1 /*
2  * Copyright (C) 2015 Rasmus Villemoes.
3  *
4  * This program is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU General Public License
6  * as published by the Free Software Foundation; either version 2
7  * of the License, or (at your option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12  * GNU General Public License for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16  */
17 
18 #include <assert.h>
19 #include <ctype.h>
20 #include <string.h>
21 #include "smatch.h"
22 #include "smatch_slist.h"
23 
24 #define spam(args...) do {			\
25 	if (option_spammy)			\
26 		sm_msg(args);			\
27 	} while (0)
28 
29 static int my_id;
30 
31 /*
32  * Much of this is taken directly from the kernel (mostly vsprintf.c),
33  * with a few modifications here and there.
34  */
35 
36 #define KERN_SOH_ASCII  '\001'
37 
38 typedef unsigned char u8;
39 typedef signed short s16;
40 
41 #define SIGN	1		/* unsigned/signed, must be 1 */
42 #define LEFT	2		/* left justified */
43 #define PLUS	4		/* show plus */
44 #define SPACE	8		/* space if plus */
45 #define ZEROPAD	16		/* pad with zero, must be 16 == '0' - ' ' */
46 #define SMALL	32		/* use lowercase in hex (must be 32 == 0x20) */
47 #define SPECIAL	64		/* prefix hex with "0x", octal with "0" */
48 
49 enum format_type {
50 	FORMAT_TYPE_NONE, /* Just a string part */
51 	FORMAT_TYPE_WIDTH,
52 	FORMAT_TYPE_PRECISION,
53 	FORMAT_TYPE_CHAR,
54 	FORMAT_TYPE_STR,
55 	FORMAT_TYPE_PTR,
56 	FORMAT_TYPE_PERCENT_CHAR,
57 	FORMAT_TYPE_INVALID,
58 	FORMAT_TYPE_LONG_LONG,
59 	FORMAT_TYPE_ULONG,
60 	FORMAT_TYPE_LONG,
61 	FORMAT_TYPE_UBYTE,
62 	FORMAT_TYPE_BYTE,
63 	FORMAT_TYPE_USHORT,
64 	FORMAT_TYPE_SHORT,
65 	FORMAT_TYPE_UINT,
66 	FORMAT_TYPE_INT,
67 	FORMAT_TYPE_SIZE_T,
68 	FORMAT_TYPE_PTRDIFF,
69 	FORMAT_TYPE_NRCHARS, /* Reintroduced for this checker */
70 	FORMAT_TYPE_FLOAT, /* for various floating point formatters */
71 };
72 
73 struct printf_spec {
74 	unsigned int	type:8;		/* format_type enum */
75 	signed int	field_width:24;	/* width of output field */
76 	unsigned int	flags:8;	/* flags to number() */
77 	unsigned int	base:8;		/* number base, 8, 10 or 16 only */
78 	signed int	precision:16;	/* # of digits/chars */
79 } __packed;
80 #define FIELD_WIDTH_MAX ((1 << 23) - 1)
81 #define PRECISION_MAX ((1 << 15) - 1)
82 extern char __check_printf_spec[1-2*(sizeof(struct printf_spec) != 8)];
83 
84 static int
85 skip_atoi(const char **s)
86 {
87 	int i = 0;
88 
89 	while (isdigit(**s))
90 		i = i*10 + *((*s)++) - '0';
91 
92 	return i;
93 }
94 
95 static int
96 format_decode(const char *fmt, struct printf_spec *spec)
97 {
98 	const char *start = fmt;
99 	char qualifier;
100 
101 	/* we finished early by reading the field width */
102 	if (spec->type == FORMAT_TYPE_WIDTH) {
103 		if (spec->field_width < 0) {
104 			spec->field_width = -spec->field_width;
105 			spec->flags |= LEFT;
106 		}
107 		spec->type = FORMAT_TYPE_NONE;
108 		goto precision;
109 	}
110 
111 	/* we finished early by reading the precision */
112 	if (spec->type == FORMAT_TYPE_PRECISION) {
113 		if (spec->precision < 0)
114 			spec->precision = 0;
115 
116 		spec->type = FORMAT_TYPE_NONE;
117 		goto qualifier;
118 	}
119 
120 	/* By default */
121 	spec->type = FORMAT_TYPE_NONE;
122 
123 	for (; *fmt ; ++fmt) {
124 		if (*fmt == '%')
125 			break;
126 	}
127 
128 	/* Return the current non-format string */
129 	if (fmt != start || !*fmt)
130 		return fmt - start;
131 
132 	/* Process flags */
133 	spec->flags = 0;
134 
135 	while (1) { /* this also skips first '%' */
136 		bool found = true;
137 
138 		++fmt;
139 
140 		switch (*fmt) {
141 		case '-': spec->flags |= LEFT;    break;
142 		case '+': spec->flags |= PLUS;    break;
143 		case ' ': spec->flags |= SPACE;   break;
144 		case '#': spec->flags |= SPECIAL; break;
145 		case '0': spec->flags |= ZEROPAD; break;
146 		default:  found = false;
147 		}
148 
149 		if (!found)
150 			break;
151 	}
152 
153 	/* get field width */
154 	spec->field_width = -1;
155 
156 	if (isdigit(*fmt))
157 		spec->field_width = skip_atoi(&fmt);
158 	else if (*fmt == '*') {
159 		/* it's the next argument */
160 		spec->type = FORMAT_TYPE_WIDTH;
161 		return ++fmt - start;
162 	}
163 
164 precision:
165 	/* get the precision */
166 	spec->precision = -1;
167 	if (*fmt == '.') {
168 		++fmt;
169 		if (isdigit(*fmt)) {
170 			spec->precision = skip_atoi(&fmt);
171 			if (spec->precision < 0)
172 				spec->precision = 0;
173 		} else if (*fmt == '*') {
174 			/* it's the next argument */
175 			spec->type = FORMAT_TYPE_PRECISION;
176 			return ++fmt - start;
177 		}
178 	}
179 
180 qualifier:
181 	/* get the conversion qualifier */
182 	qualifier = 0;
183 	if (*fmt == 'h' || _tolower(*fmt) == 'l' ||
184 	    _tolower(*fmt) == 'z' || *fmt == 't') {
185 		qualifier = *fmt++;
186 		if (qualifier == *fmt) {
187 			if (qualifier == 'l') {
188 				qualifier = 'L';
189 				++fmt;
190 			} else if (qualifier == 'h') {
191 				qualifier = 'H';
192 				++fmt;
193 			} else {
194 				sm_warning("invalid repeated qualifier '%c'", *fmt);
195 			}
196 		}
197 	}
198 
199 	/* default base */
200 	spec->base = 10;
201 	switch (*fmt) {
202 	case 'c':
203 		if (qualifier)
204 			sm_warning("qualifier '%c' ignored for %%c specifier", qualifier);
205 
206 		spec->type = FORMAT_TYPE_CHAR;
207 		return ++fmt - start;
208 
209 	case 's':
210 		if (qualifier)
211 			sm_warning("qualifier '%c' ignored for %%s specifier", qualifier);
212 
213 		spec->type = FORMAT_TYPE_STR;
214 		return ++fmt - start;
215 
216 	case 'p':
217 		spec->type = FORMAT_TYPE_PTR;
218 		return ++fmt - start;
219 
220 	case '%':
221 		spec->type = FORMAT_TYPE_PERCENT_CHAR;
222 		return ++fmt - start;
223 
224 	/* integer number formats - set up the flags and "break" */
225 	case 'o':
226 		spec->base = 8;
227 		break;
228 
229 	case 'x':
230 		spec->flags |= SMALL;
231 
232 	case 'X':
233 		spec->base = 16;
234 		break;
235 
236 	case 'd':
237 	case 'i':
238 		spec->flags |= SIGN;
239 	case 'u':
240 		break;
241 
242 	case 'n':
243 		spec->type = FORMAT_TYPE_NRCHARS;
244 		return ++fmt - start;
245 
246 	case 'a': case 'A':
247 	case 'e': case 'E':
248 	case 'f': case 'F':
249 	case 'g': case 'G':
250 		spec->type = FORMAT_TYPE_FLOAT;
251 		return ++fmt - start;
252 
253 	default:
254 		spec->type = FORMAT_TYPE_INVALID;
255 		/* Unlike the kernel code, we 'consume' the invalid
256 		 * character so that it can get included in the
257 		 * report. After that, we bail out. */
258 		return ++fmt - start;
259 	}
260 
261 	if (qualifier == 'L')
262 		spec->type = FORMAT_TYPE_LONG_LONG;
263 	else if (qualifier == 'l') {
264 		if (spec->flags & SIGN)
265 			spec->type = FORMAT_TYPE_LONG;
266 		else
267 			spec->type = FORMAT_TYPE_ULONG;
268 	} else if (_tolower(qualifier) == 'z') {
269 		spec->type = FORMAT_TYPE_SIZE_T;
270 	} else if (qualifier == 't') {
271 		spec->type = FORMAT_TYPE_PTRDIFF;
272 	} else if (qualifier == 'H') {
273 		if (spec->flags & SIGN)
274 			spec->type = FORMAT_TYPE_BYTE;
275 		else
276 			spec->type = FORMAT_TYPE_UBYTE;
277 	} else if (qualifier == 'h') {
278 		if (spec->flags & SIGN)
279 			spec->type = FORMAT_TYPE_SHORT;
280 		else
281 			spec->type = FORMAT_TYPE_USHORT;
282 	} else {
283 		if (spec->flags & SIGN)
284 			spec->type = FORMAT_TYPE_INT;
285 		else
286 			spec->type = FORMAT_TYPE_UINT;
287 	}
288 
289 	return ++fmt - start;
290 }
291 
292 static int is_struct_tag(struct symbol *type, const char *tag)
293 {
294 	return type->type == SYM_STRUCT && type->ident && !strcmp(type->ident->name, tag);
295 }
296 
297 static int has_struct_tag(struct symbol *type, const char *tag)
298 {
299 	struct symbol *tmp;
300 
301 	if (type->type == SYM_STRUCT)
302 		return is_struct_tag(type, tag);
303 	if (type->type == SYM_UNION) {
304 		FOR_EACH_PTR(type->symbol_list, tmp) {
305 			tmp = get_real_base_type(tmp);
306 			if (tmp && is_struct_tag(tmp, tag))
307 				return 1;
308 		} END_FOR_EACH_PTR(tmp);
309 	}
310 	return 0;
311 }
312 
313 static int is_char_type(struct symbol *type)
314 {
315 	return type == &uchar_ctype || type == &char_ctype || type == &schar_ctype;
316 }
317 
318 /*
319  * I have absolutely no idea if this is how one is supposed to get the
320  * symbol representing a typedef, but it seems to work.
