check_unwind.c

   1 /*
   2  * Copyright (C) 2020 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include <ctype.h>
  19
  20 #include "smatch.h"
  21 #include "smatch_extra.h"
  22 #include "smatch_slist.h"
  23
  24 static int my_id;
  25 static int info_id;
  26
  27 STATE(alloc);
  28 STATE(release);
  29 STATE(param_released);
  30 STATE(ignore);
  31
  32 static unsigned long fn_has_alloc;
  33
  34 struct ref_func_info {
  35         const char *name;
  36         int type;
  37         int param;
  38         const char *key;
  39         const sval_t *implies_start, *implies_end;
  40         func_hook *call_back;
  41 };
  42
  43 static struct ref_func_info func_table[] = {
  44         { "clk_prepare_enable", ALLOC, 0, "$", &int_zero, &int_zero },
  45         { "clk_disable_unprepare", RELEASE, 0, "$" },
  46
  47         { "alloc_etherdev_mqs", ALLOC, -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  48         { "free_netdev", RELEASE, 0, "$" },
  49
  50         /*
  51          * FIXME: A common pattern in release functions like amd76xrom_cleanup()
  52          * is to do:
  53          *
  54          *      if (window->rsrc.parent)
  55          *              release_resource(&window->rsrc);
  56          *
  57          * Which is slightly tricky to know how to merge the states so let's
  58          * hold off checking request_resource() for now.
  59          *
  60          * { "request_resource", ALLOC,   1, "$", &int_zero, &int_zero },
  61          * { "release_resource", RELEASE, 0, "$" },
  62          *
  63          */
  64
  65         { "pci_request_regions", ALLOC,   0, "$", &int_zero, &int_zero },
  66         { "pci_release_regions", RELEASE, 0, "$" },
  67
  68         { "request_free_mem_region", ALLOC,   -1, "$->start", &valid_ptr_min_sval, &valid_ptr_max_sval },
  69         { "__request_region", ALLOC,   1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  70         { "__release_region", RELEASE, 1, "$" },
  71
  72         { "ioremap", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  73         { "of_iomap", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  74         { "ioremap_encrypted", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  75         { "iounmap", RELEASE, 0, "$" },
  76
  77         { "request_threaded_irq", ALLOC,   0, "$", &int_zero, &int_zero },
  78         { "request_irq", ALLOC,   0, "$", &int_zero, &int_zero },
  79         { "free_irq",    RELEASE, 0, "$" },
  80         { "pci_request_irq", ALLOC,   1, "$", &int_zero, &int_zero },
  81         { "pci_free_irq",    RELEASE, 1, "$" },
  82
  83         { "register_netdev",   ALLOC,   0, "$", &int_zero, &int_zero },
  84         { "unregister_netdev", RELEASE, 0, "$" },
  85
  86         { "misc_register",   ALLOC,   0, "$", &int_zero, &int_zero },
  87         { "misc_deregister", RELEASE, 0, "$" },
  88
  89         { "ieee80211_alloc_hw", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  90         { "ieee80211_free_hw",  RELEASE, 0, "$" },
  91 };
  92
  93 static struct smatch_state *unmatched_state(struct sm_state *sm)
  94 {
  95         struct smatch_state *state;
  96
  97         if (sm->state != &param_released)
  98                 return &undefined;
  99
 100         if (is_impossible_path())
 101                 return &param_released;
 102
 103         state = get_state(SMATCH_EXTRA, sm->name, sm->sym);
 104         if (!state)
 105                 return &undefined;
 106         if (!estate_rl(state) || is_err_or_null(estate_rl(state)))
 107                 return &param_released;
 108         if (parent_is_err_or_null_var_sym(sm->name, sm->sym))
 109                 return &param_released;
 110
 111          return &undefined;
 112 }
 113
 114 static bool is_param_var_sym(const char *name, struct symbol *sym)
 115 {
 116         const char *key;
 117
 118         return get_param_key_from_var_sym(name, sym, NULL, &key) >= 0;
 119 }
 120
 121 static void mark_matches_as_undefined(const char *key)
 122 {
 123         struct sm_state *sm;
 124         int start_pos, state_len, key_len;
 125         char *p;
 126
 127         while ((p = strchr(key, '-'))) {
 128                 if (p[1] != '>')
