check_locking.c

   1 /*
   2  * sparse/check_locking.c
   3  *
   4  * Copyright (C) 2009 Dan Carpenter.
   5  *
   6  *  Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * This test checks that locks are held the same across all returns.
  12  *
  13  * Of course, some functions are designed to only hold the locks on success.
  14  * Oh well... We can rewrite it later if we want.
  15  *
  16  * The list of wine locking functions came from an earlier script written
  17  * by Michael Stefaniuc.
  18  *
  19  */
  20
  21 #include "parse.h"
  22 #include "smatch.h"
  23 #include "smatch_slist.h"
  24
  25 static int my_id;
  26
  27 STATE(locked);
  28 STATE(start_state);
  29 STATE(unlocked);
  30
  31 enum action {
  32         LOCK,
  33         UNLOCK,
  34 };
  35
  36 enum return_type {
  37         ret_any,
  38         ret_non_zero,
  39         ret_zero,
  40 };
  41
  42 #define RETURN_VAL -1
  43 #define NO_ARG -2
  44
  45 struct lock_info {
  46         const char *function;
  47         enum action action;
  48         const char *name;
  49         int arg;
  50         enum return_type return_type;
  51 };
  52
  53 static struct lock_info wine_lock_table[] = {
  54         {"create_window_handle", LOCK, "create_window_handle", RETURN_VAL, ret_non_zero},
  55         {"WIN_GetPtr", LOCK, "create_window_handle", RETURN_VAL, ret_non_zero},
  56         {"WIN_ReleasePtr", UNLOCK, "create_window_handle", 0, ret_any},
  57         {"EnterCriticalSection", LOCK, "CriticalSection", 0, ret_any},
  58         {"LeaveCriticalSection", UNLOCK, "CriticalSection", 0, ret_any},
  59         {"RtlEnterCriticalSection", LOCK, "RtlCriticalSection", 0, ret_any},
  60         {"RtlLeaveCriticalSection", UNLOCK, "RtlCriticalSection", 0, ret_any},
  61         {"GDI_GetObjPtr", LOCK, "GDI_Get", 0, ret_non_zero},
  62         {"GDI_ReleaseObj", UNLOCK, "GDI_Get", 0, ret_any},
  63         {"LdrLockLoaderLock", LOCK, "LdrLockLoaderLock", 2, ret_any},
  64         {"LdrUnlockLoaderLock", UNLOCK, "LdrLockLoaderLock", 1, ret_any},
  65         {"_lock", LOCK, "_lock", 0, ret_any},
  66         {"_unlock", UNLOCK, "_lock", 0, ret_any},
  67         {"msiobj_lock", LOCK, "msiobj_lock", 0, ret_any},
  68         {"msiobj_unlock", UNLOCK, "msiobj_lock", 0, ret_any},
  69         {"RtlAcquirePebLock", LOCK, "PebLock", NO_ARG, ret_any},
  70         {"RtlReleasePebLock", UNLOCK, "PebLock", NO_ARG, ret_any},
  71         {"server_enter_uninterrupted_section", LOCK, "server_uninterrupted_section", 0, ret_any},
  72         {"server_leave_uninterrupted_section", UNLOCK, "server_uninterrupted_section", 0, ret_any},
  73         {"RtlLockHeap", LOCK, "RtlLockHeap", 0, ret_any},
  74         {"RtlUnlockHeap", UNLOCK, "RtlLockHeap", 0, ret_any},
  75         {"_EnterSysLevel", LOCK, "SysLevel", 0, ret_any},
  76         {"_LeaveSysLevel", UNLOCK, "SysLevel", 0, ret_any},
  77         {"USER_Lock", LOCK, "USER_Lock", NO_ARG, ret_any},
  78         {"USER_Unlock", UNLOCK, "USER_Lock", NO_ARG, ret_any},
  79         {"wine_tsx11_lock", LOCK, "wine_tsx11_lock", NO_ARG, ret_any},
  80         {"wine_tsx11_unlock", UNLOCK, "wine_tsx11_lock", NO_ARG, ret_any},
  81         {"wine_tsx11_lock_ptr", LOCK, "wine_tsx11_lock_ptr", NO_ARG, ret_any},
  82         {"wine_tsx11_unlock_ptr", UNLOCK, "wine_tsx11_lock_ptr", NO_ARG, ret_any},
  83         {"wined3d_mutex_lock", LOCK, "wined3d_mutex_lock", NO_ARG, ret_any},
