1 // SPDX-License-Identifier: GPL-2.0-only 1 // SPDX-License-Identifier: GPL-2.0-only
2 /// 2 ///
3 /// Check that kvmalloc'ed memory is freed by 3 /// Check that kvmalloc'ed memory is freed by kfree functions,
4 /// vmalloc'ed by vfree functions and kvmalloc 4 /// vmalloc'ed by vfree functions and kvmalloc'ed by kvfree
5 /// functions. 5 /// functions.
6 /// 6 ///
7 // Confidence: High 7 // Confidence: High
8 // Copyright: (C) 2020 Denis Efremov ISPRAS 8 // Copyright: (C) 2020 Denis Efremov ISPRAS
9 // Options: --no-includes --include-headers 9 // Options: --no-includes --include-headers
10 // 10 //
11 11
12 virtual patch 12 virtual patch
13 virtual report 13 virtual report
14 virtual org 14 virtual org
15 virtual context 15 virtual context
16 16
17 @alloc@ 17 @alloc@
18 expression E, E1; 18 expression E, E1;
19 position kok, vok; 19 position kok, vok;
20 @@ 20 @@
21 21
22 ( 22 (
23 if (...) { 23 if (...) {
24 ... 24 ...
25 E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\ 25 E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\|
26 kmalloc_node\|kzalloc_node\|kmalloc_ 26 kmalloc_node\|kzalloc_node\|kmalloc_array\|
27 kmalloc_array_node\|kcalloc_node\)(. 27 kmalloc_array_node\|kcalloc_node\)(...)@kok
28 ... 28 ...
29 } else { 29 } else {
30 ... 30 ...
31 E = \(vmalloc\|vzalloc\|vmalloc_user\|vmal 31 E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|
32 vzalloc_node\|vmalloc_exec\|vmalloc_ 32 vzalloc_node\|vmalloc_exec\|vmalloc_32\|
33 vmalloc_32_user\|__vmalloc\|__vmallo 33 vmalloc_32_user\|__vmalloc\|__vmalloc_node_range\|
34 __vmalloc_node\)(...)@vok 34 __vmalloc_node\)(...)@vok
35 ... 35 ...
36 } 36 }
37 | 37 |
38 E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\|k 38 E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\|kmalloc_node\|kzalloc_node\|
39 kmalloc_array\|kmalloc_array_node\|kca 39 kmalloc_array\|kmalloc_array_node\|kcalloc_node\)(...)@kok
40 ... when != E = E1 40 ... when != E = E1
41 when any 41 when any
42 if (E == NULL) { 42 if (E == NULL) {
43 ... 43 ...
44 E = \(vmalloc\|vzalloc\|vmalloc_user\|vmal 44 E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|
45 vzalloc_node\|vmalloc_exec\|vmalloc_ 45 vzalloc_node\|vmalloc_exec\|vmalloc_32\|
46 vmalloc_32_user\|__vmalloc\|__vmallo 46 vmalloc_32_user\|__vmalloc\|__vmalloc_node_range\|
47 __vmalloc_node\)(...)@vok 47 __vmalloc_node\)(...)@vok
48 ... 48 ...
49 } 49 }
50 ) 50 )
51 51
52 @free@ 52 @free@
53 expression E; 53 expression E;
54 position fok; 54 position fok;
55 @@ 55 @@
56 56
57 E = \(kvmalloc\|kvzalloc\|kvcalloc\|kvzalloc 57 E = \(kvmalloc\|kvzalloc\|kvcalloc\|kvzalloc_node\|kvmalloc_node\|
58 kvmalloc_array\)(...) 58 kvmalloc_array\)(...)
59 ... 59 ...
