smatch_refcount_info.c

   1 /*
   2  * Copyright (C) 2021 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * This is basically a copy for check_preempt_info.c but for refcount instead.
  20  */
  21
  22 #include "smatch.h"
  23 #include "smatch_extra.h"
  24 #include "smatch_slist.h"
  25
  26 static int my_id;
  27
  28 STATE(init);
  29 STATE(inc);
  30 STATE(dec);
  31 STATE(ignore);
  32 STATE(gone);
  33
  34 struct ref_func_info {
  35         const char *name;
  36         int type;
  37         int param;
  38         const char *key;
  39         const sval_t *implies_start, *implies_end;
  40         param_key_hook *call_back;
  41 };
  42
  43 static void match_atomic_add(struct expression *expr, const char *name, struct symbol *sym, void *_unused);
  44
  45 static struct ref_func_info func_table[] = {
  46         { "atomic_inc", REFCOUNT_INC, 0, "$->counter" },
  47         { "atomic_long_inc", REFCOUNT_INC, 0, "$->counter" },
  48         { "atomic64_inc", REFCOUNT_INC, 0, "$->counter" },
  49
  50         { "atomic_inc_return", REFCOUNT_INC, 0, "$->counter" },
  51         { "atomic_long_inc_return", REFCOUNT_INC, 0, "$->counter" },
  52         { "atomic64_return", REFCOUNT_INC, 0, "$->counter" },
  53
  54         { "atomic_add_return", REFCOUNT_INC, 1, "$->counter", NULL, NULL, match_atomic_add },
  55         { "atomic_long_add_return", REFCOUNT_INC, 1, "$->counter", NULL, NULL, match_atomic_add },
  56         { "atomic64_add_return", REFCOUNT_INC, 1, "$->counter", NULL, NULL, match_atomic_add },
  57
  58         { "atomic64_inc_not_zero", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  59         { "atomic64_fetch_add_unless", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  60         { "atomic64_add_unless", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  61         { "atomic64_add_unless_negative", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  62         { "atomic64_add_unless_positive", REFCOUNT_INC, 0, "$->counter", &bool_true, &bool_true},
  63
  64         // atomic64_dec_if_positive
  65         // atomic64_dec_unless_positive
  66
  67         { "atomic_dec", REFCOUNT_DEC, 0, "$->counter" },
  68         { "atomic_long_dec", REFCOUNT_DEC, 0, "$->counter" },
  69         { "atomic64_dec", REFCOUNT_DEC, 0, "$->counter" },
  70
  71         { "atomic_dec_return", REFCOUNT_DEC, 0, "$->counter" },
  72         { "atomic_long_dec_return", REFCOUNT_DEC, 0, "$->counter" },
  73         { "atomic64_dec_return", REFCOUNT_DEC, 0, "$->counter" },
  74
  75         { "atomic_dec_and_test", REFCOUNT_DEC, 0, "$->counter" },
  76         { "atomic_long_dec_and_test", REFCOUNT_DEC, 0, "$->counter" },
  77         { "atomic64_dec_and_test", REFCOUNT_DEC, 0, "$->counter" },
  78
  79         { "_atomic_dec_and_lock", REFCOUNT_DEC, 0, "$->counter" },
  80
  81         { "atomic_sub", REFCOUNT_DEC, 1, "$->counter" },
  82         { "atomic_long_sub", REFCOUNT_DEC, 1, "$->counter" },
  83         { "atomic64_sub", REFCOUNT_DEC, 1, "$->counter" },
  84
  85         { "atomic_sub_return", REFCOUNT_DEC, 1, "$->counter" },
  86         { "atomic_long_sub_return", REFCOUNT_DEC, 1, "$->counter" },
  87         { "atomic64_sub_return", REFCOUNT_DEC, 1, "$->counter" },
  88
  89         { "atomic_sub_and_test", REFCOUNT_DEC, 1, "$->counter" },
  90         { "atomic_long_sub_and_test", REFCOUNT_DEC, 1, "$->counter" },
  91         { "atomic64_sub_and_test", REFCOUNT_DEC, 1, "$->counter" },
  92
  93         { "register_device", REFCOUNT_INIT, 0, "$->kobj.kset->kobj.kref.refcount.refs.counter", &err_min, &err_max},