  84         {"wined3d_mutex_unlock", UNLOCK, "wined3d_mutex_lock", NO_ARG, ret_any},
  85         {"X11DRV_DIB_Lock", LOCK, "X11DRV_DIB_Lock", 0, ret_any},
  86         {"X11DRV_DIB_Unlock", UNLOCK, "X11DRV_DIB_Lock", 0, ret_any},
  87 };
  88
  89 static struct lock_info kernel_lock_table[] = {
  90         {"__raw_spin_lock", LOCK, "spin_lock", 0, ret_any},
  91         {"__raw_spin_unlock", UNLOCK, "spin_lock", 0, ret_any},
  92         {"__raw_spin_trylock", LOCK, "spin_lock", 0, ret_non_zero},
  93
  94         {"__spin_lock_nested", LOCK, "spin_lock", 0, ret_any},
  95         {"__spin_trylock", LOCK, "spin_lock", 0, ret_non_zero},
  96         {"__spin_lock", LOCK, "spin_lock", 0, ret_any},
  97         {"__spin_unlock", UNLOCK, "spin_lock", 0, ret_any},
  98
  99         {"__spin_lock_irqsave_nested", LOCK, "spin_lock", 0, ret_any},
 100         {"__spin_lock_irqsave", LOCK, "spin_lock", 0, ret_any},
 101         {"__spin_unlock_irqrestore", UNLOCK, "spin_lock", 0, ret_any},
 102         {"__spin_lock_irq", LOCK, "spin_lock", 0, ret_any},
 103         {"__spin_unlock_irq", UNLOCK, "spin_lock", 0, ret_any},
 104
 105         {"__spin_trylock_bh", LOCK, "spin_lock", 0, ret_non_zero},
 106         {"__spin_lock_bh", LOCK, "spin_lock", 0, ret_any},
 107         {"__spin_unlock_bh", UNLOCK, "spin_lock", 0, ret_any},
 108         {"__raw_read_trylock", LOCK, "read_lock", 0, ret_non_zero},
 109         {"__raw_read_trylock", LOCK, "read_lock", 0, ret_non_zero},
 110         {"__read_trylock", LOCK, "read_lock", 0, ret_non_zero},
 111         {"__read_lock", LOCK, "read_lock", 0, ret_any},
 112         {"__read_unlock", UNLOCK, "read_lock", 0, ret_any},
 113
 114         {"__read_lock_irqsave", LOCK, "read_lock", 0, ret_any},
 115         {"__read_unlock_irqrestore", UNLOCK, "read_lock", 0, ret_any},
 116         {"__read_lock_irq", LOCK, "read_lock", 0, ret_any},
 117         {"__read_unlock_irq", UNLOCK, "read_lock", 0, ret_any},
 118
 119         {"__read_lock_bh", LOCK, "read_lock", 0, ret_any},
 120         {"__read_unlock_bh", UNLOCK, "read_lock", 0, ret_any},
 121         {"__write_trylock", LOCK, "write_lock", 0, ret_non_zero},
 122         {"__raw_write_trylock", LOCK, "write_lock", 0, ret_non_zero},
 123         {"__raw_write_trylock", LOCK, "write_lock", 0, ret_non_zero},
 124         {"__write_lock", LOCK, "write_lock", 0, ret_any},
 125         {"__write_unlock", UNLOCK, "write_lock", 0, ret_any},
 126
 127         {"__write_lock_irqsave", LOCK, "write_lock", 0, ret_any},
 128         {"__write_unlock_irqrestore", UNLOCK, "write_lock", 0, ret_any},
 129         {"__write_lock_irq", LOCK, "write_lock", 0, ret_any},
 130         {"__write_unlock_irq", UNLOCK, "write_lock", 0, ret_any},
 131
 132         {"__write_lock_bh", LOCK, "write_lock", 0, ret_any},
 133         {"__write_unlock_bh", UNLOCK, "write_lock", 0, ret_any},
 134
 135         {"lock_kernel", LOCK, "BKL", NO_ARG, ret_any},
 136         {"unlock_kernel", UNLOCK, "BKL", NO_ARG, ret_any},
 137         {"_raw_spin_lock", LOCK, "spin_lock", 0, ret_any},
 138         {"_raw_spin_unlock", UNLOCK, "spin_lock", 0, ret_any},
 139         {"_raw_spin_trylock", LOCK, "spin_lock", 0, ret_non_zero},
 140         {"_spin_lock_nested", LOCK, "spin_lock", 0, ret_any},
 141         {"_spin_trylock", LOCK, "spin_lock", 0, ret_non_zero},
 142         {"_spin_lock", LOCK, "spin_lock", 0, ret_any},
