check_unwind.c

   1 /*
   2  * smatch/check_unwind.c
   3  *
   4  * Copyright (C) 2010 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * This is a kernel check to make sure we unwind everything on
  12  * on errors.
  13  *
  14  */
  15
  16 #include "smatch.h"
  17 #include "smatch_extra.h"
  18 #include "smatch_slist.h"
  19
  20 #define EBUSY 16
  21 #define MAX_ERRNO 4095
  22
  23 static int my_id;
  24
  25 STATE(allocated);
  26 STATE(unallocated);
  27
  28 /* state of unwind function */
  29 STATE(called);
  30
  31 static int was_passed_as_param(struct expression *expr)
  32 {
  33         char *name;
  34         struct symbol *sym;
  35         struct symbol *arg;
  36
  37         name = expr_to_var_sym(expr, &sym);
  38         if (!name)
  39                 return 0;
  40         free_string(name);
  41
  42         FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
  43                 if (arg == sym)
  44                         return 1;
  45         } END_FOR_EACH_PTR(arg);
  46         return 0;
  47 }
  48
  49 static void print_unwind_functions(const char *fn, struct expression *expr, void *_arg_no)
  50 {
  51         struct expression *arg_expr;
  52         int arg_no = PTR_INT(_arg_no);
  53         static struct symbol *last_printed = NULL;
  54
  55         arg_expr = get_argument_from_call_expr(expr->args, arg_no);
  56         if (!was_passed_as_param(arg_expr))
  57                 return;
  58         if (last_printed == cur_func_sym)
  59                 return;
  60         last_printed = cur_func_sym;
  61         sm_msg("info: is unwind function");
  62 }
  63
  64 static void request_granted(const char *fn, struct expression *call_expr,
  65                         struct expression *assign_expr, void *_arg_no)
  66 {
  67         struct expression *arg_expr;
  68         int arg_no = PTR_INT(_arg_no);
  69
  70         if (arg_no == -1)
  71                 arg_expr = assign_expr->left;
  72         else
  73                 arg_expr = get_argument_from_call_expr(call_expr->args, arg_no);
  74         set_state_expr(my_id, arg_expr, &allocated);
  75 }
  76
  77 static void request_denied(const char *fn, struct expression *call_expr,
  78                         struct expression *assign_expr, void *_arg_no)
  79 {
  80         struct expression *arg_expr;
  81         int arg_no = PTR_INT(_arg_no);
  82
  83         if (arg_no == -1)
  84                 arg_expr = assign_expr->left;
  85         else
  86                 arg_expr = get_argument_from_call_expr(call_expr->args, arg_no);
  87         set_state_expr(my_id, arg_expr, &unallocated);
  88 }
  89
  90 static void match_release(const char *fn, struct expression *expr, void *_arg_no)
  91 {
  92         struct expression *arg_expr;
  93         int arg_no = PTR_INT(_arg_no);
  94
  95         arg_expr = get_argument_from_call_expr(expr->args, arg_no);
  96         if (get_state_expr(my_id, arg_expr))
  97                 set_state_expr(my_id, arg_expr, &unallocated);
  98         set_equiv_state_expr(my_id, arg_expr, &unallocated);
  99 }
 100
 101 static void match_unwind_function(const char *fn, struct expression *expr, void *unused)
 102 {
 103         set_state(my_id, "unwind_function", NULL, &called);
 104 }
 105
 106 static int func_returns_int()
 107 {
 108         struct symbol *type;
 109
 110         type = get_base_type(cur_func_sym);
 111         if (!type || type->type != SYM_FN)
 112                 return 0;
 113         type = get_base_type(type);
 114         if (type->ctype.base_type == &int_type) {
 115                 return 1;
 116         }
 117         return 0;
 118 }
 119
 120 static void match_return(struct expression *ret_value)
 121 {
 122         struct state_list *slist;
 123         struct sm_state *tmp;
 124         sval_t sval;
 125
 126         if (!func_returns_int())
 127                 return;
 128         if (get_value(ret_value, &sval) && sval_cmp_val(sval, 0) >= 0)
 129                 return;
 130         if (!implied_not_equal(ret_value, 0))
 131                 return;
 132         if (get_state(my_id, "unwind_function", NULL) == &called)
