check_locking.c

   1 /*
   2  * sparse/check_locking.c
   3  *
   4  * Copyright (C) 2009 Dan Carpenter.
   5  *
   6  *  Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * This test checks that locks are held the same across all returns.
  12  *
  13  * Of course, some functions are designed to only hold the locks on success.
  14  * Oh well... We can rewrite it later if we want.
  15  *
  16  * The list of wine locking functions came from an earlier script written
  17  * by Michael Stefaniuc.
  18  *
  19  */
  20
  21 #include "parse.h"
  22 #include "smatch.h"
  23 #include "smatch_slist.h"
  24
  25 static int my_id;
  26
  27 STATE(locked);
  28 STATE(start_state);
  29 STATE(unlocked);
  30
  31 enum action {
  32         LOCK,
  33         UNLOCK,
  34 };
  35
  36 enum return_type {
  37         ret_any,
  38         ret_non_zero,
  39         ret_zero,
  40 };
  41
  42 #define RETURN_VAL -1
  43 #define NO_ARG -2
  44
  45 struct lock_info {
  46         const char *function;
  47         enum action action;
  48         const char *name;
  49         int arg;
  50         enum return_type return_type;
  51 };
  52
  53 static struct lock_info wine_lock_table[] = {
  54         {"create_window_handle", LOCK, "create_window_handle", RETURN_VAL, ret_non_zero},
  55         {"WIN_GetPtr", LOCK, "create_window_handle", RETURN_VAL, ret_non_zero},
  56         {"WIN_ReleasePtr", UNLOCK, "create_window_handle", 0, ret_any},
  57         {"EnterCriticalSection", LOCK, "CriticalSection", 0, ret_any},
  58         {"LeaveCriticalSection", UNLOCK, "CriticalSection", 0, ret_any},
  59         {"RtlEnterCriticalSection", LOCK, "RtlCriticalSection", 0, ret_any},
  60         {"RtlLeaveCriticalSection", UNLOCK, "RtlCriticalSection", 0, ret_any},
  61         {"GDI_GetObjPtr", LOCK, "GDI_Get", 0, ret_non_zero},
  62         {"GDI_ReleaseObj", UNLOCK, "GDI_Get", 0, ret_any},
  63         {"LdrLockLoaderLock", LOCK, "LdrLockLoaderLock", 2, ret_any},
  64         {"LdrUnlockLoaderLock", UNLOCK, "LdrLockLoaderLock", 1, ret_any},
  65         {"_lock", LOCK, "_lock", 0, ret_any},
  66         {"_unlock", UNLOCK, "_lock", 0, ret_any},
  67         {"msiobj_lock", LOCK, "msiobj_lock", 0, ret_any},
  68         {"msiobj_unlock", UNLOCK, "msiobj_lock", 0, ret_any},
  69         {"RtlAcquirePebLock", LOCK, "PebLock", NO_ARG, ret_any},
  70         {"RtlReleasePebLock", UNLOCK, "PebLock", NO_ARG, ret_any},
  71         {"server_enter_uninterrupted_section", LOCK, "server_uninterrupted_section", 0, ret_any},
  72         {"server_leave_uninterrupted_section", UNLOCK, "server_uninterrupted_section", 0, ret_any},
  73         {"RtlLockHeap", LOCK, "RtlLockHeap", 0, ret_any},
  74         {"RtlUnlockHeap", UNLOCK, "RtlLockHeap", 0, ret_any},
  75         {"_EnterSysLevel", LOCK, "SysLevel", 0, ret_any},
  76         {"_LeaveSysLevel", UNLOCK, "SysLevel", 0, ret_any},
  77         {"USER_Lock", LOCK, "USER_Lock", NO_ARG, ret_any},
  78         {"USER_Unlock", UNLOCK, "USER_Lock", NO_ARG, ret_any},
  79         {"wine_tsx11_lock", LOCK, "wine_tsx11_lock", NO_ARG, ret_any},
  80         {"wine_tsx11_unlock", UNLOCK, "wine_tsx11_lock", NO_ARG, ret_any},
  81         {"wine_tsx11_lock_ptr", LOCK, "wine_tsx11_lock_ptr", NO_ARG, ret_any},
  82         {"wine_tsx11_unlock_ptr", UNLOCK, "wine_tsx11_lock_ptr", NO_ARG, ret_any},
  83         {"wined3d_mutex_lock", LOCK, "wined3d_mutex_lock", NO_ARG, ret_any},
  84         {"wined3d_mutex_unlock", UNLOCK, "wined3d_mutex_lock", NO_ARG, ret_any},
  85         {"X11DRV_DIB_Lock", LOCK, "X11DRV_DIB_Lock", 0, ret_any},