 143         {"_spin_unlock", UNLOCK, "spin_lock", 0, ret_any},
 144
 145         {"_spin_lock_irqsave_nested", LOCK, "spin_lock", 0, ret_any},
 146         {"_spin_lock_irqsave", LOCK, "spin_lock", 0, ret_any},
 147         {"_spin_unlock_irqrestore", UNLOCK, "spin_lock", 0, ret_any},
 148         {"_spin_lock_irq", LOCK, "spin_lock", 0, ret_any},
 149         {"_spin_unlock_irq", UNLOCK, "spin_lock", 0, ret_any},
 150
 151         {"_spin_trylock_bh", LOCK, "spin_lock", 0, ret_non_zero},
 152         {"_spin_lock_bh", LOCK, "spin_lock", 0, ret_any},
 153         {"_spin_unlock_bh", UNLOCK, "spin_lock", 0, ret_any},
 154         {"generic__raw_read_trylock", LOCK, "read_lock", 0, ret_non_zero},
 155         {"_raw_read_trylock", LOCK, "read_lock", 0, ret_non_zero},
 156         {"_read_trylock", LOCK, "read_lock", 0, ret_non_zero},
 157         {"_read_lock", LOCK, "read_lock", 0, ret_any},
 158         {"_read_unlock", UNLOCK, "read_lock", 0, ret_any},
 159
 160         {"_read_lock_irqsave", LOCK, "read_lock", 0, ret_any},
 161         {"_read_unlock_irqrestore", UNLOCK, "read_lock", 0, ret_any},
 162         {"_read_lock_irq", LOCK, "read_lock", 0, ret_any},
 163         {"_read_unlock_irq", UNLOCK, "read_lock", 0, ret_any},
 164
 165         {"_read_lock_bh", LOCK, "read_lock", 0, ret_any},
 166         {"_read_unlock_bh", UNLOCK, "read_lock", 0, ret_any},
 167         {"_write_trylock", LOCK, "write_lock", 0, ret_non_zero},
 168         {"_raw_write_trylock", LOCK, "write_lock", 0, ret_non_zero},
 169         {"_write_lock", LOCK, "write_lock", 0, ret_any},
 170         {"_write_unlock", UNLOCK, "write_lock", 0, ret_any},
 171
 172         {"_write_lock_irqsave", LOCK, "write_lock", 0, ret_any},
 173         {"_write_unlock_irqrestore", UNLOCK, "write_lock", 0, ret_any},
 174         {"_write_lock_irq", LOCK, "write_lock", 0, ret_any},
 175         {"_write_unlock_irq", UNLOCK, "write_lock", 0, ret_any},
 176
 177         {"_write_lock_bh", LOCK, "write_lock", 0, ret_any},
 178         {"_write_unlock_bh", UNLOCK, "write_lock", 0, ret_any},
 179         {"down_trylock", LOCK, "sem", 0, ret_zero},
 180         {"down_interruptible", LOCK, "sem", 0, ret_zero},
 181         {"down", LOCK, "sem", 0, ret_any},
 182         {"up", UNLOCK, "sem", 0, ret_any},
 183         {"mutex_trylock", LOCK, "mutex", 0, ret_non_zero},
 184         {"mutex_lock_interruptible", LOCK, "mutex", 0, ret_zero},
 185         {"mutex_lock_interruptible_nested", LOCK, "mutex", 0, ret_zero},
 186         {"mutex_lock_killable", LOCK, "mutex", 0, ret_zero},
 187         {"mutex_lock_killable_nested", LOCK, "mutex", 0, ret_zero},
 188         {"mutex_lock", LOCK, "mutex", 0, ret_any},
 189         {"mutex_lock_nested", LOCK, "mutex", 0, ret_any},
 190         {"mutex_unlock", UNLOCK, "mutex", 0, ret_any},
 191
 192         {"raw_local_irq_disable", LOCK, "irq", NO_ARG, ret_any},
 193         {"__raw_local_irq_save", LOCK, "irqsave", RETURN_VAL, ret_any},
 194         {"raw_local_irq_restore", UNLOCK, "irqsave", 0, ret_any},
 195
 196         {"__spin_lock_irqsave_nested", LOCK, "irqsave", 1, ret_any},
 197         {"__spin_lock_irqsave", LOCK, "irqsave", 1, ret_any},
 198         {"__spin_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
 199         {"__spin_lock_irq", LOCK, "irq", NO_ARG, ret_any},
 200         {"__spin_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
 201
 202         {"__read_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