  94         { "register_device", REFCOUNT_INC, 0, "$->kobj.kset->kobj.kref.refcount.refs.counter", &int_zero, &int_zero},
  95         { "device_add", REFCOUNT_INC, 0, "$->kobj.kset->kobj.kref.refcount.refs.counter", &int_zero, &int_zero},
  96
  97         { "refcount_set", REFCOUNT_INIT, 0, "$->refs.counter" },
  98
  99         { "refcount_inc", REFCOUNT_INC, 0, "$->refs.counter" },
 100         { "refcount_dec", REFCOUNT_DEC, 0, "$->refs.counter" },
 101         { "refcount_dec_and_test", REFCOUNT_DEC, 0, "$->refs.counter" },
 102         { "__refcount_dec_and_test", REFCOUNT_DEC, 0, "$->refs.counter" },
 103         { "refcount_sub_and_test", REFCOUNT_DEC, 1, "$->refs.counter" },
 104         { "__refcount_sub_and_test", REFCOUNT_DEC, 1, "$->refs.counter" },
 105         { "refcount_add", REFCOUNT_INC, 1, "$->refs.counter" },
 106         { "refcount_sub_and_test", REFCOUNT_DEC, 1, "$->refs.counter" },
 107
 108         { "pm_runtime_get_sync", REFCOUNT_INC, 0, "$->power.usage_count.counter" },
 109
 110         { "refcount_inc_not_zero", REFCOUNT_INC, 0, "$->refs.counter", &int_one, &int_one},
 111         { "refcount_add_not_zero", REFCOUNT_INC, 1, "$->refs.counter", &int_one, &int_one},
 112
 113         { "atomic_dec_if_positive", REFCOUNT_DEC, 0, "$->counter", &int_zero, &int_max},
 114         { "atomic64_dec_if_positive", REFCOUNT_DEC, 0, "$->counter", &int_zero, &int_max},
 115
 116         { "of_node_get", REFCOUNT_INC, 0, "$->kobj.kref.refcount.refs.counter" },
 117         { "of_node_put", REFCOUNT_DEC, 0, "$->kobj.kref.refcount.refs.counter" },
 118         { "of_get_parent", REFCOUNT_INC, -1, "$->kobj.kref.refcount.refs.counter" },
 119         { "of_clk_del_provider", REFCOUNT_DEC, 0, "$->kobj.kref.refcount.refs.counter" },
 120
 121         { "kfree_skb", REFCOUNT_DEC, 0, "$->users.refs.counter" },
 122
 123         { "pci_get_dev_by_id", REFCOUNT_INC, -1, "$->dev.kobj.kref.refcount.refs.counter" },
 124         { "pci_get_dev_by_id", REFCOUNT_DEC,  1, "$->dev.kobj.kref.refcount.refs.counter" },
 125
 126         { "fget", REFCOUNT_INC, -1, "$->f_count.counter", &valid_ptr_min_sval, &valid_ptr_max_sval },
 127         { "sockfd_lookup", REFCOUNT_INC, -1, "$->file->f_count.counter", &valid_ptr_min_sval, &valid_ptr_max_sval },
 128         { "skb_get", REFCOUNT_INC, 0, "$->users.refs.counter", },
 129 //      { "fsnotify_put_mark", REFCOUNT_DEC, 0, "$->refcnt.refs.counter" },
 130
 131         { "dma_buf_put", REFCOUNT_DEC, 0, "$->file->f_count.counter" },
 132 };
 133
 134 static struct smatch_state *unmatched_state(struct sm_state *sm)
 135 {
 136         if (parent_is_null_var_sym(sm->name, sm->sym))
 137                 return &gone;
 138         return &undefined;
 139 }
 140
 141 static struct smatch_state *merge_states(struct smatch_state *s1, struct smatch_state *s2)
 142 {
 143         if (s1 == &gone)
 144                 return s2;
 145         if (s2 == &gone)
 146                 return s1;
 147         return &merged;
 148 }
 149
 150 static struct name_sym_fn_list *init_hooks, *inc_hooks, *dec_hooks;
 151
 152 void add_refcount_init_hook(name_sym_hook *hook)
 153 {
 154         add_ptr_list(&init_hooks, hook);
 155 }
 156
 157 void add_refcount_inc_hook(name_sym_hook *hook)
 158 {
 159         add_ptr_list(&inc_hooks, hook);
 160 }
 161
 162 void add_refcount_dec_hook(name_sym_hook *hook)
 163 {
 164         add_ptr_list(&dec_hooks, hook);
 165 }
 166
 167 void call_hooks(struct name_sym_fn_list *hooks, struct expression *expr,