  86         {"X11DRV_DIB_Unlock", UNLOCK, "X11DRV_DIB_Lock", 0, ret_any},
  87 };
  88
  89 static struct lock_info kernel_lock_table[] = {
  90         {"lock_kernel",   LOCK,   "BKL", NO_ARG, ret_any},
  91         {"unlock_kernel", UNLOCK, "BKL", NO_ARG, ret_any},
  92
  93         {"_spin_lock",                 LOCK,   "spin_lock", 0, ret_any},
  94         {"_spin_unlock",               UNLOCK, "spin_lock", 0, ret_any},
  95         {"_spin_lock_nested",          LOCK,   "spin_lock", 0, ret_any},
  96         {"__spin_lock",                LOCK,   "spin_lock", 0, ret_any},
  97         {"__spin_unlock",              UNLOCK, "spin_lock", 0, ret_any},
  98         {"__spin_lock_nested",         LOCK,   "spin_lock", 0, ret_any},
  99         {"_raw_spin_lock",             LOCK,   "spin_lock", 0, ret_any},
 100         {"_raw_spin_unlock",           UNLOCK, "spin_lock", 0, ret_any},
 101         {"__raw_spin_lock",            LOCK,   "spin_lock", 0, ret_any},
 102         {"__raw_spin_unlock",          UNLOCK, "spin_lock", 0, ret_any},
 103
 104         {"_spin_lock_irq",             LOCK,   "spin_lock", 0, ret_any},
 105         {"_spin_unlock_irq",           UNLOCK, "spin_lock", 0, ret_any},
 106         {"__spin_lock_irq",            LOCK,   "spin_lock", 0, ret_any},
 107         {"__spin_unlock_irq",          UNLOCK, "spin_lock", 0, ret_any},
 108         {"_spin_lock_irqsave",         LOCK,   "spin_lock", 0, ret_any},
 109         {"_spin_unlock_irqrestore",    UNLOCK, "spin_lock", 0, ret_any},
 110         {"__spin_lock_irqsave",        LOCK,   "spin_lock", 0, ret_any},
 111         {"__spin_unlock_irqrestore",   UNLOCK, "spin_lock", 0, ret_any},
 112         {"_spin_lock_irqsave_nested",  LOCK,   "spin_lock", 0, ret_any},
 113         {"__spin_lock_irqsave_nested", LOCK,   "spin_lock", 0, ret_any},
 114         {"_spin_lock_bh",              LOCK,   "spin_lock", 0, ret_any},
 115         {"_spin_unlock_bh",            UNLOCK, "spin_lock", 0, ret_any},
 116         {"__spin_lock_bh",             LOCK,   "spin_lock", 0, ret_any},
 117         {"__spin_unlock_bh",           UNLOCK, "spin_lock", 0, ret_any},
 118
 119         {"_spin_trylock",              LOCK,   "spin_lock", 0, ret_non_zero},
 120         {"__spin_trylock",             LOCK,   "spin_lock", 0, ret_non_zero},
 121         {"_raw_spin_trylock",          LOCK,   "spin_lock", 0, ret_non_zero},
 122         {"_spin_trylock_bh",           LOCK,   "spin_lock", 0, ret_non_zero},
 123         {"__spin_trylock_bh",          LOCK,   "spin_lock", 0, ret_non_zero},
 124         {"__raw_spin_trylock",         LOCK,   "spin_lock", 0, ret_non_zero},
 125
 126         {"_read_lock",                LOCK,   "read_lock", 0, ret_any},
 127         {"_read_unlock",              UNLOCK, "read_lock", 0, ret_any},
 128         {"__read_lock",               LOCK,   "read_lock", 0, ret_any},
 129         {"__read_unlock",             UNLOCK, "read_lock", 0, ret_any},
 130         {"_read_lock_irq",            LOCK,   "read_lock", 0, ret_any},
 131         {"_read_unlock_irq",          UNLOCK, "read_lock", 0, ret_any},
 132         {"__read_lock_irq",           LOCK,   "read_lock", 0, ret_any},
 133         {"__read_unlock_irq",         UNLOCK, "read_lock", 0, ret_any},
 134         {"_read_lock_irqsave",        LOCK,   "read_lock", 0, ret_any},
 135         {"_read_unlock_irqrestore",   UNLOCK, "read_lock", 0, ret_any},
 136         {"__read_lock_irqsave",       LOCK,   "read_lock", 0, ret_any},
 137         {"__read_unlock_irqrestore",  UNLOCK, "read_lock", 0, ret_any},