 129                         return;
 130                 key = p + 2;
 131         }
 132         key_len = strlen(key);
 133
 134         FOR_EACH_MY_SM(my_id, __get_cur_stree(), sm) {
 135                 state_len = strlen(sm->name);
 136                 if (state_len < key_len)
 137                         continue;
 138                 if (!slist_has_state(sm->possible, &alloc))
 139                         continue;
 140
 141                 start_pos = state_len - key_len;
 142                 if ((start_pos == 0 || !isalnum(sm->name[start_pos - 1])) &&
 143                     strcmp(sm->name + start_pos, key) == 0)
 144                         update_ssa_state(my_id, sm->name, sm->sym, &undefined);
 145
 146         } END_FOR_EACH_SM(sm);
 147 }
 148
 149 static bool is_alloc_primitive(struct expression *expr)
 150 {
 151         int i;
 152
 153         while (expr->type == EXPR_ASSIGNMENT)
 154                 expr = strip_expr(expr->right);
 155         if (expr->type != EXPR_CALL)
 156                 return false;
 157
 158         if (expr->fn->type != EXPR_SYMBOL)
 159                 return false;
 160
 161         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 162                 if (sym_name_is(func_table[i].name, expr->fn))
 163                         return true;
 164         }
 165
 166         return false;
 167 }
 168
 169 static void return_param_alloc(struct expression *expr, const char *name, struct symbol *sym, void *data)
 170 {
 171         fn_has_alloc = true;
 172         set_ssa_state(my_id, name, sym, &alloc);
 173 }
 174
 175 static void return_param_release(struct expression *expr, const char *name, struct symbol *sym, void *data)
 176 {
 177         struct sm_state *start_sm;
 178
 179         /* The !data means this comes from the DB (not hard coded). */
 180         if (!data && is_alloc_primitive(expr))
 181                 return;
 182
 183         start_sm = get_ssa_sm_state(my_id, name, sym);
 184         if (start_sm) {
 185                 update_ssa_state(my_id, start_sm->name, start_sm->sym, &release);
 186         } else {
 187                 if (fn_has_alloc) {
 188                         mark_matches_as_undefined(name);
 189                         return;
 190                 }
 191                 if (is_param_var_sym(name, sym))
 192                         set_state(info_id, name, sym, &param_released);
 193         }
 194 }
 195
 196 static void ignore_path(const char *fn, struct expression *expr, void *data)
 197 {
 198         set_state(my_id, "path", NULL, &ignore);
 199 }
 200
 201 static void match_return_info(int return_id, char *return_ranges, struct expression *expr)
 202 {
 203         struct sm_state *sm;
 204         const char *param_name;
 205         int param;
 206
 207         if (is_impossible_path())
 208                 return;
 209
 210         FOR_EACH_MY_SM(info_id, __get_cur_stree(), sm) {
 211                 if (sm->state != &param_released)
 212                         continue;
 213                 param = get_param_key_from_sm(sm, expr, &param_name);
 214                 if (param < 0)
 215                         continue;
 216                 sql_insert_return_states(return_id, return_ranges, RELEASE,
 217                                          param, param_name, "");
 218         } END_FOR_EACH_SM(sm);
 219 }
 220
 221 enum {
 222         UNKNOWN, FAIL, SUCCESS, NUM_BUCKETS
 223 };
 224
 225 static int success_fail_positive(struct range_list *rl)
 226 {
 227         if (!rl)
 228                 return UNKNOWN;
 229
 230         if (sval_is_negative(rl_min(rl)) && sval_is_negative(rl_max(rl)))
 231                 return FAIL;
 232
 233         if (rl_min(rl).value == 0)
 234                 return SUCCESS;
 235
 236         return UNKNOWN;
 237 }
 238
 239 static void check_balance(const char *name, struct symbol *sym)
 240 {
 241         struct range_list *inc_lines = NULL;
 242         int inc_buckets[NUM_BUCKETS] = {};
 243         struct stree *stree, *orig_stree;
 244         struct smatch_state *state;
 245         struct sm_state *return_sm;
 246         struct sm_state *sm;
 247         sval_t line = sval_type_val(&int_ctype, 0);
 248         int bucket;