 203         {"__read_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
 204         {"__read_lock_irq", LOCK, "irq", NO_ARG, ret_any},
 205         {"__read_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
 206
 207         {"__write_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
 208         {"__write_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
 209         {"__write_lock_irq", LOCK, "irq", NO_ARG, ret_any},
 210         {"__write_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
 211
 212         {"_spin_lock_irqsave_nested", LOCK, "irqsave", RETURN_VAL, ret_any},
 213         {"_spin_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
 214         {"_spin_lock_irqsave", LOCK, "irqsave", 1, ret_any},
 215         {"_spin_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
 216         {"_spin_lock_irq", LOCK, "irq", NO_ARG, ret_any},
 217         {"_spin_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
 218
 219         {"_read_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
 220         {"_read_lock_irqsave", LOCK, "irqsave", 1, ret_any},
 221         {"_read_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
 222         {"_read_lock_irq", LOCK, "irq", NO_ARG, ret_any},
 223         {"_read_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
 224
 225         {"_write_lock_irqsave", LOCK, "irqsave", RETURN_VAL, ret_any},
 226         {"_write_lock_irqsave", LOCK, "irqsave", 1, ret_any},
 227         {"_write_unlock_irqrestore", UNLOCK, "irqsave", 1, ret_any},
 228         {"_write_lock_irq", LOCK, "irq", NO_ARG, ret_any},
 229         {"_write_unlock_irq", UNLOCK, "irq", NO_ARG, ret_any},
 230
 231         {"__spin_trylock_bh", LOCK, "bottom_half", NO_ARG, ret_non_zero},
 232         {"__spin_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
 233         {"__spin_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
 234         {"__read_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
 235         {"__read_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
 236         {"__write_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
 237         {"__write_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
 238         {"_spin_trylock_bh", LOCK, "bottom_half", NO_ARG, ret_non_zero},
 239         {"_spin_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
 240         {"_spin_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
 241         {"_read_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
 242         {"_read_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
 243         {"_write_lock_bh", LOCK, "bottom_half", NO_ARG, ret_any},
 244         {"_write_unlock_bh", UNLOCK, "bottom_half", NO_ARG, ret_any},
 245 };
 246
 247 static struct lock_info *lock_table;
 248
 249 static struct tracker_list *starts_locked;
 250 static struct tracker_list *starts_unlocked;
 251
 252 struct locks_on_return {
 253         int line;
 254         struct tracker_list *locked;
 255         struct tracker_list *unlocked;
 256 };
 257 DECLARE_PTR_LIST(return_list, struct locks_on_return);
 258 static struct return_list *all_returns;
 259
 260 static char *make_full_name(const char *lock, const char *var)
 261 {
 262         static char tmp_buf[512];
 263
 264         snprintf(tmp_buf, 512, "%s:%s", lock, var);
 265         tmp_buf[511] = '\0';
 266         return alloc_string(tmp_buf);
 267 }
 268
