^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /// Find uses of standard freeing functons on values allocated using devm_
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) /// functions. Values allocated using the devm_functions are freed when
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) /// the device is detached, and thus the use of the standard freeing
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) /// function would cause a double free.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) /// See Documentation/driver-api/driver-model/devres.rst for more information.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) ///
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) /// A difficulty of detecting this problem is that the standard freeing
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) /// function might be called from a different function than the one
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) /// containing the allocation function. It is thus necessary to make the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) /// connection between the allocation function and the freeing function.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) /// Here this is done using the specific argument text, which is prone to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) /// false positives. There is no rule for the request_region and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) /// request_mem_region variants because this heuristic seems to be a bit
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) /// less reliable in these cases.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) ///
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) // Confidence: Moderate
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) // Copyright: (C) 2011 Julia Lawall, INRIA/LIP6.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) // Copyright: (C) 2011 Gilles Muller, INRIA/LiP6.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) // URL: http://coccinelle.lip6.fr/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) // Comments:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) // Options: --no-includes --include-headers
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) virtual org
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) virtual report
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) virtual context
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) @r depends on context || org || report@
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) expression x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) @@
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) (
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) x = devm_kmalloc(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) x = devm_kvasprintf(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) x = devm_kasprintf(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) x = devm_kzalloc(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) x = devm_kmalloc_array(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) x = devm_kcalloc(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) x = devm_kstrdup(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) x = devm_kmemdup(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) x = devm_get_free_pages(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) x = devm_request_irq(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) x = devm_ioremap(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) x = devm_ioport_map(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) @safe depends on context || org || report exists@
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) expression x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) position p;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) @@
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) (
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) x = kmalloc(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) x = kvasprintf(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) x = kasprintf(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) x = kzalloc(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) x = kmalloc_array(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) x = kcalloc(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) x = kstrdup(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) x = kmemdup(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) x = get_free_pages(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) x = request_irq(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) x = ioremap(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) x = ioport_map(...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) ...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) (
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) kfree@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) kfree_sensitive@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) krealloc@p(x, ...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) free_pages@p(x, ...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) free_page@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) free_irq@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) iounmap@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) ioport_unmap@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) @pb@
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) expression r.x;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) position p != safe.p;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) @@
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) (
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) * kfree@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) * kfree_sensitive@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) * krealloc@p(x, ...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) * free_pages@p(x, ...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) * free_page@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) * free_irq@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) * iounmap@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) * ioport_unmap@p(x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) )
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) @script:python depends on org@
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) p << pb.p;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) @@
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) msg="WARNING: invalid free of devm_ allocated data"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) coccilib.org.print_todo(p[0], msg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) @script:python depends on report@
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) p << pb.p;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) @@
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) msg="WARNING: invalid free of devm_ allocated data"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) coccilib.report.print_report(p[0], msg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags