check_leaks.c

   1 /*
   2  * sparse/check_leaks.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * The point of this check is to look for leaks.
  12  * foo = malloc();  // <- mark it as allocated.
  13  * A variable becomes &ok if we:
  14  * 1) assign it to another variable.
  15  * 2) pass it to a function.
  16  *
  17  * One complication is dealing with stuff like:
  18  * foo->bar = malloc();
  19  * foo->baz = malloc();
  20  * foo = something();
  21  *
  22  * The work around is that for now what this check only
  23  * checks simple expressions and doesn't check whether
  24  * foo->bar is leaked.
  25  *
  26  */
  27
  28 #include <fcntl.h>
  29 #include <unistd.h>
  30 #include "parse.h"
  31 #include "smatch.h"
  32 #include "smatch_slist.h"
  33
  34 static int my_id;
  35
  36 STATE(allocated);
  37 STATE(ok);
  38
  39 static void set_parent(struct expression *expr, struct smatch_state *state);
  40
  41 static const char *allocation_funcs[] = {
  42         "malloc",
  43         "kmalloc",
  44         "kzalloc",
  45 };
  46
  47 static char *alloc_parent_str(struct symbol *sym)
  48 {
  49         static char buf[256];
  50
  51         if (!sym || !sym->ident)
  52                 return NULL;
  53
  54         snprintf(buf, 255, "%s", sym->ident->name);
  55         buf[255] = '\0';
  56         return alloc_string(buf);
  57 }
  58
  59 static char *get_parent_from_expr(struct expression *expr, struct symbol **sym)
  60 {
  61         char *name;
  62
  63         expr = strip_expr(expr);
  64
  65         name = get_variable_from_expr_complex(expr, sym);
  66         free_string(name);
  67         if (!name || !*sym || !(*sym)->ident) {
  68                 *sym = NULL;
  69                 return NULL;
  70         }
  71         return alloc_parent_str(*sym);
  72 }
  73
  74 static int is_local(struct expression *expr)
  75 {
  76         char *name;
  77         struct symbol *sym;
  78         int ret = 0;
  79
  80         name = get_variable_from_expr_complex(expr, &sym);
  81         if (!name || !sym)
  82                 goto out;
  83         if (sym->ctype.modifiers & (MOD_NONLOCAL | MOD_STATIC | MOD_ADDRESSABLE))
  84                 goto out;
  85         ret = 1;
  86 out:
  87         free_string(name);
  88         return ret;
  89 }
  90
  91 static int is_param(struct expression *expr)
  92 {
  93         char *name;
  94         struct symbol *sym;
  95         struct symbol *tmp;
  96         int ret = 0;
  97
  98         name = get_variable_from_expr_complex(expr, &sym);
  99         if (!name || !sym)
 100                 goto out;
 101         FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, tmp) {
 102                 if (tmp == sym) {
 103                         ret = 1;
 104                         goto out;
 105                 }
 106         } END_FOR_EACH_PTR(tmp);
 107 out:
 108         free_string(name);
 109         return ret;
 110
 111 }
 112
 113 static void match_alloc(const char *fn, struct expression *expr, void *unused)
 114 {
 115         if (!is_local(expr->left))
 116                 return;
 117         if (is_param(expr->left))
 118                 return;
 119         if (expr->left->type != EXPR_SYMBOL)
 120                 return;
 121         set_state_expr(my_id, expr->left, &allocated);
 122 }
 123
 124 static void match_condition(struct expression *expr)
 125 {
 126         struct sm_state *sm;
 127
 128         expr = strip_expr(expr);
 129
 130         switch (expr->type) {
 131         case EXPR_PREOP:
 132         case EXPR_SYMBOL:
 133         case EXPR_DEREF:
 134                 sm = get_sm_state_expr(my_id, expr);
 135                 if (sm && slist_has_state(sm->possible, &allocated))
 136                         set_true_false_states_expr(my_id, expr, &allocated, &ok);
 137                 return;
 138         case EXPR_ASSIGNMENT:
 139                  /* You have to deal with stuff like if (a = b = c) */
 140                 match_condition(expr->left);
 141                 return;
 142         default:
 143                 return;
 144         }
 145 }
 146
 147 static void set_parent(struct expression *expr, struct smatch_state *state)
 148 {
 149         char *name;
 150         struct symbol *sym;
 151
 152         name = get_parent_from_expr(expr, &sym);
 153         if (!name || !sym)
 154                 goto free;
 155         if (state == &ok && !get_state(my_id, name, sym))
 156                 goto free;
 157         set_state(my_id, name, sym, state);
 158 free:
 159         free_string(name);
 160 }
 161
 162 static void match_function_call(struct expression *expr)
 163 {
 164         struct expression *tmp;
 165
 166         FOR_EACH_PTR(expr->args, tmp) {
 167                 set_parent(tmp, &ok);
 168         } END_FOR_EACH_PTR(tmp);
 169 }
 170
 171 static void warn_if_allocated(struct expression *expr)
 172 {
 173         struct sm_state *sm;
 174         char *name;
 175
 176         sm = get_sm_state_expr(my_id, expr);
 177         if (!sm)
 178                 return;
 179         if (!slist_has_state(sm->possible, &allocated))
 180                 return;
 181
 182         name = get_variable_from_expr(expr, NULL);
 183         sm_msg("warn: overwrite may leak '%s'", name);
 184         free_string(name);
 185
 186         /* silence further warnings */
 187         set_state_expr(my_id, expr, &ok);
 188 }
 189
 190 static void match_assign(struct expression *expr)
 191 {
 192         struct expression *right;
 193
 194         right = expr->right;
 195
 196         while (right->type == EXPR_ASSIGNMENT)
 197                 right = right->left;
 198
 199         warn_if_allocated(expr->left);
 200         set_parent(right, &ok);
 201 }
 202
 203 static void check_for_allocated(void)
 204 {
 205         struct state_list *slist;
 206         struct sm_state *tmp;
 207
 208         slist = get_all_states(my_id);
 209         FOR_EACH_PTR(slist, tmp) {
 210                 if (!slist_has_state(tmp->possible, &allocated))
 211                         continue;
 212                 sm_msg("warn: possible memory leak of '%s'", tmp->name);
 213         } END_FOR_EACH_PTR(tmp);
 214         free_slist(&slist);
 215 }
 216
 217 static void match_return(struct expression *ret_value)
 218 {
 219         set_parent(ret_value, &ok);
 220         check_for_allocated();
 221 }
 222
 223 static void match_end_func(struct symbol *sym)
 224 {
 225         check_for_allocated();
 226 }
 227
 228 void check_leaks(int id)
 229 {
 230         int i;
 231
 232         my_id = id;
 233
 234         for (i = 0; i < ARRAY_SIZE(allocation_funcs); i++)
 235                 add_function_assign_hook(allocation_funcs[i], &match_alloc, NULL);
 236
 237         add_hook(&match_condition, CONDITION_HOOK);
 238
 239         add_hook(&match_function_call, FUNCTION_CALL_HOOK);
 240         add_hook(&match_assign, ASSIGNMENT_HOOK);
 241
 242         add_hook(&match_return, RETURN_HOOK);
 243         add_hook(&match_end_func, END_FUNC_HOOK);
 244 }