60 kvfree(E)@fok 60 kvfree(E)@fok
61 61
62 @vfree depends on !patch@ 62 @vfree depends on !patch@
63 expression E; 63 expression E;
64 position a != alloc.kok; 64 position a != alloc.kok;
65 position f != free.fok; 65 position f != free.fok;
66 @@ 66 @@
67 67
68 * E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\|k 68 * E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\|kmalloc_node\|
69 * kzalloc_node\|kmalloc_array\|kmalloc_a 69 * kzalloc_node\|kmalloc_array\|kmalloc_array_node\|
70 * kcalloc_node\)(...)@a 70 * kcalloc_node\)(...)@a
71 ... when != if (...) { ... E = \(vmalloc\|vz 71 ... when != if (...) { ... E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|vzalloc_node\|vmalloc_exec\|vmalloc_32\|vmalloc_32_user\|__vmalloc\|__vmalloc_node_range\|__vmalloc_node\)(...); ... }
72 when != is_vmalloc_addr(E) 72 when != is_vmalloc_addr(E)
73 when any 73 when any
74 * \(vfree\|vfree_atomic\|kvfree\)(E)@f 74 * \(vfree\|vfree_atomic\|kvfree\)(E)@f
75 75
76 @depends on patch exists@ 76 @depends on patch exists@
77 expression E; 77 expression E;
78 position a != alloc.kok; 78 position a != alloc.kok;
79 position f != free.fok; 79 position f != free.fok;
80 @@ 80 @@
81 81
82 E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\|k 82 E = \(kmalloc\|kzalloc\|krealloc\|kcalloc\|kmalloc_node\|
83 kzalloc_node\|kmalloc_array\|kmalloc_a 83 kzalloc_node\|kmalloc_array\|kmalloc_array_node\|
84 kcalloc_node\)(...)@a 84 kcalloc_node\)(...)@a
85 ... when != if (...) { ... E = \(vmalloc\|vz 85 ... when != if (...) { ... E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|vzalloc_node\|vmalloc_exec\|vmalloc_32\|vmalloc_32_user\|__vmalloc\|__vmalloc_node_range\|__vmalloc_node\)(...); ... }
86 when != is_vmalloc_addr(E) 86 when != is_vmalloc_addr(E)
87 when any 87 when any
88 - \(vfree\|vfree_atomic\|kvfree\)(E)@f 88 - \(vfree\|vfree_atomic\|kvfree\)(E)@f
89 + kfree(E) 89 + kfree(E)
90 90
91 @kfree depends on !patch@ 91 @kfree depends on !patch@
92 expression E; 92 expression E;
93 position a != alloc.vok; 93 position a != alloc.vok;
94 position f != free.fok; 94 position f != free.fok;
95 @@ 95 @@
96 96
97 * E = \(vmalloc\|vzalloc\|vmalloc_user\|vmallo 97 * E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|vzalloc_node\|
98 * vmalloc_exec\|vmalloc_32\|vmalloc_32_u 98 * vmalloc_exec\|vmalloc_32\|vmalloc_32_user\|__vmalloc\|
99 * __vmalloc_node_range\|__vmalloc_node\) 99 * __vmalloc_node_range\|__vmalloc_node\)(...)@a
100 ... when != is_vmalloc_addr(E) 100 ... when != is_vmalloc_addr(E)
101 when any 101 when any
102 * \(kfree\|kfree_sensitive\|kvfree\)(E)@f 102 * \(kfree\|kfree_sensitive\|kvfree\)(E)@f
103 103
104 @depends on patch exists@ 104 @depends on patch exists@
105 expression E; 105 expression E;
106 position a != alloc.vok; 106 position a != alloc.vok;
107 position f != free.fok; 107 position f != free.fok;
108 @@ 108 @@
109 109
110 E = \(vmalloc\|vzalloc\|vmalloc_user\|vmallo 110 E = \(vmalloc\|vzalloc\|vmalloc_user\|vmalloc_node\|vzalloc_node\|
111 vmalloc_exec\|vmalloc_32\|vmalloc_32_u 111 vmalloc_exec\|vmalloc_32\|vmalloc_32_user\|__vmalloc\|
112 __vmalloc_node_range\|__vmalloc_node\) 112 __vmalloc_node_range\|__vmalloc_node\)(...)@a
113 ... when != is_vmalloc_addr(E) 113 ... when != is_vmalloc_addr(E)
114 when any 114 when any
115 - \(kfree\|kvfree\)(E)@f 115 - \(kfree\|kvfree\)(E)@f
116 + vfree(E) 116 + vfree(E)
117 117
118 @kvfree depends on !patch@ 118 @kvfree depends on !patch@
119 expression E; 119 expression E;
120 position a, f; 120 position a, f;
121 @@ 121 @@
122 122
123 * E = \(kvmalloc\|kvzalloc\|kvcalloc\|kvzalloc 123 * E = \(kvmalloc\|kvzalloc\|kvcalloc\|kvzalloc_node\|kvmalloc_node\|
124 * kvmalloc_array\)(...)@a 124 * kvmalloc_array\)(...)@a
125 ... when != is_vmalloc_addr(E) 125 ... when != is_vmalloc_addr(E)
126 when any 126 when any
127 * \(kfree\|kfree_sensitive\|vfree\|vfree_atomi 127 * \(kfree\|kfree_sensitive\|vfree\|vfree_atomic\)(E)@f
128 128
129 @depends on patch exists@ 129 @depends on patch exists@
130 expression E; 130 expression E;
131 @@ 131 @@
132 132
133 E = \(kvmalloc\|kvzalloc\|kvcalloc\|kvzalloc 133 E = \(kvmalloc\|kvzalloc\|kvcalloc\|kvzalloc_node\|kvmalloc_node\|
134 kvmalloc_array\)(...) 134 kvmalloc_array\)(...)
