smatch_refcount_info.c

   1 /*
   2  * Copyright (C) 2021 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * This is basically a copy for check_preempt_info.c but for refcount instead.
  20  */
  21
  22 #include "smatch.h"
  23 #include "smatch_extra.h"
  24 #include "smatch_slist.h"
  25
  26 static int my_id;
  27
  28 STATE(init);
  29 STATE(inc);
  30 STATE(dec);
  31 STATE(ignore);
  32 STATE(gone);
  33
  34 struct ref_func_info {
  35         const char *name;
  36         int type;
  37         int param;
  38         const char *key;
  39         const sval_t *implies_start, *implies_end;
  40         param_key_hook *call_back;
  41 };
  42
  43 static void match_atomic_add(struct expression *expr, const char *name, struct symbol *sym, void *_unused);
  44
  45 static struct ref_func_info func_table[] = {
  46         { "atomic_inc", REFCOUNT_INC, 0, "$->counter" },
  47         { "atomic_long_inc", REFCOUNT_INC, 0, "$->counter" },
  48         { "atomic64_inc", REFCOUNT_INC, 0, "$->counter" },
  49
  50         { "atomic_inc_return", REFCOUNT_INC, 0, "$->counter" },
  51         { "atomic_long_inc_return", REFCOUNT_INC, 0, "$->counter" },
  52         { "atomic64_return", REFCOUNT_INC, 0, "$->counter" },
  53
  54         { "atomic_add_return", REFCOUNT_INC, 1, "$->counter", NULL, NULL, match_atomic_add },
  55         { "atomic_long_add_return", REFCOUNT_INC, 1, "$->counter", NULL, NULL, match_atomic_add },
  56         { "atomic64_add_return", REFCOUNT_INC, 1, "$->counter", NULL, NULL, match_atomic_add },
  57
  58         { "atomic64_inc_not_zero", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  59         { "atomic64_fetch_add_unless", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  60         { "atomic64_add_unless", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  61         { "atomic64_add_unless_negative", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  62         { "atomic64_add_unless_positive", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  63
  64         // atomic64_dec_if_positive
  65         // atomic64_dec_unless_positive
  66
  67         { "atomic_dec", REFCOUNT_DEC, 0, "$->counter" },
  68         { "atomic_long_dec", REFCOUNT_DEC, 0, "$->counter" },
  69         { "atomic64_dec", REFCOUNT_DEC, 0, "$->counter" },
  70
  71         { "atomic_dec_return", REFCOUNT_DEC, 0, "$->counter" },
  72         { "atomic_long_dec_return", REFCOUNT_DEC, 0, "$->counter" },
  73         { "atomic64_dec_return", REFCOUNT_DEC, 0, "$->counter" },
  74
  75         { "atomic_dec_and_test", REFCOUNT_DEC, 0, "$->counter" },
  76         { "atomic_long_dec_and_test", REFCOUNT_DEC, 0, "$->counter" },
  77         { "atomic64_dec_and_test", REFCOUNT_DEC, 0, "$->counter" },
  78
  79         { "_atomic_dec_and_lock", REFCOUNT_DEC, 0, "$->counter" },
  80
  81         { "atomic_sub", REFCOUNT_DEC, 1, "$->counter" },
  82         { "atomic_long_sub", REFCOUNT_DEC, 1, "$->counter" },
  83         { "atomic64_sub", REFCOUNT_DEC, 1, "$->counter" },
  84
  85         { "atomic_sub_return", REFCOUNT_DEC, 1, "$->counter" },
  86         { "atomic_long_sub_return", REFCOUNT_DEC, 1, "$->counter" },
  87         { "atomic64_sub_return", REFCOUNT_DEC, 1, "$->counter" },
  88
  89         { "atomic_sub_and_test", REFCOUNT_DEC, 1, "$->counter" },
  90         { "atomic_long_sub_and_test", REFCOUNT_DEC, 1, "$->counter" },
  91         { "atomic64_sub_and_test", REFCOUNT_DEC, 1, "$->counter" },
  92
  93         { "register_device", REFCOUNT_INIT, 0, "$->kobj.kset->kobj.kref.refcount.refs.counter", &err_min, &err_max},
  94         { "register_device", REFCOUNT_INC, 0, "$->kobj.kset->kobj.kref.refcount.refs.counter", &int_zero, &int_zero},
  95         { "device_add", REFCOUNT_INC, 0, "$->kobj.kset->kobj.kref.refcount.refs.counter", &int_zero, &int_zero},
  96
  97         { "refcount_set", REFCOUNT_INIT, 0, "$->refs.counter" },
  98
  99         { "refcount_inc", REFCOUNT_INC, 0, "$->refs.counter" },
 100         { "refcount_dec", REFCOUNT_DEC, 0, "$->refs.counter" },
 101         { "refcount_dec_and_test", REFCOUNT_DEC, 0, "$->refs.counter" },
 102         { "refcount_add", REFCOUNT_INC, 1, "$->refs.counter" },
 103         { "refcount_sub_and_test", REFCOUNT_DEC, 1, "$->refs.counter" },
 104
 105         { "pm_runtime_get_sync", REFCOUNT_INC, 0, "$->power.usage_count.counter" },
 106
 107         { "refcount_inc_not_zero", REFCOUNT_INC, 0, "$->refs.counter", &int_one, &int_one},
 108         { "refcount_add_not_zero", REFCOUNT_INC, 1, "$->refs.counter", &int_one, &int_one},
 109
 110         { "atomic_dec_if_positive", REFCOUNT_DEC, 0, "$->counter", &int_zero, &int_max},
