Blame view

scripts/coccinelle/free/devm_free.cocci 1.69 KB
fb3f8af4f   Julia Lawall   coccinelle: seman...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
  /// Find uses of standard freeing functons on values allocated using devm_
  /// functions.  Values allocated using the devm_functions are freed when
  /// the device is detached, and thus the use of the standard freeing
  /// function would cause a double free.
  /// See Documentation/driver-model/devres.txt for more information.
  ///
  /// A difficulty of detecting this problem is that the standard freeing
  /// function might be called from a different function than the one
  /// containing the allocation function.  It is thus necessary to make the
  /// connection between the allocation function and the freeing function.
  /// Here this is done using the specific argument text, which is prone to
  /// false positives.  There is no rule for the request_region and
  /// request_mem_region variants because this heuristic seems to be a bit
  /// less reliable in these cases.
  ///
  // Confidence: Moderate
  // Copyright: (C) 2011 Julia Lawall, INRIA/LIP6.  GPLv2.
  // Copyright: (C) 2011 Gilles Muller, INRIA/LiP6.  GPLv2.
  // URL: http://coccinelle.lip6.fr/
  // Comments:
  // Options: -no_includes -include_headers
  
  virtual org
  virtual report
  virtual context
  
  @r depends on context || org || report@
  expression x;
  @@
  
  (
   x = devm_kzalloc(...)
  |
   x = devm_request_irq(...)
  |
   x = devm_ioremap(...)
  |
   x = devm_ioremap_nocache(...)
  |
   x = devm_ioport_map(...)
  )
  
  @pb@
  expression r.x;
  position p;
  @@
  
  (
  * kfree@p(x)
  |
  * free_irq@p(x)
  |
  * iounmap@p(x)
  |
  * ioport_unmap@p(x)
  )
  
  @script:python depends on org@
  p << pb.p;
  @@
  
  msg="WARNING: invalid free of devm_ allocated data"
  coccilib.org.print_todo(p[0], msg)
  
  @script:python depends on report@
  p << pb.p;
  @@
  
  msg="WARNING: invalid free of devm_ allocated data"
  coccilib.report.print_report(p[0], msg)