return full_name;
412 }
413
414 static struct smatch_state *get_start_state(struct sm_state *sm)
415 {
416 int is_locked = 0;
417 int is_unlocked = 0;
418
419 if (in_tracker_list(starts_locked, my_id, sm->name, sm->sym))
420 is_locked = 1;
421 if (in_tracker_list(starts_unlocked, my_id, sm->name, sm->sym))
422 is_unlocked = 1;
423 if (is_locked && is_unlocked)
424 return &undefined;
425 if (is_locked)
426 return &locked;
427 if (is_unlocked)
428 return &unlocked;
429 return &undefined;
430 }
431
432 static struct smatch_state *unmatched_state(struct sm_state *sm)
433 {
434 return &start_state;
435 }
436
437 static void do_lock(const char *name)
438 {
439 struct sm_state *sm;
440
441 if (__inline_fn)
442 return;
443
444 sm = get_sm_state(my_id, name, NULL);
445 if (!sm)
446 add_tracker(&starts_unlocked, my_id, name, NULL);
447 if (sm && slist_has_state(sm->possible, &locked) &&
448 strcmp(name, "bottom_half:") != 0)
449 sm_msg("error: double lock '%s'", name);
450 if (sm)
451 func_has_transition = TRUE;
452 set_state(my_id, name, NULL, &locked);
453 }
454
455 static void do_lock_failed(const char *name)
456 {
457 struct sm_state *sm;
458
459 if (__inline_fn)
460 return;
461
462 sm = get_sm_state(my_id, name, NULL);
463 if (!sm)
464 add_tracker(&starts_unlocked, my_id, name, NULL);
465 set_state(my_id, name, NULL, &unlocked);
466 }
467
468 static void do_unlock(const char *name)
469 {
470 struct sm_state *sm;
471
472 if (__inline_fn)
473 return;
474 if (__path_is_null())
475 return;
476 sm = get_sm_state(my_id, name, NULL);
477 if (!sm)
478 add_tracker(&starts_locked, my_id, name, NULL);
479 if (sm && slist_has_state(sm->possible, &unlocked) &&
480 strcmp(name, "bottom_half:") != 0)
481 sm_msg("error: double unlock '%s'", name);
482 if (sm)
483 func_has_transition = TRUE;
484 set_state(my_id, name, NULL, &unlocked);
485 }
486
487 static void match_lock_held(const char *fn, struct expression *call_expr,
488 struct expression *assign_expr, void *_index)
489 {
490 int index = PTR_INT(_index);
491 char *lock_name;
492 struct lock_info *lock = &lock_table[index];
493
494 if (lock->arg == NO_ARG) {
495 lock_name = get_full_name(NULL, index);
496 } else if (lock->arg == RETURN_VAL) {
497 if (!assign_expr)
498 return;
499 lock_name = get_full_name(assign_expr, index);
500 } else {
501 lock_name = get_full_name(call_expr, index);
502 }
503 if (!lock_name)
504 return;
505 do_lock(lock_name);
506 free_string(lock_name);
507 }
508
509 static void match_lock_failed(const char *fn, struct expression *call_expr,
510 struct expression *assign_expr, void *_index)
511 {
512 int index = PTR_INT(_index);
513 char *lock_name;
514 struct lock_info *lock = &lock_table[index];
515
516 if (lock->arg == NO_ARG) {
517 lock_name = get_full_name(NULL, index);
518 } else if (lock->arg == RETURN_VAL) {
519 if (!assign_expr)
520 return;
521 lock_name = get_full_name(assign_expr, index);
522 } else {
523 lock_name = get_full_name(call_expr, index);
524 }
525 if (!lock_name)
526 return;
527 do_lock_failed(lock_name);
528 free_string(lock_name);
529 }
530
531 static void match_returns_locked(const char *fn, struct expression *expr,
532 void *_index)
533 {
534 char *full_name = NULL;
535 int index = PTR_INT(_index);
536 struct lock_info *lock = &lock_table[index];
537
538 if (lock->arg != RETURN_VAL)
539 return;
540 full_name = get_full_name(expr, index);
541 do_lock(full_name);
542 }
543
544 static void match_lock_unlock(const char *fn, struct expression *expr, void *_index)
545 {
546 char *full_name = NULL;
547 int index = PTR_INT(_index);