321  */
322 struct typedef_lookup {
323 	const char *name;
324 	struct symbol *sym;
325 	int failed;
326 };
327 
328 static struct symbol *_typedef_lookup(const char *name)
329 {
330 	struct ident *id;
331 	struct symbol *node;
332 
333 	id = built_in_ident(name);
334 	if (!id)
335 		return NULL;
336 	node = lookup_symbol(id, NS_TYPEDEF);
337 	if (!node || node->type != SYM_NODE)
338 		return NULL;
339 	return get_real_base_type(node);
340 }
341 
342 static void typedef_lookup(struct typedef_lookup *tl)
343 {
344 	if (tl->sym || tl->failed)
345 		return;
346 	tl->sym = _typedef_lookup(tl->name);
347 	if (!tl->sym) {
348 		sm_perror(" could not find typedef '%s'", tl->name);
349 		tl->failed = 1;
350 	}
351 }
352 
353 
354 static void ip4(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
355 {
356 	enum { ENDIAN_BIG, ENDIAN_LITTLE, ENDIAN_HOST } endian = ENDIAN_BIG;
357 
358 	assert(fmt[0] == 'i' || fmt[0] == 'I');
359 	assert(fmt[1] == '4');
360 
361 	if (isalnum(fmt[2])) {
362 		switch (fmt[2]) {
363 		case 'h':
364 			endian = ENDIAN_HOST;
365 			break;
366 		case 'l':
367 			endian = ENDIAN_LITTLE;
368 			break;
369 		case 'n':
370 		case 'b':
371 			endian = ENDIAN_BIG;
372 			break;
373 		default:
374 			sm_warning("'%%p%c4' can only be followed by one of [hnbl], not '%c'", fmt[0], fmt[2]);
375 		}
376 		if (isalnum(fmt[3]))
377 			sm_warning("'%%p%c4' can only be followed by precisely one of [hnbl]", fmt[0]);
378 	}
379 
380 
381 	if (type->ctype.modifiers & MOD_NODEREF)
382 		sm_error("passing __user pointer to '%%p%c4'", fmt[0]);
383 
384 	/*
385 	 * If we have a pointer to char/u8/s8, we expect the caller to
386 	 * handle endianness; I don't think there's anything we can
387 	 * do. I'd like to check that if we're passed a pointer to a
388 	 * __bitwise u32 (most likely a __be32), we should have endian
389 	 * == ENDIAN_BIG. But I can't figure out how to get that
390 	 * information (it also seems to require ensuring certain
391 	 * macros are defined). But struct in_addr certainly consists
392 	 * of only a single __be32, so in that case we can do a check.
393 	 */
394 	if (is_char_type(basetype))
395 		return;
396 
397 	if (is_struct_tag(basetype, "in_addr") && endian != ENDIAN_BIG)
398 		sm_warning("passing struct in_addr* to '%%p%c4%c', is the endianness ok?", fmt[0], fmt[2]);
399 
400 	/* ... */
401 }
402 
403 static void ip6(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
404 {
405 	assert(fmt[0] == 'i' || fmt[0] == 'I');
406 	assert(fmt[1] == '6');
407 
408 	if (isalnum(fmt[2])) {
409 		if (fmt[2] != 'c')
410 			sm_warning("'%%p%c6' can only be followed by c", fmt[0]);
411 		else if (fmt[0] == 'i')
412 			sm_warning("'%%pi6' does not allow flag c");
413 		if (isalnum(fmt[3]))
414 			sm_warning("'%%p%c6%c' cannot be followed by other alphanumerics", fmt[0], fmt[2]);
415 	}
416 
417 	if (type->ctype.modifiers & MOD_NODEREF)
418 		sm_error("passing __user pointer to '%%p%c6'", fmt[0]);
419 }
420 
421 static void ipS(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
422 {
423 	const char *f;
424 
425 	assert(tolower(fmt[0]) == 'i');
426 	assert(fmt[1] == 'S');
427 
428 	for (f = fmt+2; isalnum(*f); ++f) {
429 		/* It's probably too anal checking for duplicate flags. */
430 		if (!strchr("pfschnbl", *f))
431 			sm_warning("'%%p%cS' cannot be followed by '%c'", fmt[0], *f);
432 	}
433 
434 	/*
435 	 * XXX: Should we also allow passing a pointer to a union, one
436 	 * member of which is a struct sockaddr? It may be slightly
437 	 * cleaner actually passing &u.raw instead of just &u, though
438 	 * the generated code is of course exactly the same. For now,
439 	 * we do accept struct sockaddr_in and struct sockaddr_in6,
440 	 * since those are easy to handle and rather harmless.
441 	 */
442 	if (!has_struct_tag(basetype, "sockaddr") &&
443 	    !has_struct_tag(basetype, "sockaddr_in") &&
444 	    !has_struct_tag(basetype, "sockaddr_in6") &&
445 	    !has_struct_tag(basetype, "__kernel_sockaddr_storage"))
446 		sm_error("'%%p%cS' expects argument of type struct sockaddr *, "
447 			"argument %d has type '%s'", fmt[0], vaidx, type_to_str(type));
448 }
449 
450 static void hex_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
451 {
452 	assert(fmt[0] == 'h');
453 	if (isalnum(fmt[1])) {
454 		if (!strchr("CDN", fmt[1]))
455 			sm_warning("'%%ph' cannot be followed by '%c'", fmt[1]);
456 		if (isalnum(fmt[2]))
457 			sm_warning("'%%ph' can be followed by at most one of [CDN], and no other alphanumerics");
458 	}
459 	if (type->ctype.modifiers & MOD_NODEREF)
460 		sm_error("passing __user pointer to %%ph");
461 }
462 
463 static void escaped_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
464 {
465 	assert(fmt[0] == 'E');
466 	while (isalnum(*++fmt)) {
467 		if (!strchr("achnops", *fmt))
468 			sm_warning("%%pE can only be followed by a combination of [achnops]");
469 	}
470 	if (type->ctype.modifiers & MOD_NODEREF)
471 		sm_error("passing __user pointer to %%pE");
472 }
473 
474 static void resource_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
475 {
476 	assert(tolower(fmt[0]) == 'r');
477 	if (!is_struct_tag(basetype, "resource")) {
478 		sm_error("'%%p%c' expects argument of type struct resource *, "
479 			"but argument %d has type '%s'", fmt[0], vaidx, type_to_str(type));
480 	}
481 	if (isalnum(fmt[1]))
482 		sm_warning("'%%p%c' cannot be followed by '%c'", fmt[0], fmt[1]);
483 }
484 
485 static void mac_address_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
486 {
487 	assert(tolower(fmt[0]) == 'm');
488 	if (isalnum(fmt[1])) {
489 		if (!(fmt[1] == 'F' || fmt[1] == 'R'))
490 			sm_warning("'%%p%c' cannot be followed by '%c'", fmt[0], fmt[1]);
491 		if (fmt[0] == 'm' && fmt[1] == 'F')
492 			sm_warning("it is pointless to pass flag F to %%pm");
493 		if (isalnum(fmt[2]))
494 			sm_warning("'%%p%c%c' cannot be followed by other alphanumeric", fmt[0], fmt[1]);
495 	}
496 	/* Technically, bdaddr_t is a typedef for an anonymous struct, but this still seems to work. */
497 	if (!is_char_type(basetype) && !is_struct_tag(basetype, "bdaddr_t") && basetype != &void_ctype) {
498 		sm_warning("'%%p%c' expects argument of type u8 * or bdaddr_t *, argument %d has type '%s'",
499 			fmt[0], vaidx, type_to_str(type));
500 	}
501 	if (type->ctype.modifiers & MOD_NODEREF)
502 		sm_error("passing __user pointer to '%%p%c'", fmt[0]);
503 }
504 
505 static void dentry_file(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
506 {
507 	const char *tag;
508 
509 	assert(tolower(fmt[0]) == 'd');
510 	tag = fmt[0] == 'd' ? "dentry" : "file";
511 
512 	if (isalnum(fmt[1])) {
513 		if (!strchr("234", fmt[1]))
514 			sm_warning("'%%p%c' can only be followed by one of [234]", fmt[0]);
515 		if (isalnum(fmt[2]))
516 			sm_warning("'%%p%c%c' cannot be followed by '%c'", fmt[0], fmt[1], fmt[2]);
517 	}
518 
519 	if (!is_struct_tag(basetype, tag))
520 		sm_error("'%%p%c' expects argument of type struct '%s*', argument %d has type '%s'",
521 			fmt[0], tag, vaidx, type_to_str(type));
