check_refcount_info.c

   1 /*
   2  * Copyright (C) 2021 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * This is basically a copy for check_preempt_info.c but for refcount instead.
  20  */
  21
  22 #include "smatch.h"
  23 #include "smatch_extra.h"
  24 #include "smatch_slist.h"
  25
  26 static int my_id;
  27
  28 STATE(init);
  29 STATE(inc);
  30 STATE(dec);
  31 STATE(ignore);
  32 STATE(gone);
  33
  34 struct ref_func_info {
  35         const char *name;
  36         int type;
  37         int param;
  38         const char *key;
  39         const sval_t *implies_start, *implies_end;
  40         param_key_hook *call_back;
  41 };
  42
  43 static void match_atomic_add(struct expression *expr, const char *name, struct symbol *sym, void *_unused);
  44
  45 static struct ref_func_info func_table[] = {
  46         { "atomic_inc", REFCOUNT_INC, 0, "$->counter" },
  47         { "atomic_long_inc", REFCOUNT_INC, 0, "$->counter" },
  48         { "atomic64_inc", REFCOUNT_INC, 0, "$->counter" },
  49
  50         { "atomic_inc_return", REFCOUNT_INC, 0, "$->counter" },
  51         { "atomic_long_inc_return", REFCOUNT_INC, 0, "$->counter" },
  52         { "atomic64_return", REFCOUNT_INC, 0, "$->counter" },
  53
  54         { "atomic_add_return", REFCOUNT_INC, 1, "$->counter", NULL, NULL, match_atomic_add },
  55         { "atomic_long_add_return", REFCOUNT_INC, 1, "$->counter", NULL, NULL, match_atomic_add },
  56         { "atomic64_add_return", REFCOUNT_INC, 1, "$->counter", NULL, NULL, match_atomic_add },
  57
  58         { "atomic64_inc_not_zero", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  59         { "atomic64_fetch_add_unless", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  60         { "atomic64_add_unless", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  61         { "atomic64_add_unless_negative", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  62         { "atomic64_add_unless_positive", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  63
  64         // atomic64_dec_if_positive
  65         // atomic64_dec_unless_positive
  66
  67         { "atomic_dec", REFCOUNT_DEC, 0, "$->counter" },
  68         { "atomic_long_dec", REFCOUNT_DEC, 0, "$->counter" },
  69         { "atomic64_dec", REFCOUNT_DEC, 0, "$->counter" },
  70
  71         { "atomic_dec_return", REFCOUNT_DEC, 0, "$->counter" },
  72         { "atomic_long_dec_return", REFCOUNT_DEC, 0, "$->counter" },
  73         { "atomic64_dec_return", REFCOUNT_DEC, 0, "$->counter" },
  74
  75         { "atomic_dec_and_test", REFCOUNT_DEC, 0, "$->counter" },
  76         { "atomic_long_dec_and_test", REFCOUNT_DEC, 0, "$->counter" },
  77         { "atomic64_dec_and_test", REFCOUNT_DEC, 0, "$->counter" },
  78
  79         { "_atomic_dec_and_lock", REFCOUNT_DEC, 0, "$->counter" },
  80
  81         { "atomic_sub", REFCOUNT_DEC, 1, "$->counter" },
  82         { "atomic_long_sub", REFCOUNT_DEC, 1, "$->counter" },
  83         { "atomic64_sub", REFCOUNT_DEC, 1, "$->counter" },
  84
  85         { "atomic_sub_return", REFCOUNT_DEC, 1, "$->counter" },
  86         { "atomic_long_sub_return", REFCOUNT_DEC, 1, "$->counter" },
  87         { "atomic64_sub_return", REFCOUNT_DEC, 1, "$->counter" },
  88
  89         { "atomic_sub_and_test", REFCOUNT_DEC, 1, "$->counter" },
  90         { "atomic_long_sub_and_test", REFCOUNT_DEC, 1, "$->counter" },
  91         { "atomic64_sub_and_test", REFCOUNT_DEC, 1, "$->counter" },
  92
  93         { "register_device", REFCOUNT_INIT, 0, "$->kobj.kset->kobj.kref.refcount.refs.counter", &err_min, &err_max},
  94         { "register_device", REFCOUNT_INC, 0, "$->kobj.kset->kobj.kref.refcount.refs.counter", &int_zero, &int_zero},
  95         { "device_add", REFCOUNT_INC, 0, "$->kobj.kset->kobj.kref.refcount.refs.counter", &int_zero, &int_zero},
  96
  97         { "refcount_set", REFCOUNT_INIT, 0, "$->refs.counter" },
  98
  99         { "refcount_inc", REFCOUNT_INC, 0, "$->refs.counter" },
 100         { "refcount_dec", REFCOUNT_DEC, 0, "$->refs.counter" },
 101         { "refcount_dec_and_test", REFCOUNT_DEC, 0, "$->refs.counter" },
 102         { "refcount_add", REFCOUNT_INC, 1, "$->refs.counter" },
 103         { "refcount_sub_and_test", REFCOUNT_DEC, 1, "$->refs.counter" },
 104
 105         { "pm_runtime_get_sync", REFCOUNT_INC, 0, "$->power.usage_count.counter" },
 106
 107         { "refcount_inc_not_zero", REFCOUNT_INC, 0, "$->refs.counter", &int_one, &int_one},
 108         { "refcount_add_not_zero", REFCOUNT_INC, 1, "$->refs.counter", &int_one, &int_one},
 109
 110         { "atomic_dec_if_positive", REFCOUNT_DEC, 0, "$->counter", &int_zero, &int_max},
