| /// Find uses of standard freeing functons on values allocated using devm_ |
| /// functions. Values allocated using the devm_functions are freed when |
| /// the device is detached, and thus the use of the standard freeing |
| /// function would cause a double free. |
| /// See Documentation/driver-model/devres.txt for more information. |
| /// |
| /// A difficulty of detecting this problem is that the standard freeing |
| /// function might be called from a different function than the one |
| /// containing the allocation function. It is thus necessary to make the |
| /// connection between the allocation function and the freeing function. |
| /// Here this is done using the specific argument text, which is prone to |
| /// false positives. There is no rule for the request_region and |
| /// request_mem_region variants because this heuristic seems to be a bit |
| /// less reliable in these cases. |
| /// |
| // Confidence: Moderate |
| // Copyright: (C) 2011 Julia Lawall, INRIA/LIP6. GPLv2. |
| // Copyright: (C) 2011 Gilles Muller, INRIA/LiP6. GPLv2. |
| // URL: http://coccinelle.lip6.fr/ |
| // Comments: |
| // Options: --no-includes --include-headers |
| |
| virtual org |
| virtual report |
| virtual context |
| |
| @r depends on context || org || report@ |
| expression x; |
| @@ |
| |
| ( |
| x = devm_kzalloc(...) |
| | |
| x = devm_request_irq(...) |
| | |
| x = devm_ioremap(...) |
| | |
| x = devm_ioremap_nocache(...) |
| | |
| x = devm_ioport_map(...) |
| ) |
| |
| @pb@ |
| expression r.x; |
| position p; |
| @@ |
| |
| ( |
| * kfree@p(x) |
| | |
| * free_irq@p(x) |
| | |
| * iounmap@p(x) |
| | |
| * ioport_unmap@p(x) |
| ) |
| |
| @script:python depends on org@ |
| p << pb.p; |
| @@ |
| |
| msg="WARNING: invalid free of devm_ allocated data" |
| coccilib.org.print_todo(p[0], msg) |
| |
| @script:python depends on report@ |
| p << pb.p; |
| @@ |
| |
| msg="WARNING: invalid free of devm_ allocated data" |
| coccilib.report.print_report(p[0], msg) |
| |