 138         {"_read_lock_bh",             LOCK,   "read_lock", 0, ret_any},
 139         {"_read_unlock_bh",           UNLOCK, "read_lock", 0, ret_any},
 140         {"__read_lock_bh",            LOCK,   "read_lock", 0, ret_any},
 141         {"__read_unlock_bh",          UNLOCK, "read_lock", 0, ret_any},
 142
 143         {"generic__raw_read_trylock", LOCK,   "read_lock", 0, ret_non_zero},
 144         {"_raw_read_trylock",         LOCK,   "read_lock", 0, ret_non_zero},
 145         {"_read_trylock",             LOCK,   "read_lock", 0, ret_non_zero},
 146         {"__raw_read_trylock",        LOCK,   "read_lock", 0, ret_non_zero},
 147         {"__read_trylock",            LOCK,   "read_lock", 0, ret_non_zero},
 148
 149         {"_write_lock",               LOCK,   "write_lock", 0, ret_any},
 150         {"_write_unlock",             UNLOCK, "write_lock", 0, ret_any},
 151         {"__write_lock",              LOCK,   "write_lock", 0, ret_any},
 152         {"__write_unlock",            UNLOCK, "write_lock", 0, ret_any},
 153         {"_write_lock_irq",           LOCK,   "write_lock", 0, ret_any},
 154         {"_write_unlock_irq",         UNLOCK, "write_lock", 0, ret_any},
 155         {"__write_lock_irq",          LOCK,   "write_lock", 0, ret_any},
 156         {"__write_unlock_irq",        UNLOCK, "write_lock", 0, ret_any},
 157         {"_write_lock_irqsave",       LOCK,   "write_lock", 0, ret_any},
 158         {"_write_unlock_irqrestore",  UNLOCK, "write_lock", 0, ret_any},
 159         {"__write_lock_irqsave",      LOCK,   "write_lock", 0, ret_any},
 160         {"__write_unlock_irqrestore", UNLOCK, "write_lock", 0, ret_any},
 161         {"_write_lock_bh",            LOCK,   "write_lock", 0, ret_any},
 162         {"_write_unlock_bh",          UNLOCK, "write_lock", 0, ret_any},
 163         {"__write_lock_bh",           LOCK,   "write_lock", 0, ret_any},
 164         {"__write_unlock_bh",         UNLOCK, "write_lock", 0, ret_any},
 165
 166         {"_write_trylock",            LOCK,   "write_lock", 0, ret_non_zero},
 167         {"_raw_write_trylock",        LOCK,   "write_lock", 0, ret_non_zero},
 168         {"__write_trylock",           LOCK,   "write_lock", 0, ret_non_zero},
 169         {"__raw_write_trylock",       LOCK,   "write_lock", 0, ret_non_zero},
 170
 171         {"down",               LOCK,   "sem", 0, ret_any},
 172         {"up",                 UNLOCK, "sem", 0, ret_any},
 173         {"down_trylock",       LOCK,   "sem", 0, ret_zero},
 174         {"down_interruptible", LOCK,   "sem", 0, ret_zero},
 175
 176         {"mutex_lock",                      LOCK,   "mutex", 0, ret_any},
 177         {"mutex_unlock",                    UNLOCK, "mutex", 0, ret_any},
 178         {"mutex_lock_nested",               LOCK,   "mutex", 0, ret_any},
 179
 180         {"mutex_lock_interruptible",        LOCK,   "mutex", 0, ret_zero},
 181         {"mutex_lock_interruptible_nested", LOCK,   "mutex", 0, ret_zero},
 182         {"mutex_lock_killable",             LOCK,   "mutex", 0, ret_zero},
 183         {"mutex_lock_killable_nested",      LOCK,   "mutex", 0, ret_zero},
 184
 185         {"mutex_trylock",                   LOCK,   "mutex", 0, ret_non_zero},
 186
 187         {"raw_local_irq_disable", LOCK,   "irq", NO_ARG, ret_any},
 188         {"raw_local_irq_enable",  UNLOCK, "irq", NO_ARG, ret_any},
 189         {"_spin_lock_irq",        LOCK,   "irq", NO_ARG, ret_any},
 190         {"_spin_unlock_irq",      UNLOCK, "irq", NO_ARG, ret_any},
 191         {"__spin_lock_irq",       LOCK,   "irq", NO_ARG, ret_any},