548 struct lock_info *lock = &lock_table[index];
549
550 if (__inline_fn)
551 return;
552
553 full_name = get_full_name(expr, index);
554 if (!full_name)
555 return;
556 if (lock->action == LOCK)
557 do_lock(full_name);
558 else
559 do_unlock(full_name);
560 free_string(full_name);
561 }
562
563 static struct locks_on_return *alloc_return(struct expression *expr)
564 {
565 struct locks_on_return *ret;
566
567 ret = malloc(sizeof(*ret));
568 if (!get_implied_rl(expr, &ret->return_values))
569 ret->return_values = NULL;
570 ret->line = get_lineno();
571 ret->locked = NULL;
572 ret->unlocked = NULL;
573 return ret;
574 }
575
576 static int check_possible(struct sm_state *sm)
577 {
578 struct sm_state *tmp;
579 int islocked = 0;
580 int isunlocked = 0;
581 int undef = 0;
582
583 if (!option_spammy)
584 return 0;
585
586 FOR_EACH_PTR(sm->possible, tmp) {
587 if (tmp->state == &locked)
588 islocked = 1;
589 if (tmp->state == &unlocked)
590 isunlocked = 1;
591 if (tmp->state == &start_state) {
592 struct smatch_state *s;
593
594 s = get_start_state(tmp);
595 if (s == &locked)
596 islocked = 1;
597 else if (s == &unlocked)
598 isunlocked = 1;
599 else
600 undef = 1;
601 }
602 if (tmp->state == &undefined)
603 undef = 1; // i don't think this is possible any more.
604 } END_FOR_EACH_PTR(tmp);
605 if ((islocked && isunlocked) || undef) {
606 sm_msg("warn: '%s' is sometimes locked here and sometimes unlocked.", sm->name);
607 return 1;
608 }
609 return 0;
610 }
611
612 static struct position warned_pos;
613
614 static void match_return(int return_id, char *return_ranges, struct expression *expr)
615 {
616 struct locks_on_return *ret;
617 struct stree *stree;
618 struct sm_state *tmp;
619
620 if (!final_pass)
621 return;
622 if (__inline_fn)
623 return;
624
625 if (expr && cmp_pos(expr->pos, warned_pos) == 0)
626 return;
627
628 ret = alloc_return(expr);
629
630 stree = __get_cur_stree();
631 FOR_EACH_MY_SM(my_id, stree, tmp) {
632 if (tmp->state == &locked) {
633 add_tracker(&ret->locked, tmp->owner, tmp->name,
634 tmp->sym);
635 } else if (tmp->state == &unlocked) {
636 add_tracker(&ret->unlocked, tmp->owner, tmp->name,
637 tmp->sym);
638 } else if (tmp->state == &start_state) {
639 struct smatch_state *s;
640
641 s = get_start_state(tmp);
642 if (s == &locked)
643 add_tracker(&ret->locked, tmp->owner, tmp->name,
644 tmp->sym);
645 if (s == &unlocked)
646 add_tracker(&ret->unlocked, tmp->owner,tmp->name,
647 tmp->sym);
648 } else {
649 if (check_possible(tmp)) {
650 if (expr)
651 warned_pos = expr->pos;
652 }
653 }
654 } END_FOR_EACH_SM(tmp);
655 add_ptr_list(&all_returns, ret);
656 }
657
658 static void add_line(struct range_list **rl, int line)
659 {
660 sval_t sval = sval_type_val(&int_ctype, line);
661
662 add_range(rl, sval, sval);
663 }
664
665 static int line_printed(struct range_list *rl, int line)
666 {
667 sval_t sval = sval_type_val(&int_ctype, line);
668
669 return rl_has_sval(rl, sval);
670 }
671
672 static void print_inconsistent_returns(struct tracker *lock,
673 struct smatch_state *start)
674 {
675 struct locks_on_return *tmp;
676 struct range_list *printed = NULL;
677 int i;
678
679 sm_msg("warn: inconsistent returns '%s'.", lock->name);
680 sm_printf(" Locked on: ");
681
682 i = 0;
683 FOR_EACH_PTR(all_returns, tmp) {
684 if (line_printed(printed, tmp->line))
685 continue;
686 if (in_tracker_list(tmp->unlocked, lock->owner, lock->name, lock->sym))
687 continue;
688 if (in_tracker_list(tmp->locked, lock->owner, lock->name, lock->sym)) {
689 if (i++)
690 sm_printf(" ");
