check_unwind.c

   1 /*
   2  * Copyright (C) 2020 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include <ctype.h>
  19
  20 #include "smatch.h"
  21 #include "smatch_extra.h"
  22 #include "smatch_slist.h"
  23
  24 static int my_id;
  25
  26 STATE(alloc);
  27 STATE(release);
  28 STATE(param_released);
  29 STATE(ignore);
  30
  31 static unsigned long fn_has_alloc;
  32
  33 struct ref_func_info {
  34         const char *name;
  35         int type;
  36         int param;
  37         const char *key;
  38         const sval_t *implies_start, *implies_end;
  39         func_hook *call_back;
  40 };
  41
  42 static sval_t zero_sval = { .type = &int_ctype };
  43
  44 static struct ref_func_info func_table[] = {
  45         { "clk_prepare_enable",    ALLOC, 0, "$", &zero_sval, &zero_sval },
  46         { "clk_disable_unprepare", RELEASE, 0, "$" },
  47
  48         { "alloc_etherdev_mqs", ALLOC, -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  49         { "free_netdev", RELEASE, 0, "$" },
  50
  51         /*
  52          * FIXME: A common pattern in release functions like amd76xrom_cleanup()
  53          * is to do:
  54          *
  55          *      if (window->rsrc.parent)
  56          *              release_resource(&window->rsrc);
  57          *
  58          * Which is slightly tricky to know how to merge the states so let's
  59          * hold off checking request_resource() for now.
  60          *
  61          * { "request_resource", ALLOC,   1, "$", &zero_sval, &zero_sval },
  62          * { "release_resource", RELEASE, 0, "$" },
  63          *
  64          */
  65
  66         { "pci_request_regions", ALLOC,   0, "$", &zero_sval, &zero_sval },
  67         { "pci_release_regions", RELEASE, 0, "$" },
  68
  69         { "request_free_mem_region", ALLOC,   -1, "$->start", &valid_ptr_min_sval, &valid_ptr_max_sval },
  70         { "__request_region", ALLOC,   1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  71         { "__release_region", RELEASE, 1, "$" },
  72
  73         { "ioremap", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  74         { "of_iomap", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  75         { "ioremap_encrypted", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  76         { "iounmap", RELEASE, 0, "$" },
  77
  78         { "request_threaded_irq", ALLOC,   0, "$", &zero_sval, &zero_sval },
  79         { "request_irq", ALLOC,   0, "$", &zero_sval, &zero_sval },
  80         { "free_irq",    RELEASE, 0, "$" },
  81         { "pci_request_irq", ALLOC,   1, "$", &zero_sval, &zero_sval },
  82         { "pci_free_irq",    RELEASE, 1, "$" },
  83
  84         { "register_netdev",   ALLOC,   0, "$", &zero_sval, &zero_sval },
  85         { "unregister_netdev", RELEASE, 0, "$" },
  86
  87         { "misc_register",   ALLOC,   0, "$", &zero_sval, &zero_sval },
  88         { "misc_deregister", RELEASE, 0, "$" },
  89
  90         { "ieee80211_alloc_hw", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  91         { "ieee80211_free_hw",  RELEASE, 0, "$" },
  92 };
  93
  94 struct smatch_state *unmatched_state(struct sm_state *sm)
  95 {
  96         struct smatch_state *state;
  97
  98         if (sm->state != &param_released)
  99                 return &undefined;
 100
 101         if (is_impossible_path())
 102                 return &param_released;
 103
 104         state = get_state(SMATCH_EXTRA, sm->name, sm->sym);
 105         if (!state)
 106                 return &undefined;
 107         if (!estate_rl(state) || is_err_or_null(estate_rl(state)))
 108                 return &param_released;
 109         if (parent_is_err_or_null_var_sym(sm->name, sm->sym))
 110                 return &param_released;
 111
 112          return &undefined;
 113 }
 114
 115 static struct sm_state *get_start_sm(const char *name, struct symbol *sym)
 116 {
 117         struct sm_state *sm;
 118
 119         sm = get_sm_state(my_id, name, sym);
 120         if (sm)
 121                 return sm;
 122
 123         FOR_EACH_MY_SM(my_id, __get_cur_stree(), sm) {
 124                 if (get_comparison_strings(name, sm->name) == SPECIAL_EQUAL)
 125                         return sm;
 126         } END_FOR_EACH_SM(sm);
 127
 128         return NULL;
 129 }
 130
 131 static bool is_param_var_sym(const char *name, struct symbol *sym)
 132 {
 133         const char *key;
