1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
|
/// Find uses of standard freeing functons on values allocated using devm_
/// functions. Values allocated using the devm_functions are freed when
/// the device is detached, and thus the use of the standard freeing
/// function would cause a double free.
/// See Documentation/driver-model/devres.txt for more information.
///
/// A difficulty of detecting this problem is that the standard freeing
/// function might be called from a different function than the one
/// containing the allocation function. It is thus necessary to make the
/// connection between the allocation function and the freeing function.
/// Here this is done using the specific argument text, which is prone to
/// false positives. There is no rule for the request_region and
/// request_mem_region variants because this heuristic seems to be a bit
/// less reliable in these cases.
///
// Confidence: Moderate
// Copyright: (C) 2011 Julia Lawall, INRIA/LIP6. GPLv2.
// Copyright: (C) 2011 Gilles Muller, INRIA/LiP6. GPLv2.
// URL: http://coccinelle.lip6.fr/
// Comments:
// Options: --no-includes --include-headers
virtual org
virtual report
virtual context
@r depends on context || org || report@
expression x;
@@
(
x = devm_kmalloc(...)
|
x = devm_kvasprintf(...)
|
x = devm_kasprintf(...)
|
x = devm_kzalloc(...)
|
x = devm_kmalloc_array(...)
|
x = devm_kcalloc(...)
|
x = devm_kstrdup(...)
|
x = devm_kmemdup(...)
|
x = devm_get_free_pages(...)
|
x = devm_request_irq(...)
|
x = devm_ioremap(...)
|
x = devm_ioremap_nocache(...)
|
x = devm_ioport_map(...)
)
@safe depends on context || org || report exists@
expression x;
position p;
@@
(
x = kmalloc(...)
|
x = kvasprintf(...)
|
x = kasprintf(...)
|
x = kzalloc(...)
|
x = kmalloc_array(...)
|
x = kcalloc(...)
|
x = kstrdup(...)
|
x = kmemdup(...)
|
x = get_free_pages(...)
|
x = request_irq(...)
|
x = ioremap(...)
|
x = ioremap_nocache(...)
|
x = ioport_map(...)
)
...
(
kfree@p(x)
|
kzfree@p(x)
|
__krealloc@p(x, ...)
|
krealloc@p(x, ...)
|
free_pages@p(x, ...)
|
free_page@p(x)
|
free_irq@p(x)
|
iounmap@p(x)
|
ioport_unmap@p(x)
)
@pb@
expression r.x;
position p != safe.p;
@@
(
* kfree@p(x)
|
* kzfree@p(x)
|
* __krealloc@p(x, ...)
|
* krealloc@p(x, ...)
|
* free_pages@p(x, ...)
|
* free_page@p(x)
|
* free_irq@p(x)
|
* iounmap@p(x)
|
* ioport_unmap@p(x)
)
@script:python depends on org@
p << pb.p;
@@
msg="WARNING: invalid free of devm_ allocated data"
coccilib.org.print_todo(p[0], msg)
@script:python depends on report@
p << pb.p;
@@
msg="WARNING: invalid free of devm_ allocated data"
coccilib.report.print_report(p[0], msg)
|