691 sm_printf("line %d\n", tmp->line);
692 add_line(&printed, tmp->line);
693 continue;
694 }
695 if (start == &locked) {
696 if (i++)
697 sm_printf(" ");
698 sm_printf("line %d\n", tmp->line);
699 add_line(&printed, tmp->line);
700 }
701 } END_FOR_EACH_PTR(tmp);
702
703 sm_printf(" Unlocked on: ");
704 printed = NULL;
705 i = 0;
706 FOR_EACH_PTR(all_returns, tmp) {
707 if (line_printed(printed, tmp->line))
708 continue;
709 if (in_tracker_list(tmp->unlocked, lock->owner, lock->name, lock->sym)) {
710 if (i++)
711 sm_printf(" ");
712 sm_printf("line %d\n", tmp->line);
713 add_line(&printed, tmp->line);
714 continue;
715 }
716 if (in_tracker_list(tmp->locked, lock->owner, lock->name, lock->sym))
717 continue;
718 if (start == &unlocked) {
719 if (i++)
720 sm_printf(" ");
721 sm_printf("line %d\n", tmp->line);
722 add_line(&printed, tmp->line);
723 }
724 } END_FOR_EACH_PTR(tmp);
725 }
726
727 static int matches_return_type(struct range_list *rl, enum return_type type)
728 {
729 sval_t zero_sval = ll_to_sval(0);
730
731 /* All these double negatives are super ugly! */
732
733 switch (type) {
734 case ret_zero:
735 return !possibly_true_rl(rl, SPECIAL_NOTEQUAL, alloc_rl(zero_sval, zero_sval));
736 case ret_non_zero:
737 return !possibly_true_rl(rl, SPECIAL_EQUAL, alloc_rl(zero_sval, zero_sval));
738 case ret_negative:
739 return !possibly_true_rl(rl, SPECIAL_GTE, alloc_rl(zero_sval, zero_sval));
740 case ret_positive:
741 return !possibly_true_rl(rl, '<', alloc_rl(zero_sval, zero_sval));
742 case ret_any:
743 default:
744 return 1;
745 }
746 }
747
748 static int match_held(struct tracker *lock, struct locks_on_return *this_return, struct smatch_state *start)
749 {
750 if (in_tracker_list(this_return->unlocked, lock->owner, lock->name, lock->sym))
751 return 0;
752 if (in_tracker_list(this_return->locked, lock->owner, lock->name, lock->sym))
753 return 1;
754 if (start == &unlocked)
755 return 0;
756 return 1;
757 }
758
759 static int match_released(struct tracker *lock, struct locks_on_return *this_return, struct smatch_state *start)
760 {
761 if (in_tracker_list(this_return->unlocked, lock->owner, lock->name, lock->sym))
762 return 1;
763 if (in_tracker_list(this_return->locked, lock->owner, lock->name, lock->sym))
764 return 0;
765 if (start == &unlocked)
766 return 1;
767 return 0;
768 }
769
770 static int held_on_return(struct tracker *lock, struct smatch_state *start, enum return_type type)
771 {
772 struct locks_on_return *tmp;
773
774 FOR_EACH_PTR(all_returns, tmp) {
775 if (!matches_return_type(tmp->return_values, type))
776 continue;
777 if (match_held(lock, tmp, start))
778 return 1;
779 } END_FOR_EACH_PTR(tmp);
780 return 0;
781 }
782
783 static int released_on_return(struct tracker *lock, struct smatch_state *start, enum return_type type)
784 {
785 struct locks_on_return *tmp;
786
787 FOR_EACH_PTR(all_returns, tmp) {
788 if (!matches_return_type(tmp->return_values, type))
789 continue;
790 if (match_released(lock, tmp, start))
791 return 1;
792 } END_FOR_EACH_PTR(tmp);
793 return 0;
794 }
795
796 static void check_returns_consistently(struct tracker *lock,
797 struct smatch_state *start)
798 {
799 struct symbol *type;
800
801 if (!held_on_return(lock, start, ret_any) ||
802 !released_on_return(lock, start, ret_any))
803 return;
804
805 if (held_on_return(lock, start, ret_zero) &&
806 !held_on_return(lock, start, ret_non_zero))
807 return;
808
809 if (held_on_return(lock, start, ret_positive) &&
810 !held_on_return(lock, start, ret_zero))
811 return;
812
813 if (held_on_return(lock, start, ret_positive) &&