522 }
523 
524 static void time_and_date(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
525 {
526 	assert(tolower(fmt[0]) == 't');
527 
528 	if (fmt[1] == 'R' && !is_struct_tag(basetype, "rtc_time"))
529 		sm_error("'%%ptR' expects argument of type struct 'rtc_time', argument %d has type '%s'",
530 			 vaidx, type_to_str(type));
531 }
532 
533 static void check_clock(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
534 {
535 	assert(fmt[0] == 'C');
536 	if (isalnum(fmt[1])) {
537 		if (!strchr("nr", fmt[1]))
538 			sm_warning("'%%pC' can only be followed by one of [nr]");
539 		if (isalnum(fmt[2]))
540 			sm_warning("'%%pC%c' cannot be followed by '%c'", fmt[1], fmt[2]);
541 	}
542 	if (!is_struct_tag(basetype, "clk"))
543 		sm_error("'%%pC' expects argument of type 'struct clk*', argument %d has type '%s'",
544 		       vaidx, type_to_str(type));
545 }
546 
547 static void va_format(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
548 {
549 	assert(fmt[0] == 'V');
550 	if (isalnum(fmt[1]))
551 		sm_warning("%%pV cannot be followed by any alphanumerics");
552 	if (!is_struct_tag(basetype, "va_format"))
553 		sm_error("%%pV expects argument of type struct va_format*, argument %d has type '%s'", vaidx, type_to_str(type));
554 }
555 
556 static void netdev_feature(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
557 {
558 	static struct typedef_lookup netdev = { .name = "netdev_features_t" };
559 
560 	assert(fmt[0] == 'N');
561 	if (fmt[1] != 'F') {
562 		sm_error("%%pN must be followed by 'F'");
563 		return;
564 	}
565 	if (isalnum(fmt[2]))
566 		sm_warning("%%pNF cannot be followed by '%c'", fmt[2]);
567 
568 	typedef_lookup(&netdev);
569 	if (!netdev.sym)
570 		return;
571 	if (basetype != netdev.sym)
572 		sm_error("%%pNF expects argument of type netdev_features_t*, argument %d has type '%s'",
573 			vaidx, type_to_str(type));
574 
575 }
576 static void address_val(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
577 {
578 	static struct typedef_lookup dma = { .name = "dma_addr_t" };
579 	static struct typedef_lookup phys = { .name = "phys_addr_t" };
580 	struct typedef_lookup *which = &phys;
581 	const char *suf = "";
582 	assert(fmt[0] == 'a');
583 
584 	if (isalnum(fmt[1])) {
585 		switch (fmt[1]) {
586 		case 'd':
587 			which = &dma;
588 			suf = "d";
589 			break;
590 		case 'p':
591 			suf = "p";
592 			break;
593 		default:
594 			sm_error("'%%pa' can only be followed by one of [dp]");
595 		}
596 		if (isalnum(fmt[2]))
597 			sm_error("'%%pa%c' cannot be followed by '%c'", fmt[1], fmt[2]);
598 	}
599 
600 	typedef_lookup(which);
601 	if (!which->sym)
602 		return;
603 	if (basetype != which->sym) {
604 		sm_error("'%%pa%s' expects argument of type '%s*', argument %d has type '%s'",
605 			suf, which->name, vaidx, type_to_str(type));
606 	}
607 }
608 
609 static void block_device(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
610 {
611 	const char *tag = "block_device";
612 
613 	assert(fmt[0] == 'g');
614 	if (isalnum(fmt[1])) {
615 		sm_warning("%%pg cannot be followed by '%c'", fmt[1]);
616 	}
617 	if (!is_struct_tag(basetype, tag))
618 		sm_error("'%%p%c' expects argument of type struct '%s*', argument %d has type '%s'",
619 			fmt[0], tag, vaidx, type_to_str(type));
620 }
621 
622 static void flag_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
623 {
624 	static struct typedef_lookup gfp = { .name = "gfp_t" };
625 
626 	assert(fmt[0] == 'G');
627 	if (!isalnum(fmt[1])) {
628 		sm_error("%%pG must be followed by one of [gpv]");
629 		return;
630 	}
631 	switch (fmt[1]) {
632 	case 'p':
633 	case 'v':
634 		if (basetype != &ulong_ctype)
635 			sm_error("'%%pG%c' expects argument of type 'unsigned long *', argument %d has type '%s'",
636 				fmt[1], vaidx, type_to_str(type));
637 		break;
638 	case 'g':
639 		typedef_lookup(&gfp);
640 		if (basetype != gfp.sym)
641 			sm_error("'%%pGg' expects argument of type 'gfp_t *', argument %d has type '%s'",
642 				vaidx, type_to_str(type));
643 		break;
644 	default:
645 		sm_error("'%%pG' must be followed by one of [gpv]");
646 	}
647 }
648 
649 static void device_node_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
650 {
651 	if (fmt[1] != 'F') {
652 		sm_error("%%pO can only be followed by 'F'");
653 		return;
654 	}
655 	if (!is_struct_tag(basetype, "device_node"))
656 		sm_error("'%%pOF' expects argument of type 'struct device_node*', argument %d has type '%s'",
657 		       vaidx, type_to_str(type));
658 }
659 
660 static void
661 pointer(const char *fmt, struct expression *arg, int vaidx)
662 {
663 	struct symbol *type, *basetype;
664 
665 	type = get_type(arg);
666 	if (!type) {
667 		sm_warning("could not determine type of argument %d", vaidx);
668 		return;
669 	}
670 	if (!is_ptr_type(type)) {
671 		sm_error("%%p expects pointer argument, but argument %d has type '%s'",
672 			vaidx, type_to_str(type));
673 		return;
674 	}
675 	/* Just plain %p, nothing to check. */
676 	if (!isalnum(*fmt))
677 		return;
678 
679 	basetype = get_real_base_type(type);
680 	if (is_void_type(basetype))
681 		return;
682 	/*
683 	 * Passing a pointer-to-array is harmless, but most likely one
684 	 * meant to pass pointer-to-first-element. If basetype is
685 	 * array type, we issue a notice and "dereference" the types
686 	 * once more.
687 	 */
688 	if (basetype->type == SYM_ARRAY) {
689 		spam("note: passing pointer-to-array; is the address-of redundant?");
690 		type = basetype;
691 		basetype = get_real_base_type(type);
692 	}
693 
694 	/*
695 	 * We pass both the type and the basetype to the helpers. If,
696 	 * for example, the pointer is really a decayed array which is
697 	 * passed to %pI4, we might want to check that it is in fact
698 	 * an array of four bytes. But most are probably only
699 	 * interested in whether the basetype makes sense. Also, the
700 	 * pointer may carry some annotation such as __user which
701 	 * might be worth checking in the handlers which actually
702 	 * dereference the pointer.
703 	 */
704 
705 	switch (*fmt) {
706 	case 'b':
707 	case 'F':
708 	case 'f':
709 	case 'S':
710 	case 's':
711 	case 'B':
712 		/* Can we do anything sensible? Check that the arg is a function pointer, for example? */
713 		break;
714 
715 	case 'R':
716 	case 'r':
717 		resource_string(fmt, type, basetype, vaidx);
718 		break;
719 	case 'M':
720 	case 'm':
721 		mac_address_string(fmt, type, basetype, vaidx);
722 		break;
723 	case 'I':
724 	case 'i':
725 		switch (fmt[1]) {
726 		case '4':
727 			ip4(fmt, type, basetype, vaidx);
728 			break;
729 		case '6':
730 			ip6(fmt, type, basetype, vaidx);
731 			break;
732 		case 'S':
733 			ipS(fmt, type, basetype, vaidx);
734 			break;
735 		default:
736 			sm_warning("'%%p%c' must be followed by one of [46S]", fmt[0]);
737 			break;
738 		}
739 		break;
740        /*
741 	* %pE and %ph can handle any valid pointer. We still check
742 	* whether all the subsequent alphanumerics are valid for the
743 	* particular %pX conversion.
