11f5207bJohn Levon/*
21f5207bJohn Levon * Copyright (C) 2010 Dan Carpenter.
31f5207bJohn Levon *
41f5207bJohn Levon * This program is free software; you can redistribute it and/or
51f5207bJohn Levon * modify it under the terms of the GNU General Public License
61f5207bJohn Levon * as published by the Free Software Foundation; either version 2
71f5207bJohn Levon * of the License, or (at your option) any later version.
81f5207bJohn Levon *
91f5207bJohn Levon * This program is distributed in the hope that it will be useful,
101f5207bJohn Levon * but WITHOUT ANY WARRANTY; without even the implied warranty of
111f5207bJohn Levon * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
121f5207bJohn Levon * GNU General Public License for more details.
131f5207bJohn Levon *
141f5207bJohn Levon * You should have received a copy of the GNU General Public License
151f5207bJohn Levon * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
161f5207bJohn Levon */
171f5207bJohn Levon
181f5207bJohn Levon/*
191f5207bJohn Levon * The point of this check is to look for leaks.
201f5207bJohn Levon * foo = malloc();  // <- mark it as allocated.
211f5207bJohn Levon * A variable becomes &ok if we:
221f5207bJohn Levon * 1) assign it to another variable.
231f5207bJohn Levon * 2) pass it to a function.
241f5207bJohn Levon *
251f5207bJohn Levon * One complication is dealing with stuff like:
261f5207bJohn Levon * foo->bar = malloc();
271f5207bJohn Levon * foo->baz = malloc();
281f5207bJohn Levon * foo = something();
291f5207bJohn Levon *
301f5207bJohn Levon * The work around is that for now what this check only
311f5207bJohn Levon * checks simple expressions and doesn't check whether
321f5207bJohn Levon * foo->bar is leaked.
331f5207bJohn Levon *
341f5207bJohn Levon */
351f5207bJohn Levon
361f5207bJohn Levon#include <fcntl.h>
371f5207bJohn Levon#include <unistd.h>
381f5207bJohn Levon#include "parse.h"
391f5207bJohn Levon#include "smatch.h"
401f5207bJohn Levon#include "smatch_slist.h"
411f5207bJohn Levon
421f5207bJohn Levonstatic int my_id;
431f5207bJohn Levon
441f5207bJohn LevonSTATE(allocated);
451f5207bJohn LevonSTATE(ok);
461f5207bJohn Levon
471f5207bJohn Levonstatic void set_parent(struct expression *expr, struct smatch_state *state);
481f5207bJohn Levon
491f5207bJohn Levonstatic const char *allocation_funcs[] = {
501f5207bJohn Levon	"malloc",
511f5207bJohn Levon	"kmalloc",
521f5207bJohn Levon	"kzalloc",
531f5207bJohn Levon	"kmemdup",
541f5207bJohn Levon};
551f5207bJohn Levon
561f5207bJohn Levonstatic char *alloc_parent_str(struct symbol *sym)
571f5207bJohn Levon{
581f5207bJohn Levon	static char buf[256];
591f5207bJohn Levon
601f5207bJohn Levon	if (!sym || !sym->ident)
611f5207bJohn Levon		return NULL;
621f5207bJohn Levon
631f5207bJohn Levon	snprintf(buf, 255, "%s", sym->ident->name);
641f5207bJohn Levon	buf[255] = '\0';
651f5207bJohn Levon	return alloc_string(buf);
661f5207bJohn Levon}
671f5207bJohn Levon
681f5207bJohn Levonstatic char *get_parent_from_expr(struct expression *expr, struct symbol **sym)
691f5207bJohn Levon{
701f5207bJohn Levon	char *name;
711f5207bJohn Levon
721f5207bJohn Levon	expr = strip_expr(expr);
731f5207bJohn Levon
741f5207bJohn Levon	name = expr_to_str_sym(expr, sym);
751f5207bJohn Levon	free_string(name);
761f5207bJohn Levon	if (!name || !*sym || !(*sym)->ident) {
771f5207bJohn Levon		*sym = NULL;
781f5207bJohn Levon		return NULL;
791f5207bJohn Levon	}
801f5207bJohn Levon	return alloc_parent_str(*sym);
811f5207bJohn Levon}
821f5207bJohn Levon
831f5207bJohn Levonstatic int is_local(struct expression *expr)
841f5207bJohn Levon{
851f5207bJohn Levon	char *name;
861f5207bJohn Levon	struct symbol *sym;
