rosenberg: remove pahole dependency
[smatch.git] / check_leaks.c
blobb433adad2279a4dcd2bc1279c1363d910fc48944
1 /*
2 * sparse/check_leaks.c
4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
8 */
11 * The point of this check is to look for leaks.
12 * foo = malloc(); // <- mark it as allocated.
13 * A variable becomes &ok if we:
14 * 1) assign it to another variable.
15 * 2) pass it to a function.
17 * One complication is dealing with stuff like:
18 * foo->bar = malloc();
19 * foo->baz = malloc();
20 * foo = something();
22 * The work around is that for now what this check only
23 * checks simple expressions and doesn't check whether
24 * foo->bar is leaked.
28 #include <fcntl.h>
29 #include <unistd.h>
30 #include "parse.h"
31 #include "smatch.h"
32 #include "smatch_slist.h"
34 static int my_id;
36 STATE(allocated);
37 STATE(ok);
39 static void set_parent(struct expression *expr, struct smatch_state *state);
41 static const char *allocation_funcs[] = {
42 "malloc",
43 "kmalloc",
44 "kzalloc",
47 static char *alloc_parent_str(struct symbol *sym)
49 static char buf[256];
51 if (!sym || !sym->ident)
52 return NULL;
54 snprintf(buf, 255, "%s", sym->ident->name);
55 buf[255] = '\0';
56 return alloc_string(buf);
59 static char *get_parent_from_expr(struct expression *expr, struct symbol **sym)
61 char *name;
63 expr = strip_expr(expr);
65 name = expr_to_str_sym(expr, sym);
66 free_string(name);
67 if (!name || !*sym || !(*sym)->ident) {
68 *sym = NULL;
69 return NULL;
71 return alloc_parent_str(*sym);
74 static int is_local(struct expression *expr)
76 char *name;
77 struct symbol *sym;
78 int ret = 0;
80 name = expr_to_str_sym(expr, &sym);
81 if (!name || !sym)
82 goto out;
83 if (sym->ctype.modifiers & (MOD_NONLOCAL | MOD_STATIC | MOD_ADDRESSABLE))
84 goto out;
85 ret = 1;
86 out:
87 free_string(name);
88 return ret;
91 static int is_param(struct expression *expr)
93 char *name;
94 struct symbol *sym;
95 struct symbol *tmp;
96 int ret = 0;
98 name = expr_to_str_sym(expr, &sym);
99 if (!name || !sym)
100 goto out;
101 FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, tmp) {
102 if (tmp == sym) {
103 ret = 1;
104 goto out;
106 } END_FOR_EACH_PTR(tmp);
107 out:
108 free_string(name);
109 return ret;
113 static void match_alloc(const char *fn, struct expression *expr, void *unused)
115 if (!is_local(expr->left))
116 return;
117 if (is_param(expr->left))
118 return;
119 if (expr->left->type != EXPR_SYMBOL)
120 return;
121 set_state_expr(my_id, expr->left, &allocated);
124 static void match_condition(struct expression *expr)
126 struct sm_state *sm;
128 expr = strip_expr(expr);
130 switch (expr->type) {
131 case EXPR_PREOP:
132 case EXPR_SYMBOL:
133 case EXPR_DEREF:
134 sm = get_sm_state_expr(my_id, expr);
135 if (sm && slist_has_state(sm->possible, &allocated))
136 set_true_false_states_expr(my_id, expr, &allocated, &ok);
137 return;
138 case EXPR_ASSIGNMENT:
139 /* You have to deal with stuff like if (a = b = c) */
140 match_condition(expr->left);
141 return;
142 default:
143 return;
147 static void set_parent(struct expression *expr, struct smatch_state *state)
149 char *name;
150 struct symbol *sym;
152 name = get_parent_from_expr(expr, &sym);
153 if (!name || !sym)
154 goto free;
155 if (state == &ok && !get_state(my_id, name, sym))
156 goto free;
157 set_state(my_id, name, sym, state);
158 free:
159 free_string(name);
162 static void match_function_call(struct expression *expr)
164 struct expression *tmp;
166 FOR_EACH_PTR(expr->args, tmp) {
167 set_parent(tmp, &ok);
168 } END_FOR_EACH_PTR(tmp);
171 static void warn_if_allocated(struct expression *expr)
173 struct sm_state *sm;
174 char *name;
176 sm = get_sm_state_expr(my_id, expr);
177 if (!sm)
178 return;
179 if (!slist_has_state(sm->possible, &allocated))
180 return;
182 name = expr_to_var(expr);
183 sm_msg("warn: overwrite may leak '%s'", name);
184 free_string(name);
186 /* silence further warnings */
187 set_state_expr(my_id, expr, &ok);
190 static void match_assign(struct expression *expr)
192 struct expression *right;
194 right = expr->right;
196 while (right->type == EXPR_ASSIGNMENT)
197 right = right->left;
199 warn_if_allocated(expr->left);
200 set_parent(right, &ok);
203 static void check_for_allocated(void)
205 struct state_list *slist;
206 struct sm_state *tmp;
208 slist = get_all_states(my_id);
209 FOR_EACH_PTR(slist, tmp) {
210 if (!slist_has_state(tmp->possible, &allocated))
211 continue;
212 sm_msg("warn: possible memory leak of '%s'", tmp->name);
213 } END_FOR_EACH_PTR(tmp);
214 free_slist(&slist);
217 static void match_return(struct expression *ret_value)
219 if (__inline_fn)
220 return;
221 set_parent(ret_value, &ok);
222 check_for_allocated();
225 static void match_end_func(struct symbol *sym)
227 if (__inline_fn)
228 return;
229 check_for_allocated();
232 void check_leaks(int id)
234 int i;
236 my_id = id;
238 for (i = 0; i < ARRAY_SIZE(allocation_funcs); i++)
239 add_function_assign_hook(allocation_funcs[i], &match_alloc, NULL);
241 add_hook(&match_condition, CONDITION_HOOK);
243 add_hook(&match_function_call, FUNCTION_CALL_HOOK);
244 add_hook(&match_assign, ASSIGNMENT_HOOK);
246 add_hook(&match_return, RETURN_HOOK);
247 add_hook(&match_end_func, END_FUNC_HOOK);