&(foo->bar) is not really a dereference.
[smatch.git] / check_memory.c
blob70cfebdae6d5acd87a3da73bba4db78a96243110
1 /*
2 * sparse/check_memory.c
4 * Copyright (C) 2008 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
8 */
10 #include <fcntl.h>
11 #include <unistd.h>
12 #include "parse.h"
13 #include "smatch.h"
14 #include "smatch_slist.h"
16 static int my_id;
18 STATE(allocated);
19 STATE(assigned);
20 STATE(isfree);
21 STATE(malloced);
22 STATE(isnull);
23 STATE(unfree);
26 malloced --> allocated --> assigned --> isfree +
27 \-> isnull. \-> isfree +
29 isfree --> unfree.
30 \-> isnull.
33 static struct tracker_list *arguments;
35 static const char *allocation_funcs[] = {
36 "malloc",
37 "kmalloc",
38 "kzalloc",
39 NULL,
42 static char *get_parent_name(struct symbol *sym)
44 static char buf[256];
46 if (!sym || !sym->ident)
47 return NULL;
49 snprintf(buf, 255, "-%s", sym->ident->name);
50 buf[255] = '\0';
51 return alloc_string(buf);
54 static int is_parent_sym(const char *name)
56 if (!strncmp(name, "-", 1))
57 return 1;
58 return 0;
61 static struct smatch_state *unmatched_state(struct sm_state *sm)
63 if (is_parent_sym(sm->name))
64 return &assigned;
65 return &undefined;
68 static void assign_parent(struct symbol *sym)
70 char *name;
72 name = get_parent_name(sym);
73 if (!name)
74 return;
75 set_state(my_id, name, sym, &assigned);
76 free_string(name);
79 static int parent_is_assigned(struct symbol *sym)
81 struct smatch_state *state;
82 char *name;
84 name = get_parent_name(sym);
85 if (!name)
86 return 0;
87 state = get_state(my_id, name, sym);
88 free_string(name);
89 if (state == &assigned)
90 return 1;
91 return 0;
94 static int is_allocation(struct expression *expr)
96 char *fn_name;
97 int i;
99 if (expr->type != EXPR_CALL)
100 return 0;
102 if (!(fn_name = get_variable_from_expr(expr->fn, NULL)))
103 return 0;
105 for (i = 0; allocation_funcs[i]; i++) {
106 if (!strcmp(fn_name, allocation_funcs[i])) {
107 free_string(fn_name);
108 return 1;
111 free_string(fn_name);
112 return 0;
115 static int is_freed(const char *name, struct symbol *sym)
117 struct state_list *slist;
119 slist = get_possible_states(my_id, name, sym);
120 if (slist_has_state(slist, &isfree)) {
121 return 1;
123 return 0;
126 static int is_argument(struct symbol *sym)
128 struct tracker *arg;
130 FOR_EACH_PTR(arguments, arg) {
131 if (arg->sym == sym)
132 return 1;
133 } END_FOR_EACH_PTR(arg);
134 return 0;
137 static void match_function_def(struct symbol *sym)
139 struct symbol *arg;
141 FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
142 add_tracker(&arguments, my_id, (arg->ident?arg->ident->name:"NULL"), arg);
143 } END_FOR_EACH_PTR(arg);
146 static int is_parent(struct expression *expr)
148 if (expr->type == EXPR_DEREF)
149 return 0;
150 return 1;
153 static void match_assign(struct expression *expr)
155 struct expression *left, *right;
156 char *left_name = NULL;
157 char *right_name = NULL;
158 struct symbol *left_sym, *right_sym;
159 struct smatch_state *state;
161 left = strip_expr(expr->left);
162 left_name = get_variable_from_expr_complex(left, &left_sym);
164 right = strip_expr(expr->right);
165 if (left_name && left_sym && is_allocation(right) &&
166 !(left_sym->ctype.modifiers &