871f5207bJohn Levon	int ret = 0;
881f5207bJohn Levon
891f5207bJohn Levon	name = expr_to_str_sym(expr, &sym);
901f5207bJohn Levon	if (!name || !sym)
911f5207bJohn Levon		goto out;
921f5207bJohn Levon	if (sym->ctype.modifiers & (MOD_NONLOCAL | MOD_STATIC | MOD_ADDRESSABLE))
931f5207bJohn Levon		goto out;
941f5207bJohn Levon	ret = 1;
951f5207bJohn Levonout:
961f5207bJohn Levon	free_string(name);
971f5207bJohn Levon	return ret;
981f5207bJohn Levon}
991f5207bJohn Levon
1001f5207bJohn Levonstatic int is_param(struct expression *expr)
1011f5207bJohn Levon{
1021f5207bJohn Levon	char *name;
1031f5207bJohn Levon	struct symbol *sym;
1041f5207bJohn Levon	struct symbol *tmp;
1051f5207bJohn Levon	int ret = 0;
1061f5207bJohn Levon
1071f5207bJohn Levon	name = expr_to_str_sym(expr, &sym);
1081f5207bJohn Levon	if (!name || !sym)
1091f5207bJohn Levon		goto out;
1101f5207bJohn Levon	FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, tmp) {
1111f5207bJohn Levon		if (tmp == sym) {
1121f5207bJohn Levon			ret = 1;
1131f5207bJohn Levon			goto out;
1141f5207bJohn Levon		}
1151f5207bJohn Levon	} END_FOR_EACH_PTR(tmp);
1161f5207bJohn Levonout:
1171f5207bJohn Levon	free_string(name);
1181f5207bJohn Levon	return ret;
1191f5207bJohn Levon
1201f5207bJohn Levon}
1211f5207bJohn Levon
1221f5207bJohn Levonstatic void match_alloc(const char *fn, struct expression *expr, void *unused)
1231f5207bJohn Levon{
1241f5207bJohn Levon	if (!is_local(expr->left))
1251f5207bJohn Levon		return;
1261f5207bJohn Levon	if (is_param(expr->left))
1271f5207bJohn Levon		return;
1281f5207bJohn Levon	if (expr->left->type != EXPR_SYMBOL)
1291f5207bJohn Levon		return;
1301f5207bJohn Levon	set_state_expr(my_id, expr->left, &allocated);
1311f5207bJohn Levon}
1321f5207bJohn Levon
1331f5207bJohn Levonstatic void match_condition(struct expression *expr)
1341f5207bJohn Levon{
1351f5207bJohn Levon	struct sm_state *sm;
1361f5207bJohn Levon
1371f5207bJohn Levon	expr = strip_expr(expr);
1381f5207bJohn Levon
1391f5207bJohn Levon	switch (expr->type) {
1401f5207bJohn Levon	case EXPR_PREOP:
1411f5207bJohn Levon	case EXPR_SYMBOL:
1421f5207bJohn Levon	case EXPR_DEREF:
1431f5207bJohn Levon		sm = get_sm_state_expr(my_id, expr);
1441f5207bJohn Levon		if (sm && slist_has_state(sm->possible, &allocated))
1451f5207bJohn Levon			set_true_false_states_expr(my_id, expr, NULL, &ok);
1461f5207bJohn Levon		return;
1471f5207bJohn Levon	case EXPR_ASSIGNMENT:
1481f5207bJohn Levon		 /* You have to deal with stuff like if (a = b = c) */
1491f5207bJohn Levon		match_condition(expr->left);
1501f5207bJohn Levon		return;
1511f5207bJohn Levon	default:
1521f5207bJohn Levon		return;
1531f5207bJohn Levon	}
1541f5207bJohn Levon}
1551f5207bJohn Levon
1561f5207bJohn Levonstatic void set_parent(struct expression *expr, struct smatch_state *state)
1571f5207bJohn Levon{
1581f5207bJohn Levon	char *name;
1591f5207bJohn Levon	struct symbol *sym;
1601f5207bJohn Levon
1611f5207bJohn Levon	expr = strip_expr(expr);
1621f5207bJohn Levon	if (!expr)
1631f5207bJohn Levon		return;
1641f5207bJohn Levon	if (expr->type == EXPR_CONDITIONAL ||
1651f5207bJohn Levon	    expr->type == EXPR_SELECT) {
1661f5207bJohn Levon		set_parent(expr->cond_true, state);
1671f5207bJohn Levon		set_parent(expr->cond_false, state);
1681f5207bJohn Levon		return;
1691f5207bJohn Levon	}
1701f5207bJohn Levon
1711f5207bJohn Levon	name = get_parent_from_expr(expr, &sym);
1721f5207bJohn Levon	if (!name || !sym)
1731f5207bJohn Levon		goto free;
1741f5207bJohn Levon	if (state == &ok && !get_state(my_id, name, sym))
1751f5207bJohn Levon		goto free;
1761f5207bJohn Levon	set_state(my_id, name, sym, state);
1771f5207bJohn Levonfree:
