diff options
Diffstat (limited to 'ANDROID_3.4.5/scripts/coccinelle/free')
-rw-r--r-- | ANDROID_3.4.5/scripts/coccinelle/free/clk_put.cocci | 67 | ||||
-rw-r--r-- | ANDROID_3.4.5/scripts/coccinelle/free/devm_free.cocci | 71 | ||||
-rw-r--r-- | ANDROID_3.4.5/scripts/coccinelle/free/iounmap.cocci | 67 | ||||
-rw-r--r-- | ANDROID_3.4.5/scripts/coccinelle/free/kfree.cocci | 121 |
4 files changed, 0 insertions, 326 deletions
diff --git a/ANDROID_3.4.5/scripts/coccinelle/free/clk_put.cocci b/ANDROID_3.4.5/scripts/coccinelle/free/clk_put.cocci deleted file mode 100644 index 46747adf..00000000 --- a/ANDROID_3.4.5/scripts/coccinelle/free/clk_put.cocci +++ /dev/null @@ -1,67 +0,0 @@ -/// Find missing clk_puts. -/// -//# This only signals a missing clk_put when there is a clk_put later -//# in the same function. -//# False positives can be due to loops. -// -// Confidence: Moderate -// Copyright: (C) 2012 Julia Lawall, INRIA/LIP6. GPLv2. -// Copyright: (C) 2012 Gilles Muller, INRIA/LiP6. GPLv2. -// URL: http://coccinelle.lip6.fr/ -// Comments: -// Options: - -virtual context -virtual org -virtual report - -@clk@ -expression e; -statement S,S1; -int ret; -position p1,p2,p3; -@@ - -e = clk_get@p1(...) -... when != clk_put(e) -if (<+...e...+>) S -... when any - when != clk_put(e) - when != if (...) { ... clk_put(e); ... } -( - if (ret == 0) S1 -| -if (...) - { ... - return 0; } -| -if (...) - { ... - return <+...e...+>; } -| -*if@p2 (...) - { ... when != clk_put(e) - when forall - return@p3 ...; } -) -... when any -clk_put(e); - -@script:python depends on org@ -p1 << clk.p1; -p2 << clk.p2; -p3 << clk.p3; -@@ - -cocci.print_main("clk_get",p1) -cocci.print_secs("if",p2) -cocci.print_secs("needed clk_put",p3) - -@script:python depends on report@ -p1 << clk.p1; -p2 << clk.p2; -p3 << clk.p3; -@@ - -msg = "ERROR: missing clk_put; clk_get on line %s and execution via conditional on line %s" % (p1[0].line,p2[0].line) -coccilib.report.print_report(p3[0],msg) diff --git a/ANDROID_3.4.5/scripts/coccinelle/free/devm_free.cocci b/ANDROID_3.4.5/scripts/coccinelle/free/devm_free.cocci deleted file mode 100644 index 0a1e3614..00000000 --- a/ANDROID_3.4.5/scripts/coccinelle/free/devm_free.cocci +++ /dev/null @@ -1,71 +0,0 @@ -/// Find uses of standard freeing functons on values allocated using devm_ -/// functions. Values allocated using the devm_functions are freed when -/// the device is detached, and thus the use of the standard freeing -/// function would cause a double free. -/// See Documentation/driver-model/devres.txt for more information. -/// -/// A difficulty of detecting this problem is that the standard freeing -/// function might be called from a different function than the one -/// containing the allocation function. It is thus necessary to make the -/// connection between the allocation function and the freeing function. -/// Here this is done using the specific argument text, which is prone to -/// false positives. There is no rule for the request_region and -/// request_mem_region variants because this heuristic seems to be a bit -/// less reliable in these cases. -/// -// Confidence: Moderate -// Copyright: (C) 2011 Julia Lawall, INRIA/LIP6. GPLv2. -// Copyright: (C) 2011 Gilles Muller, INRIA/LiP6. GPLv2. -// URL: http://coccinelle.lip6.fr/ -// Comments: -// Options: -no_includes -include_headers - -virtual org -virtual report -virtual context - -@r depends on context || org || report@ -expression x; -@@ - -( - x = devm_kzalloc(...) -| - x = devm_request_irq(...) -| - x = devm_ioremap(...) -| - x = devm_ioremap_nocache(...) -| - x = devm_ioport_map(...) -) - -@pb@ -expression r.x; -position p; -@@ - -( -* kfree@p(x) -| -* free_irq@p(x) -| -* iounmap@p(x) -| -* ioport_unmap@p(x) -) - -@script:python depends on org@ -p << pb.p; -@@ - -msg="WARNING: invalid free of devm_ allocated