167 (MOD_NONLOCAL | MOD_STATIC | MOD_ADDRESSABLE)) &&
168 !parent_is_assigned(left_sym)) {
169 set_state(my_id, left_name, left_sym, &malloced);
170 goto exit;
173 right_name = get_variable_from_expr_complex(right, &right_sym);
175 if (right_name && (state = get_state(my_id, right_name, right_sym))) {
176 if (state == &isfree)
177 sm_msg("error: assigning freed pointer");
178 set_state(my_id, right_name, right_sym, &assigned);
181 if (is_freed(left_name, left_sym)) {
182 set_state(my_id, left_name, left_sym, &unfree);
184 if (left_name && is_parent(left))
185 assign_parent(left_sym);
186 if (right_name && is_parent(right))
187 assign_parent(right_sym);
188 exit:
189 free_string(left_name);
190 free_string(right_name);
193 static int is_null(const char *name, struct symbol *sym)
195 struct smatch_state *state;
197 state = get_state(my_id, name, sym);
198 if (state && !strcmp(state->name, "isnull"))
199 return 1;
200 return 0;
203 static void match_free_func(const char *fn, struct expression *expr, void *data)
205 struct expression *ptr_expr;
206 char *ptr_name;
207 struct symbol *ptr_sym;
208 int arg_num = PTR_INT(data);
210 ptr_expr = get_argument_from_call_expr(expr->args, arg_num);
211 ptr_name = get_variable_from_expr_complex(ptr_expr, &ptr_sym);
212 if (is_freed(ptr_name, ptr_sym) && !is_null(ptr_name, ptr_sym)) {
213 sm_msg("error: double free of %s", ptr_name);
215 set_state(my_id, ptr_name, ptr_sym, &isfree);
216 free_string(ptr_name);
219 static int possibly_allocated(struct state_list *slist)
221 struct sm_state *tmp;
223 FOR_EACH_PTR(slist, tmp) {
224 if (tmp->state == &allocated)
225 return 1;
226 if (tmp->state == &malloced)
227 return 1;
228 } END_FOR_EACH_PTR(tmp);
229 return 0;
232 static void check_sm_is_leaked(struct sm_state *sm)
234 if (possibly_allocated(sm->possible) &&
235 !is_null(sm->name, sm->sym) &&
236 !is_argument(sm->sym) &&
237 !parent_is_assigned(sm->sym))
238 sm_msg("error: memory leak of %s", sm->name);
241 static void check_tracker_is_leaked(struct tracker *t)
243 struct sm_state *sm;
245 sm = get_sm_state(t->owner, t->name, t->sym);
246 if (sm)
247 check_sm_is_leaked(sm);
248 __free_tracker(t);
251 static void match_declarations(struct symbol *sym)
253 const char *name;
255 if ((get_base_type(sym))->type == SYM_ARRAY) {
256 return;
259 name = sym->ident->name;
261 if (sym->initializer) {
262 if (is_allocation(sym->initializer)) {
263 set_state(my_id, name, sym, &malloced);
264 add_scope_hook((scope_hook *)&check_tracker_is_leaked,
265 alloc_tracker(my_id, name, sym));
266 scoped_state(my_id, name, sym);
267 } else {
268 assign_parent(sym);
273 static void check_for_allocated(void)
275 struct state_list *slist;
276 struct sm_state *tmp;
278 slist = get_all_states(my_id);
279 FOR_EACH_PTR(slist, tmp) {
280 check_sm_is_leaked(tmp);
281 } END_FOR_EACH_PTR(tmp);
282 free_slist(&slist);
285 static void match_return(struct expression *ret_value)
287 char *name;
288 struct symbol *sym;
290 name = get_variable_from_expr_complex(ret_value, &sym);
291 if (sym)
292 assign_parent(sym);
293 free_string(name);
294 check_for_allocated();
297 static void set_new_true_false_paths(const char *name, struct symbol *sym)
299 struct smatch_state *tmp;
301 tmp = get_state(my_id, name, sym);