1781f5207bJohn Levon	free_string(name);
1791f5207bJohn Levon}
1801f5207bJohn Levon
1811f5207bJohn Levonstatic void match_function_call(struct expression *expr)
1821f5207bJohn Levon{
1831f5207bJohn Levon	struct expression *tmp;
1841f5207bJohn Levon
1851f5207bJohn Levon	FOR_EACH_PTR(expr->args, tmp) {
1861f5207bJohn Levon		set_parent(tmp, &ok);
1871f5207bJohn Levon	} END_FOR_EACH_PTR(tmp);
1881f5207bJohn Levon}
1891f5207bJohn Levon
1901f5207bJohn Levonstatic void warn_if_allocated(struct expression *expr)
1911f5207bJohn Levon{
1921f5207bJohn Levon	struct sm_state *sm;
1931f5207bJohn Levon	char *name;
1941f5207bJohn Levon	sval_t sval;
1951f5207bJohn Levon
1961f5207bJohn Levon	if (get_implied_value(expr, &sval) && sval.value == 0)
1971f5207bJohn Levon		return;
1981f5207bJohn Levon
1991f5207bJohn Levon	sm = get_sm_state_expr(my_id, expr);
2001f5207bJohn Levon	if (!sm)
2011f5207bJohn Levon		return;
2021f5207bJohn Levon	if (!slist_has_state(sm->possible, &allocated))
2031f5207bJohn Levon		return;
2041f5207bJohn Levon
2051f5207bJohn Levon	name = expr_to_var(expr);
2061f5207bJohn Levon	sm_warning("overwrite may leak '%s'", name);
2071f5207bJohn Levon	free_string(name);
2081f5207bJohn Levon
2091f5207bJohn Levon	/* silence further warnings */
2101f5207bJohn Levon	set_state_expr(my_id, expr, &ok);
2111f5207bJohn Levon}
2121f5207bJohn Levon
2131f5207bJohn Levonstatic void match_assign(struct expression *expr)
2141f5207bJohn Levon{
2151f5207bJohn Levon	struct expression *right;
2161f5207bJohn Levon
2171f5207bJohn Levon	right = expr->right;
2181f5207bJohn Levon
2191f5207bJohn Levon	while (right->type == EXPR_ASSIGNMENT)
2201f5207bJohn Levon		right = right->left;
2211f5207bJohn Levon
2221f5207bJohn Levon	warn_if_allocated(expr->left);
2231f5207bJohn Levon	set_parent(right, &ok);
2241f5207bJohn Levon}
2251f5207bJohn Levon
2261f5207bJohn Levonstatic void check_for_allocated(void)
2271f5207bJohn Levon{
2281f5207bJohn Levon	struct stree *stree;
2291f5207bJohn Levon	struct sm_state *tmp;
2301f5207bJohn Levon
2311f5207bJohn Levon	stree = __get_cur_stree();
2321f5207bJohn Levon	FOR_EACH_MY_SM(my_id, stree, tmp) {
2331f5207bJohn Levon		if (!slist_has_state(tmp->possible, &allocated))
2341f5207bJohn Levon			continue;
2351f5207bJohn Levon		sm_warning("possible memory leak of '%s'", tmp->name);
2361f5207bJohn Levon	} END_FOR_EACH_SM(tmp);
2371f5207bJohn Levon}
2381f5207bJohn Levon
2391f5207bJohn Levonstatic void match_return(struct expression *ret_value)
2401f5207bJohn Levon{
2411f5207bJohn Levon	if (__inline_fn)
2421f5207bJohn Levon		return;
2431f5207bJohn Levon	set_parent(ret_value, &ok);
2441f5207bJohn Levon	check_for_allocated();
2451f5207bJohn Levon}
2461f5207bJohn Levon
2471f5207bJohn Levonstatic void match_end_func(struct symbol *sym)
2481f5207bJohn Levon{
2491f5207bJohn Levon	if (__inline_fn)
2501f5207bJohn Levon		return;
2511f5207bJohn Levon	check_for_allocated();
2521f5207bJohn Levon}
2531f5207bJohn Levon
2541f5207bJohn Levonvoid check_leaks(int id)
2551f5207bJohn Levon{
2561f5207bJohn Levon	int i;
2571f5207bJohn Levon
2581f5207bJohn Levon	my_id = id;
2591f5207bJohn Levon
2601f5207bJohn Levon	for (i = 0; i < ARRAY_SIZE(allocation_funcs); i++)
2611f5207bJohn Levon		add_function_assign_hook(allocation_funcs[i], &match_alloc, NULL);
2621f5207bJohn Levon
2631f5207bJohn Levon	add_hook(&match_condition, CONDITION_HOOK);
2641f5207bJohn Levon
2651f5207bJohn Levon	add_hook(&match_function_call, FUNCTION_CALL_HOOK);
2661f5207bJohn Levon	add_hook(&match_assign, ASSIGNMENT_HOOK);
2671f5207bJohn Levon
2681f5207bJohn Levon	add_hook(&match_return, RETURN_HOOK);
2691f5207bJohn Levon	add_hook(&match_end_func, END_FUNC_HOOK);
2701f5207bJohn Levon}
271