check_unwind.c

   1 /*
   2  * Copyright (C) 2020 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include <ctype.h>
  19
  20 #include "smatch.h"
  21 #include "smatch_extra.h"
  22 #include "smatch_slist.h"
  23
  24 static int my_id;
  25 static int info_id;
  26
  27 #define IGNORE 100000
  28
  29 STATE(alloc);
  30 STATE(release);
  31 STATE(param_released);
  32 STATE(ignore);
  33 STATE(unknown);
  34
  35 static unsigned long fn_has_alloc;
  36
  37 struct ref_func_info {
  38         const char *name;
  39         int type;
  40         int param;
  41         const char *key;
  42         const sval_t *implies_start, *implies_end;
  43         func_hook *call_back;
  44 };
  45
  46 static struct ref_func_info func_table[] = {
  47         { "clk_prepare", ALLOC, 0, "$", &int_zero, &int_zero },
  48         { "clk_prepare_enable", ALLOC, 0, "$", &int_zero, &int_zero },
  49         { "clk_disable_unprepare", RELEASE, 0, "$" },
  50         { "clk_unprepare", RELEASE, 0, "$" },
  51
  52         { "alloc_etherdev_mqs", ALLOC, -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  53         { "free_netdev", RELEASE, 0, "$" },
  54
  55         /*
  56          * FIXME: A common pattern in release functions like amd76xrom_cleanup()
  57          * is to do:
  58          *
  59          *      if (window->rsrc.parent)
  60          *              release_resource(&window->rsrc);
  61          *
  62          * Which is slightly tricky to know how to merge the states so let's
  63          * hold off checking request_resource() for now.
  64          *
  65          * { "request_resource", ALLOC,   1, "$", &int_zero, &int_zero },
  66          * { "release_resource", RELEASE, 0, "$" },
  67          *
  68          */
  69
  70         { "pci_request_regions", ALLOC,   0, "$", &int_zero, &int_zero },
  71         { "pci_release_regions", RELEASE, 0, "$" },
  72
  73         { "request_free_mem_region", ALLOC,   -1, "$->start", &valid_ptr_min_sval, &valid_ptr_max_sval },
  74         { "__request_region", ALLOC,   1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  75         { "release_and_free_resource", RELEASE, 0, "$->start" },
  76         { "release_resource", RELEASE, 0, "$->start" },
  77         { "__release_region", RELEASE, 1, "$" },
  78
  79         { "ioremap", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  80         { "of_iomap", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  81         { "ioremap_encrypted", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  82         { "iounmap", RELEASE, 0, "$" },
  83
  84         { "request_threaded_irq", ALLOC,   0, "$", &int_zero, &int_zero },
  85         { "request_irq", ALLOC,   0, "$", &int_zero, &int_zero },
  86         { "free_irq",    RELEASE, 0, "$" },
  87         { "pci_request_irq", ALLOC,   1, "$", &int_zero, &int_zero },
  88         { "pci_free_irq",    RELEASE, 1, "$" },
  89
  90         { "register_netdev",   ALLOC,   0, "$", &int_zero, &int_zero },
  91         { "unregister_netdev", RELEASE, 0, "$" },
  92
  93         { "misc_register",   ALLOC,   0, "$", &int_zero, &int_zero },
  94         { "misc_deregister", RELEASE, 0, "$" },
  95
  96         { "ieee80211_alloc_hw", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
  97         { "ieee80211_free_hw",  RELEASE, 0, "$" },
  98 };
  99
 100 static struct smatch_state *unmatched_state(struct sm_state *sm)
 101 {
 102         struct smatch_state *state;
 103
 104         if (sm->state != &param_released)
 105                 return &undefined;
 106
 107         if (is_impossible_path())
 108                 return &param_released;
 109
 110         state = get_state(SMATCH_EXTRA, sm->name, sm->sym);
 111         if (!state)
 112                 return &undefined;
 113         if (!estate_rl(state) || is_err_or_null(estate_rl(state)))
 114                 return &param_released;
 115         if (parent_is_err_or_null_var_sym(sm->name, sm->sym))
 116                 return &param_released;
 117
 118         if (estate_min(state).value == 0 &&
