mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 02:39:48 +00:00
b7b2ee41f3
krealloc() must not be used against devm_*() allocated memory regions: - if a bigger memory is to be allocated, krealloc() and __krealloc() could return a different pointer than the one given to them, creating a memory region which is not managed, thus it will not be automatically released on device removal. - if a bigger memory is to be allocated, krealloc() could kfree() the managed memory region which is passed to it. The old pointer is left registered as a resource for the device. On device removal, this dangling pointer will be used and an unrelated memory region could be released. - if the requested size is equal to 0, krealloc() can also just behave like kfree(). Here too, the old pointer is kept associated with the device. On device removal, this invalid pointer will be used and an unrelated memory region could be released. For all these reasons, krealloc() must not be used on a pointer returned by devm_*() functions. Cc: Tejun Heo <tj@kernel.org> Cc: Pekka Enberg <penberg@cs.helsinki.fi> Acked-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Yann Droneaud <ydroneaud@opteya.com> Signed-off-by: Michal Marek <mmarek@suse.com>
97 lines
2 KiB
Text
97 lines
2 KiB
Text
/// Find uses of standard freeing functons on values allocated using devm_
|
|
/// functions. Values allocated using the devm_functions are freed when
|
|
/// the device is detached, and thus the use of the standard freeing
|
|
/// function would cause a double free.
|
|
/// See Documentation/driver-model/devres.txt for more information.
|
|
///
|
|
/// A difficulty of detecting this problem is that the standard freeing
|
|
/// function might be called from a different function than the one
|
|
/// containing the allocation function. It is thus necessary to make the
|
|
/// connection between the allocation function and the freeing function.
|
|
/// Here this is done using the specific argument text, which is prone to
|
|
/// false positives. There is no rule for the request_region and
|
|
/// request_mem_region variants because this heuristic seems to be a bit
|
|
/// less reliable in these cases.
|
|
///
|
|
// Confidence: Moderate
|
|
// Copyright: (C) 2011 Julia Lawall, INRIA/LIP6. GPLv2.
|
|
// Copyright: (C) 2011 Gilles Muller, INRIA/LiP6. GPLv2.
|
|
// URL: http://coccinelle.lip6.fr/
|
|
// Comments:
|
|
// Options: --no-includes --include-headers
|
|
|
|
virtual org
|
|
virtual report
|
|
virtual context
|
|
|
|
@r depends on context || org || report@
|
|
expression x;
|
|
@@
|
|
|
|
(
|
|
x = devm_kmalloc(...)
|
|
|
|
|
x = devm_kvasprintf(...)
|
|
|
|
|
x = devm_kasprintf(...)
|
|
|
|
|
x = devm_kzalloc(...)
|
|
|
|
|
x = devm_kmalloc_array(...)
|
|
|
|
|
x = devm_kcalloc(...)
|
|
|
|
|
x = devm_kstrdup(...)
|
|
|
|
|
x = devm_kmemdup(...)
|
|
|
|
|
x = devm_get_free_pages(...)
|
|
|
|
|
x = devm_request_irq(...)
|
|
|
|
|
x = devm_ioremap(...)
|
|
|
|
|
x = devm_ioremap_nocache(...)
|
|
|
|
|
x = devm_ioport_map(...)
|
|
)
|
|
|
|
@pb@
|
|
expression r.x;
|
|
position p;
|
|
@@
|
|
|
|
(
|
|
* kfree@p(x)
|
|
|
|
|
* kzfree@p(x)
|
|
|
|
|
* __krealloc@p(x, ...)
|
|
|
|
|
* krealloc@p(x, ...)
|
|
|
|
|
* free_pages@p(x, ...)
|
|
|
|
|
* free_page@p(x)
|
|
|
|
|
* free_irq@p(x)
|
|
|
|
|
* iounmap@p(x)
|
|
|
|
|
* ioport_unmap@p(x)
|
|
)
|
|
|
|
@script:python depends on org@
|
|
p << pb.p;
|
|
@@
|
|
|
|
msg="WARNING: invalid free of devm_ allocated data"
|
|
coccilib.org.print_todo(p[0], msg)
|
|
|
|
@script:python depends on report@
|
|
p << pb.p;
|
|
@@
|
|
|
|
msg="WARNING: invalid free of devm_ allocated data"
|
|
coccilib.report.print_report(p[0], msg)
|
|
|