 192         {"__spin_unlock_irq",     UNLOCK, "irq", NO_ARG, ret_any},
 193         {"_read_lock_irq",        LOCK,   "irq", NO_ARG, ret_any},
 194         {"_read_unlock_irq",      UNLOCK, "irq", NO_ARG, ret_any},
 195         {"__read_lock_irq",       LOCK,   "irq", NO_ARG, ret_any},
 196         {"__read_unlock_irq",     UNLOCK, "irq", NO_ARG, ret_any},
 197         {"_write_lock_irq",       LOCK,   "irq", NO_ARG, ret_any},
 198         {"_write_unlock_irq",     UNLOCK, "irq", NO_ARG, ret_any},
 199         {"__write_lock_irq",      LOCK,   "irq", NO_ARG, ret_any},
 200         {"__write_unlock_irq",    UNLOCK, "irq", NO_ARG, ret_any},
 201
 202         {"__raw_local_irq_save",       LOCK,   "irqsave", RETURN_VAL, ret_any},
 203         {"raw_local_irq_restore",      UNLOCK, "irqsave", 0, ret_any},
 204         {"_spin_lock_irqsave_nested",  LOCK,   "irqsave", RETURN_VAL, ret_any},
 205         {"_spin_lock_irqsave",         LOCK,   "irqsave", RETURN_VAL, ret_any},
 206         {"_spin_lock_irqsave",         LOCK,   "irqsave", 1, ret_any},
 207         {"_spin_unlock_irqrestore",    UNLOCK, "irqsave", 1, ret_any},
 208         {"__spin_lock_irqsave_nested", LOCK,   "irqsave", 1, ret_any},
 209         {"__spin_lock_irqsave",        LOCK,   "irqsave", 1, ret_any},
 210         {"__spin_unlock_irqrestore",   UNLOCK, "irqsave", 1, ret_any},
 211         {"_read_lock_irqsave",         LOCK,   "irqsave", RETURN_VAL, ret_any},
 212         {"_read_lock_irqsave",         LOCK,   "irqsave", 1, ret_any},
 213         {"_read_unlock_irqrestore",    UNLOCK, "irqsave", 1, ret_any},
 214         {"__read_lock_irqsave",        LOCK,   "irqsave", RETURN_VAL, ret_any},
 215         {"__read_unlock_irqrestore",   UNLOCK, "irqsave", 1, ret_any},
 216         {"_write_lock_irqsave",        LOCK,   "irqsave", RETURN_VAL, ret_any},
 217         {"_write_lock_irqsave",        LOCK,   "irqsave", 1, ret_any},
 218         {"_write_unlock_irqrestore",   UNLOCK, "irqsave", 1, ret_any},
 219         {"__write_lock_irqsave",       LOCK,   "irqsave", RETURN_VAL, ret_any},
 220         {"__write_unlock_irqrestore",  UNLOCK, "irqsave", 1, ret_any},
 221
 222         {"_spin_lock_bh",     LOCK,   "bottom_half", NO_ARG, ret_any},
 223         {"_spin_unlock_bh",   UNLOCK, "bottom_half", NO_ARG, ret_any},
 224         {"__spin_lock_bh",    LOCK,   "bottom_half", NO_ARG, ret_any},
 225         {"__spin_unlock_bh",  UNLOCK, "bottom_half", NO_ARG, ret_any},
 226         {"_read_lock_bh",     LOCK,   "bottom_half", NO_ARG, ret_any},
 227         {"_read_unlock_bh",   UNLOCK, "bottom_half", NO_ARG, ret_any},
 228         {"__read_lock_bh",    LOCK,   "bottom_half", NO_ARG, ret_any},
 229         {"__read_unlock_bh",  UNLOCK, "bottom_half", NO_ARG, ret_any},
 230         {"_write_lock_bh",    LOCK,   "bottom_half", NO_ARG, ret_any},
 231         {"_write_unlock_bh",  UNLOCK, "bottom_half", NO_ARG, ret_any},
 232         {"__write_lock_bh",   LOCK,   "bottom_half", NO_ARG, ret_any},
 233         {"__write_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
 234         {"_spin_trylock_bh",  LOCK,   "bottom_half", NO_ARG, ret_non_zero},
 235         {"__spin_trylock_bh", LOCK,   "bottom_half", NO_ARG, ret_non_zero},
 236 };
 237
 238 static struct lock_info *lock_table;
 239
 240 static struct tracker_list *starts_locked;
 241 static struct tracker_list *starts_unlocked;
 242
 243 struct locks_on_return {
 244         int line;
 245         struct tracker_list *locked;
 246         struct tracker_list *unlocked;
 247 };
 248 DECLARE_PTR_LIST(return_list, struct locks_on_return);