 111         { "atomic64_dec_if_positive", REFCOUNT_DEC, 0, "$->counter", &int_zero, &int_max},
 112
 113         { "of_node_get", REFCOUNT_INC, 0, "$->kobj.kref.refcount.refs.counter" },
 114         { "of_node_put", REFCOUNT_DEC, 0, "$->kobj.kref.refcount.refs.counter" },
 115         { "of_get_parent", REFCOUNT_INC, -1, "$->kobj.kref.refcount.refs.counter" },
 116         { "of_clk_del_provider", REFCOUNT_DEC, 0, "$->kobj.kref.refcount.refs.counter" },
 117
 118         { "kfree_skb", REFCOUNT_DEC, 0, "$->users.refs.counter" },
 119
 120         { "pci_get_dev_by_id", REFCOUNT_INC, -1, "$->dev.kobj.kref.refcount.refs.counter" },
 121         { "pci_get_dev_by_id", REFCOUNT_DEC,  1, "$->dev.kobj.kref.refcount.refs.counter" },
 122
 123         { "fget", REFCOUNT_INC, -1, "$->f_count.counter", &valid_ptr_min_sval, &valid_ptr_max_sval },
 124         { "sockfd_lookup", REFCOUNT_INC, -1, "$->file->f_count.counter", &valid_ptr_min_sval, &valid_ptr_max_sval },
 125 //      { "fsnotify_put_mark", REFCOUNT_DEC, 0, "$->refcnt.refs.counter" },
 126
 127 };
 128
 129 static struct smatch_state *unmatched_state(struct sm_state *sm)
 130 {
 131         if (parent_is_null_var_sym(sm->name, sm->sym))
 132                 return &gone;
 133         return &undefined;
 134 }
 135
 136 static struct smatch_state *merge_states(struct smatch_state *s1, struct smatch_state *s2)
 137 {
 138         if (s1 == &gone)
 139                 return s2;
 140         if (s2 == &gone)
 141                 return s1;
 142         return &merged;
 143 }
 144
 145 static struct name_sym_fn_list *init_hooks, *inc_hooks, *dec_hooks;
 146
 147 void add_refcount_init_hook(name_sym_hook *hook)
 148 {
 149         add_ptr_list(&init_hooks, hook);
 150 }
 151
 152 void add_refcount_inc_hook(name_sym_hook *hook)
 153 {
 154         add_ptr_list(&inc_hooks, hook);
 155 }
 156
 157 void add_refcount_dec_hook(name_sym_hook *hook)
 158 {
 159         add_ptr_list(&dec_hooks, hook);
 160 }
 161
 162 void call_hooks(struct name_sym_fn_list *hooks, struct expression *expr,
 163                 const char *name, struct symbol *sym)
 164 {
 165         name_sym_hook *hook;
 166
 167         FOR_EACH_PTR(hooks, hook) {
 168                 hook(expr, name, sym);
 169         } END_FOR_EACH_PTR(hook);
 170 }
 171
 172 static void do_init(struct expression *expr, const char *name, struct symbol *sym)
 173 {
 174         struct smatch_state *orig;
 175
 176         call_hooks(init_hooks, expr, name, sym);
 177
 178         orig = get_state(my_id, name, sym);
 179         if (orig) {
 180                 set_state(my_id, name, sym, &ignore);
 181                 return;
 182         }
 183
 184         set_state(my_id, name, sym, &init);
 185 }
 186
 187 static void do_inc(struct expression *expr, const char *name, struct symbol *sym)
 188 {
 189         struct smatch_state *orig;
 190
 191         call_hooks(inc_hooks, expr, name, sym);
 192
 193         orig = get_state(my_id, name, sym);
 194         if (orig) {
 195                 set_state(my_id, name, sym, &ignore);
 196                 return;
 197         }
 198
 199         set_state(my_id, name, sym, &inc);
 200 }
 201
 202 static void do_dec(struct expression *expr, const char *name, struct symbol *sym)
 203 {
 204         struct smatch_state *orig;
 205
 206         call_hooks(dec_hooks, expr, name, sym);
 207
 208         orig = get_state(my_id, name, sym);
 209         if (orig) {
 210                 set_state(my_id, name, sym, &ignore);
 211                 return;
 212         }
 213
 214         set_state(my_id, name, sym, &dec);
 215 }
 216
 217 static bool is_refcount_primitive(struct expression *expr)
 218 {
 219         int i;
 220
 221         while (expr->type == EXPR_ASSIGNMENT)
 222                 expr = strip_expr(expr->right);
 223         if (expr->type != EXPR_CALL)
 224                 return false;
 225
 226         if (expr->fn->type != EXPR_SYMBOL)
 227                 return false;
 228
 229         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 230                 if (sym_name_is(func_table[i].name, expr->fn))
 231                         return true;
 232         }
 233
 234         return false;
 235 }
 236
 237 static void match_atomic_add(struct expression *expr, const char *name, struct symbol *sym, void *_unused)
 238 {
 239         struct expression *amount;
 240         sval_t sval;
 241
 242         amount = get_argument_from_call_expr(expr->args, 0);
 243         if (!get_implied_value(amount, &sval)) {
 244                 do_inc(expr, name, sym);
