2 * sparse/check_memory.c
4 * Copyright (C) 2008 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
14 #include "smatch_slist.h"
26 malloced --> allocated --> assigned --> isfree +
27 \-> isnull. \-> isfree +
33 static struct tracker_list
*arguments
;
35 static const char *allocation_funcs
[] = {
42 static char *get_parent_name(struct symbol
*sym
)
46 if (!sym
|| !sym
->ident
)
49 snprintf(buf
, 255, "-%s", sym
->ident
->name
);
51 return alloc_string(buf
);
54 static int is_parent_sym(const char *name
)
56 if (!strncmp(name
, "-", 1))
61 static struct smatch_state
*unmatched_state(struct sm_state
*sm
)
63 if (is_parent_sym(sm
->name
))
68 static void assign_parent(struct symbol
*sym
)
72 name
= get_parent_name(sym
);
75 set_state(my_id
, name
, sym
, &assigned
);
79 static int parent_is_assigned(struct symbol
*sym
)
81 struct smatch_state
*state
;
84 name
= get_parent_name(sym
);
87 state
= get_state(my_id
, name
, sym
);
89 if (state
== &assigned
)
94 static int is_allocation(struct expression
*expr
)
99 if (expr
->type
!= EXPR_CALL
)
102 if (!(fn_name
= get_variable_from_expr(expr
->fn
, NULL
)))
105 for (i
= 0; allocation_funcs
[i
]; i
++) {
106 if (!strcmp(fn_name
, allocation_funcs
[i
])) {
107 free_string(fn_name
);
111 free_string(fn_name
);
115 static int is_freed(const char *name
, struct symbol
*sym
)
117 struct state_list
*slist
;
119 slist
= get_possible_states(my_id
, name
, sym
);
120 if (slist_has_state(slist
, &isfree
)) {
126 static int is_argument(struct symbol
*sym
)
130 FOR_EACH_PTR(arguments
, arg
) {
133 } END_FOR_EACH_PTR(arg
);
137 static void match_function_def(struct symbol
*sym
)
141 FOR_EACH_PTR(sym
->ctype
.base_type
->arguments
, arg
) {
142 add_tracker(&arguments
, my_id
, (arg
->ident
?arg
->ident
->name
:"NULL"), arg
);
143 } END_FOR_EACH_PTR(arg
);
146 static int is_parent(struct expression
*expr
)
148 if (expr
->type
== EXPR_DEREF
)
153 static void match_assign(struct expression
*expr
)
155 struct expression
*left
, *right
;
156 char *left_name
= NULL
;
157 char *right_name
= NULL
;
158 struct symbol
*left_sym
, *right_sym
;
159 struct smatch_state
*state
;
161 left
= strip_expr(expr
->left
);
162 left_name
= get_variable_from_expr_complex(left
, &left_sym
);
164 right
= strip_expr(expr
->right
);
165 if (left_name
&& left_sym
&& is_allocation(right
) &&
166 !(left_sym
->ctype
.modifiers
&
167 (MOD_NONLOCAL
| MOD_STATIC
| MOD_ADDRESSABLE
)) &&
168 !parent_is_assigned(left_sym
)) {
169 set_state(my_id
, left_name
, left_sym
, &malloced
);
173 right_name
= get_variable_from_expr_complex(right
, &right_sym
);
175 if (right_name
&& (state
= get_state(my_id
, right_name
, right_sym
))) {
176 if (state
== &isfree
)
177 sm_msg("error: assigning freed pointer");
178 set_state(my_id
, right_name
, right_sym
, &assigned
);
181 if (is_freed(left_name
, left_sym
)) {
182 set_state(my_id
, left_name
, left_sym
, &unfree
);
184 if (left_name
&& is_parent(left
))
185 assign_parent(left_sym
);
186 if (right_name
&& is_parent(right
))
187 assign_parent(right_sym
);
189 free_string(left_name
);
190 free_string(right_name
);
193 static int is_null(const char *name
, struct symbol
*sym
)
195 struct smatch_state
*state
;
197 state
= get_state(my_id
, name
, sym
);
198 if (state
&& !strcmp(state
->name
, "isnull"))
203 static void match_free_func(const char *fn
, struct expression
*expr
, void *data
)
205 struct expression
*ptr_expr
;
207 struct symbol
*ptr_sym
;
208 int arg_num
= PTR_INT(data
);
210 ptr_expr
= get_argument_from_call_expr(expr
->args
, arg_num
);
211 ptr_name
= get_variable_from_expr_complex(ptr_expr
, &ptr_sym
);
212 if (is_freed(ptr_name
, ptr_sym
) && !is_null(ptr_name
, ptr_sym
)) {
213 sm_msg("error: double free of %s", ptr_name
);
215 set_state(my_id
, ptr_name
, ptr_sym
, &isfree
);
216 free_string(ptr_name
);
219 static int possibly_allocated(struct state_list
*slist
)
221 struct sm_state
*tmp
;