303 if (!tmp) {
304 return;
307 if (tmp == &isfree) {
308 sm_msg("warn: why do you care about freed memory?");
311 if (tmp == &assigned) {
312 /* we don't care about assigned pointers any more */
313 return;
315 set_true_false_states(my_id, name, sym, &allocated, &isnull);
318 static void match_condition(struct expression *expr)
320 struct symbol *sym;
321 char *name;
323 expr = strip_expr(expr);
324 switch(expr->type) {
325 case EXPR_PREOP:
326 case EXPR_SYMBOL:
327 case EXPR_DEREF:
328 name = get_variable_from_expr_complex(expr, &sym);
329 if (!name)
330 return;
331 set_new_true_false_paths(name, sym);
332 free_string(name);
333 return;
334 case EXPR_ASSIGNMENT:
335 /* You have to deal with stuff like if (a = b = c) */
336 match_condition(expr->right);
337 match_condition(expr->left);
338 return;
339 default:
340 return;
344 static void match_function_call(struct expression *expr)
346 struct expression *tmp;
347 struct symbol *sym;
348 char *name;
349 struct sm_state *state;
351 FOR_EACH_PTR(expr->args, tmp) {
352 tmp = strip_expr(tmp);
353 name = get_variable_from_expr_complex(tmp, &sym);
354 if (!name)
355 continue;
356 if ((state = get_sm_state(my_id, name, sym))) {
357 if (possibly_allocated(state->possible)) {
358 set_state(my_id, name, sym, &assigned);
361 assign_parent(sym);
362 free_string(name);
363 } END_FOR_EACH_PTR(tmp);
366 static void match_dereferences(struct expression *expr)
368 char *deref = NULL;
369 struct symbol *sym = NULL;
371 if (expr->type != EXPR_PREOP)
372 return;
373 expr = strip_expr(expr->unop);
375 deref = get_variable_from_expr(expr, &sym);
376 if (!deref)
377 return;
378 if (is_freed(deref, sym)) {
379 sm_msg("error: dereferencing freed memory '%s'", deref);
380 set_state(my_id, deref, sym, &unfree);
382 free_string(deref);
385 static void match_end_func(struct symbol *sym)
387 check_for_allocated();
388 free_trackers_and_list(&arguments);
391 static void register_funcs_from_file(void)
393 struct token *token;
394 const char *func;
395 int arg;
397 token = get_tokens_file("kernel.frees_argument");
398 if (!token)
399 return;
400 if (token_type(token) != TOKEN_STREAMBEGIN)
401 return;
402 token = token->next;
403 while (token_type(token) != TOKEN_STREAMEND) {
404 if (token_type(token) != TOKEN_IDENT)
405 return;
406 func = show_ident(token->ident);
407 token = token->next;
408 if (token_type(token) != TOKEN_NUMBER)
409 return;
410 arg = atoi(token->number);
411 add_function_hook(func, &match_free_func, INT_PTR(arg));
412 token = token->next;
414 clear_token_alloc();
417 void check_memory(int id)
419 my_id = id;
420 add_unmatched_state_hook(my_id, &unmatched_state);
421 add_hook(&match_function_def, FUNC_DEF_HOOK);
422 add_hook(&match_declarations, DECLARATION_HOOK);
423 add_hook(&match_function_call, FUNCTION_CALL_HOOK);
424 add_hook(&match_condition, CONDITION_HOOK);
425 add_hook(&match_dereferences, DEREF_HOOK);
426 add_hook(&match_assign, ASSIGNMENT_HOOK);
427 add_hook(&match_return, RETURN_HOOK);
428 add_hook(&match_end_func, END_FUNC_HOOK);
429 if (option_project == PROJ_KERNEL)
430 add_function_hook("kfree", &match_free_func, (void *)0);
431 else
432 add_function_hook("free", &match_free_func, (void *)0);
433 register_funcs_from_file();