Edit File: devm_free.cocci
/// Find uses of standard freeing functons on values allocated using devm_ /// functions. Values allocated using the devm_functions are freed when /// the device is detached, and thus the use of the standard freeing /// function would cause a double free. /// See Documentation/driver-model/devres.txt for more information. /// /// A difficulty of detecting this problem is that the standard freeing /// function might be called from a different function than the one /// containing the allocation function. It is thus necessary to make the /// connection between the allocation function and the freeing function. /// Here this is done using the specific argument text, which is prone to /// false positives. There is no rule for the request_region and /// request_mem_region variants because this heuristic seems to be a bit /// less reliable in these cases. /// // Confidence: Moderate // Copyright: (C) 2011 Julia Lawall, INRIA/LIP6. GPLv2. // Copyright: (C) 2011 Gilles Muller, INRIA/LiP6. GPLv2. // URL: http://coccinelle.lip6.fr/ // Comments: // Options: -no_includes -include_headers virtual org virtual report virtual context @r depends on context || org || report@ expression x; @@ ( x = devm_kzalloc(...) | x = devm_request_irq(...) | x = devm_ioremap(...) | x = devm_ioremap_nocache(...) | x = devm_ioport_map(...) ) @pb@ expression r.x; position p; @@ ( * kfree@p(x) | * free_irq@p(x) | * iounmap@p(x) | * ioport_unmap@p(x) ) @script:python depends on org@ p << pb.p; @@ msg="WARNING: invalid free of devm_ allocated data" coccilib.org.print_todo(p[0], msg) @script:python depends on report@ p << pb.p; @@ msg="WARNING: invalid free of devm_ allocated data" coccilib.report.print_report(p[0], msg)