223 FOR_EACH_PTR(slist
, tmp
) {
224 if (tmp
->state
== &allocated
)
226 if (tmp
->state
== &malloced
)
228 } END_FOR_EACH_PTR(tmp
);
232 static void check_sm_is_leaked(struct sm_state
*sm
)
234 if (possibly_allocated(sm
->possible
) &&
235 !is_null(sm
->name
, sm
->sym
) &&
236 !is_argument(sm
->sym
) &&
237 !parent_is_assigned(sm
->sym
))
238 sm_msg("error: memery leak of %s", sm
->name
);
241 static void check_tracker_is_leaked(struct tracker
*t
)
245 sm
= get_sm_state(t
->owner
, t
->name
, t
->sym
);
247 check_sm_is_leaked(sm
);
251 static void match_declarations(struct symbol
*sym
)
255 if ((get_base_type(sym
))->type
== SYM_ARRAY
) {
259 name
= sym
->ident
->name
;
261 if (sym
->initializer
) {
262 if (is_allocation(sym
->initializer
)) {
263 set_state(my_id
, name
, sym
, &malloced
);
264 add_scope_hook((scope_hook
*)&check_tracker_is_leaked
,
265 alloc_tracker(my_id
, name
, sym
));
266 scoped_state(name
, my_id
, sym
);
273 static void check_for_allocated(void)
275 struct state_list
*slist
;
276 struct sm_state
*tmp
;
278 slist
= get_all_states(my_id
);
279 FOR_EACH_PTR(slist
, tmp
) {
280 check_sm_is_leaked(tmp
);
281 } END_FOR_EACH_PTR(tmp
);
285 static void match_return(struct expression
*ret_value
)
290 name
= get_variable_from_expr_complex(ret_value
, &sym
);
294 check_for_allocated();
297 static void set_new_true_false_paths(const char *name
, struct symbol
*sym
)
299 struct smatch_state
*tmp
;
301 tmp
= get_state(my_id
, name
, sym
);
307 if (tmp
== &isfree
) {
308 sm_msg("warn: why do you care about freed memory?");
311 if (tmp
== &assigned
) {
312 /* we don't care about assigned pointers any more */
315 set_true_false_states(my_id
, name
, sym
, &allocated
, &isnull
);
318 static void match_condition(struct expression
*expr
)
323 expr
= strip_expr(expr
);
328 name
= get_variable_from_expr_complex(expr
, &sym
);
331 set_new_true_false_paths(name
, sym
);
334 case EXPR_ASSIGNMENT
:
335 /* You have to deal with stuff like if (a = b = c) */
336 match_condition(expr
->right
);
337 match_condition(expr
->left
);
344 static void match_function_call(struct expression
*expr
)
346 struct expression
*tmp
;
349 struct sm_state
*state
;
351 FOR_EACH_PTR(expr
->args
, tmp
) {
352 tmp
= strip_expr(tmp
);
353 name
= get_variable_from_expr_complex(tmp
, &sym
);
356 if ((state
= get_sm_state(my_id
, name
, sym
))) {
357 if (possibly_allocated(state
->possible
)) {
358 set_state(my_id
, name
, sym
, &assigned
);
363 } END_FOR_EACH_PTR(tmp
);
366 static void match_dereferences(struct expression
*expr
)
369 struct symbol
*sym
= NULL
;
371 deref
= get_variable_from_expr(expr
->deref
->unop
, &sym
);
374 if (is_freed(deref
, sym
)) {
375 sm_msg("error: dereferencing freed memory '%s'", deref
);
376 set_state(my_id
, deref
, sym
, &unfree
);
381 static void match_end_func(struct symbol
*sym
)
383 check_for_allocated();
384 free_trackers_and_list(&arguments
);
387 static void register_funcs_from_file(void)
393 token
= get_tokens_file("kernel.frees_argument");
396 if (token_type(token
) != TOKEN_STREAMBEGIN
)
399 while (token_type(token
) != TOKEN_STREAMEND
) {
400 if (token_type(token
) != TOKEN_IDENT
)
402 func
= show_ident(token
->ident
);
404 if (token_type(token
) != TOKEN_NUMBER
)
406 arg
= atoi(token
->number
);
407 add_function_hook(func
, &match_free_func
, INT_PTR(arg
));
413 void check_memory(int id
)
416 add_unmatched_state_hook(my_id
, &unmatched_state
);
417 add_hook(&match_function_def
, FUNC_DEF_HOOK
);
418 add_hook(&match_declarations
, DECLARATION_HOOK
);
419 add_hook(&match_function_call
, FUNCTION_CALL_HOOK
);
420 add_hook(&match_condition
, CONDITION_HOOK
);
421 add_hook(&match_dereferences
, DEREF_HOOK
);
422 add_hook(&match_assign
, ASSIGNMENT_HOOK
);
423 add_hook(&match_return
, RETURN_HOOK
);
424 add_hook(&match_end_func
, END_FUNC_HOOK
);
425 add_function_hook("kfree", &match_free_func
, (void *)0);
426 register_funcs_from_file();