814 !held_on_return(lock, start, ret_negative))
815 return;
816
817 type = cur_func_return_type();
818 if (type && type->type == SYM_PTR) {
819 if (held_on_return(lock, start, ret_non_zero) &&
820 !held_on_return(lock, start, ret_zero))
821 return;
822 }
823
824 print_inconsistent_returns(lock, start);
825 }
826
827 static void check_consistency(struct symbol *sym)
828 {
829 struct tracker *tmp;
830
831 FOR_EACH_PTR(starts_locked, tmp) {
832 if (in_tracker_list(starts_unlocked, tmp->owner, tmp->name,
833 tmp->sym))
834 sm_msg("error: locking inconsistency. We assume "
835 "'%s' is both locked and unlocked at the "
836 "start.",
837 tmp->name);
838 } END_FOR_EACH_PTR(tmp);
839
840 FOR_EACH_PTR(starts_locked, tmp) {
841 check_returns_consistently(tmp, &locked);
842 } END_FOR_EACH_PTR(tmp);
843
844 FOR_EACH_PTR(starts_unlocked, tmp) {
845 check_returns_consistently(tmp, &unlocked);
846 } END_FOR_EACH_PTR(tmp);
847 }
848
849 static void clear_lists(void)
850 {
851 struct locks_on_return *tmp;
852
853 func_has_transition = FALSE;
854
855 free_trackers_and_list(&starts_locked);
856 free_trackers_and_list(&starts_unlocked);
857
858 FOR_EACH_PTR(all_returns, tmp) {
859 free_trackers_and_list(&tmp->locked);
860 free_trackers_and_list(&tmp->unlocked);
861 free(tmp);
862 } END_FOR_EACH_PTR(tmp);
863 __free_ptr_list((struct ptr_list **)&all_returns);
864 }
865
866 static void match_func_end(struct symbol *sym)
867 {
868 if (__inline_fn)
869 return;
870
871 if (func_has_transition)
872 check_consistency(sym);
873 clear_lists();
874 }
875
876 static void register_lock(int index)
877 {
878 struct lock_info *lock = &lock_table[index];
879 void *idx = INT_PTR(index);
880
881 if (lock->return_type == ret_non_zero) {
882 return_implies_state(lock->function, valid_ptr_min, valid_ptr_max, &match_lock_held, idx);
883 return_implies_state(lock->function, 0, 0, &match_lock_failed, idx);
884 } else if (lock->return_type == ret_any && lock->arg == RETURN_VAL) {
885 add_function_assign_hook(lock->function, &match_returns_locked, idx);
886 } else if (lock->return_type == ret_any) {
887 add_function_hook(lock->function, &match_lock_unlock, idx);
888 } else if (lock->return_type == ret_zero) {
889 return_implies_state(lock->function, 0, 0, &match_lock_held, idx);
890 return_implies_state(lock->function, -4095, -1, &match_lock_failed, idx);
891 }
892 }
893
894 static void load_table(struct lock_info *_lock_table, int size)
895 {
896 int i;
897
898 lock_table = _lock_table;
899
900 for (i = 0; i < size; i++) {
901 if (lock_table[i].action == LOCK)
902 register_lock(i);
903 else
904 add_function_hook(lock_table[i].function, &match_lock_unlock, INT_PTR(i));
905 }
906 }
907
908 /* print_held_locks() is used in check_call_tree.c */
909 void print_held_locks(void)
910 {
911 struct stree *stree;
912 struct sm_state *sm;
913 int i = 0;
914
915 stree = __get_cur_stree();
916 FOR_EACH_MY_SM(my_id, stree, sm) {
917 if (sm->state != &locked)
918 continue;
919 if (i++)
920 sm_printf(" ");
921 sm_printf("'%s'", sm->name);
922 } END_FOR_EACH_SM(sm);
923 }
924
925 void check_locking(int id)
926 {
927 my_id = id;
928
929 if (option_project == PROJ_WINE)
930 load_table(wine_lock_table, ARRAY_SIZE(wine_lock_table));
931 else if (option_project == PROJ_KERNEL)
932 load_table(kernel_lock_table, ARRAY_SIZE(kernel_lock_table));
933 else
934 return;
935
936 add_unmatched_state_hook(my_id, &unmatched_state);
937 add_split_return_callback(match_return);
938 add_hook(&match_func_end, END_FUNC_HOOK);
939 }
Static analysis for C