 111         { "atomic64_dec_if_positive", REFCOUNT_DEC, 0, "$->counter", &int_zero, &int_max},
 112
 113         { "of_node_get", REFCOUNT_INC, 0, "$->kobj.kref.refcount.refs.counter" },
 114         { "of_node_put", REFCOUNT_DEC, 0, "$->kobj.kref.refcount.refs.counter" },
 115         { "of_get_parent", REFCOUNT_INC, -1, "$->kobj.kref.refcount.refs.counter" },
 116         { "of_clk_del_provider", REFCOUNT_DEC, 0, "$->kobj.kref.refcount.refs.counter" },
 117
 118         { "kfree_skb", REFCOUNT_DEC, 0, "$->users.refs.counter" },
 119
 120         { "pci_get_dev_by_id", REFCOUNT_INC, -1, "$->dev.kobj.kref.refcount.refs.counter" },
 121         { "pci_get_dev_by_id", REFCOUNT_DEC,  1, "$->dev.kobj.kref.refcount.refs.counter" },
 122
 123         { "fget", REFCOUNT_INC, -1, "$->f_count.counter", &valid_ptr_min_sval, &valid_ptr_max_sval },
 124         { "sockfd_lookup", REFCOUNT_INC, -1, "$->file->f_count.counter", &valid_ptr_min_sval, &valid_ptr_max_sval },
 125         { "skb_get", REFCOUNT_INC, 0, "$->users.refs.counter", },
 126 //      { "fsnotify_put_mark", REFCOUNT_DEC, 0, "$->refcnt.refs.counter" },
 127
 128         { "dma_buf_put", REFCOUNT_DEC, 0, "$->file->f_count.counter" },
 129 };
 130
 131 static struct smatch_state *unmatched_state(struct sm_state *sm)
 132 {
 133         if (parent_is_null_var_sym(sm->name, sm->sym))
 134                 return &gone;
 135         return &undefined;
 136 }
 137
 138 static struct smatch_state *merge_states(struct smatch_state *s1, struct smatch_state *s2)
 139 {
 140         if (s1 == &gone)
 141                 return s2;
 142         if (s2 == &gone)
 143                 return s1;
 144         return &merged;
 145 }
 146
 147 static struct name_sym_fn_list *init_hooks, *inc_hooks, *dec_hooks;
 148
 149 void add_refcount_init_hook(name_sym_hook *hook)
 150 {
 151         add_ptr_list(&init_hooks, hook);
 152 }
 153
 154 void add_refcount_inc_hook(name_sym_hook *hook)
 155 {
 156         add_ptr_list(&inc_hooks, hook);
 157 }
 158
 159 void add_refcount_dec_hook(name_sym_hook *hook)
 160 {
 161         add_ptr_list(&dec_hooks, hook);
 162 }
 163
 164 void call_hooks(struct name_sym_fn_list *hooks, struct expression *expr,
 165                 const char *name, struct symbol *sym)
 166 {
 167         name_sym_hook *hook;
 168
 169         FOR_EACH_PTR(hooks, hook) {
 170                 hook(expr, name, sym);
 171         } END_FOR_EACH_PTR(hook);
 172 }
 173
 174 static void do_init(struct expression *expr, const char *name, struct symbol *sym)
 175 {
 176         struct smatch_state *orig;
 177
 178         call_hooks(init_hooks, expr, name, sym);
 179
 180         orig = get_state(my_id, name, sym);
 181         if (orig) {
 182                 set_state(my_id, name, sym, &ignore);
 183                 return;
 184         }
 185
 186         set_state(my_id, name, sym, &init);
 187 }
 188
 189 static void do_inc(struct expression *expr, const char *name, struct symbol *sym)
 190 {
 191         struct smatch_state *orig;
 192
 193         call_hooks(inc_hooks, expr, name, sym);
 194
 195         orig = get_state(my_id, name, sym);
 196         if (orig) {
 197                 set_state(my_id, name, sym, &ignore);
 198                 return;
 199         }
 200
 201         set_state(my_id, name, sym, &inc);
 202 }
 203
 204 static void do_dec(struct expression *expr, const char *name, struct symbol *sym)
 205 {
 206         struct smatch_state *orig;
 207
 208         call_hooks(dec_hooks, expr, name, sym);
 209
 210         orig = get_state(my_id, name, sym);
 211         if (orig) {
 212                 set_state(my_id, name, sym, &ignore);
 213                 return;
 214         }
 215
 216         set_state(my_id, name, sym, &dec);
 217 }
 218
 219 static bool is_refcount_primitive(struct expression *expr)
 220 {
 221         int i;
 222
 223         while (expr->type == EXPR_ASSIGNMENT)
 224                 expr = strip_expr(expr->right);
 225         if (expr->type != EXPR_CALL)
 226                 return false;
 227
 228         if (expr->fn->type != EXPR_SYMBOL)
 229                 return false;
 230
 231         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 232                 if (sym_name_is(func_table[i].name, expr->fn))
 233                         return true;
 234         }
 235
 236         return false;
 237 }
 238
 239 static void match_atomic_add(struct expression *expr, const char *name, struct symbol *sym, void *_unused)
 240 {
 241         struct expression *amount;
 242         sval_t sval;
 243
 244         amount = get_argument_from_call_expr(expr->args, 0);
 245         if (!get_implied_value(amount, &sval)) {
