1*1f5207b7SJohn Levon /*
2*1f5207b7SJohn Levon * Copyright (C) 2010 Dan Carpenter.
3*1f5207b7SJohn Levon *
4*1f5207b7SJohn Levon * This program is free software; you can redistribute it and/or
5*1f5207b7SJohn Levon * modify it under the terms of the GNU General Public License
6*1f5207b7SJohn Levon * as published by the Free Software Foundation; either version 2
7*1f5207b7SJohn Levon * of the License, or (at your option) any later version.
8*1f5207b7SJohn Levon *
9*1f5207b7SJohn Levon * This program is distributed in the hope that it will be useful,
10*1f5207b7SJohn Levon * but WITHOUT ANY WARRANTY; without even the implied warranty of
11*1f5207b7SJohn Levon * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12*1f5207b7SJohn Levon * GNU General Public License for more details.
13*1f5207b7SJohn Levon *
14*1f5207b7SJohn Levon * You should have received a copy of the GNU General Public License
15*1f5207b7SJohn Levon * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16*1f5207b7SJohn Levon */
17*1f5207b7SJohn Levon
18*1f5207b7SJohn Levon /*
19*1f5207b7SJohn Levon * According to an email on lkml you are not allowed to reuse the skb
20*1f5207b7SJohn Levon * passed to dev_queue_xmit()
21*1f5207b7SJohn Levon *
22*1f5207b7SJohn Levon */
23*1f5207b7SJohn Levon
24*1f5207b7SJohn Levon #include "smatch.h"
25*1f5207b7SJohn Levon #include "smatch_slist.h"
26*1f5207b7SJohn Levon
27*1f5207b7SJohn Levon static int my_id;
28*1f5207b7SJohn Levon
29*1f5207b7SJohn Levon STATE(do_not_use);
30*1f5207b7SJohn Levon
ok_to_use(struct sm_state * sm,struct expression * mod_expr)31*1f5207b7SJohn Levon static void ok_to_use(struct sm_state *sm, struct expression *mod_expr)
32*1f5207b7SJohn Levon {
33*1f5207b7SJohn Levon set_state(my_id, sm->name, sm->sym, &undefined);
34*1f5207b7SJohn Levon }
35*1f5207b7SJohn Levon
valid_use(void)36*1f5207b7SJohn Levon static int valid_use(void)
37*1f5207b7SJohn Levon {
38*1f5207b7SJohn Levon struct expression *tmp;
39*1f5207b7SJohn Levon int i = 0;
40*1f5207b7SJohn Levon int dot_ops = 0;
41*1f5207b7SJohn Levon
42*1f5207b7SJohn Levon FOR_EACH_PTR_REVERSE(big_expression_stack, tmp) {
43*1f5207b7SJohn Levon if (!i++)
44*1f5207b7SJohn Levon continue;
45*1f5207b7SJohn Levon if (tmp->type == EXPR_PREOP && tmp->op == '(')
46*1f5207b7SJohn Levon continue;
47*1f5207b7SJohn Levon if (tmp->op == '.' && !dot_ops++)
48*1f5207b7SJohn Levon continue;
49*1f5207b7SJohn Levon // if (tmp->type == EXPR_POSTOP)
50*1f5207b7SJohn Levon // return 1;
51*1f5207b7SJohn Levon if (tmp->type == EXPR_CALL && sym_name_is("kfree_skb", tmp->fn))
52*1f5207b7SJohn Levon return 1;
53*1f5207b7SJohn Levon return 0;
54*1f5207b7SJohn Levon } END_FOR_EACH_PTR_REVERSE(tmp);
55*1f5207b7SJohn Levon return 0;
56*1f5207b7SJohn Levon }
57*1f5207b7SJohn Levon
58*1f5207b7SJohn Levon /* match symbol is expensive. only turn it on after we match the xmit function */
59*1f5207b7SJohn Levon static int match_symbol_active;
match_symbol(struct expression * expr)60*1f5207b7SJohn Levon static void match_symbol(struct expression *expr)
61*1f5207b7SJohn Levon {
62*1f5207b7SJohn Levon struct sm_state *sm;
63*1f5207b7SJohn Levon char *name;
64*1f5207b7SJohn Levon
65*1f5207b7SJohn Levon sm = get_sm_state_expr(my_id, expr);
