check_free_strict.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * check_memory() is getting too big and messy.
  20  *
  21  */
  22
  23 #include <string.h>
  24 #include "smatch.h"
  25 #include "smatch_slist.h"
  26 #include "smatch_extra.h"
  27
  28 static int my_id;
  29
  30 STATE(freed);
  31 STATE(ok);
  32
  33 static void ok_to_use(struct sm_state *sm, struct expression *mod_expr)
  34 {
  35         if (sm->state != &ok)
  36                 set_state(my_id, sm->name, sm->sym, &ok);
  37 }
  38
  39 static void pre_merge_hook(struct sm_state *sm)
  40 {
  41         if (is_impossible_path())
  42                 set_state(my_id, sm->name, sm->sym, &ok);
  43 }
  44
  45 static int is_freed(struct expression *expr)
  46 {
  47         struct sm_state *sm;
  48
  49         sm = get_sm_state_expr(my_id, expr);
  50         if (sm && slist_has_state(sm->possible, &freed))
  51                 return 1;
  52         return 0;
  53 }
  54
  55 static void match_symbol(struct expression *expr)
  56 {
  57         struct expression *parent;
  58         char *name;
  59
  60         if (is_impossible_path())
  61                 return;
  62         if (__in_fake_parameter_assign)
  63                 return;
  64
  65         parent = expr_get_parent_expr(expr);
  66         while (parent && parent->type == EXPR_PREOP && parent->op == '(')
  67                 parent = expr_get_parent_expr(parent);
  68         if (parent && parent->type == EXPR_PREOP && parent->op == '&')
  69                 return;
  70
  71         if (!is_freed(expr))
  72                 return;
  73         name = expr_to_var(expr);
  74         sm_msg("warn: '%s' was already freed.", name);
  75         free_string(name);
  76 }
  77
  78 static void match_dereferences(struct expression *expr)
  79 {
  80         char *name;
  81
  82         if (expr->type != EXPR_PREOP)
  83                 return;
  84
  85         if (is_impossible_path())
  86                 return;
  87         if (__in_fake_parameter_assign)
  88                 return;
  89
  90         expr = strip_expr(expr->unop);
  91         if (!is_freed(expr))
  92                 return;
  93         name = expr_to_var(expr);
  94         sm_msg("error: dereferencing freed memory '%s'", name);
  95         set_state_expr(my_id, expr, &ok);
  96         free_string(name);
  97 }
  98
  99 static int ignored_params[16];
 100
 101 static void set_ignored_params(struct expression *call)
 102 {
 103         struct expression *arg;
 104         const char *p;
 105         int i;
 106
 107         memset(&ignored_params, 0, sizeof(ignored_params));
 108
 109         i = -1;
 110         FOR_EACH_PTR(call->args, arg) {
 111                 i++;
 112                 if (arg->type != EXPR_STRING)
 113                         continue;
 114                 goto found;
 115         } END_FOR_EACH_PTR(arg);
 116
 117         return;
 118
 119 found:
 120         i++;
 121         p = arg->string->data;
 122         while ((p = strchr(p, '%'))) {
 123                 if (i >= ARRAY_SIZE(ignored_params))
 124                         return;
 125                 p++;
 126                 if (*p == '%') {
 127                         p++;
 128                         continue;
 129                 }
 130                 if (*p == '.')