 269 static char *get_full_name(struct expression *expr, int index)
 270 {
 271         struct expression *arg;
 272         char *name = NULL;
 273         char *full_name = NULL;
 274         struct lock_info *lock = &lock_table[index];
 275
 276         if (lock->arg == RETURN_VAL) {
 277                 name = get_variable_from_expr(expr->left, NULL);
 278                 full_name = make_full_name(lock->name, name);
 279         } else if (lock->arg == NO_ARG) {
 280                 full_name = make_full_name(lock->name, "");
 281         } else {
 282                 arg = get_argument_from_call_expr(expr->args, lock->arg);
 283                 if (!arg)
 284                         goto free;
 285                 name = get_variable_from_expr(arg, NULL);
 286                 if (!name)
 287                         goto free;
 288                 full_name = make_full_name(lock->name, name);
 289         }
 290 free:
 291         free_string(name);
 292         return full_name;
 293 }
 294
 295 static struct smatch_state *get_start_state(struct sm_state *sm)
 296 {
 297        int is_locked = 0;
 298        int is_unlocked = 0;
 299
 300        if (in_tracker_list(starts_locked, my_id, sm->name, sm->sym))
 301                is_locked = 1;
 302        if (in_tracker_list(starts_unlocked, my_id, sm->name, sm->sym))
 303                is_unlocked = 1;
 304        if (is_locked && is_unlocked)
 305                return &undefined;
 306        if (is_locked)
 307                return &locked;
 308        if (is_unlocked)
 309                return &unlocked;
 310         return &undefined;
 311 }
 312
 313 static struct smatch_state *unmatched_state(struct sm_state *sm)
 314 {
 315         return &start_state;
 316 }
 317
 318 static void do_lock(const char *name)
 319 {
 320         struct sm_state *sm;
 321
 322         sm = get_sm_state(my_id, name, NULL);
 323         if (!sm)
 324                 add_tracker(&starts_unlocked, my_id, name, NULL);
 325         if (sm && slist_has_state(sm->possible, &locked))
 326                 sm_msg("error: double lock '%s'", name);
 327         set_state(my_id, name, NULL, &locked);
 328 }
 329
 330 static void do_lock_failed(const char *name)
 331 {
 332         struct sm_state *sm;
 333
 334         sm = get_sm_state(my_id, name, NULL);
 335         if (!sm)
 336                 add_tracker(&starts_unlocked, my_id, name, NULL);
 337         set_state(my_id, name, NULL, &unlocked);
 338 }
 339
 340 static void do_unlock(const char *name)
 341 {
 342         struct sm_state *sm;
 343
 344         sm = get_sm_state(my_id, name, NULL);
 345         if (!sm)
 346                 add_tracker(&starts_locked, my_id, name, NULL);
 347         if (sm && slist_has_state(sm->possible, &unlocked))
 348                 sm_msg("error: double unlock '%s'", name);
 349         set_state(my_id, name, NULL, &unlocked);
 350
 351 }
 352
 353 static void match_lock_held(const char *fn, struct expression *call_expr,
 354                         struct expression *assign_expr, void *_index)
 355 {
 356         int index = (int)_index;
 357         char *lock_name;
 358         struct lock_info *lock = &lock_table[index];
 359
 360         if (lock->arg == NO_ARG) {
 361                 lock_name = get_full_name(NULL, index);
 362         } else if (lock->arg == RETURN_VAL) {
 363                 if (!assign_expr)
 364                         return;