66*1f5207b7SJohn Levon if (!sm || !slist_has_state(sm->possible, &do_not_use))
67*1f5207b7SJohn Levon return;
68*1f5207b7SJohn Levon if (valid_use())
69*1f5207b7SJohn Levon return;
70*1f5207b7SJohn Levon name = expr_to_var(expr);
71*1f5207b7SJohn Levon sm_error("'%s' was already used up by dev_queue_xmit()", name);
72*1f5207b7SJohn Levon free_string(name);
73*1f5207b7SJohn Levon }
74*1f5207b7SJohn Levon
match_kfree_skb(const char * fn,struct expression * expr,void * param)75*1f5207b7SJohn Levon static void match_kfree_skb(const char *fn, struct expression *expr, void *param)
76*1f5207b7SJohn Levon {
77*1f5207b7SJohn Levon struct expression *arg;
78*1f5207b7SJohn Levon
79*1f5207b7SJohn Levon arg = get_argument_from_call_expr(expr->args, 0);
80*1f5207b7SJohn Levon if (!arg)
81*1f5207b7SJohn Levon return;
82*1f5207b7SJohn Levon set_state_expr(my_id, arg, &undefined);
83*1f5207b7SJohn Levon }
84*1f5207b7SJohn Levon
match_xmit(const char * fn,struct expression * expr,void * param)85*1f5207b7SJohn Levon static void match_xmit(const char *fn, struct expression *expr, void *param)
86*1f5207b7SJohn Levon {
87*1f5207b7SJohn Levon struct expression *arg;
88*1f5207b7SJohn Levon
89*1f5207b7SJohn Levon arg = get_argument_from_call_expr(expr->args, PTR_INT(param));
90*1f5207b7SJohn Levon if (!arg)
91*1f5207b7SJohn Levon return;
92*1f5207b7SJohn Levon set_state_expr(my_id, arg, &do_not_use);
93*1f5207b7SJohn Levon if (!match_symbol_active++) {
94*1f5207b7SJohn Levon add_hook(&match_symbol, SYM_HOOK);
95*1f5207b7SJohn Levon add_function_hook("kfree_skb", &match_kfree_skb, NULL);
96*1f5207b7SJohn Levon }
97*1f5207b7SJohn Levon }
98*1f5207b7SJohn Levon
register_funcs_from_file(void)99*1f5207b7SJohn Levon static void register_funcs_from_file(void)
100*1f5207b7SJohn Levon {
101*1f5207b7SJohn Levon struct token *token;
102*1f5207b7SJohn Levon const char *func;
103*1f5207b7SJohn Levon int arg;
104*1f5207b7SJohn Levon
105*1f5207b7SJohn Levon token = get_tokens_file("kernel.dev_queue_xmit");
106*1f5207b7SJohn Levon if (!token)
107*1f5207b7SJohn Levon return;
108*1f5207b7SJohn Levon if (token_type(token) != TOKEN_STREAMBEGIN)
109*1f5207b7SJohn Levon return;
110*1f5207b7SJohn Levon token = token->next;
111*1f5207b7SJohn Levon while (token_type(token) != TOKEN_STREAMEND) {
112*1f5207b7SJohn Levon if (token_type(token) != TOKEN_IDENT)
113*1f5207b7SJohn Levon return;
114*1f5207b7SJohn Levon func = show_ident(token->ident);
115*1f5207b7SJohn Levon token = token->next;
116*1f5207b7SJohn Levon if (token_type(token) != TOKEN_NUMBER)
117*1f5207b7SJohn Levon return;
118*1f5207b7SJohn Levon arg = atoi(token->number);
119*1f5207b7SJohn Levon add_function_hook(func, &match_xmit, INT_PTR(arg));
120*1f5207b7SJohn Levon token = token->next;
121*1f5207b7SJohn Levon }
122*1f5207b7SJohn Levon clear_token_alloc();
123*1f5207b7SJohn Levon }
124*1f5207b7SJohn Levon
check_dev_queue_xmit(int id)125*1f5207b7SJohn Levon void check_dev_queue_xmit(int id)
126*1f5207b7SJohn Levon {
127*1f5207b7SJohn Levon if (option_project != PROJ_KERNEL)
128*1f5207b7SJohn Levon return;
129*1f5207b7SJohn Levon my_id = id;
130*1f5207b7SJohn Levon add_modification_hook(my_id, ok_to_use);
131*1f5207b7SJohn Levon register_funcs_from_file();
132*1f5207b7SJohn Levon }
133