Coccinelle Archive on lore.kernel.org
 help / color / Atom feed
From: Wen Yang <yellowriver2010@hotmail.com>
To: Julia Lawall <Julia.Lawall@lip6.fr>,
	Gilles Muller <Gilles.Muller@lip6.fr>,
	Nicolas Palix <nicolas.palix@imag.fr>,
	Michal Marek <michal.lkml@markovi.net>
Cc: Wen Yang <yellowriver2010@hotmail.com>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	Wen Yang <wen.yang99@zte.com.cn>,
	Markus Elfring <Markus.Elfring@web.de>,
	"cheng.shengyu@zte.com.cn" <cheng.shengyu@zte.com.cn>,
	"cocci@systeme.lip6.fr" <cocci@systeme.lip6.fr>
Subject: [Cocci] [PATCH v6] coccinelle: semantic code search for missing put_device()
Date: Sat, 16 Feb 2019 16:05:23 +0000
Message-ID: <HK0PR02MB36344E2B29CEB195892F6420B2610@HK0PR02MB3634.apcprd02.prod.outlook.com> (raw)

The of_find_device_by_node() takes a reference to the underlying device
structure, we should release that reference.
The implementation of this semantic code search is:
In a function, for a local variable obtained by of_find_device_by_node(),
a, if it is released by a function such as
   put_device()/of_dev_put()/platform_device_put() after the last use,
   it is considered that there is no reference leak;
b, if it is passed back to the caller via
   dev_get_drvdata()/platform_get_drvdata()/get_device(), etc., the
   reference will be released in other functions, and the current function
   also considers that there is no reference leak;
c, for the rest of the situation, the current function should release the
   reference by calling put_device, this code search will report an error
   with a specific confidence.

By using this semantic code search, we have found some issues, such as:
commit 11907e9d3533 ("ASoC: fsl-asoc-card: fix object reference leaks in
fsl_asoc_card_probe")
commit a12085d13997 ("mtd: rawnand: atmel: fix possible object reference
leak")
commit 11493f26856a ("mtd: rawnand: jz4780: fix possible object reference
leak")

There are still dozens of reference leaks in the current kernel code.

Further, for the case of b, the object returned to other functions may also
have a reference leak, we will continue to develop other cocci scripts to
further check the reference leak.

Signed-off-by: Wen Yang <yellowriver2010@hotmail.com>
Reviewed-by: Julia Lawall <Julia.Lawall@lip6.fr>
Reviewed-by: Markus Elfring <Markus.Elfring@web.de>
Cc: Julia Lawall <Julia.Lawall@lip6.fr>
Cc: Gilles Muller <Gilles.Muller@lip6.fr>
Cc: Nicolas Palix <nicolas.palix@imag.fr>
Cc: Michal Marek <michal.lkml@markovi.net>
Cc: Markus Elfring <Markus.Elfring@web.de>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Wen Yang <wen.yang99@zte.com.cn>
Cc: cheng.shengyu@zte.com.cn
Cc: cocci@systeme.lip6.fr
Cc: linux-kernel@vger.kernel.org
---
v6:
- to be double sure, replace &id->dev with (T)(&id->dev).
- long string literals can be accepted because of error message search concerns around a tool like grep
v5:
- exchange the word patch by code search.
- add a SPDX identifier.
- a split string literal can be unwanted.
- Change the content of the reported information.
v4:
- add Masahiro Yamada
- omit a blank line
- split the long message parameter
- reduce the number of metavariables
- Describe the implementation of the semantic patch,
  explain the scenarios it can detect,
  and further software development considerations. 
v3:
- reduction of a bit of redundant C code within SmPL search specifications.
- consider the message construction without using the extra Python variable msg.
v2:
- put exists after search, and then drop the when exists below.
- should not use the same e as in the when's below.
- Make a new type metavariable and use it to put a cast on the result of platform_get_drvdata.