 365                 lock_name = get_full_name(assign_expr, index);
 366         } else {
 367                 lock_name = get_full_name(call_expr, index);
 368         }
 369         if (!lock_name)
 370                 return;
 371         do_lock(lock_name);
 372         free_string(lock_name);
 373 }
 374
 375 static void match_lock_failed(const char *fn, struct expression *call_expr,
 376                         struct expression *assign_expr, void *_index)
 377 {
 378         int index = (int)_index;
 379         char *lock_name;
 380         struct lock_info *lock = &lock_table[index];
 381
 382         if (lock->arg == NO_ARG) {
 383                 lock_name = get_full_name(NULL, index);
 384         } else if (lock->arg == RETURN_VAL) {
 385                 if (!assign_expr)
 386                         return;
 387                 lock_name = get_full_name(assign_expr, index);
 388         } else {
 389                 lock_name = get_full_name(call_expr, index);
 390         }
 391         if (!lock_name)
 392                 return;
 393         do_lock_failed(lock_name);
 394         free_string(lock_name);
 395 }
 396
 397 static void match_returns_locked(const char *fn, struct expression *expr,
 398                                       void *_index)
 399 {
 400         char *full_name = NULL;
 401         int index = (int)_index;
 402         struct lock_info *lock = &lock_table[index];
 403
 404         if (lock->arg != RETURN_VAL)
 405                 return;
 406         full_name = get_full_name(expr, index);
 407         do_lock(full_name);
 408 }
 409
 410 static void match_lock_unlock(const char *fn, struct expression *expr, void *_index)
 411 {
 412         char *full_name = NULL;
 413         int index = (int)_index;
 414         struct lock_info *lock = &lock_table[index];
 415
 416         full_name = get_full_name(expr, index);
 417         if (!full_name)
 418                 return;
 419         if (lock->action == LOCK)
 420                 do_lock(full_name);
 421         else
 422                 do_unlock(full_name);
 423         free_string(full_name);
 424 }
 425
 426 static struct locks_on_return *alloc_return(int line)
 427 {
 428         struct locks_on_return *ret;
 429
 430         ret = malloc(sizeof(*ret));
 431         ret->line = line;
 432         ret->locked = NULL;
 433         ret->unlocked = NULL;
 434         return ret;
 435 }
 436
 437 static void check_possible(struct sm_state *sm)
 438 {
 439         struct sm_state *tmp;
 440         int islocked = 0;
 441         int isunlocked = 0;
 442         int undef = 0;
 443
 444         FOR_EACH_PTR(sm->possible, tmp) {
 445                 if (tmp->state == &locked)
 446                         islocked = 1;
 447                 if (tmp->state == &unlocked)
 448                         isunlocked = 1;
 449                 if (tmp->state == &start_state) {
 450                         struct smatch_state *s;
 451
 452                         s = get_start_state(tmp);
 453                         if (s == &locked)
 454                                 islocked = 1;
 455                         else if (s == &unlocked)
 456                                 isunlocked = 1;
 457                         else
 458                                 undef = 1;
 459                 }
 460                 if (tmp->state == &undefined)
 461                         undef = 1;  // i don't think this is possible any more.