 249 static struct return_list *all_returns;
 250
 251 static char *make_full_name(const char *lock, const char *var)
 252 {
 253         static char tmp_buf[512];
 254
 255         snprintf(tmp_buf, 512, "%s:%s", lock, var);
 256         tmp_buf[511] = '\0';
 257         return alloc_string(tmp_buf);
 258 }
 259
 260 static char *get_full_name(struct expression *expr, int index)
 261 {
 262         struct expression *arg;
 263         char *name = NULL;
 264         char *full_name = NULL;
 265         struct lock_info *lock = &lock_table[index];
 266
 267         if (lock->arg == RETURN_VAL) {
 268                 name = get_variable_from_expr(expr->left, NULL);
 269                 full_name = make_full_name(lock->name, name);
 270         } else if (lock->arg == NO_ARG) {
 271                 full_name = make_full_name(lock->name, "");
 272         } else {
 273                 arg = get_argument_from_call_expr(expr->args, lock->arg);
 274                 if (!arg)
 275                         goto free;
 276                 name = get_variable_from_expr(arg, NULL);
 277                 if (!name)
 278                         goto free;
 279                 full_name = make_full_name(lock->name, name);
 280         }
 281 free:
 282         free_string(name);
 283         return full_name;
 284 }
 285
 286 static struct smatch_state *get_start_state(struct sm_state *sm)
 287 {
 288        int is_locked = 0;
 289        int is_unlocked = 0;
 290
 291        if (in_tracker_list(starts_locked, my_id, sm->name, sm->sym))
 292                is_locked = 1;
 293        if (in_tracker_list(starts_unlocked, my_id, sm->name, sm->sym))
 294                is_unlocked = 1;
 295        if (is_locked && is_unlocked)
 296                return &undefined;
 297        if (is_locked)
 298                return &locked;
 299        if (is_unlocked)
 300                return &unlocked;
 301         return &undefined;
 302 }
 303
 304 static struct smatch_state *unmatched_state(struct sm_state *sm)
 305 {
 306         return &start_state;
 307 }
 308
 309 static void do_lock(const char *name)
 310 {
 311         struct sm_state *sm;
 312
 313         sm = get_sm_state(my_id, name, NULL);
 314         if (!sm)
 315                 add_tracker(&starts_unlocked, my_id, name, NULL);
 316         if (sm && slist_has_state(sm->possible, &locked))
 317                 sm_msg("error: double lock '%s'", name);
 318         set_state(my_id, name, NULL, &locked);
 319 }
 320
 321 static void do_lock_failed(const char *name)
 322 {
 323         struct sm_state *sm;
 324
 325         sm = get_sm_state(my_id, name, NULL);
 326         if (!sm)
 327                 add_tracker(&starts_unlocked, my_id, name, NULL);
 328         set_state(my_id, name, NULL, &unlocked);
 329 }
 330
 331 static void do_unlock(const char *name)
 332 {
 333         struct sm_state *sm;
 334
 335         sm = get_sm_state(my_id, name, NULL);
 336         if (!sm)
 337                 add_tracker(&starts_locked, my_id, name, NULL);
 338         if (sm && slist_has_state(sm->possible, &unlocked))
 339                 sm_msg("error: double unlock '%s'", name);
 340         set_state(my_id, name, NULL, &unlocked);
 341
 342 }
 343
 344 static void match_lock_held(const char *fn, struct expression *call_expr,
 345                         struct expression *assign_expr, void *_index)
 346 {
 347         int index = (int)_index;
 348         char *lock_name;
 349         struct lock_info *lock = &lock_table[index];
 350
 351         if (lock->arg == NO_ARG) {
 352                 lock_name = get_full_name(NULL, index);