744 	*/
745 	case 'E':
746 		escaped_string(fmt, type, basetype, vaidx);
747 		break;
748 	case 'h':
749 		hex_string(fmt, type, basetype, vaidx);
750 		break;
751 	case 'U': /* TODO */
752 		break;
753 	case 'V':
754 		va_format(fmt, type, basetype, vaidx);
755 		break;
756 	case 'K': /* TODO */
757 		break;
758 	case 'N':
759 		netdev_feature(fmt, type, basetype, vaidx);
760 		break;
761 	case 'a':
762 		address_val(fmt, type, basetype, vaidx);
763 		break;
764 	case 'D':
765 	case 'd':
766 		dentry_file(fmt, type, basetype, vaidx);
767 		break;
768 	case 't':
769 		time_and_date(fmt, type, basetype, vaidx);
770 		break;
771 	case 'C':
772 		check_clock(fmt, type, basetype, vaidx);
773 		break;
774 	case 'g':
775 		block_device(fmt, type, basetype, vaidx);
776 		break;
777 	case 'G':
778 		flag_string(fmt, type, basetype, vaidx);
779 		break;
780 	case 'O':
781 		device_node_string(fmt, type, basetype, vaidx);
782 		break;
783 	case 'x':
784 		/* 'x' is for an unhashed pointer */
785 		break;
786 	default:
787 		sm_error("unrecognized %%p extension '%c', treated as normal %%p", *fmt);
788 	}
789 }
790 
791 /*
792  * A common error is to pass a "char" or "signed char" to %02x (or
793  * %.2X or some other variant). This can actually be a security
794  * problem, because a lot of code expects this to produce exactly two
795  * characters of output. Unfortunately this also produces false
796  * positives, since we're sometimes in arch-specific code on an arch
797  * where char is always unsigned.
798  */
799 static void
800 hexbyte(const char *fmt, int fmt_len, struct expression *arg, int vaidx, struct printf_spec spec)
801 {
802 	struct symbol *type;
803 
804 	/*
805 	 * For now, just check the most common and obvious, which is
806 	 * roughly %[.0]2[xX].
807 	 */
808 	if (spec.field_width != 2 && spec.precision != 2)
809 		return;
810 	if (spec.base != 16)
811 		return;
812 
813 	type = get_type(arg);
814 	if (!type) {
815 		sm_warning("could not determine type of argument %d", vaidx);
816 		return;
817 	}
818 	if (type == &char_ctype || type == &schar_ctype)
819 		sm_warning("argument %d to %.*s specifier has type '%s'",
820 		       vaidx, fmt_len, fmt, type_to_str(type));
821 }
822 
823 static int
824 check_format_string(const char *fmt, const char *caller)
825 {
826 	const char *f;
827 
828 	for (f = fmt; *f; ++f) {
829 		unsigned char c = *f;
830 		switch (c) {
831 		case KERN_SOH_ASCII:
832 			/*
833 			 * This typically arises from bad conversion
834 			 * to pr_*, e.g. pr_warn(KERN_WARNING "something").
835 			 */
836 			if (f != fmt)
837 				sm_warning("KERN_* level not at start of string");
838 			/*
839 			 * In a very few cases, the level is actually
840 			 * computed and passed via %c, as in KERN_SOH
841 			 * "%c...". printk explicitly supports
842 			 * this.
843 			 */
844 			if (!(('0' <= f[1] && f[1] <= '7') ||
845 			      f[1] == 'd' || /* KERN_DEFAULT */
846 			      f[1] == 'c' || /* KERN_CONT */
847 			      (f[1] == '%' && f[2] == 'c')))
848 				sm_warning("invalid KERN_* level: KERN_SOH_ASCII followed by '\\x%02x'", (unsigned char)f[1]);
849 			break;
850 		case '\t':
851 		case '\n':
852 		case '\r':
853 		case 0x20 ... 0x7e:
854 			break;
855 		case 0x80 ... 0xff:
856 			sm_warning("format string contains non-ascii character '\\x%02x'", c);
857 			break;
858 		case 0x08:
859 			if (f == fmt)
860 				break;
861 			/* fall through */
862 		default:
863 			sm_warning("format string contains unusual character '\\x%02x'", c);
864 			break;
865 		}
866 	}
867 
868 	f = strstr(fmt, caller);
869 	if (f && strstr(f+1, caller))
870 		sm_warning("format string contains name of enclosing function '%s' twice", caller);
871 
872 	return f != NULL;
873 }
874 
875 static int arg_is___func__(struct expression *arg)
876 {
877 	if (arg->type != EXPR_SYMBOL)
878 		return 0;
879 	return !strcmp(arg->symbol_name->name, "__func__") ||
880 	       !strcmp(arg->symbol_name->name, "__FUNCTION__") ||
881 	       !strcmp(arg->symbol_name->name, "__PRETTY_FUNCTION__");
882 }
883 static int arg_contains_caller(struct expression *arg, const char *caller)
884 {
885 	if (arg->type != EXPR_STRING)
886 		return 0;
887 	return strstr(arg->string->data, caller) != NULL;
888 }
889 
890 static int is_array_of_const_char(struct symbol *sym)
891 {
892 	struct symbol *base = sym->ctype.base_type;
893 	if (base->type != SYM_ARRAY)
894 		return 0;
895 	if (!(base->ctype.modifiers & MOD_CONST))
896 		return 0;
897 	if (!is_char_type(base->ctype.base_type)) {
898 		spam("weird: format argument is array of const '%s'", type_to_str(base->ctype.base_type));
899 		return 0;
900 	}
901 	return 1;
902 }
903 
904 static int is_const_pointer_to_const_char(struct symbol *sym)
905 {
906 	struct symbol *base = sym->ctype.base_type;
907 	if (!(sym->ctype.modifiers & MOD_CONST))
908 		return 0;
909 	if (base->type != SYM_PTR)
910 		return 0;
911 	if (!(base->ctype.modifiers & MOD_CONST))
912 		return 0;
913 	if (!is_char_type(base->ctype.base_type)) {
914 		spam("weird: format argument is pointer to const '%s'", type_to_str(base->ctype.base_type));
915 		return 0;
916 	}
917 	return 1;
918 }
919 
920 static int unknown_format(struct expression *expr)
921 {
922 	struct state_list *slist;
923 
924 	slist = get_strings(expr);
925 	if (!slist)
926 		return 1;
927 	if (slist_has_state(slist, &undefined))
928 		return 1;
929 	free_slist(&slist);
930 	return 0;
931 }
932 
933 static bool has_hex_prefix(const char *orig_fmt, const char *old_fmt)
934 {
935 	return old_fmt >= orig_fmt + 2 &&
936 		old_fmt[-2] == '0' && _tolower(old_fmt[-1]) == 'x';
937 }
938 
939 static bool is_integer_specifier(int type)
940 {
941 	switch (type) {
942 	case FORMAT_TYPE_LONG_LONG:
943 	case FORMAT_TYPE_ULONG:
944 	case FORMAT_TYPE_LONG:
945 	case FORMAT_TYPE_UBYTE:
946 	case FORMAT_TYPE_BYTE:
947 	case FORMAT_TYPE_USHORT:
948 	case FORMAT_TYPE_SHORT:
949 	case FORMAT_TYPE_UINT:
950 	case FORMAT_TYPE_INT:
951 	case FORMAT_TYPE_SIZE_T:
952 	case FORMAT_TYPE_PTRDIFF:
953 		return true;
954 	default:
955 		return false;
956 	}
957 }
958 
959 static int
960 is_cast_expr(struct expression *expr)
961 {
962 	if (!expr)
963 		return 0;
964 
965 	switch (expr->type) {
966 	case EXPR_CAST:
967 	case EXPR_FORCE_CAST:
968 		/* not EXPR_IMPLIED_CAST for our purposes */
969 		return 1;
970 	default:
971 		return 0;
972 	}
973 }
974 
975 static void
976 check_cast_from_pointer(const char *fmt, int len, struct expression *arg, int va_idx)
977 {
978 	/*
979 	 * This can easily be fooled by passing 0+(long)ptr or doing
980 	 * "long local_var = (long)ptr" and passing local_var to
981 	 * %lx. Tough.
982 	 */
983 	if (!is_cast_expr(arg))
984 		return;
985 	while (is_cast_expr(arg))
986 		arg = arg->cast_expression;
987 	if (is_ptr_type(get_final_type(arg)))
988 		sm_warning("argument %d to %.*s specifier is cast from pointer",
989 			va_idx, len, fmt);
990 }
991 
992 static void
993 do_check_printf_call(const char *caller, const char *name, struct expression *callexpr, struct expression *fmtexpr, int vaidx)
994 {
995 	struct printf_spec spec = {0};
996 	const char *fmt, *orig_fmt;
997 	int caller_in_fmt;
998 
999 	fmtexpr = strip_parens(fmtexpr);
1000 	if (fmtexpr->type == EXPR_CONDITIONAL) {
1001 		do_check_printf_call(caller, name, callexpr, fmtexpr->cond_true ? : fmtexpr->conditional, vaidx);
1002 		do_check_printf_call(caller, name, callexpr, fmtexpr->cond_false, vaidx);
1003 		return;
1004 	}
1005 	if (fmtexpr->type == EXPR_SYMBOL) {
1006 		/*
1007 		 * If the symbol has an initializer, we can handle
1008 		 *
1009 		 *   const char foo[] = "abc";         and
1010 		 *   const char * const foo = "abc";
1011 		 *
1012 		 * We simply replace fmtexpr with the initializer
1013 		 * expression. If foo is not one of the above, or if
1014 		 * the initializer expression is somehow not a string
1015 		 * literal, fmtexpr->type != EXPR_STRING will trigger
1016 		 * below and we'll spam+return.
