1*1f5207b7SJohn Levon /* 2*1f5207b7SJohn Levon * Copyright (C) 2010 Dan Carpenter. 3*1f5207b7SJohn Levon * 4*1f5207b7SJohn Levon * This program is free software; you can redistribute it and/or 5*1f5207b7SJohn Levon * modify it under the terms of the GNU General Public License 6*1f5207b7SJohn Levon * as published by the Free Software Foundation; either version 2 7*1f5207b7SJohn Levon * of the License, or (at your option) any later version. 8*1f5207b7SJohn Levon * 9*1f5207b7SJohn Levon * This program is distributed in the hope that it will be useful, 10*1f5207b7SJohn Levon * but WITHOUT ANY WARRANTY; without even the implied warranty of 11*1f5207b7SJohn Levon * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12*1f5207b7SJohn Levon * GNU General Public License for more details. 13*1f5207b7SJohn Levon * 14*1f5207b7SJohn Levon * You should have received a copy of the GNU General Public License 15*1f5207b7SJohn Levon * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt 16*1f5207b7SJohn Levon */ 17*1f5207b7SJohn Levon 18*1f5207b7SJohn Levon /* 19*1f5207b7SJohn Levon * This is a kernel check to make sure we unwind everything on 20*1f5207b7SJohn Levon * on errors. 21*1f5207b7SJohn Levon * 22*1f5207b7SJohn Levon */ 23*1f5207b7SJohn Levon 24*1f5207b7SJohn Levon #include "smatch.h" 25*1f5207b7SJohn Levon #include "smatch_extra.h" 26*1f5207b7SJohn Levon #include "smatch_slist.h" 27*1f5207b7SJohn Levon 28*1f5207b7SJohn Levon #define EBUSY 16 29*1f5207b7SJohn Levon #define MAX_ERRNO 4095 30*1f5207b7SJohn Levon 31*1f5207b7SJohn Levon static int my_id; 32*1f5207b7SJohn Levon 33*1f5207b7SJohn Levon STATE(allocated); 34*1f5207b7SJohn Levon STATE(unallocated); 35*1f5207b7SJohn Levon 36*1f5207b7SJohn Levon /* state of unwind function */ 37*1f5207b7SJohn Levon STATE(called); 38*1f5207b7SJohn Levon 39*1f5207b7SJohn Levon static int was_passed_as_param(struct expression *expr) 40*1f5207b7SJohn Levon { 41*1f5207b7SJohn Levon char *name; 42*1f5207b7SJohn Levon struct symbol *sym; 43*1f5207b7SJohn Levon struct symbol *arg; 44*1f5207b7SJohn Levon 45*1f5207b7SJohn Levon name = expr_to_var_sym(expr, &sym); 46*1f5207b7SJohn Levon if (!name) 47*1f5207b7SJohn Levon return 0; 48*1f5207b7SJohn Levon free_string(name); 49*1f5207b7SJohn Levon 50*1f5207b7SJohn Levon FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) { 51*1f5207b7SJohn Levon if (arg == sym) 52*1f5207b7SJohn Levon return 1; 53*1f5207b7SJohn Levon } END_FOR_EACH_PTR(arg); 54*1f5207b7SJohn Levon return 0; 55*1f5207b7SJohn Levon } 56*1f5207b7SJohn Levon 57*1f5207b7SJohn Levon static void print_unwind_functions(const char *fn, struct expression *expr, void *_arg_no) 58*1f5207b7SJohn Levon { 59*1f5207b7SJohn Levon struct expression *arg_expr; 60*1f5207b7SJohn Levon int arg_no = PTR_INT(_arg_no); 61*1f5207b7SJohn Levon static struct symbol *last_printed = NULL; 62*1f5207b7SJohn Levon 63*1f5207b7SJohn Levon arg_expr = get_argument_from_call_expr(expr->args, arg_no); 64*1f5207b7SJohn Levon if (!was_passed_as_param(arg_expr)) 