 246                 do_inc(expr, name, sym);
 247                 return;
 248         }
 249
 250         if (sval.value == 0) {
 251                 set_state(my_id, name, sym, &ignore);
 252                 return;
 253         }
 254
 255         if (sval_is_positive(sval))
 256                 do_inc(expr, name, sym);
 257         else
 258                 do_dec(expr, name, sym);
 259 }
 260
 261 static void refcount_init(struct expression *expr, const char *name, struct symbol *sym, void *data)
 262 {
 263         if (!data && is_refcount_primitive(expr))
 264                 return;
 265         do_init(expr, name, sym);
 266 }
 267
 268 static void refcount_inc(struct expression *expr, const char *name, struct symbol *sym, void *data)
 269 {
 270         if (!data && is_refcount_primitive(expr))
 271                 return;
 272         do_inc(expr, name, sym);
 273 }
 274
 275 static void refcount_dec(struct expression *expr, const char *name, struct symbol *sym, void *data)
 276 {
 277         if (!data && is_refcount_primitive(expr))
 278                 return;
 279         do_dec(expr, name, sym);
 280 }
 281
 282 static void match_return_info(int return_id, char *return_ranges,
 283                                        struct expression *returned_expr,
 284                                        int param,
 285                                        const char *printed_name,
 286                                        struct sm_state *sm)
 287 {
 288         struct smatch_state *state;
 289         int type;
 290
 291         if (param == -1 && return_ranges && strcmp(return_ranges, "0") == 0)
 292                 return;
 293
 294         state = sm->state;
 295         if (state == &init)
 296                 type = REFCOUNT_INIT;
 297         else if (state == &inc)
 298                 type = REFCOUNT_INC;
 299         else if (state == &dec)
 300                 type = REFCOUNT_DEC;
 301         else
 302                 return;
 303
 304         sql_insert_return_states(return_id, return_ranges, type, param, printed_name, "");
 305 }
 306
 307 static void match_asm(struct statement *stmt)
 308 {
 309         struct expression *expr;
 310         struct asm_operand *op;
 311         struct symbol *sym;
 312         bool inc = false;
 313         char *macro;
 314         char *name;
 315
 316         macro = get_macro_name(stmt->pos);
 317         if (!macro)
 318                 return;
 319
 320         if (strcmp(macro, "this_cpu_inc") == 0)
 321                 inc = true;
 322         else if (strcmp(macro, "this_cpu_dec") != 0)
 323                 return;
 324
 325         op = first_ptr_list((struct ptr_list *)stmt->asm_outputs);
 326         if (!op)
 327                 return;
 328
 329         expr = strip_expr(op->expr);
 330         name = expr_to_var_sym(expr, &sym);
 331         if (!name || !sym)
 332                 return;
 333
 334         if (inc)
 335                 do_inc(expr, name, sym);
 336         else
 337                 do_dec(expr, name, sym);
 338 }
 339
 340 void register_refcount_info(int id)
 341 {
 342         struct ref_func_info *info;
 343         param_key_hook *cb;
 344         int i;
 345
 346         my_id = id;
 347
 348         if (option_project != PROJ_KERNEL)
 349                 return;
 350
 351         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 352                 info = &func_table[i];
 353
 354                 if (info->call_back)
 355                         cb = info->call_back;
 356                 else if (info->type == REFCOUNT_INIT)
 357                         cb = refcount_init;
 358                 else if (info->type == REFCOUNT_INC)
 359                         cb = refcount_inc;
 360                 else
 361                         cb = refcount_dec;
 362
 363                 if (info->implies_start) {
 364                         return_implies_param_key(info->name,
 365                                         *info->implies_start, *info->implies_end,
 366                                         cb, info->param, info->key, info);
 367                 } else {
 368                         add_function_param_key_hook_late(info->name, cb,
 369                                         info->param, info->key, info);
 370                 }
 371         }
 372
 373         add_merge_hook(my_id, &merge_states);
 374         add_return_info_callback(my_id, &match_return_info);
 375         add_hook(match_asm, ASM_HOOK);
 376
 377         select_return_param_key(REFCOUNT_INC, &refcount_inc);
 378         select_return_param_key(REFCOUNT_DEC, &refcount_dec);
 379
 380         add_unmatched_state_hook(my_id, &unmatched_state);
 381 }