1017 		 */
1018 		struct symbol *sym = fmtexpr->symbol;
1019 		if (sym && sym->initializer &&
1020 		    (is_array_of_const_char(sym) ||
1021 		     is_const_pointer_to_const_char(sym))) {
1022 			fmtexpr = strip_parens(sym->initializer);
1023 		}
1024 	}
1025 
1026 	if (fmtexpr->type != EXPR_STRING) {
1027 		if (!unknown_format(fmtexpr))
1028 			return;
1029 		/*
1030 		 * Since we're now handling both ?: and static const
1031 		 * char[] arguments, we don't get as much noise. It's
1032 		 * still spammy, though.
1033 		 */
1034 		spam("warn: call of '%s' with non-constant format argument", name);
1035 		return;
1036 	}
1037 
1038 	orig_fmt = fmt = fmtexpr->string->data;
1039 	caller_in_fmt = check_format_string(fmt, caller);
1040 
1041 	while (*fmt) {
1042 		const char *old_fmt = fmt;
1043 		int read = format_decode(fmt, &spec);
1044 		struct expression *arg;
1045 
1046 		fmt += read;
1047 		if (spec.type == FORMAT_TYPE_NONE ||
1048 		    spec.type == FORMAT_TYPE_PERCENT_CHAR)
1049 			continue;
1050 
1051 		/*
1052 		 * vaidx is currently the correct 0-based index for
1053 		 * get_argument_from_call_expr. We post-increment it
1054 		 * here so that it is the correct 1-based index for
1055 		 * all the handlers below. This of course requires
1056 		 * that we handle all FORMAT_TYPE_* things not taking
1057 		 * an argument above.
1058 		 */
1059 		arg = get_argument_from_call_expr(callexpr->args, vaidx++);
1060 
1061 		if (spec.flags & SPECIAL && has_hex_prefix(orig_fmt, old_fmt))
1062 			sm_warning("'%.2s' prefix is redundant when # flag is used", old_fmt-2);
1063 		if (is_integer_specifier(spec.type)) {
1064 			if (spec.base != 16 && has_hex_prefix(orig_fmt, old_fmt))
1065 				sm_warning("'%.2s' prefix is confusing together with '%.*s' specifier",
1066 				       old_fmt-2, (int)(fmt-old_fmt), old_fmt);
1067 
1068 			check_cast_from_pointer(old_fmt, read, arg, vaidx);
1069 		}
1070 
1071 		switch (spec.type) {
1072 		/* case FORMAT_TYPE_NONE: */
1073 		/* case FORMAT_TYPE_PERCENT_CHAR: */
1074 		/* 	break; */
1075 
1076 		case FORMAT_TYPE_INVALID:
1077 			sm_error("format specifier '%.*s' invalid", read, old_fmt);
1078 			return;
1079 
1080 		case FORMAT_TYPE_FLOAT:
1081 			sm_error("no floats in the kernel; invalid format specifier '%.*s'", read, old_fmt);
1082 			return;
1083 
1084 		case FORMAT_TYPE_NRCHARS:
1085 			sm_error("%%n not supported in kernel");
1086 			return;
1087 
1088 		case FORMAT_TYPE_WIDTH:
1089 		case FORMAT_TYPE_PRECISION:
1090 			/* check int argument */
1091 			break;
1092 
1093 		case FORMAT_TYPE_STR:
1094 			/*
1095 			 * If the format string already contains the
1096 			 * function name, it probably doesn't make
1097 			 * sense to pass __func__ as well (or rather
1098 			 * vice versa: If pr_fmt(fmt) has been defined
1099 			 * to '"%s: " fmt, __func__', it doesn't make
1100 			 * sense to use a format string containing the
1101 			 * function name).
1102 			 *
1103 			 * This produces a lot of hits. They are not
1104 			 * false positives, but it is easier to handle
1105 			 * the things which don't occur that often
1106 			 * first, so we use spam().
1107 			 */
1108 			if (caller_in_fmt) {
1109 				if (arg_is___func__(arg))
1110 					spam("warn: passing __func__ while the format string already contains the name of the function '%s'",
1111 					     caller);
1112 				else if (arg_contains_caller(arg, caller))
1113 					sm_warning("passing string constant '%s' containing '%s' which is already part of the format string",
1114 					       arg->string->data, caller);
1115 			}
1116 			break;
1117 
1118 		case FORMAT_TYPE_PTR:
1119 			/* This is the most important part: Checking %p extensions. */
1120 			pointer(fmt, arg, vaidx);
1121 			while (isalnum(*fmt))
1122 				fmt++;
1123 			break;
1124 
1125 		case FORMAT_TYPE_CHAR:
1126 
1127 		case FORMAT_TYPE_UBYTE:
1128 		case FORMAT_TYPE_BYTE:
1129 		case FORMAT_TYPE_USHORT:
1130 		case FORMAT_TYPE_SHORT:
1131 		case FORMAT_TYPE_INT:
1132 			/* argument should have integer type of width <= sizeof(int) */
1133 			break;
1134 
1135 		case FORMAT_TYPE_UINT:
1136 			hexbyte(old_fmt, fmt-old_fmt, arg, vaidx, spec);
1137 		case FORMAT_TYPE_LONG:
1138 		case FORMAT_TYPE_ULONG:
1139 		case FORMAT_TYPE_LONG_LONG:
1140 		case FORMAT_TYPE_PTRDIFF:
1141 		case FORMAT_TYPE_SIZE_T:
1142 			break;
1143 		}
1144 
1145 
1146 	}
1147 
1148 	if (get_argument_from_call_expr(callexpr->args, vaidx))
1149 		sm_warning("excess argument passed to '%s'", name);
1150 
1151 
1152 }
1153 
1154 static void
1155 check_printf_call(const char *name, struct expression *callexpr, void *_info)
1156 {
1157 	/*
1158 	 * Note: attribute(printf) uses 1-based indexing, but
1159 	 * get_argument_from_call_expr() uses 0-based indexing.
1160 	 */
1161 	int info = PTR_INT(_info);
1162 	int fmtidx = (info & 0xff) - 1;
1163 	int vaidx = ((info >> 8) & 0xff) - 1;
1164 	struct expression *fmtexpr;
1165 	const char *caller = get_function();
1166 
1167 	if (!caller)
1168 		return;
1169 
1170 	/*
1171 	 * Calling a v*printf function with a literal format arg is
1172 	 * extremely rare, so we don't bother doing the only checking
1173 	 * we could do, namely checking that the format string is
1174 	 * valid.
1175 	 */
1176 	if (vaidx < 0)
1177 		return;
1178 
1179 	/*
1180 	 * For the things we use the name of the calling function for,
1181 	 * it is more appropriate to skip a potential SyS_ prefix; the
1182 	 * same goes for leading underscores.
