check_unwind.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * This is a kernel check to make sure we unwind everything on
  20  * on errors.
  21  *
  22  */
  23
  24 #include "smatch.h"
  25 #include "smatch_extra.h"
  26 #include "smatch_slist.h"
  27
  28 #define EBUSY 16
  29 #define MAX_ERRNO 4095
  30
  31 static int my_id;
  32
  33 STATE(allocated);
  34 STATE(unallocated);
  35
  36 /* state of unwind function */
  37 STATE(called);
  38
  39 static int was_passed_as_param(struct expression *expr)
  40 {
  41         char *name;
  42         struct symbol *sym;
  43         struct symbol *arg;
  44
  45         name = expr_to_var_sym(expr, &sym);
  46         if (!name)
  47                 return 0;
  48         free_string(name);
  49
  50         FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
  51                 if (arg == sym)
  52                         return 1;
  53         } END_FOR_EACH_PTR(arg);
  54         return 0;
  55 }
  56
  57 static void print_unwind_functions(const char *fn, struct expression *expr, void *_arg_no)
  58 {
  59         struct expression *arg_expr;
  60         int arg_no = PTR_INT(_arg_no);
  61         static struct symbol *last_printed = NULL;
  62
  63         arg_expr = get_argument_from_call_expr(expr->args, arg_no);
  64         if (!was_passed_as_param(arg_expr))
  65                 return;
  66         if (last_printed == cur_func_sym)
  67                 return;
  68         last_printed = cur_func_sym;
  69         sm_msg("info: is unwind function");
  70 }
  71
  72 static void request_granted(const char *fn, struct expression *call_expr,
  73                         struct expression *assign_expr, void *_arg_no)
  74 {
  75         struct expression *arg_expr;
  76         int arg_no = PTR_INT(_arg_no);
  77
  78         if (arg_no == -1) {
  79                 if (!assign_expr)
  80                         return;
  81                 arg_expr = assign_expr->left;
  82         } else {
  83                 arg_expr = get_argument_from_call_expr(call_expr->args, arg_no);
  84         }
  85         set_state_expr(my_id, arg_expr, &allocated);
  86 }
  87
  88 static void request_denied(const char *fn, struct expression *call_expr,
  89                         struct expression *assign_expr, void *_arg_no)
  90 {
  91         struct expression *arg_expr;
  92         int arg_no = PTR_INT(_arg_no);
  93
  94         if (arg_no == -1) {
  95                 if (!assign_expr)
  96                         return;
  97                 arg_expr = assign_expr->left;
  98         } else {
  99                 arg_expr = get_argument_from_call_expr(call_expr->args, arg_no);
 100         }
 101         set_state_expr(my_id, arg_expr, &unallocated);
 102 }
 103
 104 static void match_release(const char *fn, struct expression *expr, void *_arg_no)
 105 {
 106         struct expression *arg_expr;
 107         int arg_no = PTR_INT(_arg_no);
 108
 109         arg_expr = get_argument_from_call_expr(expr->args, arg_no);
 110         if (get_state_expr(my_id, arg_expr))
 111                 set_state_expr(my_id, arg_expr, &unallocated);
 112         set_equiv_state_expr(my_id, arg_expr, &unallocated);
 113 }
 114
 115 static void match_unwind_function(const char *fn, struct expression *expr, void *unused)
 116 {
 117         set_state(my_id, "unwind_function", NULL, &called);
 118 }
 119
 120 static int func_returns_int(void)
 121 {
 122         struct symbol *type;
 123
 124         type = get_base_type(cur_func_sym);
 125         if (!type || type->type != SYM_FN)
 126                 return 0;
 127         type = get_base_type(type);
 128         if (type->ctype.base_type == &int_type) {
 129                 return 1;
 130         }
 131         return 0;
 132 }
 133
 134 static void match_return(struct expression *ret_value)
 135 {
 136         struct stree *stree;
 137         struct sm_state *tmp;
 138         sval_t sval;
 139
 140         if (!func_returns_int())
 141                 return;
 142         if (get_value(ret_value, &sval) && sval_cmp_val(sval, 0) >= 0)
 143                 return;
 144         if (!implied_not_equal(ret_value, 0))
 145                 return;
