Blame view
scripts/coccinelle/free/devm_free.cocci
1.69 KB
fb3f8af4f coccinelle: seman... |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 |
/// Find uses of standard freeing functons on values allocated using devm_ /// functions. Values allocated using the devm_functions are freed when /// the device is detached, and thus the use of the standard freeing /// function would cause a double free. /// See Documentation/driver-model/devres.txt for more information. /// /// A difficulty of detecting this problem is that the standard freeing /// function might be called from a different function than the one /// containing the allocation function. It is thus necessary to make the /// connection between the allocation function and the freeing function. /// Here this is done using the specific argument text, which is prone to /// false positives. There is no rule for the request_region and /// request_mem_region variants because this heuristic seems to be a bit /// less reliable in these cases. /// // Confidence: Moderate // Copyright: (C) 2011 Julia Lawall, INRIA/LIP6. GPLv2. // Copyright: (C) 2011 Gilles Muller, INRIA/LiP6. GPLv2. // URL: http://coccinelle.lip6.fr/ // Comments: // Options: -no_includes -include_headers virtual org virtual report virtual context @r depends on context || org || report@ expression x; @@ ( x = devm_kzalloc(...) | x = devm_request_irq(...) | x = devm_ioremap(...) | x = devm_ioremap_nocache(...) | x = devm_ioport_map(...) ) @pb@ expression r.x; position p; @@ ( * kfree@p(x) | * free_irq@p(x) | * iounmap@p(x) | * ioport_unmap@p(x) ) @script:python depends on org@ p << pb.p; @@ msg="WARNING: invalid free of devm_ allocated data" coccilib.org.print_todo(p[0], msg) @script:python depends on report@ p << pb.p; @@ msg="WARNING: invalid free of devm_ allocated data" coccilib.report.print_report(p[0], msg) |