check_free.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * check_memory() is getting too big and messy.
  20  *
  21  */
  22
  23 #include "smatch.h"
  24 #include "smatch_slist.h"
  25
  26 static int my_id;
  27
  28 STATE(freed);
  29 STATE(ok);
  30
  31 static void ok_to_use(struct sm_state *sm, struct expression *mod_expr)
  32 {
  33         if (sm->state != &ok)
  34                 set_state(my_id, sm->name, sm->sym, &ok);
  35 }
  36
  37 static int is_freed(struct expression *expr)
  38 {
  39         struct sm_state *sm;
  40
  41         sm = get_sm_state_expr(my_id, expr);
  42         if (sm && slist_has_state(sm->possible, &freed))
  43                 return 1;
  44         return 0;
  45 }
  46
  47 static void match_symbol(struct expression *expr)
  48 {
  49         char *name;
  50
  51         if (!is_freed(expr))
  52                 return;
  53         name = expr_to_var(expr);
  54         sm_msg("warn: '%s' was already freed.", name);
  55         free_string(name);
  56 }
  57
  58 static void match_dereferences(struct expression *expr)
  59 {
  60         char *name;
  61
  62         if (expr->type != EXPR_PREOP)
  63                 return;
  64         expr = strip_expr(expr->unop);
  65
  66         if (!is_freed(expr))
  67                 return;
  68         name = expr_to_var(expr);
  69         sm_msg("error: dereferencing freed memory '%s'", name);
  70         set_state_expr(my_id, expr, &ok);
  71         free_string(name);
  72 }
  73
  74 static int ignored_params[16];
  75
  76 static void set_ignored_params(struct expression *call)
  77 {
  78         struct expression *arg;
  79         const char *p;
  80         int i;
  81
  82         memset(&ignored_params, 0, sizeof(ignored_params));
  83
  84         i = -1;
  85         FOR_EACH_PTR(call->args, arg) {
  86                 i++;
  87                 if (arg->type != EXPR_STRING)
  88                         continue;
  89                 goto found;
  90         } END_FOR_EACH_PTR(arg);
  91
  92         return;
  93
  94 found:
  95         i++;
  96         p = arg->string->data;
  97         while ((p = strchr(p, '%'))) {
  98                 if (i >= ARRAY_SIZE(ignored_params))
  99                         return;
 100                 p++;
 101                 if (*p == '%') {
 102                         p++;
 103                         continue;
 104                 }
 105                 if (*p == '.')
 106                         p++;
 107                 if (*p == '*')
 108                         i++;
 109                 if (*p == 'p')
 110                         ignored_params[i] = 1;
 111                 i++;
 112         }
 113 }
 114
 115 static void match_call(struct expression *expr)
 116 {
 117         struct expression *arg;
 118         char *name;
 119         int i;
 120
 121         set_ignored_params(expr);
 122
 123         i = -1;
 124         FOR_EACH_PTR(expr->args, arg) {
 125                 i++;
 126                 if (!is_pointer(arg))
 127                         continue;
 128                 if (!is_freed(arg))
 129                         continue;
 130                 if (ignored_params[i])
 131                         continue;
 132
 133                 name = expr_to_var(arg);
 134                 sm_msg("warn: passing freed memory '%s'", name);
 135                 set_state_expr(my_id, arg, &ok);
 136                 free_string(name);
 137         } END_FOR_EACH_PTR(arg);
 138 }
 139
 140 static void match_return(struct expression *expr)
 141 {
 142         char *name;
 143
 144         if (!expr)
 145                 return;
 146         if (!is_freed(expr))
 147                 return;
 148
 149         name = expr_to_var(expr);
 150         sm_msg("warn: returning freed memory '%s'", name);
 151         set_state_expr(my_id, expr, &ok);
 152         free_string(name);
 153 }
 154
 155 static void match_free(const char *fn, struct expression *expr, void *param)
 156 {
 157         struct expression *arg;
 158
 159         arg = get_argument_from_call_expr(expr->args, PTR_INT(param));
 160         if (!arg)
 161                 return;
 162         if (is_freed(arg)) {
 163                 char *name = expr_to_var(arg);
 164
 165                 sm_msg("error: double free of '%s'", name);
 166                 free_string(name);
 167         }
 168         set_state_expr(my_id, arg, &freed);
 169 }
 170
 171 static void set_param_freed(struct expression *arg, char *key, char *unused)
 172 {
 173         struct symbol *sym;
 174         char *name;
 175
 176         name = get_variable_from_key(arg, key, &sym);
 177         if (!name || !sym)
 178                 goto free;
 179
 180         set_state(my_id, name, sym, &freed);
 181 free:
 182         free_string(name);
 183 }
 184
 185 int parent_is_free_var_sym(const char *name, struct symbol *sym)
 186 {
 187         char buf[256];
 188         char *start;
 189         char *end;
 190         struct smatch_state *state;
 191
 192         strncpy(buf, name, sizeof(buf) - 1);
 193         buf[sizeof(buf) - 1] = '\0';
 194
 195         start = &buf[0];
 196         while ((*start == '&'))
 197                 start++;
 198
 199         while ((end = strrchr(start, '-'))) {
 200                 *end = '\0';
 201                 state = get_state(my_id, start, sym);
 202                 if (state == &freed)
 203                         return 1;
 204         }
 205         return 0;
 206 }
 207
 208 int parent_is_free(struct expression *expr)
 209 {
 210         struct symbol *sym;
 211         char *var;
 212         int ret = 0;
 213
 214         expr = strip_expr(expr);
 215         var = expr_to_var_sym(expr, &sym);
 216         if (!var || !sym)
 217                 goto free;
 218         ret = parent_is_free_var_sym(var, sym);
 219 free:
 220         free_string(var);
 221         return ret;
 222 }
 223
 224 void check_free(int id)
 225 {
 226         my_id = id;
 227
 228         if (option_project == PROJ_KERNEL) {
 229                 add_function_hook("kfree", &match_free, INT_PTR(0));
 230                 add_function_hook("kmem_cache_free", &match_free, INT_PTR(1));
 231         } else {
 232                 add_function_hook("free", &match_free, INT_PTR(0));
 233         }
 234
 235         if (option_spammy)
 236                 add_hook(&match_symbol, SYM_HOOK);
 237         add_hook(&match_dereferences, DEREF_HOOK);
 238         add_hook(&match_call, FUNCTION_CALL_HOOK);
 239         add_hook(&match_return, RETURN_HOOK);
 240
 241         add_modification_hook(my_id, &ok_to_use);
 242         select_call_implies_hook(PARAM_FREED, &set_param_freed);
 243 }