 462         } END_FOR_EACH_PTR(tmp);
 463         if ((islocked && isunlocked) || undef)
 464                 sm_msg("warn: '%s' is sometimes locked here and "
 465                            "sometimes unlocked.", sm->name);
 466 }
 467
 468 static void match_return(struct expression *ret_value)
 469 {
 470         struct locks_on_return *ret;
 471         struct state_list *slist;
 472         struct sm_state *tmp;
 473
 474         if (!final_pass)
 475                 return;
 476
 477         ret = alloc_return(get_lineno());
 478
 479         slist = get_all_states(my_id);
 480         FOR_EACH_PTR(slist, tmp) {
 481                 if (tmp->state == &locked) {
 482                         add_tracker(&ret->locked, tmp->owner, tmp->name,
 483                                 tmp->sym);
 484                 } else if (tmp->state == &unlocked) {
 485                         add_tracker(&ret->unlocked, tmp->owner, tmp->name,
 486                                 tmp->sym);
 487                 } else if (tmp->state == &start_state) {
 488                         struct smatch_state *s;
 489
 490                         s = get_start_state(tmp);
 491                         if (s == &locked)
 492                                 add_tracker(&ret->locked, tmp->owner, tmp->name,
 493                                             tmp->sym);
 494                         if (s == &unlocked)
 495                                 add_tracker(&ret->unlocked, tmp->owner,tmp->name,
 496                                              tmp->sym);
 497                 }else {
 498                         check_possible(tmp);
 499                 }
 500         } END_FOR_EACH_PTR(tmp);
 501         free_slist(&slist);
 502         add_ptr_list(&all_returns, ret);
 503 }
 504
 505 static void print_inconsistent_returns(struct tracker *lock,
 506                                 struct smatch_state *start)
 507 {
 508         struct locks_on_return *tmp;
 509         int i;
 510
 511         sm_printf("%s +%d %s(%d) ", get_filename(), get_lineno(), get_function(), get_func_pos());
 512         sm_printf("warn: inconsistent returns %s:", lock->name);
 513         sm_printf(" locked (");
 514         i = 0;
 515         FOR_EACH_PTR(all_returns, tmp) {
 516                 if (in_tracker_list(tmp->unlocked, lock->owner, lock->name, lock->sym))
 517                         continue;
 518                 if (in_tracker_list(tmp->locked, lock->owner, lock->name, lock->sym)) {
 519                         if (i++)
 520                                 sm_printf(",");
 521                         sm_printf("%d", tmp->line);
 522                         continue;
 523                 }
 524                 if (start == &locked) {
 525                         if (i++)
 526                                 sm_printf(",");
 527                         sm_printf("%d", tmp->line);
 528                 }
 529         } END_FOR_EACH_PTR(tmp);
 530
 531         sm_printf(") unlocked (");
 532         i = 0;
 533         FOR_EACH_PTR(all_returns, tmp) {
 534                 if (in_tracker_list(tmp->unlocked, lock->owner, lock->name, lock->sym)) {
 535                         if (i++)
 536                                 sm_printf(",");
 537                         sm_printf("%d", tmp->line);
 538                         continue;
 539                 }
 540                 if (in_tracker_list(tmp->locked, lock->owner, lock->name, lock->sym)) {
 541                         continue;
 542                 }
 543                 if (start == &unlocked) {
 544                         if (i++)
 545                                 sm_printf(",");
 546                         sm_printf("%d", tmp->line);
 547                 }
 548         } END_FOR_EACH_PTR(tmp);
 549         sm_printf(")\n");
 550 }
 551
 552 static void check_returns_consistently(struct tracker *lock,
 553                                 struct smatch_state *start)
 554 {
 555         int returns_locked = 0;
 556         int returns_unlocked = 0;
 557         struct locks_on_return *tmp;
 558
 559         FOR_EACH_PTR(all_returns, tmp) {
 560                 if (in_tracker_list(tmp->unlocked, lock->owner, lock->name,
 561                                         lock->sym))