 scripts/coccinelle/free/put_device.cocci | 55 ++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 scripts/coccinelle/free/put_device.cocci

diff --git a/scripts/coccinelle/free/put_device.cocci b/scripts/coccinelle/free/put_device.cocci
new file mode 100644
index 000000000000..96e2508c0be1
--- /dev/null
+++ b/scripts/coccinelle/free/put_device.cocci
@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: GPL-2.0
+/// Find missing put_device for every of_find_device_by_node.
+///
+// Confidence: Moderate
+// Copyright: (C) 2018-2019 Wen Yang, ZTE.
+// Comments:
+// Options: --no-includes --include-headers
+
+virtual report
+virtual org
+
+@search exists@
+local idexpression id;
+expression x,e,e1;
+position p1,p2;
+type T,T1,T2;
+@@
+
+id = of_find_device_by_node@p1(x)
+... when != e = id
+if (id == NULL || ...) { ... return ...; }
+... when != put_device(&id->dev)
+    when != platform_device_put(id)
+    when != of_dev_put(id)
+    when != if (id) { ... put_device(&id->dev) ... }
+    when != e1 = (T)id
+    when != e1 = (T)(&id->dev)
+    when != e1 = get_device(&id->dev)
+    when != e1 = (T)platform_get_drvdata(id)
+(
+  return
+(    id
+|    (T1)dev_get_drvdata(&id->dev)
+|    (T2)platform_get_drvdata(id)
+);
+| return@p2 ...;
+)
+
+@script:python depends on report@
+p1 << search.p1;
+p2 << search.p2;
+@@
+
+coccilib.report.print_report(p2[0],
+			     "ERROR: missing put_device; call of_find_device_by_node on line "
+                             + p1[0].line
+                             + ", but without a corresponding object release within this function.")
+
+@script:python depends on org@
+p1 << search.p1;
+p2 << search.p2;
+@@
+
+cocci.print_main("of_find_device_by_node", p1)
+cocci.print_secs("needed put_device", p2)
-- 
2.20.1

_______________________________________________
Cocci mailing list
Cocci@systeme.lip6.fr
https://systeme.lip6.fr/mailman/listinfo/cocci

             reply index

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-02-16 16:05 Wen Yang [this message]
2019-02-16 16:33 ` Julia Lawall
2019-02-16 18:39 ` [Cocci] [v6] " Markus Elfring
2019-02-17  2:32   ` [Cocci] 答复: " Wen Yang
2019-02-17  7:42     ` Markus Elfring
2019-02-17  9:50 ` [Cocci] [PATCH v6] " Markus Elfring
2019-02-17 11:37   ` Julia Lawall
2019-02-17 11:42     ` Markus Elfring
2019-02-17 11:48       ` Julia Lawall
2019-02-17 12:00         ` [Cocci] [v6] " Markus Elfring
2019-02-17 12:05           ` Julia Lawall
2019-02-17 12:20             ` Markus Elfring
2019-02-17 12:52               ` Julia Lawall
2019-02-17 13:14                 ` Markus Elfring
2019-02-18  3:22                   ` wen.yang99
2019-02-18  6:43                     ` Julia Lawall
2019-02-18  8:19                       ` Markus Elfring
2019-02-19  2:14                         ` wen.yang99
2019-02-19  7:04                           ` Julia Lawall
2019-02-19  8:12                             ` Markus Elfring
2019-02-19  8:29                           ` Markus Elfring
2019-02-19  9:09                             ` wen.yang99
2019-02-19  9:30                               ` Markus Elfring
2019-03-06 11:18                           ` Markus Elfring
2019-02-18 21:40                     ` Markus Elfring

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=HK0PR02MB36344E2B29CEB195892F6420B2610@HK0PR02MB3634.apcprd02.prod.outlook.com \
    --to=yellowriver2010@hotmail.com \
    --cc=Gilles.Muller@lip6.fr \
    --cc=Julia.Lawall@lip6.fr \
    --cc=Markus.Elfring@web.de \
    --cc=cheng.shengyu@zte.com.cn \
    --cc=cocci@systeme.lip6.fr \
    --cc=linux-kernel@vger.kernel.org \
    --cc=michal.lkml@markovi.net \
    --cc=nicolas.palix@imag.fr \
    --cc=wen.yang99@zte.com.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Coccinelle Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/cocci/0 cocci/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 cocci cocci/ https://lore.kernel.org/cocci \
		cocci@systeme.lip6.fr
	public-inbox-index cocci

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/fr.lip6.systeme.cocci


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git