 353         } else if (lock->arg == RETURN_VAL) {
 354                 if (!assign_expr)
 355                         return;
 356                 lock_name = get_full_name(assign_expr, index);
 357         } else {
 358                 lock_name = get_full_name(call_expr, index);
 359         }
 360         if (!lock_name)
 361                 return;
 362         do_lock(lock_name);
 363         free_string(lock_name);
 364 }
 365
 366 static void match_lock_failed(const char *fn, struct expression *call_expr,
 367                         struct expression *assign_expr, void *_index)
 368 {
 369         int index = (int)_index;
 370         char *lock_name;
 371         struct lock_info *lock = &lock_table[index];
 372
 373         if (lock->arg == NO_ARG) {
 374                 lock_name = get_full_name(NULL, index);
 375         } else if (lock->arg == RETURN_VAL) {
 376                 if (!assign_expr)
 377                         return;
 378                 lock_name = get_full_name(assign_expr, index);
 379         } else {
 380                 lock_name = get_full_name(call_expr, index);
 381         }
 382         if (!lock_name)
 383                 return;
 384         do_lock_failed(lock_name);
 385         free_string(lock_name);
 386 }
 387
 388 static void match_returns_locked(const char *fn, struct expression *expr,
 389                                       void *_index)
 390 {
 391         char *full_name = NULL;
 392         int index = (int)_index;
 393         struct lock_info *lock = &lock_table[index];
 394
 395         if (lock->arg != RETURN_VAL)
 396                 return;
 397         full_name = get_full_name(expr, index);
 398         do_lock(full_name);
 399 }
 400
 401 static void match_lock_unlock(const char *fn, struct expression *expr, void *_index)
 402 {
 403         char *full_name = NULL;
 404         int index = (int)_index;
 405         struct lock_info *lock = &lock_table[index];
 406
 407         full_name = get_full_name(expr, index);
 408         if (!full_name)
 409                 return;
 410         if (lock->action == LOCK)
 411                 do_lock(full_name);
 412         else
 413                 do_unlock(full_name);
 414         free_string(full_name);
 415 }
 416
 417 static struct locks_on_return *alloc_return(int line)
 418 {
 419         struct locks_on_return *ret;
 420
 421         ret = malloc(sizeof(*ret));
 422         ret->line = line;
 423         ret->locked = NULL;
 424         ret->unlocked = NULL;
 425         return ret;
 426 }
 427
 428 static void check_possible(struct sm_state *sm)
 429 {
 430         struct sm_state *tmp;
 431         int islocked = 0;
 432         int isunlocked = 0;
 433         int undef = 0;
 434
 435         FOR_EACH_PTR(sm->possible, tmp) {
 436                 if (tmp->state == &locked)
 437                         islocked = 1;
 438                 if (tmp->state == &unlocked)
 439                         isunlocked = 1;
 440                 if (tmp->state == &start_state) {
 441                         struct smatch_state *s;
 442
 443                         s = get_start_state(tmp);
 444                         if (s == &locked)
 445                                 islocked = 1;
 446                         else if (s == &unlocked)
 447                                 isunlocked = 1;
 448                         else
 449                                 undef = 1;
 450                 }
 451                 if (tmp->state == &undefined)
 452                         undef = 1;  // i don't think this is possible any more.