 131                         p++;
 132                 if (*p == '*')
 133                         i++;
 134                 if (*p == 'p')
 135                         ignored_params[i] = 1;
 136                 i++;
 137         }
 138 }
 139
 140 static int is_free_func(struct expression *fn)
 141 {
 142         char *name;
 143         int ret = 0;
 144
 145         name = expr_to_str(fn);
 146         if (!name)
 147                 return 0;
 148         if (strstr(name, "free"))
 149                 ret = 1;
 150         free_string(name);
 151
 152         return ret;
 153 }
 154
 155 static void match_call(struct expression *expr)
 156 {
 157         struct expression *arg;
 158         char *name;
 159         int i;
 160
 161         if (is_impossible_path())
 162                 return;
 163
 164         set_ignored_params(expr);
 165
 166         i = -1;
 167         FOR_EACH_PTR(expr->args, arg) {
 168                 i++;
 169                 if (!is_pointer(arg))
 170                         continue;
 171                 if (!is_freed(arg))
 172                         continue;
 173                 if (ignored_params[i])
 174                         continue;
 175
 176                 name = expr_to_var(arg);
 177                 if (is_free_func(expr->fn))
 178                         sm_msg("error: double free of '%s'", name);
 179                 else
 180                         sm_msg("warn: passing freed memory '%s'", name);
 181                 set_state_expr(my_id, arg, &ok);
 182                 free_string(name);
 183         } END_FOR_EACH_PTR(arg);
 184 }
 185
 186 static void match_return(struct expression *expr)
 187 {
 188         char *name;
 189
 190         if (is_impossible_path())
 191                 return;
 192
 193         if (!expr)
 194                 return;
 195         if (!is_freed(expr))
 196                 return;
 197
 198         name = expr_to_var(expr);
 199         sm_msg("warn: returning freed memory '%s'", name);
 200         set_state_expr(my_id, expr, &ok);
 201         free_string(name);
 202 }
 203
 204 static void match_free(const char *fn, struct expression *expr, void *param)
 205 {
 206         struct expression *arg;
 207
 208         if (is_impossible_path())
 209                 return;
 210
 211         arg = get_argument_from_call_expr(expr->args, PTR_INT(param));
 212         if (!arg)
 213                 return;
 214         if (is_freed(arg)) {
 215                 char *name = expr_to_var(arg);
 216
 217                 sm_msg("error: double free of '%s'", name);
 218                 free_string(name);
 219         }
 220         set_state_expr(my_id, arg, &freed);
 221 }
 222
 223 static void set_param_freed(struct expression *expr, int param, char *key, char *value)
 224 {
 225         struct expression *arg;
 226         char *name;
 227         struct symbol *sym;
 228         struct sm_state *sm;
 229
 230         while (expr->type == EXPR_ASSIGNMENT)
 231                 expr = strip_expr(expr->right);
 232         if (expr->type != EXPR_CALL)
 233                 return;
 234
 235         arg = get_argument_from_call_expr(expr->args, param);
 236         if (!arg)
 237                 return;
 238         name = get_variable_from_key(arg, key, &sym);
 239         if (!name || !sym)
 240                 goto free;
 241
 242         if (!is_impossible_path()) {
 243                 sm = get_sm_state(my_id, name, sym);
 244                 if (sm && slist_has_state(sm->possible, &freed)) {
 245                         sm_msg("warn: '%s' double freed", name);
 246                         set_state(my_id, name, sym, &ok);  /* fixme: doesn't silence anything.  I know */
 247                 }
 248         }
 249
 250         set_state(my_id, name, sym, &freed);
 251 free:
 252         free_string(name);
 253 }
 254
 255 int parent_is_free_var_sym_strict(const char *name, struct symbol *sym)
 256 {
 257         char buf[256];
 258         char *start;
 259         char *end;
 260         struct smatch_state *state;
 261
 262         strncpy(buf, name, sizeof(buf) - 1);
 263         buf[sizeof(buf) - 1] = '\0';
 264
 265         start = &buf[0];
 266         while ((*start == '&'))
 267                 start++;
 268
 269         while ((end = strrchr(start, '-'))) {
 270                 *end = '\0';
 271                 state = __get_state(my_id, start, sym);
 272                 if (state == &freed)
 273                         return 1;
 274         }
 275         return 0;
 276 }
 277
 278 int parent_is_free_strict(struct expression *expr)
 279 {
 280         struct symbol *sym;
 281         char *var;
 282         int ret = 0;
 283
 284         expr = strip_expr(expr);
 285         var = expr_to_var_sym(expr, &sym);
 286         if (!var || !sym)
 287                 goto free;
 288         ret = parent_is_free_var_sym_strict(var, sym);
 289 free:
 290         free_string(var);
 291         return ret;
 292 }
 293
 294 void check_free_strict(int id)
 295 {
 296         my_id = id;
 297
 298         if (option_project != PROJ_KERNEL)
 299                 return;
 300
 301         add_function_hook("kfree", &match_free, INT_PTR(0));
 302         add_function_hook("kmem_cache_free", &match_free, INT_PTR(1));
 303
 304         if (option_spammy)
 305                 add_hook(&match_symbol, SYM_HOOK);
 306         add_hook(&match_dereferences, DEREF_HOOK);
 307         add_hook(&match_call, FUNCTION_CALL_HOOK);
 308         add_hook(&match_return, RETURN_HOOK);
 309
 310         add_modification_hook_late(my_id, &ok_to_use);
 311         add_pre_merge_hook(my_id, &pre_merge_hook);
 312
 313         select_return_states_hook(PARAM_FREED, &set_param_freed);
 314 }