 119             estate_max(state).value == 0)
 120                 return &param_released;
 121         if (estate_type(state) == &int_ctype &&
 122             sval_is_negative(estate_min(state)) &&
 123             (estate_max(state).value == -1 || estate_max(state).value == 0))
 124                 return &param_released;
 125
 126          return &undefined;
 127 }
 128
 129 static void pre_merge_hook(struct sm_state *cur, struct sm_state *other)
 130 {
 131         if (cur->state == &param_released)
 132                 return;
 133         if (is_impossible_path())
 134                 set_state(my_id, cur->name, cur->sym, &undefined);
 135 }
 136
 137 static bool is_param_var_sym(const char *name, struct symbol *sym)
 138 {
 139         const char *key;
 140
 141         return get_param_key_from_var_sym(name, sym, NULL, &key) >= 0;
 142 }
 143
 144 static bool mark_same_name_as_undefined(const char *name)
 145 {
 146         struct sm_state *sm;
 147         int len;
 148
 149         if (!name)
 150                 return false;
 151
 152         len = strlen(name);
 153
 154         FOR_EACH_MY_SM(my_id, __get_cur_stree(), sm) {
 155                 if (strncmp(sm->name, name, len) != 0)
 156                         continue;
 157                 if (sm->name[len] != ':')
 158                         continue;
 159                 set_state(sm->owner, sm->name, sm->sym, &unknown);
 160                 return true;
 161         } END_FOR_EACH_SM(sm);
 162
 163         return false;
 164 }
 165
 166 static void mark_partial_matches_as_undefined(const char *key)
 167 {
 168         struct sm_state *sm;
 169         int start_pos, state_len, key_len;
 170         char *p;
 171
 172         while ((p = strchr(key, '-'))) {
 173                 if (p[1] != '>')
 174                         return;
 175                 key = p + 2;
 176         }
 177         key_len = strlen(key);
 178
 179         FOR_EACH_MY_SM(my_id, __get_cur_stree(), sm) {
 180                 state_len = strlen(sm->name);
 181                 if (state_len < key_len)
 182                         continue;
 183
 184                 start_pos = state_len - key_len;
 185                 if ((start_pos == 0 || !isalnum(sm->name[start_pos - 1])) &&
 186                     strcmp(sm->name + start_pos, key) == 0)
 187                         update_ssa_state(my_id, sm->name, sm->sym, &unknown);
 188
 189         } END_FOR_EACH_SM(sm);
 190 }
 191
 192 static void mark_matches_as_undefined(const char *name)
 193 {
 194         if (mark_same_name_as_undefined(name))
 195                 return;
 196         mark_partial_matches_as_undefined(name);
 197 }
 198
 199 static bool is_alloc_primitive(struct expression *expr)
 200 {
 201         int i;
 202
 203         while (expr->type == EXPR_ASSIGNMENT)
 204                 expr = strip_expr(expr->right);
 205         if (expr->type != EXPR_CALL)
 206                 return false;
 207
 208         if (expr->fn->type != EXPR_SYMBOL)
 209                 return false;
 210
 211         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 212                 if (sym_name_is(func_table[i].name, expr->fn))
 213                         return true;
 214         }
 215
 216         return false;
 217 }
 218
 219 static void return_param_alloc(struct expression *expr, const char *name, struct symbol *sym, void *data)
 220 {
 221         struct smatch_state *state;
 222         char *fn_name;
 223
 224         fn_has_alloc = true;
 225
 226         if (strncmp(name, "__fake_", 7) == 0)
 227                 return;
 228
 229         if (sym->ctype.modifiers & (MOD_NONLOCAL | MOD_STATIC | MOD_ADDRESSABLE))
 230                 return;
 231
 232         while (expr->type == EXPR_ASSIGNMENT)
 233                 expr = strip_expr(expr->right);
 234         if (expr->type != EXPR_CALL)
 235                 return;
 236         fn_name = expr_to_var(expr->fn);
 237         if (!fn_name)
 238                 return;
 239
 240         state = alloc_state_str(fn_name);