 453         } END_FOR_EACH_PTR(tmp);
 454         if ((islocked && isunlocked) || undef)
 455                 sm_msg("warn: '%s' is sometimes locked here and "
 456                            "sometimes unlocked.", sm->name);
 457 }
 458
 459 static void match_return(struct expression *ret_value)
 460 {
 461         struct locks_on_return *ret;
 462         struct state_list *slist;
 463         struct sm_state *tmp;
 464
 465         if (!final_pass)
 466                 return;
 467
 468         ret = alloc_return(get_lineno());
 469
 470         slist = get_all_states(my_id);
 471         FOR_EACH_PTR(slist, tmp) {
 472                 if (tmp->state == &locked) {
 473                         add_tracker(&ret->locked, tmp->owner, tmp->name,
 474                                 tmp->sym);
 475                 } else if (tmp->state == &unlocked) {
 476                         add_tracker(&ret->unlocked, tmp->owner, tmp->name,
 477                                 tmp->sym);
 478                 } else if (tmp->state == &start_state) {
 479                         struct smatch_state *s;
 480
 481                         s = get_start_state(tmp);
 482                         if (s == &locked)
 483                                 add_tracker(&ret->locked, tmp->owner, tmp->name,
 484                                             tmp->sym);
 485                         if (s == &unlocked)
 486                                 add_tracker(&ret->unlocked, tmp->owner,tmp->name,
 487                                              tmp->sym);
 488                 }else {
 489                         check_possible(tmp);
 490                 }
 491         } END_FOR_EACH_PTR(tmp);
 492         free_slist(&slist);
 493         add_ptr_list(&all_returns, ret);
 494 }
 495
 496 static void print_inconsistent_returns(struct tracker *lock,
 497                                 struct smatch_state *start)
 498 {
 499         struct locks_on_return *tmp;
 500         int i;
 501
 502         sm_printf("%s +%d %s(%d) ", get_filename(), get_lineno(), get_function(), get_func_pos());
 503         sm_printf("warn: inconsistent returns %s:", lock->name);
 504         sm_printf(" locked (");
 505         i = 0;
 506         FOR_EACH_PTR(all_returns, tmp) {
 507                 if (in_tracker_list(tmp->unlocked, lock->owner, lock->name, lock->sym))
 508                         continue;
 509                 if (in_tracker_list(tmp->locked, lock->owner, lock->name, lock->sym)) {
 510                         if (i++)
 511                                 sm_printf(",");
 512                         sm_printf("%d", tmp->line);
 513                         continue;
 514                 }
 515                 if (start == &locked) {
 516                         if (i++)
 517                                 sm_printf(",");
 518                         sm_printf("%d", tmp->line);
 519                 }
 520         } END_FOR_EACH_PTR(tmp);
 521
 522         sm_printf(") unlocked (");
 523         i = 0;
 524         FOR_EACH_PTR(all_returns, tmp) {
 525                 if (in_tracker_list(tmp->unlocked, lock->owner, lock->name, lock->sym)) {
 526                         if (i++)
 527                                 sm_printf(",");
 528                         sm_printf("%d", tmp->line);
 529                         continue;
 530                 }
 531                 if (in_tracker_list(tmp->locked, lock->owner, lock->name, lock->sym)) {
 532                         continue;
 533                 }
 534                 if (start == &unlocked) {
 535                         if (i++)
 536                                 sm_printf(",");
 537                         sm_printf("%d", tmp->line);
 538                 }
 539         } END_FOR_EACH_PTR(tmp);
 540         sm_printf(")\n");
 541 }
 542
 543 static void check_returns_consistently(struct tracker *lock,
 544                                 struct smatch_state *start)
 545 {
 546         int returns_locked = 0;
 547         int returns_unlocked = 0;
 548         struct locks_on_return *tmp;
 549
 550         FOR_EACH_PTR(all_returns, tmp) {
 551                 if (in_tracker_list(tmp->unlocked, lock->owner, lock->name,
 552                                         lock->sym))