 134
 135         return get_param_key_from_var_sym(name, sym, NULL, &key) >= 0;
 136 }
 137
 138 static void mark_matches_as_undefined(const char *key)
 139 {
 140         struct sm_state *sm;
 141         int start_pos, state_len, key_len;
 142         char *p;
 143
 144         while ((p = strchr(key, '-'))) {
 145                 if (p[1] != '>')
 146                         return;
 147                 key = p + 2;
 148         }
 149         key_len = strlen(key);
 150
 151         FOR_EACH_MY_SM(my_id, __get_cur_stree(), sm) {
 152                 state_len = strlen(sm->name);
 153                 if (state_len < key_len)
 154                         continue;
 155                 if (!slist_has_state(sm->possible, &alloc))
 156                         continue;
 157
 158                 start_pos = state_len - key_len;
 159                 if ((start_pos == 0 || !isalnum(sm->name[start_pos - 1])) &&
 160                     strcmp(sm->name + start_pos, key) == 0)
 161                         set_state(my_id, sm->name, sm->sym, &undefined);
 162
 163         } END_FOR_EACH_SM(sm);
 164 }
 165
 166 static bool is_alloc_primitive(struct expression *expr)
 167 {
 168         int i;
 169
 170         while (expr->type == EXPR_ASSIGNMENT)
 171                 expr = strip_expr(expr->right);
 172         if (expr->type != EXPR_CALL)
 173                 return false;
 174
 175         if (expr->fn->type != EXPR_SYMBOL)
 176                 return false;
 177
 178         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 179                 if (sym_name_is(func_table[i].name, expr->fn))
 180                         return true;
 181         }
 182
 183         return false;
 184 }
 185
 186 static void return_param_alloc(struct expression *expr, const char *name, struct symbol *sym, void *data)
 187 {
 188         fn_has_alloc = true;
 189         set_state(my_id, name, sym, &alloc);
 190 }
 191
 192 static void return_param_release(struct expression *expr, const char *name, struct symbol *sym, void *data)
 193 {
 194         struct sm_state *start_sm;
 195
 196         /* The !data means this comes from the DB (not hard coded). */
 197         if (!data && is_alloc_primitive(expr))
 198                 return;
 199
 200         start_sm = get_start_sm(name, sym);
 201         if (!start_sm) {
 202                 if (fn_has_alloc) {
 203                         mark_matches_as_undefined(name);
 204                         return;
 205                 }
 206                 if (is_param_var_sym(name, sym))
 207                         set_state(my_id, name, sym, &param_released);
 208                 return;
 209         }
 210
 211         if (start_sm)
 212                 set_state(my_id, start_sm->name, start_sm->sym, &release);
 213         else
 214                 set_state(my_id, name, sym, &release);
 215 }
 216
 217 static void ignore_path(const char *fn, struct expression *expr, void *data)
 218 {
 219         set_state(my_id, "path", NULL, &ignore);
 220 }
 221
 222 static void match_return_info(int return_id, char *return_ranges, struct expression *expr)
 223 {
 224         struct sm_state *sm;
 225         const char *param_name;
 226         int param;
 227
 228         if (is_impossible_path())
 229                 return;
 230
 231         FOR_EACH_MY_SM(my_id, __get_cur_stree(), sm) {
 232                 if (sm->state != &param_released)
 233                         continue;
 234                 param = get_param_key_from_sm(sm, expr, &param_name);
 235                 if (param < 0)
 236                         continue;
 237                 sql_insert_return_states(return_id, return_ranges, RELEASE,
 238                                          param, param_name, "");
 239         } END_FOR_EACH_SM(sm);
 240 }
 241
 242 enum {
 243         UNKNOWN, FAIL, SUCCESS, NUM_BUCKETS
 244 };
 245
 246 static int success_fail_positive(struct range_list *rl)
 247 {
 248         if (!rl)
 249                 return UNKNOWN;
 250
 251         if (sval_is_negative(rl_min(rl)) && sval_is_negative(rl_max(rl)))
 252                 return FAIL;
 253
 254         if (rl_min(rl).value == 0)
 255                 return SUCCESS;
 256
 257         return UNKNOWN;
 258 }
 259
 260 static void check_balance(const char *name, struct symbol *sym)
 261 {
 262         struct range_list *inc_lines = NULL;