 241         state->data = &alloc;
 242
 243         set_ssa_state(my_id, name, sym, state);
 244 }
 245
 246 static void return_param_release(struct expression *expr, const char *name, struct symbol *sym, void *data)
 247 {
 248         struct sm_state *start_sm;
 249
 250         /* The !data means this comes from the DB (not hard coded). */
 251         if (!data && is_alloc_primitive(expr))
 252                 return;
 253
 254         start_sm = get_ssa_sm_state(my_id, name, sym);
 255         if (start_sm) {
 256                 update_ssa_sm(my_id, start_sm, &release);
 257         } else {
 258                 if (fn_has_alloc) {
 259                         mark_matches_as_undefined(name);
 260                         return;
 261                 }
 262                 if (is_param_var_sym(name, sym))
 263                         set_state(info_id, name, sym, &param_released);
 264         }
 265 }
 266
 267 static void return_param_ignore(struct expression *expr, const char *name, struct symbol *sym, void *data)
 268 {
 269         struct sm_state *start_sm;
 270
 271         start_sm = get_ssa_sm_state(my_id, name, sym);
 272         if (!start_sm)
 273                 return;
 274         update_ssa_sm(my_id, start_sm, &ignore);
 275 }
 276
 277 static void match_sm_assign(struct sm_state *sm, struct expression *mod_expr)
 278 {
 279         char *left;
 280         bool tracked = true;
 281
 282         if (!mod_expr || mod_expr->type != EXPR_ASSIGNMENT)
 283                 return;
 284
 285         left = expr_to_str(mod_expr->left);
 286         if (!left || strchr(left, '['))
 287                 tracked = false;
 288         free_string(left);
 289
 290         if (!tracked)
 291                 set_state(my_id, sm->name, sm->sym, &ignore);
 292 }
 293
 294 static void unwind_return_info_callback(int return_id, char *return_ranges,
 295                                  struct expression *returned_expr,
 296                                  int param,
 297                                  const char *printed_name,
 298                                  struct sm_state *sm)
 299 {
 300         if (param < 0)
 301                 return;
 302         if (sm->state != &param_released)
 303                 return;
 304         if (is_impossible_path())
 305                 return;
 306
 307         sql_insert_return_states(return_id, return_ranges, RELEASE,
 308                                  param, printed_name, "");
 309 }
 310
 311 static const char *get_alloc_fn(struct sm_state *sm)
 312 {
 313         struct sm_state *tmp;
 314
 315         if (slist_has_state(sm->possible, &unknown))
 316                 return NULL;
 317
 318         if (sm->state->data == &alloc)
 319                 return sm->state->name;
 320
 321         FOR_EACH_PTR(sm->possible, tmp) {
 322                 if (tmp->state->data == &alloc)
 323                         return tmp->state->name;
 324         } END_FOR_EACH_PTR(tmp);
 325
 326         return NULL;
 327 }
 328
 329 static void check_balance(const char *name, struct symbol *sym)
 330 {
 331         struct range_list *inc_lines = NULL;
 332         int inc_buckets[RET_UNKNOWN + 1] = {};
 333         struct stree *stree, *orig_stree;
 334         struct smatch_state *state;
 335         struct sm_state *return_sm;
 336         struct sm_state *sm;
 337         sval_t line = sval_type_val(&int_ctype, 0);
 338         const char *tmp_name, *fn_name = NULL;
 339         int bucket;
 340
 341         FOR_EACH_PTR(get_all_return_strees(), stree) {
 342                 orig_stree = __swap_cur_stree(stree);
 343
 344                 if (is_impossible_path())
 345                         goto swap_stree;
 346                 if (db_incomplete())
 347                         goto swap_stree;
 348                 if (has_devm_cleanup())
 349                         goto swap_stree;
 350
 351                 return_sm = get_sm_state(RETURN_ID, "return_ranges", NULL);
 352                 if (!return_sm)
 353                         goto swap_stree;