 168                 const char *name, struct symbol *sym)
 169 {
 170         name_sym_hook *hook;
 171
 172         FOR_EACH_PTR(hooks, hook) {
 173                 hook(expr, name, sym);
 174         } END_FOR_EACH_PTR(hook);
 175 }
 176
 177 static void do_init(struct expression *expr, const char *name, struct symbol *sym)
 178 {
 179         struct smatch_state *orig;
 180
 181         call_hooks(init_hooks, expr, name, sym);
 182
 183         orig = get_state(my_id, name, sym);
 184         if (orig) {
 185                 set_state(my_id, name, sym, &ignore);
 186                 return;
 187         }
 188
 189         set_state(my_id, name, sym, &init);
 190 }
 191
 192 static void do_inc(struct expression *expr, const char *name, struct symbol *sym)
 193 {
 194         struct smatch_state *orig;
 195
 196         call_hooks(inc_hooks, expr, name, sym);
 197
 198         orig = get_state(my_id, name, sym);
 199         if (orig) {
 200                 set_state(my_id, name, sym, &ignore);
 201                 return;
 202         }
 203
 204         set_state(my_id, name, sym, &inc);
 205 }
 206
 207 static void do_dec(struct expression *expr, const char *name, struct symbol *sym)
 208 {
 209         struct smatch_state *orig;
 210
 211         call_hooks(dec_hooks, expr, name, sym);
 212
 213         orig = get_state(my_id, name, sym);
 214         if (orig) {
 215                 set_state(my_id, name, sym, &ignore);
 216                 return;
 217         }
 218
 219         set_state(my_id, name, sym, &dec);
 220 }
 221
 222 static bool is_refcount_primitive(struct expression *expr)
 223 {
 224         int i;
 225
 226         while (expr->type == EXPR_ASSIGNMENT)
 227                 expr = strip_expr(expr->right);
 228         if (expr->type != EXPR_CALL)
 229                 return false;
 230
 231         if (expr->fn->type != EXPR_SYMBOL)
 232                 return false;
 233
 234         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 235                 if (sym_name_is(func_table[i].name, expr->fn))
 236                         return true;
 237         }
 238
 239         return false;
 240 }
 241
 242 static void match_atomic_add(struct expression *expr, const char *name, struct symbol *sym, void *_unused)
 243 {
 244         struct expression *amount;
 245         sval_t sval;
 246
 247         amount = get_argument_from_call_expr(expr->args, 0);
 248         if (!get_implied_value(amount, &sval)) {
 249                 do_inc(expr, name, sym);
 250                 return;
 251         }
 252
 253         if (sval.value == 0) {
 254                 set_state(my_id, name, sym, &ignore);
 255                 return;
 256         }
 257
 258         if (sval_is_positive(sval))
 259                 do_inc(expr, name, sym);
 260         else
 261                 do_dec(expr, name, sym);
 262 }
 263
 264 static void refcount_init(struct expression *expr, const char *name, struct symbol *sym, void *data)
 265 {
 266         if (!data && is_refcount_primitive(expr))
 267                 return;
 268         do_init(expr, name, sym);
 269 }
 270
 271 static void refcount_inc(struct expression *expr, const char *name, struct symbol *sym, void *data)
 272 {
 273         if (!data && is_refcount_primitive(expr))
 274                 return;
 275         do_inc(expr, name, sym);
 276 }
 277
 278 static void refcount_dec(struct expression *expr, const char *name, struct symbol *sym, void *data)
 279 {
 280         if (!data && is_refcount_primitive(expr))
 281                 return;
 282         do_dec(expr, name, sym);