 245                 return;
 246         }
 247
 248         if (sval.value == 0) {
 249                 set_state(my_id, name, sym, &ignore);
 250                 return;
 251         }
 252
 253         if (sval_is_positive(sval))
 254                 do_inc(expr, name, sym);
 255         else
 256                 do_dec(expr, name, sym);
 257 }
 258
 259 static void refcount_init(struct expression *expr, const char *name, struct symbol *sym, void *data)
 260 {
 261         if (!data && is_refcount_primitive(expr))
 262                 return;
 263         do_init(expr, name, sym);
 264 }
 265
 266 static void refcount_inc(struct expression *expr, const char *name, struct symbol *sym, void *data)
 267 {
 268         if (!data && is_refcount_primitive(expr))
 269                 return;
 270         do_inc(expr, name, sym);
 271 }
 272
 273 static void refcount_dec(struct expression *expr, const char *name, struct symbol *sym, void *data)
 274 {
 275         if (!data && is_refcount_primitive(expr))
 276                 return;
 277         do_dec(expr, name, sym);
 278 }
 279
 280 static void match_return_info(int return_id, char *return_ranges,
 281                                        struct expression *returned_expr,
 282                                        int param,
 283                                        const char *printed_name,
 284                                        struct sm_state *sm)
 285 {
 286         struct smatch_state *state;
 287         int type;
 288
 289         if (param == -1 && return_ranges && strcmp(return_ranges, "0") == 0)
 290                 return;
 291
 292         state = sm->state;
 293         if (state == &init)
 294                 type = REFCOUNT_INIT;
 295         else if (state == &inc)
 296                 type = REFCOUNT_INC;
 297         else if (state == &dec)
 298                 type = REFCOUNT_DEC;
 299         else
 300                 return;
 301
 302         sql_insert_return_states(return_id, return_ranges, type, param, printed_name, "");
 303 }
 304
 305 static void match_asm(struct statement *stmt)
 306 {
 307         struct expression *expr;
 308         struct asm_operand *op;
 309         struct symbol *sym;
 310         bool inc = false;
 311         char *macro;
 312         char *name;
 313
 314         macro = get_macro_name(stmt->pos);
 315         if (!macro)
 316                 return;
 317
 318         if (strcmp(macro, "this_cpu_inc") == 0)
 319                 inc = true;
 320         else if (strcmp(macro, "this_cpu_dec") != 0)
 321                 return;
 322
 323         op = first_ptr_list((struct ptr_list *)stmt->asm_outputs);
 324         if (!op)
 325                 return;
 326
 327         expr = strip_expr(op->expr);
 328         name = expr_to_var_sym(expr, &sym);
 329         if (!name || !sym)
 330                 return;
 331
 332         if (inc)
 333                 do_inc(expr, name, sym);
 334         else
 335                 do_dec(expr, name, sym);
 336 }
 337
 338 void check_refcount_info(int id)
 339 {
 340         struct ref_func_info *info;
 341         param_key_hook *cb;
 342         int i;
 343
 344         my_id = id;
 345
 346         if (option_project != PROJ_KERNEL)
 347                 return;
 348
 349         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 350                 info = &func_table[i];
 351
 352                 if (info->call_back)
 353                         cb = info->call_back;
 354                 else if (info->type == REFCOUNT_INIT)
 355                         cb = refcount_init;
 356                 else if (info->type == REFCOUNT_INC)
 357                         cb = refcount_inc;
 358                 else
 359                         cb = refcount_dec;
 360
 361                 if (info->implies_start) {
 362                         return_implies_param_key(info->name,
 363                                         *info->implies_start, *info->implies_end,
 364                                         cb, info->param, info->key, info);
 365                 } else {
 366                         add_function_param_key_hook(info->name, cb,
 367                                         info->param, info->key, info);
 368                 }
 369         }
 370
 371         add_merge_hook(my_id, &merge_states);
 372         add_return_info_callback(my_id, &match_return_info);
 373         add_hook(match_asm, ASM_HOOK);
 374
 375         select_return_param_key(REFCOUNT_INC, &refcount_inc);
 376         select_return_param_key(REFCOUNT_DEC, &refcount_dec);
 377
 378         add_unmatched_state_hook(my_id, &unmatched_state);
 379 }