1183 	 */
1184 	if (!strncmp(caller, "SyS_", 4))
1185 		caller += 4;
1186 	while (*caller == '_')
1187 		++caller;
1188 
1189 	/* Lack of format argument is a bug. */
1190 	fmtexpr = get_argument_from_call_expr(callexpr->args, fmtidx);
1191 	if (!fmtexpr) {
1192 		sm_error("call of '%s' with no format argument", name);
1193 		return;
1194 	}
1195 
1196 	do_check_printf_call(caller, name, callexpr, fmtexpr, vaidx);
1197 }
1198 
1199 
1200 void check_kernel_printf(int id)
1201 {
1202 	if (option_project != PROJ_KERNEL)
1203 		return;
1204 
1205 	my_id = id;
1206 
1207 #define printf_hook(func, fmt, first_to_check)	\
1208 	add_function_hook(#func, check_printf_call, INT_PTR(fmt + (first_to_check << 8)))
1209 
1210 	/* Extracted using stupid perl script. */
1211 
1212 #if 0
1213 	printf_hook(srm_printk, 1, 2);                    /* arch/alpha/include/asm/console.h */
1214 	printf_hook(die_if_kernel, 1, 2);                 /* arch/frv/include/asm/bug.h */
1215 	printf_hook(ia64_mca_printk, 1, 2);               /* arch/ia64/include/asm/mca.h */
1216 	printf_hook(nfprint, 1, 2);                       /* arch/m68k/include/asm/natfeat.h */
1217 	printf_hook(gdbstub_printk, 1, 2);                /* arch/mn10300/include/asm/gdb-stub.h */
1218 	printf_hook(DBG, 1, 2);                           /* arch/powerpc/boot/ps3.c */
1219 	printf_hook(printf, 1, 2);                        /* arch/powerpc/boot/stdio.h */
1220 	printf_hook(udbg_printf, 1, 2);                   /* arch/powerpc/include/asm/udbg.h */
1221 	printf_hook(__debug_sprintf_event, 3, 4);         /* arch/s390/include/asm/debug.h */
1222 	printf_hook(__debug_sprintf_exception, 3, 4);     /* arch/s390/include/asm/debug.h */
1223 	printf_hook(prom_printf, 1, 2);                   /* arch/sparc/include/asm/oplib_32.h */
1224 
1225 	printf_hook(fail, 1, 2);                          /* arch/x86/vdso/vdso2c.c */
1226 #endif
1227 
1228 	printf_hook(_ldm_printk, 3, 4);                   /* block/partitions/ldm.c */
1229 	printf_hook(rbd_warn, 2, 3);                      /* drivers/block/rbd.c */
1230 	printf_hook(fw_err, 2, 3);                        /* drivers/firewire/core.h */
1231 	printf_hook(fw_notice, 2, 3);                     /* drivers/firewire/core.h */
1232 	printf_hook(i915_error_printf, 2, 3);             /* drivers/gpu/drm/i915/i915_drv.h */
1233 	printf_hook(i915_handle_error, 3, 4);             /* drivers/gpu/drm/i915/i915_drv.h */
1234 	printf_hook(nv_printk_, 3, 4);                    /* drivers/gpu/drm/nouveau/core/include/core/printk.h */
1235 	printf_hook(host1x_debug_output, 2, 3);           /* drivers/gpu/host1x/debug.h */
1236 	printf_hook(callc_debug, 2, 3);                   /* drivers/isdn/hisax/callc.c */
1237 	printf_hook(link_debug, 3, 4);                    /* drivers/isdn/hisax/callc.c */
1238 	printf_hook(HiSax_putstatus, 3, 4);               /* drivers/isdn/hisax/hisax.h */
1239 	printf_hook(VHiSax_putstatus, 3, 0);              /* drivers/isdn/hisax/hisax.h */
1240 	printf_hook(debugl1, 2, 3);                       /* drivers/isdn/hisax/isdnl1.h */
1241 	printf_hook(l3m_debug, 2, 3);                     /* drivers/isdn/hisax/isdnl3.c */
1242 	printf_hook(dout_debug, 2, 3);                    /* drivers/isdn/hisax/st5481_d.c */
1243 	printf_hook(l1m_debug, 2, 3);                     /* drivers/isdn/hisax/st5481_d.c */
1244 	printf_hook(bch_cache_set_error, 2, 3);           /* drivers/md/bcache/bcache.h */
1245 	printf_hook(_tda_printk, 4, 5);                   /* drivers/media/tuners/tda18271-priv.h */
1246 	printf_hook(i40evf_debug_d, 3, 4);                /* drivers/net/ethernet/intel/i40evf/i40e_osdep.h */
1247 	printf_hook(en_print, 3, 4);                      /* drivers/net/ethernet/mellanox/mlx4/mlx4_en.h */
1248 	printf_hook(_ath_dbg, 3, 4);                      /* drivers/net/wireless/ath/ath.h */
1249 	printf_hook(ath_printk, 3, 4);                    /* drivers/net/wireless/ath/ath.h */
1250 	printf_hook(ath10k_dbg, 3, 4);                    /* drivers/net/wireless/ath/ath10k/debug.h */
1251 	printf_hook(ath10k_err, 2, 3);                    /* drivers/net/wireless/ath/ath10k/debug.h */
1252 	printf_hook(ath10k_info, 2, 3);                   /* drivers/net/wireless/ath/ath10k/debug.h */
1253 	printf_hook(ath10k_warn, 2, 3);                   /* drivers/net/wireless/ath/ath10k/debug.h */
1254 	printf_hook(_ath5k_printk, 3, 4);                 /* drivers/net/wireless/ath/ath5k/ath5k.h */
1255 	printf_hook(ATH5K_DBG, 3, 4);                     /* drivers/net/wireless/ath/ath5k/debug.h */
1256 	printf_hook(ATH5K_DBG_UNLIMIT, 3, 4);             /* drivers/net/wireless/ath/ath5k/debug.h */
1257 	printf_hook(ath6kl_printk, 2, 3);                 /* drivers/net/wireless/ath/ath6kl/common.h */
1258 	printf_hook(ath6kl_err, 1, 2);                    /* drivers/net/wireless/ath/ath6kl/debug.h */
1259 	printf_hook(ath6kl_info, 1, 2);                   /* drivers/net/wireless/ath/ath6kl/debug.h */
1260 	printf_hook(ath6kl_warn, 1, 2);                   /* drivers/net/wireless/ath/ath6kl/debug.h */
1261 	printf_hook(wil_dbg_trace, 2, 3);                 /* drivers/net/wireless/ath/wil6210/wil6210.h */
1262 	printf_hook(wil_err, 2, 3);                       /* drivers/net/wireless/ath/wil6210/wil6210.h */
1263 	printf_hook(wil_err_ratelimited, 2, 3);           /* drivers/net/wireless/ath/wil6210/wil6210.h */
1264 	printf_hook(wil_info, 2, 3);                      /* drivers/net/wireless/ath/wil6210/wil6210.h */
1265 	printf_hook(b43dbg, 2, 3);                        /* drivers/net/wireless/b43/b43.h */
1266 	printf_hook(b43err, 2, 3);                        /* drivers/net/wireless/b43/b43.h */
1267 	printf_hook(b43info, 2, 3);                       /* drivers/net/wireless/b43/b43.h */
1268 	printf_hook(b43warn, 2, 3);                       /* drivers/net/wireless/b43/b43.h */
1269 	printf_hook(b43legacydbg, 2, 3);                  /* drivers/net/wireless/b43legacy/b43legacy.h */
1270 	printf_hook(b43legacyerr, 2, 3);                  /* drivers/net/wireless/b43legacy/b43legacy.h */
1271 	printf_hook(b43legacyinfo, 2, 3);                 /* drivers/net/wireless/b43legacy/b43legacy.h */
1272 	printf_hook(b43legacywarn, 2, 3);                 /* drivers/net/wireless/b43legacy/b43legacy.h */
1273 	printf_hook(__brcmf_dbg, 3, 4);                   /* drivers/net/wireless/brcm80211/brcmfmac/debug.h */
1274 	printf_hook(__brcmf_err, 2, 3);                   /* drivers/net/wireless/brcm80211/brcmfmac/debug.h */
1275 	printf_hook(__brcms_crit, 2, 3);                  /* drivers/net/wireless/brcm80211/brcmsmac/debug.h */
1276 	printf_hook(__brcms_dbg, 4, 5);                   /* drivers/net/wireless/brcm80211/brcmsmac/debug.h */
1277 	printf_hook(__brcms_err, 2, 3);                   /* drivers/net/wireless/brcm80211/brcmsmac/debug.h */
1278 	printf_hook(__brcms_info, 2, 3);                  /* drivers/net/wireless/brcm80211/brcmsmac/debug.h */
1279 	printf_hook(__brcms_warn, 2, 3);                  /* drivers/net/wireless/brcm80211/brcmsmac/debug.h */
1280 	printf_hook(brcmu_dbg_hex_dump, 3, 4);            /* drivers/net/wireless/brcm80211/include/brcmu_utils.h */
1281 	printf_hook(__iwl_crit, 2, 3);                    /* drivers/net/wireless/iwlwifi/iwl-debug.h */
1282 	printf_hook(__iwl_dbg, 5, 6);                     /* drivers/net/wireless/iwlwifi/iwl-debug.h */
1283 	printf_hook(__iwl_err, 4, 5);                     /* drivers/net/wireless/iwlwifi/iwl-debug.h */
1284 	printf_hook(__iwl_info, 2, 3);                    /* drivers/net/wireless/iwlwifi/iwl-debug.h */
1285 	printf_hook(__iwl_warn, 2, 3);                    /* drivers/net/wireless/iwlwifi/iwl-debug.h */
1286 	printf_hook(rsi_dbg, 2, 3);                       /* drivers/net/wireless/rsi/rsi_main.h */
1287 	printf_hook(RTPRINT, 4, 5);                       /* drivers/net/wireless/rtlwifi/debug.h */
1288 	printf_hook(RT_ASSERT, 2, 3);                     /* drivers/net/wireless/rtlwifi/debug.h */
1289 	printf_hook(RT_TRACE, 4, 5);                      /* drivers/net/wireless/rtlwifi/debug.h */