 249
 250         FOR_EACH_PTR(get_all_return_strees(), stree) {
 251                 orig_stree = __swap_cur_stree(stree);
 252
 253                 if (is_impossible_path())
 254                         goto swap_stree;
 255                 if (db_incomplete())
 256                         goto swap_stree;
 257                 if (get_state(my_id, "path", NULL) == &ignore)
 258                         goto swap_stree;
 259
 260                 return_sm = get_sm_state(RETURN_ID, "return_ranges", NULL);
 261                 if (!return_sm)
 262                         goto swap_stree;
 263                 line.value = return_sm->line;
 264
 265                 sm = get_sm_state(my_id, name, sym);
 266                 if (!sm)
 267                         goto swap_stree;
 268
 269                 state = sm->state;
 270                 if (state == &param_released)
 271                         state = &release;
 272
 273                 if (state != &alloc &&
 274                     state != &release)
 275                         goto swap_stree;
 276
 277                 bucket = success_fail_positive(estate_rl(return_sm->state));
 278                 if (bucket != FAIL)
 279                         goto swap_stree;
 280
 281                 if (state == &alloc) {
 282                         add_range(&inc_lines, line, line);
 283                         inc_buckets[bucket] = true;
 284                 }
 285 swap_stree:
 286                 __swap_cur_stree(orig_stree);
 287         } END_FOR_EACH_PTR(stree);
 288
 289         if (inc_buckets[FAIL])
 290                 goto complain;
 291
 292         return;
 293
 294 complain:
 295         sm_warning("'%s' not released on lines: %s.", ssa_name(name), show_rl(inc_lines));
 296 }
 297
 298 static void match_check_balanced(struct symbol *sym)
 299 {
 300         struct sm_state *sm;
 301
 302         FOR_EACH_MY_SM(my_id, get_all_return_states(), sm) {
 303                 if (sm->sym == NULL && strcmp(sm->name, "path") == 0)
 304                         continue;
 305                 check_balance(sm->name, sm->sym);
 306         } END_FOR_EACH_SM(sm);
 307 }
 308
 309 void check_unwind(int id)
 310 {
 311         struct ref_func_info *info;
 312         int i;
 313
 314         my_id = id;
 315
 316         if (option_project != PROJ_KERNEL)
 317                 return;
 318
 319         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 320                 info = &func_table[i];
 321
 322                 if (info->call_back) {
 323                         add_function_hook(info->name, info->call_back, info);
 324                 } else if (info->implies_start && info->type == ALLOC) {
 325                         return_implies_param_key_exact(info->name,
 326                                         *info->implies_start,
 327                                         *info->implies_end,
 328                                         &return_param_alloc,
 329                                         info->param, info->key, info);
 330                 } else if (info->implies_start) {
 331                         return_implies_param_key(info->name,
 332                                         *info->implies_start,
 333                                         *info->implies_end,
 334                                         &return_param_release,
 335                                         info->param, info->key, info);
 336                 } else {
 337                         add_function_param_key_hook(info->name,
 338                                 (info->type == ALLOC) ? &return_param_alloc : &return_param_release,
 339                                 info->param, info->key, info);
 340                 }
 341         }
 342
 343         add_function_hook("devm_add_action_or_reset", &ignore_path, NULL);
 344
 345         add_function_data(&fn_has_alloc);
 346
 347         add_split_return_callback(match_return_info);
 348         select_return_param_key(RELEASE, &return_param_release);
 349         add_hook(&match_check_balanced, END_FUNC_HOOK);
 350 }
 351
 352 void check_unwind_info(int id)
 353 {
 354         info_id = id;
 355         add_unmatched_state_hook(info_id, &unmatched_state);
 356 }