1/// Find uses of standard freeing functons on values allocated using devm_
2/// functions.  Values allocated using the devm_functions are freed when
3/// the device is detached, and thus the use of the standard freeing
4/// function would cause a double free.
5/// See Documentation/driver-model/devres.txt for more information.
6///
7/// A difficulty of detecting this problem is that the standard freeing
8/// function might be called from a different function than the one
9/// containing the allocation function.  It is thus necessary to make the
10/// connection between the allocation function and the freeing function.
11/// Here this is done using the specific argument text, which is prone to
12/// false positives.  There is no rule for the request_region and
13/// request_mem_region variants because this heuristic seems to be a bit
14/// less reliable in these cases.
15///
16// Confidence: Moderate
17// Copyright: (C) 2011 Julia Lawall, INRIA/LIP6.  GPLv2.
18// Copyright: (C) 2011 Gilles Muller, INRIA/LiP6.  GPLv2.
19// URL: http://coccinelle.lip6.fr/
20// Comments:
21// Options: --no-includes --include-headers
22
23virtual org
24virtual report
25virtual context
26
27@r depends on context || org || report@
28expression x;
29@@
30
31(
32 x = devm_kmalloc(...)
33|
34 x = devm_kvasprintf(...)
35|
36 x = devm_kasprintf(...)
37|
38 x = devm_kzalloc(...)
39|
40 x = devm_kmalloc_array(...)
41|
42 x = devm_kcalloc(...)
43|
44 x = devm_kstrdup(...)
45|
46 x = devm_kmemdup(...)
47|
48 x = devm_get_free_pages(...)
49|
50 x = devm_request_irq(...)
51|
52 x = devm_ioremap(...)
53|
54 x = devm_ioremap_nocache(...)
55|
56 x = devm_ioport_map(...)
57)
58
59@pb@
60expression r.x;
61position p;
62@@
63
64(
65* kfree@p(x)
66|
67* kzfree@p(x)
68|
69* __krealloc@p(x, ...)
70|
71* krealloc@p(x, ...)
72|
73* free_pages@p(x, ...)
74|
75* free_page@p(x)
76|
77* free_irq@p(x)
78|
79* iounmap@p(x)
80|
81* ioport_unmap@p(x)
82)
83
84@script:python depends on org@
85p << pb.p;
86@@
87
88msg="WARNING: invalid free of devm_ allocated data"
89coccilib.org.print_todo(p[0], msg)
90
91@script:python depends on report@
92p << pb.p;
93@@
94
95msg="WARNING: invalid free of devm_ allocated data"
96coccilib.report.print_report(p[0], msg)
97
98