1 /* 2 * Copyright (C) 2010 Dan Carpenter. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 2 7 * of the License, or (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt 16 */ 17 18 /* 19 * This is a kernel check to make sure we unwind everything on 20 * on errors. 21 * 22 */ 23 24 #include "smatch.h" 25 #include "smatch_extra.h" 26 #include "smatch_slist.h" 27 28 #define EBUSY 16 29 #define MAX_ERRNO 4095 30 31 static int my_id; 32 33 STATE(allocated); 34 STATE(unallocated); 35 36 /* state of unwind function */ 37 STATE(called); 38 39 static int was_passed_as_param(struct expression *expr) 40 { 41 char *name; 42 struct symbol *sym; 43 struct symbol *arg; 44 45 name = expr_to_var_sym(expr, &sym); 46 if (!name) 47 return 0; 48 free_string(name); 49 50 FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) { 51 if (arg == sym) 52 return 1; 53 } END_FOR_EACH_PTR(arg); 54 return 0; 55 } 56 57 static void print_unwind_functions(const char *fn, struct expression *expr, void *_arg_no) 58 { 59 struct expression *arg_expr; 60 int arg_no = PTR_INT(_arg_no); 61 static struct symbol *last_printed = NULL; 62 63 arg_expr = get_argument_from_call_expr(expr->args, arg_no); 64 if (!was_passed_as_param(arg_expr)) 65 return; 66 if (last_printed == cur_func_sym) 67 return; 68 last_printed = cur_func_sym; 69 sm_msg("info: is unwind function"); 70 } 71 72 static void request_granted(const char *fn, struct expression *call_expr, 73 struct expression *assign_expr, void *_arg_no) 74 { 75 struct expression *arg_expr; 76 int arg_no = PTR_INT(_arg_no); 77 78 if (arg_no == -1) { 79 if (!assign_expr) 80 return; 81 arg_expr = assign_expr->left; 82 } else { 83 arg_expr = get_argument_from_call_expr(call_expr->args, arg_no); 84 } 85 set_state_expr(my_id, arg_expr, &allocated); 86 } 87 88 static void request_denied(const char *fn, struct expression *call_expr, 89 struct expression *assign_expr, void *_arg_no) 90 { 91 struct expression *arg_expr; 92 int arg_no = PTR_INT(_arg_no); 93 94 if (arg_no == -1) { 95 if (!assign_expr) 96 return; 97 arg_expr = assign_expr->left; 98 } else { 99 arg_expr = get_argument_from_call_expr(call_expr->args, arg_no); 100 } 101 set_state_expr(my_id, arg_expr, &unallocated); 102 } 103 104 static void match_release(const char *fn, struct expression *expr, void *_arg_no) 105 { 106 struct expression *arg_expr; 107 int arg_no = PTR_INT(_arg_no); 108 109 arg_expr = get_argument_from_call_expr(expr->args, arg_no); 110 if (get_state_expr(my_id, arg_expr)) 111 set_state_expr(my_id, arg_expr, &unallocated); 112 set_equiv_state_expr(my_id, arg_expr, &unallocated); 113 } 114 115 static void match_unwind_function(const char *fn, struct expression *expr, void *unused) 116 { 117 set_state(my_id, "unwind_function", NULL, &called); 118 } 119 120 static int func_returns_int(void) 121 { 122 struct symbol *type; 123 124 type = get_base_type(cur_func_sym); 125 if (!type || type->type != SYM_FN) 126 return 0; 127 type = get_base_type(type); 128 if (type->ctype.base_type == &int_type) { 129 return 1; 130 } 131 return 0; 132 } 133 134 static void match_return(struct expression *ret_value) 135 { 136 struct stree *stree; 137 struct sm_state *tmp; 138 sval_t sval; 139 140 if (!func_returns_int()) 141 return; 142 if (get_value(ret_value, &sval) && sval_cmp_val(sval, 0) >= 0) 143 return; 144 if (!implied_not_equal(ret_value, 0)) 145 return; 146 if (get_state(my_id, "unwind_function", NULL) == &called) 147 return; 