 263         int inc_buckets[NUM_BUCKETS] = {};
 264         struct stree *stree, *orig_stree;
 265         struct smatch_state *state;
 266         struct sm_state *return_sm;
 267         struct sm_state *sm;
 268         sval_t line = sval_type_val(&int_ctype, 0);
 269         int bucket;
 270
 271         FOR_EACH_PTR(get_all_return_strees(), stree) {
 272                 orig_stree = __swap_cur_stree(stree);
 273
 274                 if (is_impossible_path())
 275                         goto swap_stree;
 276                 if (db_incomplete())
 277                         goto swap_stree;
 278                 if (get_state(my_id, "path", NULL) == &ignore)
 279                         goto swap_stree;
 280
 281                 return_sm = get_sm_state(RETURN_ID, "return_ranges", NULL);
 282                 if (!return_sm)
 283                         goto swap_stree;
 284                 line.value = return_sm->line;
 285
 286                 sm = get_sm_state(my_id, name, sym);
 287                 if (!sm)
 288                         goto swap_stree;
 289
 290                 state = sm->state;
 291                 if (state == &param_released)
 292                         state = &release;
 293
 294                 if (state != &alloc &&
 295                     state != &release)
 296                         goto swap_stree;
 297
 298                 bucket = success_fail_positive(estate_rl(return_sm->state));
 299                 if (bucket != FAIL)
 300                         goto swap_stree;
 301
 302                 if (state == &alloc) {
 303                         add_range(&inc_lines, line, line);
 304                         inc_buckets[bucket] = true;
 305                 }
 306 swap_stree:
 307                 __swap_cur_stree(orig_stree);
 308         } END_FOR_EACH_PTR(stree);
 309
 310         if (inc_buckets[FAIL])
 311                 goto complain;
 312
 313         return;
 314
 315 complain:
 316         sm_warning("'%s' not released on lines: %s.", name, show_rl(inc_lines));
 317 }
 318
 319 static void match_check_balanced(struct symbol *sym)
 320 {
 321         struct sm_state *sm;
 322
 323         FOR_EACH_MY_SM(my_id, get_all_return_states(), sm) {
 324                 if (sm->sym == NULL && strcmp(sm->name, "path") == 0)
 325                         continue;
 326                 check_balance(sm->name, sm->sym);
 327         } END_FOR_EACH_SM(sm);
 328 }
 329
 330 void check_unwind(int id)
 331 {
 332         struct ref_func_info *info;
 333         int i;
 334
 335         my_id = id;
 336
 337         if (option_project != PROJ_KERNEL)
 338                 return;
 339
 340         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 341                 info = &func_table[i];
 342
 343                 if (info->call_back) {
 344                         add_function_hook(info->name, info->call_back, info);
 345                 } else if (info->implies_start && info->type == ALLOC) {
 346                         return_implies_param_key_exact(info->name,
 347                                         *info->implies_start,
 348                                         *info->implies_end,
 349                                         &return_param_alloc,
 350                                         info->param, info->key, info);
 351                 } else if (info->implies_start) {
 352                         return_implies_param_key(info->name,
 353                                         *info->implies_start,
 354                                         *info->implies_end,
 355                                         &return_param_release,
 356                                         info->param, info->key, info);
 357                 } else {
 358                         add_function_param_key_hook(info->name,
 359                                 (info->type == ALLOC) ? &return_param_alloc : &return_param_release,
 360                                 info->param, info->key, info);
 361                 }
 362         }
 363
 364         add_function_hook("devm_add_action_or_reset", &ignore_path, NULL);
 365
 366         add_unmatched_state_hook(my_id, &unmatched_state);
 367         add_function_data(&fn_has_alloc);
 368
 369         add_split_return_callback(match_return_info);
 370         select_return_param_key(RELEASE, &return_param_release);
 371         add_hook(&match_check_balanced, END_FUNC_HOOK);
 372 }