 354                 line.value = return_sm->line;
 355
 356                 sm = get_sm_state(my_id, name, sym);
 357                 if (!sm)
 358                         goto swap_stree;
 359
 360                 state = sm->state;
 361                 if (state == &param_released)
 362                         state = &release;
 363
 364                 tmp_name = get_alloc_fn(sm);
 365                 if (tmp_name) {
 366                         fn_name = tmp_name;
 367                         state = &alloc;
 368                 }
 369
 370                 if (state != &alloc &&
 371                     state != &release)
 372                         goto swap_stree;
 373
 374                 bucket = success_fail_return(estate_rl(return_sm->state));
 375                 if (bucket != RET_FAIL)
 376                         goto swap_stree;
 377
 378                 if (state == &alloc) {
 379                         add_range(&inc_lines, line, line);
 380                         inc_buckets[bucket] = true;
 381                 }
 382 swap_stree:
 383                 __swap_cur_stree(orig_stree);
 384         } END_FOR_EACH_PTR(stree);
 385
 386         if (inc_buckets[RET_FAIL])
 387                 goto complain;
 388
 389         return;
 390
 391 complain:
 392         sm_warning("'%s' from %s() not released on lines: %s.", ssa_name(name), fn_name, show_rl(inc_lines));
 393 }
 394
 395 static void match_check_balanced(struct symbol *sym)
 396 {
 397         struct sm_state *sm;
 398
 399         FOR_EACH_MY_SM(my_id, get_all_return_states(), sm) {
 400                 check_balance(sm->name, sm->sym);
 401         } END_FOR_EACH_SM(sm);
 402 }
 403
 404 void check_unwind(int id)
 405 {
 406         struct ref_func_info *info;
 407         int i;
 408
 409         my_id = id;
 410
 411         if (option_project != PROJ_KERNEL)
 412                 return;
 413
 414         set_dynamic_states(my_id);
 415         add_pre_merge_hook(my_id, &pre_merge_hook);
 416
 417         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 418                 param_key_hook *hook;
 419
 420                 info = &func_table[i];
 421                 if (info->type == ALLOC)
 422                         hook = &return_param_alloc;
 423                 else if (info->type == RELEASE)
 424                         hook = &return_param_release;
 425                 else if (info->type == IGNORE)
 426                         hook = &return_param_ignore;
 427                 else
 428                         exit(1);
 429
 430                 if (info->call_back) {
 431                         add_function_hook(info->name, info->call_back, info);
 432                 } else if (info->implies_start && info->type == ALLOC) {
 433                         return_implies_param_key_exact(info->name,
 434                                         *info->implies_start,
 435                                         *info->implies_end,
 436                                         hook, info->param, info->key, info);
 437                 } else if (info->implies_start) {
 438                         return_implies_param_key(info->name,
 439                                         *info->implies_start,
 440                                         *info->implies_end,
 441                                         hook, info->param, info->key, info);
 442                 } else {
 443                         add_function_param_key_hook(info->name,
 444                                 hook, info->param, info->key, info);
 445                 }
 446         }
 447
 448         add_ssa_state_assigned_hook(my_id, match_sm_assign);
 449
 450         add_function_data(&fn_has_alloc);
 451
 452         select_return_param_key(RELEASE, &return_param_release);
 453         add_hook(&match_check_balanced, END_FUNC_HOOK);
 454 }
 455
 456 void check_unwind_info(int id)
 457 {
 458         info_id = id;
 459
 460         add_unmatched_state_hook(info_id, &unmatched_state);
 461         add_return_info_callback(info_id, unwind_return_info_callback);
 462 }