1// SPDX-License-Identifier: GPL-2.0-only 2/// Find uses of standard freeing functons on values allocated using devm_ 3/// functions. Values allocated using the devm_functions are freed when 4/// the device is detached, and thus the use of the standard freeing 5/// function would cause a double free. 6/// See Documentation/driver-api/driver-model/devres.rst for more information. 7/// 8/// A difficulty of detecting this problem is that the standard freeing 9/// function might be called from a different function than the one 10/// containing the allocation function. It is thus necessary to make the 11/// connection between the allocation function and the freeing function. 12/// Here this is done using the specific argument text, which is prone to 13/// false positives. There is no rule for the request_region and 14/// request_mem_region variants because this heuristic seems to be a bit 15/// less reliable in these cases. 16/// 17// Confidence: Moderate 18// Copyright: (C) 2011 Julia Lawall, INRIA/LIP6. 19// Copyright: (C) 2011 Gilles Muller, INRIA/LiP6. 20// URL: https://coccinelle.gitlabpages.inria.fr/website 21// Comments: 22// Options: --no-includes --include-headers 23 24virtual org 25virtual report 26virtual context 27 28@r depends on context || org || report@ 29type T; 30T x; 31@@ 32 33( 34 x = devm_kmalloc(...) 35| 36 x = devm_kvasprintf(...) 37| 38 x = devm_kasprintf(...) 39| 40 x = devm_kzalloc(...) 41| 42 x = devm_kmalloc_array(...) 43| 44 x = devm_kcalloc(...) 45| 46 x = devm_kstrdup(...) 47| 48 x = devm_kmemdup(...) 49| 50 x = devm_get_free_pages(...) 51| 52 x = devm_request_irq(...) 53| 54 x = devm_ioremap(...) 55| 56 x = devm_ioport_map(...) 57) 58 59@safe depends on context || org || report exists@ 60r.T x; 61position p; 62@@ 63 64( 65 x = kmalloc(...) 66| 67 x = kmalloc_obj(...) 68| 69 x = kmalloc_objs(...) 70| 71 x = kvasprintf(...) 72| 73 x = kasprintf(...) 74| 75 x = kzalloc(...) 76| 77 x = kzalloc_obj(...) 78| 79 x = kzalloc_objs(...) 80| 81 x = kmalloc_array(...) 82| 83 x = kcalloc(...) 84| 85 x = kstrdup(...) 86| 87 x = kmemdup(...) 88| 89 x = get_free_pages(...) 90| 91 x = request_irq(...) 92| 93 x = ioremap(...) 94| 95 x = ioport_map(...) 96) 97... 98( 99 kfree@p(x) 100| 101 kfree_sensitive@p(x) 102| 103 krealloc@p(x, ...) 104| 105 free_pages@p(x, ...) 106| 107 free_page@p(x) 108| 109 free_irq@p(x) 110| 111 iounmap@p(x) 112| 113 ioport_unmap@p(x) 114) 115 116@pb@ 117r.T r.x; 118position p != safe.p; 119@@ 120 121( 122* kfree@p(x) 123| 124* kfree_sensitive@p(x) 125| 126* krealloc@p(x, ...) 127| 128* free_pages@p(x, ...) 129| 130* free_page@p(x) 131| 132* free_irq@p(x) 133| 134* iounmap@p(x) 135| 136* ioport_unmap@p(x) 137) 138 139@script:python depends on org@ 140p << pb.p; 141@@ 142 143msg="WARNING: invalid free of devm_ allocated data" 144coccilib.org.print_todo(p[0], msg) 145 146@script:python depends on report@ 147p << pb.p; 148@@ 149 150msg="WARNING: invalid free of devm_ allocated data" 151coccilib.report.print_report(p[0], msg) 152 153