 133                 return;
 134
 135         slist = get_all_states(my_id);
 136         FOR_EACH_PTR(slist, tmp) {
 137                 if (slist_has_state(tmp->possible, &allocated))
 138                         sm_msg("warn: '%s' was not released on error", tmp->name);
 139         } END_FOR_EACH_PTR(tmp);
 140         free_slist(&slist);
 141 }
 142
 143 static void register_unwind_functions(void)
 144 {
 145         struct token *token;
 146         const char *func;
 147
 148         token = get_tokens_file("kernel.unwind_functions");
 149         if (!token)
 150                 return;
 151         if (token_type(token) != TOKEN_STREAMBEGIN)
 152                 return;
 153         token = token->next;
 154         while (token_type(token) != TOKEN_STREAMEND) {
 155                 if (token_type(token) != TOKEN_IDENT)
 156                         return;
 157                 func = show_ident(token->ident);
 158                 add_function_hook(func, &match_unwind_function, NULL);
 159                 token = token->next;
 160         }
 161         clear_token_alloc();
 162 }
 163
 164 static void release_function_indicator(const char *name)
 165 {
 166         if (!option_info)
 167                 return;
 168         add_function_hook(name, &print_unwind_functions, INT_PTR(0));
 169 }
 170
 171 void check_unwind(int id)
 172 {
 173         if (option_project != PROJ_KERNEL || !option_spammy)
 174                 return;
 175         my_id = id;
 176
 177         register_unwind_functions();
 178
 179         return_implies_state("request_resource", 0, 0, &request_granted, INT_PTR(1));
 180         return_implies_state("request_resource", -EBUSY, -EBUSY, &request_denied, INT_PTR(1));
 181         add_function_hook("release_resource", &match_release, INT_PTR(0));
 182         release_function_indicator("release_resource");
 183
 184         return_implies_state("__request_region", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(1));
 185         return_implies_state("__request_region", 0, 0, &request_denied, INT_PTR(1));
 186         add_function_hook("__release_region", &match_release, INT_PTR(1));
 187         release_function_indicator("__release_region");
 188
 189         return_implies_state("ioremap", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(-1));
 190         return_implies_state("ioremap", 0, 0, &request_denied, INT_PTR(-1));
 191         add_function_hook("iounmap", &match_release, INT_PTR(0));
 192
 193         return_implies_state("pci_iomap", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(-1));
 194         return_implies_state("pci_iomap", 0, 0, &request_denied, INT_PTR(-1));
 195         add_function_hook("pci_iounmap", &match_release, INT_PTR(1));
 196         release_function_indicator("pci_iounmap");
 197
 198         return_implies_state("__create_workqueue_key", valid_ptr_min, valid_ptr_max, &request_granted,
 199                         INT_PTR(-1));
 200         return_implies_state("__create_workqueue_key", 0, 0, &request_denied, INT_PTR(-1));
 201         add_function_hook("destroy_workqueue", &match_release, INT_PTR(0));
 202
 203         return_implies_state("request_irq", 0, 0, &request_granted, INT_PTR(0));
 204         return_implies_state("request_irq", -MAX_ERRNO, -1, &request_denied, INT_PTR(0));
 205         add_function_hook("free_irq", &match_release, INT_PTR(0));
 206         release_function_indicator("free_irq");
 207
 208         return_implies_state("register_netdev", 0, 0, &request_granted, INT_PTR(0));
 209         return_implies_state("register_netdev", -MAX_ERRNO, -1, &request_denied, INT_PTR(0));
 210         add_function_hook("unregister_netdev", &match_release, INT_PTR(0));
 211         release_function_indicator("unregister_netdev");
 212
 213         return_implies_state("misc_register", 0, 0, &request_granted, INT_PTR(0));
 214         return_implies_state("misc_register", -MAX_ERRNO, -1, &request_denied, INT_PTR(0));
 215         add_function_hook("misc_deregister", &match_release, INT_PTR(0));
 216         release_function_indicator("misc_deregister");
 217
 218
 219         add_hook(&match_return, RETURN_HOOK);
 220 }