devm_free.cocci 2.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /// Find uses of standard freeing functons on values allocated using devm_
  3. /// functions. Values allocated using the devm_functions are freed when
  4. /// the device is detached, and thus the use of the standard freeing
  5. /// function would cause a double free.
  6. /// See Documentation/driver-api/driver-model/devres.rst for more information.
  7. ///
  8. /// A difficulty of detecting this problem is that the standard freeing
  9. /// function might be called from a different function than the one
  10. /// containing the allocation function. It is thus necessary to make the
  11. /// connection between the allocation function and the freeing function.
  12. /// Here this is done using the specific argument text, which is prone to
  13. /// false positives. There is no rule for the request_region and
  14. /// request_mem_region variants because this heuristic seems to be a bit
  15. /// less reliable in these cases.
  16. ///
  17. // Confidence: Moderate
  18. // Copyright: (C) 2011 Julia Lawall, INRIA/LIP6.
  19. // Copyright: (C) 2011 Gilles Muller, INRIA/LiP6.
  20. // URL: https://coccinelle.gitlabpages.inria.fr/website
  21. // Comments:
  22. // Options: --no-includes --include-headers
  23. virtual org
  24. virtual report
  25. virtual context
  26. @r depends on context || org || report@
  27. expression x;
  28. @@
  29. (
  30. x = devm_kmalloc(...)
  31. |
  32. x = devm_kvasprintf(...)
  33. |
  34. x = devm_kasprintf(...)
  35. |
  36. x = devm_kzalloc(...)
  37. |
  38. x = devm_kmalloc_array(...)
  39. |
  40. x = devm_kcalloc(...)
  41. |
  42. x = devm_kstrdup(...)
  43. |
  44. x = devm_kmemdup(...)
  45. |
  46. x = devm_get_free_pages(...)
  47. |
  48. x = devm_request_irq(...)
  49. |
  50. x = devm_ioremap(...)
  51. |
  52. x = devm_ioport_map(...)
  53. )
  54. @safe depends on context || org || report exists@
  55. expression x;
  56. position p;
  57. @@
  58. (
  59. x = kmalloc(...)
  60. |
  61. x = kvasprintf(...)
  62. |
  63. x = kasprintf(...)
  64. |
  65. x = kzalloc(...)
  66. |
  67. x = kmalloc_array(...)
  68. |
  69. x = kcalloc(...)
  70. |
  71. x = kstrdup(...)
  72. |
  73. x = kmemdup(...)
  74. |
  75. x = get_free_pages(...)
  76. |
  77. x = request_irq(...)
  78. |
  79. x = ioremap(...)
  80. |
  81. x = ioport_map(...)
  82. )
  83. ...
  84. (
  85. kfree@p(x)
  86. |
  87. kfree_sensitive@p(x)
  88. |
  89. krealloc@p(x, ...)
  90. |
  91. free_pages@p(x, ...)
  92. |
  93. free_page@p(x)
  94. |
  95. free_irq@p(x)
  96. |
  97. iounmap@p(x)
  98. |
  99. ioport_unmap@p(x)
  100. )
  101. @pb@
  102. expression r.x;
  103. position p != safe.p;
  104. @@
  105. (
  106. * kfree@p(x)
  107. |
  108. * kfree_sensitive@p(x)
  109. |
  110. * krealloc@p(x, ...)
  111. |
  112. * free_pages@p(x, ...)
  113. |
  114. * free_page@p(x)
  115. |
  116. * free_irq@p(x)
  117. |
  118. * iounmap@p(x)
  119. |
  120. * ioport_unmap@p(x)
  121. )
  122. @script:python depends on org@
  123. p << pb.p;
  124. @@
  125. msg="WARNING: invalid free of devm_ allocated data"
  126. coccilib.org.print_todo(p[0], msg)
  127. @script:python depends on report@
  128. p << pb.p;
  129. @@
  130. msg="WARNING: invalid free of devm_ allocated data"
  131. coccilib.report.print_report(p[0], msg)