65*1f5207b7SJohn Levon return; 66*1f5207b7SJohn Levon if (last_printed == cur_func_sym) 67*1f5207b7SJohn Levon return; 68*1f5207b7SJohn Levon last_printed = cur_func_sym; 69*1f5207b7SJohn Levon sm_msg("info: is unwind function"); 70*1f5207b7SJohn Levon } 71*1f5207b7SJohn Levon 72*1f5207b7SJohn Levon static void request_granted(const char *fn, struct expression *call_expr, 73*1f5207b7SJohn Levon struct expression *assign_expr, void *_arg_no) 74*1f5207b7SJohn Levon { 75*1f5207b7SJohn Levon struct expression *arg_expr; 76*1f5207b7SJohn Levon int arg_no = PTR_INT(_arg_no); 77*1f5207b7SJohn Levon 78*1f5207b7SJohn Levon if (arg_no == -1) { 79*1f5207b7SJohn Levon if (!assign_expr) 80*1f5207b7SJohn Levon return; 81*1f5207b7SJohn Levon arg_expr = assign_expr->left; 82*1f5207b7SJohn Levon } else { 83*1f5207b7SJohn Levon arg_expr = get_argument_from_call_expr(call_expr->args, arg_no); 84*1f5207b7SJohn Levon } 85*1f5207b7SJohn Levon set_state_expr(my_id, arg_expr, &allocated); 86*1f5207b7SJohn Levon } 87*1f5207b7SJohn Levon 88*1f5207b7SJohn Levon static void request_denied(const char *fn, struct expression *call_expr, 89*1f5207b7SJohn Levon struct expression *assign_expr, void *_arg_no) 90*1f5207b7SJohn Levon { 91*1f5207b7SJohn Levon struct expression *arg_expr; 92*1f5207b7SJohn Levon int arg_no = PTR_INT(_arg_no); 93*1f5207b7SJohn Levon 94*1f5207b7SJohn Levon if (arg_no == -1) { 95*1f5207b7SJohn Levon if (!assign_expr) 96*1f5207b7SJohn Levon return; 97*1f5207b7SJohn Levon arg_expr = assign_expr->left; 98*1f5207b7SJohn Levon } else { 99*1f5207b7SJohn Levon arg_expr = get_argument_from_call_expr(call_expr->args, arg_no); 100*1f5207b7SJohn Levon } 101*1f5207b7SJohn Levon set_state_expr(my_id, arg_expr, &unallocated); 102*1f5207b7SJohn Levon } 103*1f5207b7SJohn Levon 104*1f5207b7SJohn Levon static void match_release(const char *fn, struct expression *expr, void *_arg_no) 105*1f5207b7SJohn Levon { 106*1f5207b7SJohn Levon struct expression *arg_expr; 107*1f5207b7SJohn Levon int arg_no = PTR_INT(_arg_no); 108*1f5207b7SJohn Levon 109*1f5207b7SJohn Levon arg_expr = get_argument_from_call_expr(expr->args, arg_no); 110*1f5207b7SJohn Levon if (get_state_expr(my_id, arg_expr)) 111*1f5207b7SJohn Levon set_state_expr(my_id, arg_expr, &unallocated); 112*1f5207b7SJohn Levon set_equiv_state_expr(my_id, arg_expr, &unallocated); 113*1f5207b7SJohn Levon } 114*1f5207b7SJohn Levon 115*1f5207b7SJohn Levon static void match_unwind_function(const char *fn, struct expression *expr, void *unused) 116*1f5207b7SJohn Levon { 117*1f5207b7SJohn Levon set_state(my_id, "unwind_function", NULL, &called); 118*1f5207b7SJohn Levon } 119*1f5207b7SJohn Levon 120*1f5207b7SJohn Levon static int func_returns_int(void) 121*1f5207b7SJohn Levon { 122*1f5207b7SJohn Levon struct symbol *type; 123*1f5207b7SJohn Levon 124*1f5207b7SJohn Levon type = get_base_type(cur_func_sym); 125*1f5207b7SJohn Levon if (!type || type->type != SYM_FN) 126*1f5207b7SJohn Levon return 0; 127*1f5207b7SJohn Levon type = get_base_type(type); 