1290 	printf_hook(__of_node_dup, 2, 3);                 /* drivers/of/of_private.h */
1291 	printf_hook(BNX2FC_HBA_DBG, 2, 3);                /* drivers/scsi/bnx2fc/bnx2fc_debug.h */
1292 	printf_hook(BNX2FC_IO_DBG, 2, 3);                 /* drivers/scsi/bnx2fc/bnx2fc_debug.h */
1293 	printf_hook(BNX2FC_TGT_DBG, 2, 3);                /* drivers/scsi/bnx2fc/bnx2fc_debug.h */
1294 	printf_hook(ql_dbg, 4, 5);                        /* drivers/scsi/qla2xxx/qla_dbg.h */
1295 	printf_hook(ql_dbg_pci, 4, 5);                    /* drivers/scsi/qla2xxx/qla_dbg.h */
1296 	printf_hook(ql_log, 4, 5);                        /* drivers/scsi/qla2xxx/qla_dbg.h */
1297 	printf_hook(ql_log_pci, 4, 5);                    /* drivers/scsi/qla2xxx/qla_dbg.h */
1298 	printf_hook(libcfs_debug_msg, 2, 3);              /* drivers/staging/lustre/include/linux/libcfs/libcfs_debug.h */
1299 	printf_hook(libcfs_debug_vmsg2, 4, 5);            /* drivers/staging/lustre/include/linux/libcfs/libcfs_debug.h */
1300 	printf_hook(_ldlm_lock_debug, 3, 4);              /* drivers/staging/lustre/lustre/include/lustre_dlm.h */
1301 	printf_hook(_debug_req, 3, 4);                    /* drivers/staging/lustre/lustre/include/lustre_net.h */
1302 	printf_hook(iscsi_change_param_sprintf, 2, 3);    /* drivers/target/iscsi/iscsi_target_login.c */
1303 	printf_hook(dbg, 1, 2);                           /* drivers/tty/serial/samsung.c */
1304 	printf_hook(_usb_stor_dbg, 2, 3);                 /* drivers/usb/storage/debug.h */
1305 	printf_hook(usb_stor_dbg, 2, 3);                  /* drivers/usb/storage/debug.h */
1306 	printf_hook(vringh_bad, 1, 2);                    /* drivers/vhost/vringh.c */
1307 	printf_hook(__adfs_error, 3, 4);                  /* fs/adfs/adfs.h */
1308 	printf_hook(affs_error, 3, 4);                    /* fs/affs/affs.h */
1309 	printf_hook(affs_warning, 3, 4);                  /* fs/affs/affs.h */
1310 	printf_hook(befs_debug, 2, 3);                    /* fs/befs/befs.h */
1311 	printf_hook(befs_error, 2, 3);                    /* fs/befs/befs.h */
1312 	printf_hook(befs_warning, 2, 3);                  /* fs/befs/befs.h */
1313 	printf_hook(__btrfs_panic, 5, 6);                 /* fs/btrfs/ctree.h */
1314 	printf_hook(__btrfs_std_error, 5, 6);             /* fs/btrfs/ctree.h */
1315 	printf_hook(btrfs_printk, 2, 3);                  /* fs/btrfs/ctree.h */
1316 	printf_hook(cifs_vfs_err, 1, 2);                  /* fs/cifs/cifs_debug.h */
1317 	printf_hook(__ecryptfs_printk, 1, 2);             /* fs/ecryptfs/ecryptfs_kernel.h */
1318 	printf_hook(ext2_error, 3, 4);                    /* fs/ext2/ext2.h */
1319 	printf_hook(ext2_msg, 3, 4);                      /* fs/ext2/ext2.h */
1320 	printf_hook(ext3_abort, 3, 4);                    /* fs/ext3/ext3.h */
1321 	printf_hook(ext3_error, 3, 4);                    /* fs/ext3/ext3.h */
1322 	printf_hook(ext3_msg, 3, 4);                      /* fs/ext3/ext3.h */
1323 	printf_hook(ext3_warning, 3, 4);                  /* fs/ext3/ext3.h */
1324 	printf_hook(__ext4_abort, 4, 5);                  /* fs/ext4/ext4.h */
1325 	printf_hook(__ext4_error, 4, 5);                  /* fs/ext4/ext4.h */
1326 	printf_hook(__ext4_error_file, 5, 6);             /* fs/ext4/ext4.h */
1327 	printf_hook(__ext4_error_inode, 5, 6);            /* fs/ext4/ext4.h */
1328 	printf_hook(__ext4_grp_locked_error, 7, 8);       /* fs/ext4/ext4.h */
1329 	printf_hook(__ext4_msg, 3, 4);                    /* fs/ext4/ext4.h */
1330 	printf_hook(__ext4_warning, 4, 5);                /* fs/ext4/ext4.h */
1331 	printf_hook(f2fs_msg, 3, 4);                      /* fs/f2fs/f2fs.h */
1332 	printf_hook(__fat_fs_error, 3, 4);                /* fs/fat/fat.h */
1333 	printf_hook(fat_msg, 3, 4);                       /* fs/fat/fat.h */
1334 	printf_hook(gfs2_print_dbg, 2, 3);                /* fs/gfs2/glock.h */
1335 	printf_hook(gfs2_lm_withdraw, 2, 3);              /* fs/gfs2/util.h */
1336 	printf_hook(hpfs_error, 2, 3);                    /* fs/hpfs/hpfs_fn.h */
1337 	printf_hook(jfs_error, 2, 3);                     /* fs/jfs/jfs_superblock.h */
1338 	printf_hook(nilfs_error, 3, 4);                   /* fs/nilfs2/nilfs.h */
1339 	printf_hook(nilfs_warning, 3, 4);                 /* fs/nilfs2/nilfs.h */
1340 	printf_hook(__ntfs_debug, 4, 5);                  /* fs/ntfs/debug.h */
1341 	printf_hook(__ntfs_error, 3, 4);                  /* fs/ntfs/debug.h */
1342 	printf_hook(__ntfs_warning, 3, 4);                /* fs/ntfs/debug.h */
1343 	printf_hook(__ocfs2_abort, 3, 4);                 /* fs/ocfs2/super.h */
1344 	printf_hook(__ocfs2_error, 3, 4);                 /* fs/ocfs2/super.h */
1345 	printf_hook(_udf_err, 3, 4);                      /* fs/udf/udfdecl.h */
1346 	printf_hook(_udf_warn, 3, 4);                     /* fs/udf/udfdecl.h */
1347 	printf_hook(ufs_error, 3, 4);                     /* fs/ufs/ufs.h */
1348 	printf_hook(ufs_panic, 3, 4);                     /* fs/ufs/ufs.h */
1349 	printf_hook(ufs_warning, 3, 4);                   /* fs/ufs/ufs.h */
1350 	printf_hook(xfs_alert, 2, 3);                     /* fs/xfs/xfs_message.h */
1351 	printf_hook(xfs_alert_tag, 3, 4);                 /* fs/xfs/xfs_message.h */
1352 	printf_hook(xfs_crit, 2, 3);                      /* fs/xfs/xfs_message.h */
1353 	printf_hook(xfs_debug, 2, 3);                     /* fs/xfs/xfs_message.h */
1354 	printf_hook(xfs_emerg, 2, 3);                     /* fs/xfs/xfs_message.h */
1355 	printf_hook(xfs_err, 2, 3);                       /* fs/xfs/xfs_message.h */
1356 	printf_hook(xfs_info, 2, 3);                      /* fs/xfs/xfs_message.h */
1357 	printf_hook(xfs_notice, 2, 3);                    /* fs/xfs/xfs_message.h */
1358 	printf_hook(xfs_warn, 2, 3);                      /* fs/xfs/xfs_message.h */
1359 	printf_hook(warn_slowpath_fmt, 3, 4);             /* include/asm-generic/bug.h */
1360 	printf_hook(warn_slowpath_fmt_taint, 4, 5);       /* include/asm-generic/bug.h */
1361 	printf_hook(drm_err, 1, 2);                       /* include/drm/drmP.h */
1362 	printf_hook(drm_ut_debug_printk, 2, 3);           /* include/drm/drmP.h */
1363 	printf_hook(__acpi_handle_debug, 3, 4);           /* include/linux/acpi.h */
1364 	printf_hook(acpi_handle_printk, 3, 4);            /* include/linux/acpi.h */
1365 	printf_hook(audit_log, 4, 5);                     /* include/linux/audit.h */
1366 	printf_hook(audit_log_format, 2, 3);              /* include/linux/audit.h */
1367 	printf_hook(bdi_register, 3, 4);                  /* include/linux/backing-dev.h */
1368 	printf_hook(__trace_note_message, 2, 3);          /* include/linux/blktrace_api.h */
1369 	printf_hook(_dev_info, 2, 3);                     /* include/linux/device.h */
1370 	printf_hook(dev_alert, 2, 3);                     /* include/linux/device.h */
1371 	printf_hook(dev_crit, 2, 3);                      /* include/linux/device.h */
1372 	printf_hook(dev_emerg, 2, 3);                     /* include/linux/device.h */
1373 	printf_hook(dev_err, 2, 3);                       /* include/linux/device.h */
1374 	printf_hook(dev_notice, 2, 3);                    /* include/linux/device.h */
1375 	printf_hook(dev_printk, 3, 4);                    /* include/linux/device.h */
1376 	printf_hook(dev_printk_emit, 3, 4);               /* include/linux/device.h */
1377 	printf_hook(dev_set_name, 2, 3);                  /* include/linux/device.h */
1378 	printf_hook(dev_vprintk_emit, 3, 0);              /* include/linux/device.h */
1379 	printf_hook(dev_warn, 2, 3);                      /* include/linux/device.h */
1380 	printf_hook(device_create, 5, 6);                 /* include/linux/device.h */
1381 	printf_hook(device_create_with_groups, 6, 7);     /* include/linux/device.h */
1382 	printf_hook(devm_kasprintf, 3, 4);                /* include/linux/device.h */
1383 	printf_hook(__dynamic_dev_dbg, 3, 4);             /* include/linux/dynamic_debug.h */
1384 	printf_hook(__dynamic_netdev_dbg, 3, 4);          /* include/linux/dynamic_debug.h */
