coccinelle: semantic patches related to devm_ functions (part 2)

/// Find uses of standard freeing functons on values allocated using devm_

/// functions.  Values allocated using the devm_functions are freed when

/// the device is detached, and thus the use of the standard freeing

/// function would cause a double free.

/// See Documentation/driver-model/devres.txt for more information.

///

/// A difficulty of detecting this problem is that the standard freeing

/// function might be called from a different function than the one

/// containing the allocation function.  It is thus necessary to make the

/// connection between the allocation function and the freeing function.

/// Here this is done using the specific argument text, which is prone to

/// false positives.  There is no rule for the request_region and

/// request_mem_region variants because this heuristic seems to be a bit

/// less reliable in these cases.

///

// Confidence: Moderate

// Copyright: (C) 2011 Julia Lawall, INRIA/LIP6.  GPLv2.

// Copyright: (C) 2011 Gilles Muller, INRIA/LiP6.  GPLv2.

// URL: http://coccinelle.lip6.fr/

// Comments:

// Options: -no_includes -include_headers

virtual org

virtual report

virtual context

@r depends on context || org || report@

expression x;

@@

(

 x = devm_kzalloc(...)

|

 x = devm_request_irq(...)

|

 x = devm_ioremap(...)

|

 x = devm_ioremap_nocache(...)

|

 x = devm_ioport_map(...)

)

@pb@

expression r.x;

position p;

@@

(

* kfree@p(x)

|

* free_irq@p(x)

|

* iounmap@p(x)

|

* ioport_unmap@p(x)

)

@script:python depends on org@

p << pb.p;

@@

msg="WARNING: invalid free of devm_ allocated data"

coccilib.org.print_todo(p[0], msg)

@script:python depends on report@

p << pb.p;

@@

msg="WARNING: invalid free of devm_ allocated data"

coccilib.report.print_report(p[0], msg)