 283 }
 284
 285 static void match_return_info(int return_id, char *return_ranges,
 286                                        struct expression *returned_expr,
 287                                        int param,
 288                                        const char *printed_name,
 289                                        struct sm_state *sm)
 290 {
 291         struct smatch_state *state;
 292         int type;
 293
 294         if (param == -1 && return_ranges && strcmp(return_ranges, "0") == 0)
 295                 return;
 296
 297         state = sm->state;
 298         if (state == &init)
 299                 type = REFCOUNT_INIT;
 300         else if (state == &inc)
 301                 type = REFCOUNT_INC;
 302         else if (state == &dec)
 303                 type = REFCOUNT_DEC;
 304         else
 305                 return;
 306
 307         sql_insert_return_states(return_id, return_ranges, type, param, printed_name, "");
 308 }
 309
 310 static void match_asm(struct statement *stmt)
 311 {
 312         struct expression *expr;
 313         struct asm_operand *op;
 314         struct symbol *sym;
 315         bool inc = false;
 316         char *macro;
 317         char *name;
 318
 319         macro = get_macro_name(stmt->pos);
 320         if (!macro)
 321                 return;
 322
 323         if (strcmp(macro, "this_cpu_inc") == 0)
 324                 inc = true;
 325         else if (strcmp(macro, "this_cpu_dec") != 0)
 326                 return;
 327
 328         op = first_ptr_list((struct ptr_list *)stmt->asm_outputs);
 329         if (!op)
 330                 return;
 331
 332         expr = strip_expr(op->expr);
 333         name = expr_to_var_sym(expr, &sym);
 334         if (!name || !sym)
 335                 return;
 336
 337         if (inc)
 338                 do_inc(expr, name, sym);
 339         else
 340                 do_dec(expr, name, sym);
 341 }
 342
 343 void register_refcount_info(int id)
 344 {
 345         struct ref_func_info *info;
 346         param_key_hook *cb;
 347         int i;
 348
 349         my_id = id;
 350
 351         if (option_project != PROJ_KERNEL)
 352                 return;
 353
 354         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 355                 info = &func_table[i];
 356
 357                 if (info->call_back)
 358                         cb = info->call_back;
 359                 else if (info->type == REFCOUNT_INIT)
 360                         cb = refcount_init;
 361                 else if (info->type == REFCOUNT_INC)
 362                         cb = refcount_inc;
 363                 else
 364                         cb = refcount_dec;
 365
 366                 if (info->implies_start) {
 367                         return_implies_param_key(info->name,
 368                                         *info->implies_start, *info->implies_end,
 369                                         cb, info->param, info->key, info);
 370                 } else {
 371                         add_function_param_key_hook_late(info->name, cb,
 372                                         info->param, info->key, info);
 373                 }
 374         }
 375
 376         add_merge_hook(my_id, &merge_states);
 377         add_return_info_callback(my_id, &match_return_info);
 378         add_hook(match_asm, ASM_HOOK);
 379
 380         select_return_param_key(REFCOUNT_INC, &refcount_inc);
 381         select_return_param_key(REFCOUNT_DEC, &refcount_dec);
 382
 383         add_unmatched_state_hook(my_id, &unmatched_state);
 384 }