check_held_dev.c

   1 /*
   2  * sparse/check_hold_dev.c
   3  *
   4  * Copyright (C) 2009 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * This check is supposed to find bugs in reference counting using dev_hold()
  12  * and dev_put().
  13  *
  14  * When a device is first held, if an error happens later in the function
  15  * it needs to be released on all the error paths.
  16  *
  17  */
  18
  19 #include "smatch.h"
  20 #include "smatch_extra.h"
  21 #include "smatch_slist.h"
  22
  23 static int my_id;
  24
  25 STATE(held);
  26 STATE(released);
  27
  28 static void match_dev_hold(const char *fn, struct expression *expr, void *data)
  29 {
  30         struct expression *arg_expr;
  31
  32         arg_expr = get_argument_from_call_expr(expr->args, 0);
  33         set_state_expr(my_id, arg_expr, &held);
  34 }
  35
  36 static void match_dev_put(const char *fn, struct expression *expr, void *data)
  37 {
  38         struct expression *arg_expr;
  39
  40         arg_expr = get_argument_from_call_expr(expr->args, 0);
  41         set_state_expr(my_id, arg_expr, &released);
  42 }
  43
  44 static void match_returns_held(const char *fn, struct expression *call_expr,
  45                         struct expression *assign_expr, void *unused)
  46 {
  47         if (assign_expr)
  48                 set_state_expr(my_id, assign_expr->left, &held);
  49 }
  50
  51 static void match_returns_null(const char *fn, struct expression *call_expr,
  52                         struct expression *assign_expr, void *unused)
  53 {
  54         if (assign_expr)
  55                 set_state_expr(my_id, assign_expr->left, &released);
  56 }
  57
  58 static void check_for_held(void)
  59 {
  60         struct state_list *slist;
  61         struct sm_state *tmp;
  62
  63         slist = get_all_states(my_id);
  64         FOR_EACH_PTR(slist, tmp) {
  65                 if (slist_has_state(tmp->possible, &held)) {
  66                         sm_msg("warn: '%s' held on error path.",
  67                                 tmp->name);
  68                 }
  69         } END_FOR_EACH_PTR(tmp);
  70         free_slist(&slist);
  71 }
  72
  73 static void print_returns_held(struct expression *expr)
  74 {
  75         struct sm_state *sm;
  76
  77         if (!option_info)
  78                 return;
  79         sm = get_sm_state_expr(my_id, expr);
  80         if (!sm)
  81                 return;
  82         if (slist_has_state(sm->possible, &held))
  83                 sm_info("returned dev is held.");
  84 }
  85
  86 static void match_return(struct expression *ret_value)
  87 {
  88         print_returns_held(ret_value);
  89         if (!is_error_return(ret_value))
  90                 return;
  91         check_for_held();
  92 }
  93
  94 static void register_returns_held_funcs(void)
  95 {
  96         struct token *token;
  97         const char *func;
  98
  99         token = get_tokens_file("kernel.returns_held_funcs");
 100         if (!token)
 101                 return;
 102         if (token_type(token) != TOKEN_STREAMBEGIN)
 103                 return;
 104         token = token->next;
 105         while (token_type(token) != TOKEN_STREAMEND) {
 106                 if (token_type(token) != TOKEN_IDENT)
 107                         return;
 108                 func = show_ident(token->ident);
 109                 return_implies_state(func, valid_ptr_min, valid_ptr_max,
 110                                      &match_returns_held, NULL);
 111                 return_implies_state(func, 0, 0, &match_returns_null,
 112                                          NULL);
 113                 token = token->next;
 114         }
 115         clear_token_alloc();
 116 }
 117
 118 void check_hold_dev(int id)
 119 {
 120         if (option_project != PROJ_KERNEL)
 121                 return;
 122
 123         my_id = id;
 124         add_function_hook("dev_hold", &match_dev_hold, NULL);
 125         add_function_hook("dev_put", &match_dev_put, NULL);
 126         register_returns_held_funcs();
 127         add_hook(&match_return, RETURN_HOOK);
 128 }