128*1f5207b7SJohn Levon if (type->ctype.base_type == &int_type) { 129*1f5207b7SJohn Levon return 1; 130*1f5207b7SJohn Levon } 131*1f5207b7SJohn Levon return 0; 132*1f5207b7SJohn Levon } 133*1f5207b7SJohn Levon 134*1f5207b7SJohn Levon static void match_return(struct expression *ret_value) 135*1f5207b7SJohn Levon { 136*1f5207b7SJohn Levon struct stree *stree; 137*1f5207b7SJohn Levon struct sm_state *tmp; 138*1f5207b7SJohn Levon sval_t sval; 139*1f5207b7SJohn Levon 140*1f5207b7SJohn Levon if (!func_returns_int()) 141*1f5207b7SJohn Levon return; 142*1f5207b7SJohn Levon if (get_value(ret_value, &sval) && sval_cmp_val(sval, 0) >= 0) 143*1f5207b7SJohn Levon return; 144*1f5207b7SJohn Levon if (!implied_not_equal(ret_value, 0)) 145*1f5207b7SJohn Levon return; 146*1f5207b7SJohn Levon if (get_state(my_id, "unwind_function", NULL) == &called) 147*1f5207b7SJohn Levon return; 148*1f5207b7SJohn Levon 149*1f5207b7SJohn Levon stree = __get_cur_stree(); 150*1f5207b7SJohn Levon FOR_EACH_MY_SM(my_id, stree, tmp) { 151*1f5207b7SJohn Levon if (slist_has_state(tmp->possible, &allocated)) 152*1f5207b7SJohn Levon sm_warning("'%s' was not released on error", tmp->name); 153*1f5207b7SJohn Levon } END_FOR_EACH_SM(tmp); 154*1f5207b7SJohn Levon } 155*1f5207b7SJohn Levon 156*1f5207b7SJohn Levon static void register_unwind_functions(void) 157*1f5207b7SJohn Levon { 158*1f5207b7SJohn Levon struct token *token; 159*1f5207b7SJohn Levon const char *func; 160*1f5207b7SJohn Levon 161*1f5207b7SJohn Levon token = get_tokens_file("kernel.unwind_functions"); 162*1f5207b7SJohn Levon if (!token) 163*1f5207b7SJohn Levon return; 164*1f5207b7SJohn Levon if (token_type(token) != TOKEN_STREAMBEGIN) 165*1f5207b7SJohn Levon return; 166*1f5207b7SJohn Levon token = token->next; 167*1f5207b7SJohn Levon while (token_type(token) != TOKEN_STREAMEND) { 168*1f5207b7SJohn Levon if (token_type(token) != TOKEN_IDENT) 169*1f5207b7SJohn Levon return; 170*1f5207b7SJohn Levon func = show_ident(token->ident); 171*1f5207b7SJohn Levon add_function_hook(func, &match_unwind_function, NULL); 172*1f5207b7SJohn Levon token = token->next; 173*1f5207b7SJohn Levon } 174*1f5207b7SJohn Levon clear_token_alloc(); 175*1f5207b7SJohn Levon } 176*1f5207b7SJohn Levon 177*1f5207b7SJohn Levon static void release_function_indicator(const char *name) 178*1f5207b7SJohn Levon { 179*1f5207b7SJohn Levon if (!option_info) 180*1f5207b7SJohn Levon return; 181*1f5207b7SJohn Levon add_function_hook(name, &print_unwind_functions, INT_PTR(0)); 182*1f5207b7SJohn Levon } 183*1f5207b7SJohn Levon 184*1f5207b7SJohn Levon void check_unwind(int id) 185*1f5207b7SJohn Levon { 186*1f5207b7SJohn Levon if (option_project != PROJ_KERNEL || !option_spammy) 187*1f5207b7SJohn Levon return; 188*1f5207b7SJohn Levon my_id = id; 189*1f5207b7SJohn Levon 190*1f5207b7SJohn Levon register_unwind_functions(); 191*1f5207b7SJohn Levon 192*1f5207b7SJohn Levon return_implies_state("request_resource", 0, 0, &request_granted, INT_PTR(1)); 193*1f5207b7SJohn Levon