data" -coccilib.org.print_todo(p[0], msg) - -@script:python depends on report@ -p << pb.p; -@@ - -msg="WARNING: invalid free of devm_ allocated data" -coccilib.report.print_report(p[0], msg) - diff --git a/ANDROID_3.4.5/scripts/coccinelle/free/iounmap.cocci b/ANDROID_3.4.5/scripts/coccinelle/free/iounmap.cocci deleted file mode 100644 index 5384f4ba..00000000 --- a/ANDROID_3.4.5/scripts/coccinelle/free/iounmap.cocci +++ /dev/null @@ -1,67 +0,0 @@ -/// Find missing iounmaps. -/// -//# This only signals a missing iounmap when there is an iounmap later -//# in the same function. -//# False positives can be due to loops. -// -// Confidence: Moderate -// Copyright: (C) 2012 Julia Lawall, INRIA/LIP6. GPLv2. -// Copyright: (C) 2012 Gilles Muller, INRIA/LiP6. GPLv2. -// URL: http://coccinelle.lip6.fr/ -// Comments: -// Options: - -virtual context -virtual org -virtual report - -@iom@ -expression e; -statement S,S1; -int ret; -position p1,p2,p3; -@@ - -e = \(ioremap@p1\|ioremap_nocache@p1\)(...) -... when != iounmap(e) -if (<+...e...+>) S -... when any - when != iounmap(e) - when != if (...) { ... iounmap(e); ... } -( - if (ret == 0) S1 -| -if (...) - { ... - return 0; } -| -if (...) - { ... - return <+...e...+>; } -| -*if@p2 (...) - { ... when != iounmap(e) - when forall - return@p3 ...; } -) -... when any -iounmap(e); - -@script:python depends on org@ -p1 << iom.p1; -p2 << iom.p2; -p3 << iom.p3; -@@ - -cocci.print_main("ioremap",p1) -cocci.print_secs("if",p2) -cocci.print_secs("needed iounmap",p3) - -@script:python depends on report@ -p1 << iom.p1; -p2 << iom.p2; -p3 << iom.p3; -@@ - -msg = "ERROR: missing iounmap; ioremap on line %s and execution via conditional on line %s" % (p1[0].line,p2[0].line) -coccilib.report.print_report(p3[0],msg) diff --git a/ANDROID_3.4.5/scripts/coccinelle/free/kfree.cocci b/ANDROID_3.4.5/scripts/coccinelle/free/kfree.cocci deleted file mode 100644 index d9ae6d89..00000000 --- a/ANDROID_3.4.5/scripts/coccinelle/free/kfree.cocci +++ /dev/null @@ -1,121 +0,0 @@ -/// Find a use after free. -//# Values of variables may imply that some -//# execution paths are not possible, resulting in false positives. -//# Another source of false positives are macros such as -//# SCTP_DBG_OBJCNT_DEC that do not actually evaluate their argument -/// -// Confidence: Moderate -// Copyright: (C) 2010-2012 Nicolas Palix. GPLv2. -// Copyright: (C) 2010-2012 Julia Lawall, INRIA/LIP6. GPLv2. -// Copyright: (C) 2010-2012 Gilles Muller, INRIA/LiP6. GPLv2. -// URL: http://coccinelle.lip6.fr/ -// Comments: -// Options: -no_includes -include_headers - -virtual org -virtual report - -@free@ -expression E; -position p1; -@@ - -kfree@p1(E) - -@print expression@ -constant char [] c; -expression free.E,E2; -type T; -position p; -identifier f; -@@ - -( - f(...,c,...,(T)E@p,...) -| - E@p == E2 -| - E@p != E2 -| - E2 == E@p -| - E2 != E@p -| - !E@p -| - E@p || ... -) - -@sz@ -expression free.E; -position p; -@@ - - sizeof(<+...E@p...+>) - -@loop exists@ -expression E; -identifier l; -position ok; -@@ - -while (1) { ... - kfree@ok(E) - ... when != break; - when != goto l; - when forall -} - -@r exists@ -expression free.E, subE<=free.E, E2; -expression E1; -iterator iter; -statement S; -position free.p1!=loop.ok,p2!={print.p,sz.p}; -@@ - -kfree@p1(E,...) -... -( - iter(...,subE,...) S // no use -| - list_remove_head(E1,subE,...) -| - subE = E2 -| - subE++ -| - ++subE -| - --subE -| - subE-- -| - &subE -| - BUG(...) -| - BUG_ON(...) -| - return_VALUE(...) -| - return_ACPI_STATUS(...) -| - E@p2 // bad use -) - -@script:python depends on org@ -p1 << free.p1; -p2 << r.p2; -@@ - -cocci.print_main("kfree",p1) -cocci.print_secs("ref",p2) - -@script:python depends on report@ -p1 << free.p1; -p2 << r.p2; -@@ - -msg = "ERROR: reference preceded by free on line %s" % (p1[0].line) -coccilib.report.print_report(p2[0],msg) |