2 * sparse/check_locking.c
4 * Copyright (C) 2009 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 * This test checks that locks are held the same across all returns.
13 * Of course, some functions are designed to only hold the locks on success.
14 * Oh well... We can rewrite it later if we want.
19 #include "smatch_slist.h"
21 static const char *lock_funcs
[] = {
27 "_spin_lock_irqsave_nested",
34 "_write_lock_irqsave",
41 static const char *unlock_funcs
[] = {
43 "_spin_unlock_irqrestore",
48 "_read_unlock_irqrestore",
52 "_write_unlock_irqrestore",
59 static const char *conditional_funcs
[] = {
64 "generic__raw_read_trylock",
70 "__raw_write_trylock",
71 "__raw_write_trylock",
75 /* These functions return 0 on success */
76 static const char *reverse_cond_funcs
[] = {
82 /* todo still need to handle__raw_spin_is_locked */
90 static struct locked_call lock_needed
[] = {
91 {"tty_ldisc_ref_wait", "tty_ldisc_lock"},
96 static struct tracker_list
*starts_locked
;
97 static struct tracker_list
*starts_unlocked
;
99 struct locks_on_return
{
101 struct tracker_list
*locked
;
102 struct tracker_list
*unlocked
;
104 DECLARE_PTR_LIST(return_list
, struct locks_on_return
);
105 static struct return_list
*all_returns
;
111 * merge_func() is used merging NULL and a state should be merge plus
112 * the state that the function was originally called with. This way
113 * we can sometimes avoid being &undefined.
115 static struct smatch_state
*merge_func(const char *name
, struct symbol
*sym
,
116 struct smatch_state
*s1
,
117 struct smatch_state
*s2
)
124 if (in_tracker_list(starts_locked
, name
, my_id
, sym
))
126 if (in_tracker_list(starts_unlocked
, name
, my_id
, sym
))
128 if (is_locked
&& is_unlocked
)
130 if (s2
== &locked
&& is_locked
)
132 if (s2
== &unlocked
&& is_unlocked
)
137 static char *match_func(const char *list
[], char *fn_name
,
138 struct expression_list
*args
)
140 struct expression
*lock_expr
;
143 for (i
= 0; list
[i
]; i
++) {
144 if (!strcmp(fn_name
, list
[i
])) {
145 lock_expr
= get_argument_from_call_expr(args
, 0);
146 return get_variable_from_expr(lock_expr
, NULL
);
152 static char kernel
[] = "kernel";
153 static char *match_lock_func(char *fn_name
, struct expression_list
*args
)
157 arg
= match_func(lock_funcs
, fn_name
, args
);
160 if (!strcmp(fn_name
, "lock_kernel"))
161 return alloc_string(kernel
);
165 static char *match_unlock_func(char *fn_name
, struct expression_list
*args
)
169 arg
= match_func(unlock_funcs
, fn_name
, args
);
172 if (!strcmp(fn_name
, "unlock_kernel"))
173 return alloc_string(kernel
);
177 static void check_locks_needed(const char *fn_name
)
179 struct smatch_state
*state
;
182 for (i
= 0; i
< sizeof(lock_needed
)/sizeof(struct locked_call
); i
++) {
183 if (!strcmp(fn_name
, lock_needed
[i
].function
)) {
184 state
= get_state(lock_needed
[i
].lock
, my_id
, NULL
);
185 if (state
!= &locked
) {
186 smatch_msg("error: %s called without holding '%s' lock",
187 lock_needed
[i
].function
,
188 lock_needed
[i
].lock
);
194 static void match_call(struct expression
*expr
)
200 fn_name
= get_variable_from_expr(expr
->fn
, NULL
);
204 if ((lock_name
= match_lock_func(fn_name
, expr
->args
))) {
205 sm
= get_sm_state(lock_name
, my_id
, NULL
);
207 add_tracker(&starts_unlocked
, lock_name
, my_id
, NULL
);
208 if (sm
&& slist_has_state(sm
->possible
, &locked
))
209 smatch_msg("error: double lock '%s'", lock_name
);
210 set_state(lock_name
, my_id
, NULL
, &locked
);
211 } else if ((lock_name
= match_unlock_func(fn_name
, expr
->args
))) {
212 sm
= get_sm_state(lock_name
, my_id
, NULL
);
214 add_tracker(&starts_locked
, lock_name
, my_id
, NULL
);
215 if (sm
&& slist_has_state(sm
->possible
, &unlocked
))
216 smatch_msg("error: double unlock '%s'", lock_name
);
217 set_state(lock_name
, my_id
, NULL
, &unlocked
);
219 check_locks_needed(fn_name
);
220 free_string(lock_name
);
221 free_string(fn_name
);
225 static void match_condition(struct expression
*expr
)
230 if (expr
->type
!= EXPR_CALL
)
233 fn_name
= get_variable_from_expr(expr
->fn
, NULL
);
237 if ((lock_name
= match_func(conditional_funcs
, fn_name
, expr
->args
))) {
238 if (!get_state(lock_name
, my_id
, NULL
))
239 add_tracker(&starts_unlocked
, lock_name
, my_id
, NULL
);
240 set_true_false_states(lock_name
, my_id
, NULL
, &locked
, &unlocked
);
242 if ((lock_name
= match_func(reverse_cond_funcs
, fn_name
, expr
->args
))) {
243 if (!get_state(lock_name
, my_id
, NULL
))
244 add_tracker(&starts_unlocked
, lock_name
, my_id
, NULL
);
245 set_true_false_states(lock_name
, my_id
, NULL
, &unlocked
, &locked
);
247 free_string(lock_name
);
248 free_string(fn_name
);
252 static struct locks_on_return
*alloc_return(int line
)
254 struct locks_on_return
*ret
;
256 ret
= malloc(sizeof(*ret
));
259 ret
->unlocked
= NULL
;
263 static void check_possible(struct sm_state
*sm
)
265 struct sm_state
*tmp
;
270 FOR_EACH_PTR(sm
->possible
, tmp
) {
271 if (tmp
->state
== &locked
)
273 else if (tmp
->state
== &unlocked
)
275 else if (tmp
->state
== &undefined
)
277 } END_FOR_EACH_PTR(tmp
);
278 if ((islocked
&& isunlocked
) || undef
)
279 smatch_msg("warn: '%s' is sometimes locked here and "
280 "sometimes unlocked.", sm
->name
);
283 static void match_return(struct statement
*stmt
)
285 struct locks_on_return
*ret
;
286 struct state_list
*slist
;
287 struct sm_state
*tmp
;
289 ret
= alloc_return(get_lineno());
291 slist
= get_all_states(my_id
);
292 FOR_EACH_PTR(slist
, tmp
) {
293 if (tmp
->state
== &locked
) {
294 add_tracker(&ret
->locked
, tmp
->name
, tmp
->owner
,
296 } else if (tmp
->state
== &unlocked
) {
297 add_tracker(&ret
->unlocked
, tmp
->name
, tmp
->owner
,
302 } END_FOR_EACH_PTR(tmp
);
304 add_ptr_list(&all_returns
, ret
);
307 static void check_returns_consistently(struct tracker
*lock
,
308 struct smatch_state
*start
)
310 int returns_locked
= 0;
311 int returns_unlocked
= 0;
312 struct locks_on_return
*tmp
;
314 FOR_EACH_PTR(all_returns
, tmp
) {
315 if (in_tracker_list(tmp
->unlocked
, lock
->name
, lock
->owner
,
317 returns_unlocked
= tmp
->line
;
318 else if (in_tracker_list(tmp
->locked
, lock
->name
, lock
->owner
,
320 returns_locked
= tmp
->line
;
321 else if (start
== &locked
)
322 returns_locked
= tmp
->line
;
323 else if (start
== &unlocked
)
324 returns_unlocked
= tmp
->line
;
325 } END_FOR_EACH_PTR(tmp
);
327 if (returns_locked
&& returns_unlocked
)
328 smatch_msg("warn: lock '%s' held on line %d but not on %d.",
329 lock
->name
, returns_locked
, returns_unlocked
);
333 static void clear_lists()
335 struct locks_on_return
*tmp
;
337 free_trackers_and_list(&starts_locked
);
338 free_trackers_and_list(&starts_unlocked
);
340 FOR_EACH_PTR(all_returns
, tmp
) {
341 free_trackers_and_list(&tmp
->locked
);
342 free_trackers_and_list(&tmp
->unlocked
);
343 } END_FOR_EACH_PTR(tmp
);
344 __free_ptr_list((struct ptr_list
**)&all_returns
);
347 static void check_consistency(struct symbol
*sym
)
354 FOR_EACH_PTR(starts_locked
, tmp
) {
355 if (in_tracker_list(starts_unlocked
, tmp
->name
, tmp
->owner
,
357 smatch_msg("error: locking inconsistency. We assume "
358 "'%s' is both locked and unlocked at the "
361 } END_FOR_EACH_PTR(tmp
);
363 FOR_EACH_PTR(starts_locked
, tmp
) {
364 check_returns_consistently(tmp
, &locked
);
365 } END_FOR_EACH_PTR(tmp
);
367 FOR_EACH_PTR(starts_unlocked
, tmp
) {
368 check_returns_consistently(tmp
, &unlocked
);
369 } END_FOR_EACH_PTR(tmp
);
374 void register_locking(int id
)
377 add_merge_hook(my_id
, &merge_func
);
378 add_hook(&match_condition
, CONDITION_HOOK
);
379 add_hook(&match_call
, FUNCTION_CALL_HOOK
);
380 add_hook(&match_return
, RETURN_HOOK
);
381 add_hook(&check_consistency
, END_FUNC_HOOK
);