1385 	printf_hook(__dynamic_pr_debug, 2, 3);            /* include/linux/dynamic_debug.h */
1386 	printf_hook(__simple_attr_check_format, 1, 2);    /* include/linux/fs.h */
1387 	printf_hook(fscache_init_cache, 3, 4);            /* include/linux/fscache-cache.h */
1388 	printf_hook(gameport_set_phys, 2, 3);             /* include/linux/gameport.h */
1389 	printf_hook(iio_trigger_alloc, 1, 2);             /* include/linux/iio/trigger.h */
1390 	printf_hook(__check_printsym_format, 1, 2);       /* include/linux/kallsyms.h */
1391 	printf_hook(kdb_printf, 1, 2);                    /* include/linux/kdb.h */
1392 	printf_hook(vkdb_printf, 1, 0);                   /* include/linux/kdb.h */
1393 	printf_hook(____trace_printk_check_format, 1, 2);  /* include/linux/kernel.h */
1394 	printf_hook(__trace_bprintk, 2, 3);               /* include/linux/kernel.h */
1395 	printf_hook(__trace_printk, 2, 3);                /* include/linux/kernel.h */
1396 	printf_hook(kasprintf, 2, 3);                     /* include/linux/kernel.h */
1397 	printf_hook(panic, 1, 2);                         /* include/linux/kernel.h */
1398 	printf_hook(scnprintf, 3, 4);                     /* include/linux/kernel.h */
1399 	printf_hook(snprintf, 3, 4);                      /* include/linux/kernel.h */
1400 	printf_hook(sprintf, 2, 3);                       /* include/linux/kernel.h */
1401 	printf_hook(trace_printk, 1, 2);                  /* include/linux/kernel.h */
1402 	printf_hook(vscnprintf, 3, 0);                    /* include/linux/kernel.h */
1403 	printf_hook(vsnprintf, 3, 0);                     /* include/linux/kernel.h */
1404 	printf_hook(vsprintf, 2, 0);                      /* include/linux/kernel.h */
1405 	printf_hook(vmcoreinfo_append_str, 1, 2);         /* include/linux/kexec.h */
1406 	printf_hook(__request_module, 2, 3);              /* include/linux/kmod.h */
1407 	printf_hook(add_uevent_var, 2, 3);                /* include/linux/kobject.h */
1408 	printf_hook(kobject_add, 3, 4);                   /* include/linux/kobject.h */
1409 	printf_hook(kobject_init_and_add, 4, 5);          /* include/linux/kobject.h */
1410 	printf_hook(kobject_set_name, 2, 3);              /* include/linux/kobject.h */
1411 	printf_hook(kthread_create_on_node, 4, 5);        /* include/linux/kthread.h */
1412 	printf_hook(__ata_ehi_push_desc, 2, 3);           /* include/linux/libata.h */
1413 	printf_hook(ata_dev_printk, 3, 4);                /* include/linux/libata.h */
1414 	printf_hook(ata_ehi_push_desc, 2, 3);             /* include/linux/libata.h */
1415 	printf_hook(ata_link_printk, 3, 4);               /* include/linux/libata.h */
1416 	printf_hook(ata_port_desc, 2, 3);                 /* include/linux/libata.h */
1417 	printf_hook(ata_port_printk, 3, 4);               /* include/linux/libata.h */
1418 	printf_hook(warn_alloc_failed, 3, 4);             /* include/linux/mm.h */
1419 	printf_hook(mmiotrace_printk, 1, 2);              /* include/linux/mmiotrace.h */
1420 	printf_hook(netdev_alert, 2, 3);                  /* include/linux/netdevice.h */
1421 	printf_hook(netdev_crit, 2, 3);                   /* include/linux/netdevice.h */
1422 	printf_hook(netdev_emerg, 2, 3);                  /* include/linux/netdevice.h */
1423 	printf_hook(netdev_err, 2, 3);                    /* include/linux/netdevice.h */
1424 	printf_hook(netdev_info, 2, 3);                   /* include/linux/netdevice.h */
1425 	printf_hook(netdev_notice, 2, 3);                 /* include/linux/netdevice.h */
1426 	printf_hook(netdev_printk, 3, 4);                 /* include/linux/netdevice.h */
1427 	printf_hook(netdev_warn, 2, 3);                   /* include/linux/netdevice.h */
1428 	printf_hook(early_printk, 1, 2);                  /* include/linux/printk.h */
1429 	printf_hook(no_printk, 1, 2);                     /* include/linux/printk.h */
1430 	printf_hook(printk, 1, 2);                        /* include/linux/printk.h */
1431 	printf_hook(printk_deferred, 1, 2);               /* include/linux/printk.h */
1432 	printf_hook(printk_emit, 5, 6);                   /* include/linux/printk.h */
1433 	printf_hook(vprintk, 1, 0);                       /* include/linux/printk.h */
1434 	printf_hook(vprintk_emit, 5, 0);                  /* include/linux/printk.h */
1435 	printf_hook(__quota_error, 3, 4);                 /* include/linux/quotaops.h */
1436 	printf_hook(seq_buf_printf, 2, 3);                /* include/linux/seq_buf.h */
1437 	printf_hook(seq_buf_vprintf, 2, 0);               /* include/linux/seq_buf.h */
1438 	printf_hook(seq_printf, 2, 3);                    /* include/linux/seq_file.h */
1439 	printf_hook(seq_vprintf, 2, 0);                   /* include/linux/seq_file.h */
1440 	printf_hook(bprintf, 3, 4);                       /* include/linux/string.h */
1441 	printf_hook(trace_seq_printf, 2, 3);              /* include/linux/trace_seq.h */
1442 	printf_hook(trace_seq_vprintf, 2, 0);             /* include/linux/trace_seq.h */
1443 	printf_hook(__alloc_workqueue_key, 1, 6);         /* include/linux/workqueue.h */
1444 	printf_hook(set_worker_desc, 1, 2);               /* include/linux/workqueue.h */
1445 	printf_hook(_p9_debug, 3, 4);                     /* include/net/9p/9p.h */
1446 	printf_hook(bt_err, 1, 2);                        /* include/net/bluetooth/bluetooth.h */
1447 	printf_hook(bt_info, 1, 2);                       /* include/net/bluetooth/bluetooth.h */
1448 	printf_hook(nf_ct_helper_log, 3, 4);              /* include/net/netfilter/nf_conntrack_helper.h */
1449 	printf_hook(nf_log_buf_add, 2, 3);                /* include/net/netfilter/nf_log.h */
1450 	printf_hook(nf_log_packet, 8, 9);                 /* include/net/netfilter/nf_log.h */
1451 	printf_hook(SOCK_DEBUG, 2, 3);                    /* include/net/sock.h */
1452 	printf_hook(__snd_printk, 4, 5);                  /* include/sound/core.h */
1453 	printf_hook(_snd_printd, 2, 3);                   /* include/sound/core.h */
1454 	printf_hook(snd_printd, 1, 2);                    /* include/sound/core.h */
1455 	printf_hook(snd_printdd, 1, 2);                   /* include/sound/core.h */
1456 	printf_hook(snd_iprintf, 2, 3);                   /* include/sound/info.h */
1457 	printf_hook(snd_seq_create_kernel_client, 3, 4);  /* include/sound/seq_kernel.h */
1458 	printf_hook(xen_raw_printk, 1, 2);                /* include/xen/hvc-console.h */
1459 	printf_hook(xenbus_dev_error, 3, 4);              /* include/xen/xenbus.h */
1460 	printf_hook(xenbus_dev_fatal, 3, 4);              /* include/xen/xenbus.h */
1461 	printf_hook(xenbus_printf, 4, 5);                 /* include/xen/xenbus.h */
1462 	printf_hook(xenbus_watch_pathfmt, 4, 5);          /* include/xen/xenbus.h */
1463 	printf_hook(batadv_fdebug_log, 2, 3);             /* net/batman-adv/debugfs.c */
1464 	printf_hook(_batadv_dbg, 4, 5);                   /* net/batman-adv/main.h */
1465 	printf_hook(batadv_debug_log, 2, 3);              /* net/batman-adv/main.h */
1466 	printf_hook(__sdata_dbg, 2, 3);                   /* net/mac80211/debug.h */
1467 	printf_hook(__sdata_err, 1, 2);                   /* net/mac80211/debug.h */
1468 	printf_hook(__sdata_info, 1, 2);                  /* net/mac80211/debug.h */
1469 	printf_hook(__wiphy_dbg, 3, 4);                   /* net/mac80211/debug.h */
1470 	printf_hook(mac80211_format_buffer, 4, 5);        /* net/mac80211/debugfs.h */
1471 	printf_hook(__rds_conn_error, 2, 3);              /* net/rds/rds.h */
1472 	printf_hook(rdsdebug, 1, 2);                      /* net/rds/rds.h */
1473 	printf_hook(printl, 1, 2);                        /* net/sctp/probe.c */
1474 	printf_hook(svc_printk, 2, 3);                    /* net/sunrpc/svc.c */
1475 	printf_hook(tomoyo_io_printf, 2, 3);              /* security/tomoyo/common.c */
1476 	printf_hook(tomoyo_supervisor, 2, 3);             /* security/tomoyo/common.h */
1477 	printf_hook(tomoyo_write_log, 2, 3);              /* security/tomoyo/common.h */
1478 	printf_hook(cmp_error, 2, 3);                     /* sound/firewire/cmp.c */
1479 }
1480