148 149 stree = __get_cur_stree(); 150 FOR_EACH_MY_SM(my_id, stree, tmp) { 151 if (slist_has_state(tmp->possible, &allocated)) 152 sm_warning("'%s' was not released on error", tmp->name); 153 } END_FOR_EACH_SM(tmp); 154 } 155 156 static void register_unwind_functions(void) 157 { 158 struct token *token; 159 const char *func; 160 161 token = get_tokens_file("kernel.unwind_functions"); 162 if (!token) 163 return; 164 if (token_type(token) != TOKEN_STREAMBEGIN) 165 return; 166 token = token->next; 167 while (token_type(token) != TOKEN_STREAMEND) { 168 if (token_type(token) != TOKEN_IDENT) 169 return; 170 func = show_ident(token->ident); 171 add_function_hook(func, &match_unwind_function, NULL); 172 token = token->next; 173 } 174 clear_token_alloc(); 175 } 176 177 static void release_function_indicator(const char *name) 178 { 179 if (!option_info) 180 return; 181 add_function_hook(name, &print_unwind_functions, INT_PTR(0)); 182 } 183 184 void check_unwind(int id) 185 { 186 if (option_project != PROJ_KERNEL || !option_spammy) 187 return; 188 my_id = id; 189 190 register_unwind_functions(); 191 192 return_implies_state("request_resource", 0, 0, &request_granted, INT_PTR(1)); 193 return_implies_state("request_resource", -EBUSY, -EBUSY, &request_denied, INT_PTR(1)); 194 add_function_hook("release_resource", &match_release, INT_PTR(0)); 195 release_function_indicator("release_resource"); 196 197 return_implies_state("__request_region", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(1)); 198 return_implies_state("__request_region", 0, 0, &request_denied, INT_PTR(1)); 199 add_function_hook("__release_region", &match_release, INT_PTR(1)); 200 release_function_indicator("__release_region"); 201 202 return_implies_state("ioremap", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(-1)); 203 return_implies_state("ioremap", 0, 0, &request_denied, INT_PTR(-1)); 204 add_function_hook("iounmap", &match_release, INT_PTR(0)); 205 206 return_implies_state("pci_iomap", valid_ptr_min, valid_ptr_max, &request_granted, INT_PTR(-1)); 207 return_implies_state("pci_iomap", 0, 0, &request_denied, INT_PTR(-1)); 208 add_function_hook("pci_iounmap", &match_release, INT_PTR(1)); 209 release_function_indicator("pci_iounmap"); 210 211 return_implies_state("__create_workqueue_key", valid_ptr_min, valid_ptr_max, &request_granted, 212 INT_PTR(-1)); 213 return_implies_state("__create_workqueue_key", 0, 0, &request_denied, INT_PTR(-1)); 214 add_function_hook("destroy_workqueue", &match_release, INT_PTR(0)); 215 216 return_implies_state("request_irq", 0, 0, &request_granted, INT_PTR(0)); 217 return_implies_state("request_irq", -MAX_ERRNO, -1, &request_denied, INT_PTR(0)); 218 add_function_hook("free_irq", &match_release, INT_PTR(0)); 219 release_function_indicator("free_irq"); 220 221 return_implies_state("register_netdev", 0, 0, &request_granted, INT_PTR(0)); 222 return_implies_state("register_netdev", -MAX_ERRNO, -1, &request_denied, INT_PTR(0)); 223 add_function_hook("unregister_netdev", &match_release, INT_PTR(0)); 224 release_function_indicator("unregister_netdev"); 225 226 return_implies_state("misc_register", 0, 0, &request_granted, INT_PTR(0)); 227 return_implies_state("misc_register", -MAX_ERRNO, -1, &request_denied, INT_PTR(0)); 228 add_function_hook("misc_deregister", &match_release, INT_PTR(0)); 229 release_function_indicator("misc_deregister"); 230 231 232 add_hook(&match_return, RETURN_HOOK); 233 } 234