 553                         returns_unlocked = tmp->line;
 554                 else if (in_tracker_list(tmp->locked, lock->owner, lock->name,
 555                                                 lock->sym))
 556                         returns_locked = tmp->line;
 557                 else if (start == &locked)
 558                         returns_locked = tmp->line;
 559                 else if (start == &unlocked)
 560                         returns_unlocked = tmp->line;
 561         } END_FOR_EACH_PTR(tmp);
 562
 563         if (returns_locked && returns_unlocked)
 564                 print_inconsistent_returns(lock, start);
 565 }
 566
 567 static void check_consistency(struct symbol *sym)
 568 {
 569         struct tracker *tmp;
 570
 571         if (is_reachable())
 572                 match_return(NULL);
 573
 574         FOR_EACH_PTR(starts_locked, tmp) {
 575                 if (in_tracker_list(starts_unlocked, tmp->owner, tmp->name,
 576                                         tmp->sym))
 577                         sm_msg("error:  locking inconsistency.  We assume "
 578                                    "'%s' is both locked and unlocked at the "
 579                                    "start.",
 580                                 tmp->name);
 581         } END_FOR_EACH_PTR(tmp);
 582
 583         FOR_EACH_PTR(starts_locked, tmp) {
 584                 check_returns_consistently(tmp, &locked);
 585         } END_FOR_EACH_PTR(tmp);
 586
 587         FOR_EACH_PTR(starts_unlocked, tmp) {
 588                 check_returns_consistently(tmp, &unlocked);
 589         } END_FOR_EACH_PTR(tmp);
 590
 591 }
 592
 593 static void clear_lists(void)
 594 {
 595         struct locks_on_return *tmp;
 596
 597         free_trackers_and_list(&starts_locked);
 598         free_trackers_and_list(&starts_unlocked);
 599
 600         FOR_EACH_PTR(all_returns, tmp) {
 601                 free_trackers_and_list(&tmp->locked);
 602                 free_trackers_and_list(&tmp->unlocked);
 603                 free(tmp);
 604         } END_FOR_EACH_PTR(tmp);
 605         __free_ptr_list((struct ptr_list **)&all_returns);
 606 }
 607
 608 static void match_func_end(struct symbol *sym)
 609 {
 610         check_consistency(sym);
 611         clear_lists();
 612 }
 613
 614 static void register_lock(int index)
 615 {
 616         struct lock_info *lock = &lock_table[index];
 617         void *idx = (void *)index;
 618
 619         if (lock->return_type == ret_non_zero) {
 620                 return_implies_state(lock->function, 1, POINTER_MAX, &match_lock_held, idx);
 621                 return_implies_state(lock->function, 0, 0, &match_lock_failed, idx);
 622         } else if (lock->return_type == ret_any && lock->arg == RETURN_VAL) {
 623                 add_function_assign_hook(lock->function, &match_returns_locked, idx);
 624         } else if (lock->return_type == ret_any) {
 625                 add_function_hook(lock->function, &match_lock_unlock, idx);
 626         } else if (lock->return_type == ret_zero) {
 627                 return_implies_state(lock->function, 0, 0, &match_lock_held, idx);
 628                 return_implies_state(lock->function, whole_range.min, -1, &match_lock_failed, idx);
 629         }
 630 }
 631
 632 static void load_table(struct lock_info *_lock_table, int size)
 633 {
 634         int i;
 635
 636         lock_table = _lock_table;
 637
 638         for (i = 0; i < size; i++) {
 639                 if (lock_table[i].action == LOCK)
 640                         register_lock(i);
 641                 else
 642                         add_function_hook(lock_table[i].function, &match_lock_unlock, (void *)i);
 643         }
 644 }
 645
 646 void check_locking(int id)
 647 {
 648         my_id = id;
 649
 650         if (option_project == PROJ_WINE)
 651                 load_table(wine_lock_table, ARRAY_SIZE(wine_lock_table));
 652         else if (option_project == PROJ_KERNEL)
 653                 load_table(kernel_lock_table, ARRAY_SIZE(kernel_lock_table));
 654         else
 655                 return;
 656
 657         add_unmatched_state_hook(my_id, &unmatched_state);
 658         add_hook(&match_return, RETURN_HOOK);
 659         add_hook(&match_func_end, END_FUNC_HOOK);
 660 }