135 ... when != is_vmalloc_addr(E) 135 ... when != is_vmalloc_addr(E)
136 when any 136 when any
137 - \(kfree\|vfree\)(E) 137 - \(kfree\|vfree\)(E)
138 + kvfree(E) 138 + kvfree(E)
139 139
140 @kvfree_switch depends on !patch@ 140 @kvfree_switch depends on !patch@
141 expression alloc.E; 141 expression alloc.E;
142 position f; 142 position f;
143 @@ 143 @@
144 144
145 ... when != is_vmalloc_addr(E) 145 ... when != is_vmalloc_addr(E)
146 when any 146 when any
147 * \(kfree\|kfree_sensitive\|vfree\|vfree_atomi 147 * \(kfree\|kfree_sensitive\|vfree\|vfree_atomic\)(E)@f
148 148
149 @depends on patch exists@ 149 @depends on patch exists@
150 expression alloc.E; 150 expression alloc.E;
151 position f; 151 position f;
152 @@ 152 @@
153 153
154 ... when != is_vmalloc_addr(E) 154 ... when != is_vmalloc_addr(E)
155 when any 155 when any
156 ( 156 (
157 - \(kfree\|vfree\)(E)@f 157 - \(kfree\|vfree\)(E)@f
158 + kvfree(E) 158 + kvfree(E)
159 | 159 |
160 - kfree_sensitive(E)@f 160 - kfree_sensitive(E)@f
161 + kvfree_sensitive(E) 161 + kvfree_sensitive(E)
162 ) 162 )
163 163
164 @script: python depends on report@ 164 @script: python depends on report@
165 a << vfree.a; 165 a << vfree.a;
166 f << vfree.f; 166 f << vfree.f;
167 @@ 167 @@
168 168
169 msg = "WARNING kmalloc is used to allocate thi 169 msg = "WARNING kmalloc is used to allocate this memory at line %s" % (a[0].line)
170 coccilib.report.print_report(f[0], msg) 170 coccilib.report.print_report(f[0], msg)
171 171
172 @script: python depends on org@ 172 @script: python depends on org@
173 a << vfree.a; 173 a << vfree.a;
174 f << vfree.f; 174 f << vfree.f;
175 @@ 175 @@
176 176
177 msg = "WARNING kmalloc is used to allocate thi 177 msg = "WARNING kmalloc is used to allocate this memory at line %s" % (a[0].line)
178 coccilib.org.print_todo(f[0], msg) 178 coccilib.org.print_todo(f[0], msg)
179 179
180 @script: python depends on report@ 180 @script: python depends on report@
181 a << kfree.a; 181 a << kfree.a;
182 f << kfree.f; 182 f << kfree.f;
183 @@ 183 @@
184 184
185 msg = "WARNING vmalloc is used to allocate thi 185 msg = "WARNING vmalloc is used to allocate this memory at line %s" % (a[0].line)
186 coccilib.report.print_report(f[0], msg) 186 coccilib.report.print_report(f[0], msg)
187 187
188 @script: python depends on org@ 188 @script: python depends on org@
189 a << kfree.a; 189 a << kfree.a;
190 f << kfree.f; 190 f << kfree.f;
191 @@ 191 @@
192 192
193 msg = "WARNING vmalloc is used to allocate thi 193 msg = "WARNING vmalloc is used to allocate this memory at line %s" % (a[0].line)
194 coccilib.org.print_todo(f[0], msg) 194 coccilib.org.print_todo(f[0], msg)
195 195
196 @script: python depends on report@ 196 @script: python depends on report@
197 a << kvfree.a; 197 a << kvfree.a;
198 f << kvfree.f; 198 f << kvfree.f;
199 @@ 199 @@
200 200
201 msg = "WARNING kvmalloc is used to allocate th 201 msg = "WARNING kvmalloc is used to allocate this memory at line %s" % (a[0].line)
202 coccilib.report.print_report(f[0], msg) 202 coccilib.report.print_report(f[0], msg)
203 203
204 @script: python depends on org@ 204 @script: python depends on org@
205 a << kvfree.a; 205 a << kvfree.a;
206 f << kvfree.f; 206 f << kvfree.f;
207 @@ 207 @@
208 208
209 msg = "WARNING kvmalloc is used to allocate th 209 msg = "WARNING kvmalloc is used to allocate this memory at line %s" % (a[0].line)
210 coccilib.org.print_todo(f[0], msg) 210 coccilib.org.print_todo(f[0], msg)
211 211
212 @script: python depends on report@ 212 @script: python depends on report@
213 ka << alloc.kok; 213 ka << alloc.kok;
214 va << alloc.vok; 214 va << alloc.vok;
215 f << kvfree_switch.f; 215 f << kvfree_switch.f;
216 @@ 216 @@
217 217
218 msg = "WARNING kmalloc (line %s) && vmalloc (l 218 msg = "WARNING kmalloc (line %s) && vmalloc (line %s) are used to allocate this memory" % (ka[0].line, va[0].line)
219 coccilib.report.print_report(f[0], msg) 219 coccilib.report.print_report(f[0], msg)
220 220
221 @script: python depends on org@ 221 @script: python depends on org@
222 ka << alloc.kok; 222 ka << alloc.kok;
223 va << alloc.vok; 223 va << alloc.vok;
224 f << kvfree_switch.f; 224 f << kvfree_switch.f;
225 @@ 225 @@
226 226
227 msg = "WARNING kmalloc (line %s) && vmalloc (l 227 msg = "WARNING kmalloc (line %s) && vmalloc (line %s) are used to allocate this memory" % (ka[0].line, va[0].line)
228 coccilib.org.print_todo(f[0], msg) 228 coccilib.org.print_todo(f[0], msg)
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.