return_implies_state("request_resource", -EBUSY, -EBUSY, &request_denied, INT_PTR(1)); 194*1f5207b7SJohn Levon add_function_hook("release_resource", &match_release, INT_PTR(0)); 195*1f5207b7SJohn Levon release_function_indicator("release_resource"); 196*1f5207b7SJohn Levon 197*1f5207b7SJohn Levon return_implies_state("__request_region", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(1)); 198*1f5207b7SJohn Levon return_implies_state("__request_region", 0, 0, &request_denied, INT_PTR(1)); 199*1f5207b7SJohn Levon add_function_hook("__release_region", &match_release, INT_PTR(1)); 200*1f5207b7SJohn Levon release_function_indicator("__release_region"); 201*1f5207b7SJohn Levon 202*1f5207b7SJohn Levon return_implies_state("ioremap", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(-1)); 203*1f5207b7SJohn Levon return_implies_state("ioremap", 0, 0, &request_denied, INT_PTR(-1)); 204*1f5207b7SJohn Levon add_function_hook("iounmap", &match_release, INT_PTR(0)); 205*1f5207b7SJohn Levon 206*1f5207b7SJohn Levon return_implies_state("pci_iomap", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(-1)); 207*1f5207b7SJohn Levon return_implies_state("pci_iomap", 0, 0, &request_denied, INT_PTR(-1)); 208*1f5207b7SJohn Levon add_function_hook("pci_iounmap", &match_release, INT_PTR(1)); 209*1f5207b7SJohn Levon release_function_indicator("pci_iounmap"); 210*1f5207b7SJohn Levon 211*1f5207b7SJohn Levon return_implies_state("__create_workqueue_key", valid_ptr_min, valid_ptr_max, &request_granted, 212*1f5207b7SJohn Levon INT_PTR(-1)); 213*1f5207b7SJohn Levon return_implies_state("__create_workqueue_key", 0, 0, &request_denied, INT_PTR(-1)); 214*1f5207b7SJohn Levon add_function_hook("destroy_workqueue", &match_release, INT_PTR(0)); 215*1f5207b7SJohn Levon 216*1f5207b7SJohn Levon return_implies_state("request_irq", 0, 0, &request_granted, INT_PTR(0)); 217*1f5207b7SJohn Levon return_implies_state("request_irq", -MAX_ERRNO, -1, &request_denied, INT_PTR(0)); 218*1f5207b7SJohn Levon add_function_hook("free_irq", &match_release, INT_PTR(0)); 219*1f5207b7SJohn Levon release_function_indicator("free_irq"); 220*1f5207b7SJohn Levon 221*1f5207b7SJohn Levon return_implies_state("register_netdev", 0, 0, &request_granted, INT_PTR(0)); 222*1f5207b7SJohn Levon return_implies_state("register_netdev", -MAX_ERRNO, -1, &request_denied, INT_PTR(0)); 223*1f5207b7SJohn Levon add_function_hook("unregister_netdev", &match_release, INT_PTR(0)); 224*1f5207b7SJohn Levon release_function_indicator("unregister_netdev"); 225*1f5207b7SJohn Levon 226*1f5207b7SJohn Levon return_implies_state("misc_register", 0, 0, &request_granted, INT_PTR(0)); 227*1f5207b7SJohn Levon return_implies_state("misc_register", -MAX_ERRNO, -1, &request_denied, INT_PTR(0)); 228*1f5207b7SJohn Levon add_function_hook("misc_deregister", &match_release, INT_PTR(0)); 229*1f5207b7SJohn Levon release_function_indicator("misc_deregister"); 230*1f5207b7SJohn Levon 231*1f5207b7SJohn Levon 232*1f5207b7SJohn Levon add_hook(&match_return, RETURN_HOOK); 233*1f5207b7SJohn Levon } 234