 562                         returns_unlocked = tmp->line;
 563                 else if (in_tracker_list(tmp->locked, lock->owner, lock->name,
 564                                                 lock->sym))
 565                         returns_locked = tmp->line;
 566                 else if (start == &locked)
 567                         returns_locked = tmp->line;
 568                 else if (start == &unlocked)
 569                         returns_unlocked = tmp->line;
 570         } END_FOR_EACH_PTR(tmp);
 571
 572         if (returns_locked && returns_unlocked)
 573                 print_inconsistent_returns(lock, start);
 574 }
 575
 576 static void check_consistency(struct symbol *sym)
 577 {
 578         struct tracker *tmp;
 579
 580         if (is_reachable())
 581                 match_return(NULL);
 582
 583         FOR_EACH_PTR(starts_locked, tmp) {
 584                 if (in_tracker_list(starts_unlocked, tmp->owner, tmp->name,
 585                                         tmp->sym))
 586                         sm_msg("error:  locking inconsistency.  We assume "
 587                                    "'%s' is both locked and unlocked at the "
 588                                    "start.",
 589                                 tmp->name);
 590         } END_FOR_EACH_PTR(tmp);
 591
 592         FOR_EACH_PTR(starts_locked, tmp) {
 593                 check_returns_consistently(tmp, &locked);
 594         } END_FOR_EACH_PTR(tmp);
 595
 596         FOR_EACH_PTR(starts_unlocked, tmp) {
 597                 check_returns_consistently(tmp, &unlocked);
 598         } END_FOR_EACH_PTR(tmp);
 599
 600 }
 601
 602 static void clear_lists(void)
 603 {
 604         struct locks_on_return *tmp;
 605
 606         free_trackers_and_list(&starts_locked);
 607         free_trackers_and_list(&starts_unlocked);
 608
 609         FOR_EACH_PTR(all_returns, tmp) {
 610                 free_trackers_and_list(&tmp->locked);
 611                 free_trackers_and_list(&tmp->unlocked);
 612                 free(tmp);
 613         } END_FOR_EACH_PTR(tmp);
 614         __free_ptr_list((struct ptr_list **)&all_returns);
 615 }
 616
 617 static void match_func_end(struct symbol *sym)
 618 {
 619         check_consistency(sym);
 620         clear_lists();
 621 }
 622
 623 static void register_lock(int index)
 624 {
 625         struct lock_info *lock = &lock_table[index];
 626         void *idx = (void *)index;
 627
 628         if (lock->return_type == ret_non_zero) {
 629                 return_implies_state(lock->function, 1, POINTER_MAX, &match_lock_held, idx);
 630                 return_implies_state(lock->function, 0, 0, &match_lock_failed, idx);
 631         } else if (lock->return_type == ret_any && lock->arg == RETURN_VAL) {
 632                 add_function_assign_hook(lock->function, &match_returns_locked, idx);
 633         } else if (lock->return_type == ret_any) {
 634                 add_function_hook(lock->function, &match_lock_unlock, idx);
 635         } else if (lock->return_type == ret_zero) {
 636                 return_implies_state(lock->function, 0, 0, &match_lock_held, idx);
 637                 return_implies_state(lock->function, whole_range.min, -1, &match_lock_failed, idx);
 638         }
 639 }
 640
 641 static void load_table(struct lock_info *_lock_table, int size)
 642 {
 643         int i;
 644
 645         lock_table = _lock_table;
 646
 647         for (i = 0; i < size; i++) {
 648                 if (lock_table[i].action == LOCK)
 649                         register_lock(i);
 650                 else
 651                         add_function_hook(lock_table[i].function, &match_lock_unlock, (void *)i);
 652         }
 653 }
 654
 655 void check_locking(int id)
 656 {
 657         my_id = id;
 658
 659         if (option_project == PROJ_WINE)
 660                 load_table(wine_lock_table, ARRAY_SIZE(wine_lock_table));
 661         else if (option_project == PROJ_KERNEL)
 662                 load_table(kernel_lock_table, ARRAY_SIZE(kernel_lock_table));
 663         else
 664                 return;
 665
 666         add_unmatched_state_hook(my_id, &unmatched_state);
 667         add_hook(&match_return, RETURN_HOOK);
 668         add_hook(&match_func_end, END_FUNC_HOOK);
 669 }