 146         if (get_state(my_id, "unwind_function", NULL) == &called)
 147                 return;
 148
 149         stree = __get_cur_stree();
 150         FOR_EACH_MY_SM(my_id, stree, tmp) {
 151                 if (slist_has_state(tmp->possible, &allocated))
 152                         sm_msg("warn: '%s' was not released on error", tmp->name);
 153         } END_FOR_EACH_SM(tmp);
 154 }
 155
 156 static void register_unwind_functions(void)
 157 {
 158         struct token *token;
 159         const char *func;
 160
 161         token = get_tokens_file("kernel.unwind_functions");
 162         if (!token)
 163                 return;
 164         if (token_type(token) != TOKEN_STREAMBEGIN)
 165                 return;
 166         token = token->next;
 167         while (token_type(token) != TOKEN_STREAMEND) {
 168                 if (token_type(token) != TOKEN_IDENT)
 169                         return;
 170                 func = show_ident(token->ident);
 171                 add_function_hook(func, &match_unwind_function, NULL);
 172                 token = token->next;
 173         }
 174         clear_token_alloc();
 175 }
 176
 177 static void release_function_indicator(const char *name)
 178 {
 179         if (!option_info)
 180                 return;
 181         add_function_hook(name, &print_unwind_functions, INT_PTR(0));
 182 }
 183
 184 void check_unwind(int id)
 185 {
 186         if (option_project != PROJ_KERNEL || !option_spammy)
 187                 return;
 188         my_id = id;
 189
 190         register_unwind_functions();
 191
 192         return_implies_state("request_resource", 0, 0, &request_granted, INT_PTR(1));
 193         return_implies_state("request_resource", -EBUSY, -EBUSY, &request_denied, INT_PTR(1));
 194         add_function_hook("release_resource", &match_release, INT_PTR(0));
 195         release_function_indicator("release_resource");
 196
 197         return_implies_state("__request_region", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(1));
 198         return_implies_state("__request_region", 0, 0, &request_denied, INT_PTR(1));
 199         add_function_hook("__release_region", &match_release, INT_PTR(1));
 200         release_function_indicator("__release_region");
 201
 202         return_implies_state("ioremap", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(-1));
 203         return_implies_state("ioremap", 0, 0, &request_denied, INT_PTR(-1));
 204         add_function_hook("iounmap", &match_release, INT_PTR(0));
 205
 206         return_implies_state("pci_iomap", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(-1));
 207         return_implies_state("pci_iomap", 0, 0, &request_denied, INT_PTR(-1));
 208         add_function_hook("pci_iounmap", &match_release, INT_PTR(1));
 209         release_function_indicator("pci_iounmap");
 210
 211         return_implies_state("__create_workqueue_key", valid_ptr_min, valid_ptr_max, &request_granted,
 212                         INT_PTR(-1));
 213         return_implies_state("__create_workqueue_key", 0, 0, &request_denied, INT_PTR(-1));
 214         add_function_hook("destroy_workqueue", &match_release, INT_PTR(0));
 215
 216         return_implies_state("request_irq", 0, 0, &request_granted, INT_PTR(0));
 217         return_implies_state("request_irq", -MAX_ERRNO, -1, &request_denied, INT_PTR(0));
 218         add_function_hook("free_irq", &match_release, INT_PTR(0));
 219         release_function_indicator("free_irq");
 220
 221         return_implies_state("register_netdev", 0, 0, &request_granted, INT_PTR(0));
 222         return_implies_state("register_netdev", -MAX_ERRNO, -1, &request_denied, INT_PTR(0));
 223         add_function_hook("unregister_netdev", &match_release, INT_PTR(0));
 224         release_function_indicator("unregister_netdev");
 225
 226         return_implies_state("misc_register", 0, 0, &request_granted, INT_PTR(0));
 227         return_implies_state("misc_register", -MAX_ERRNO, -1, &request_denied, INT_PTR(0));
 228         add_function_hook("misc_deregister", &match_release, INT_PTR(0));
 229         release_function_indicator("misc_deregister");
 230
 231
 232         add_hook(&match_return, RETURN_HOOK);
 233 }