138 lines · c
1// RUN: %clang_analyze_cc1 -triple x86_64-unknown-linux %s -verify \2// RUN: -Wno-incompatible-library-redeclaration \3// RUN: -analyzer-checker=core \4// RUN: -analyzer-checker=unix.Malloc5 6#define __GFP_ZERO 0x80007#define NULL ((void *)0)8 9typedef __typeof(sizeof(int)) size_t;10 11void *kmalloc(size_t, int);12void kfree(void *);13 14struct test {15};16 17void foo(struct test *);18 19void test_zeroed(void) {20 struct test **list, *t;21 int i;22 23 list = kmalloc(sizeof(*list) * 10, __GFP_ZERO);24 if (list == NULL)25 return;26 27 for (i = 0; i < 10; i++) {28 t = list[i];29 foo(t);30 }31 kfree(list); // no-warning32}33 34void test_nonzero(void) {35 struct test **list, *t;36 int i;37 38 list = kmalloc(sizeof(*list) * 10, 0);39 if (list == NULL)40 return;41 42 for (i = 0; i < 10; i++) {43 t = list[i]; // expected-warning{{uninitialized}}44 foo(t);45 }46 kfree(list);47}48 49void test_indeterminate(int flags) {50 struct test **list, *t;51 int i;52 53 list = kmalloc(sizeof(*list) * 10, flags);54 if (list == NULL)55 return;56 57 for (i = 0; i < 10; i++) {58 t = list[i]; // expected-warning{{uninitialized}}59 foo(t);60 }61 kfree(list);62}63 64typedef unsigned long long uint64_t;65 66struct malloc_type;67 68// 3 parameter malloc:69// https://www.freebsd.org/cgi/man.cgi?query=malloc&sektion=970void *malloc(unsigned long size, struct malloc_type *mtp, int flags);71 72void test_3arg_malloc(struct malloc_type *mtp) {73 struct test **list, *t;74 int i;75 76 list = malloc(sizeof(*list) * 10, mtp, __GFP_ZERO);77 if (list == NULL)78 return;79 80 for (i = 0; i < 10; i++) {81 t = list[i];82 foo(t);83 }84 kfree(list); // no-warning85}86 87void test_3arg_malloc_nonzero(struct malloc_type *mtp) {88 struct test **list, *t;89 int i;90 91 list = malloc(sizeof(*list) * 10, mtp, 0);92 if (list == NULL)93 return;94 95 for (i = 0; i < 10; i++) {96 t = list[i]; // expected-warning{{uninitialized}}97 foo(t);98 }99 kfree(list);100}101 102void test_3arg_malloc_indeterminate(struct malloc_type *mtp, int flags) {103 struct test **list, *t;104 int i;105 106 list = malloc(sizeof(*list) * 10, mtp, flags);107 if (list == NULL)108 return;109 110 for (i = 0; i < 10; i++) {111 t = list[i]; // expected-warning{{uninitialized}}112 foo(t);113 }114 kfree(list);115}116 117void test_3arg_malloc_leak(struct malloc_type *mtp, int flags) {118 struct test **list;119 120 list = malloc(sizeof(*list) * 10, mtp, flags);121 if (list == NULL)122 return;123} // expected-warning{{Potential leak of memory pointed to by 'list'}}124 125// kmalloc can return a constant value defined in ZERO_SIZE_PTR126// if a block of size 0 is requested127#define ZERO_SIZE_PTR ((void *)16)128 129void test_kfree_ZERO_SIZE_PTR(void) {130 void *ptr = ZERO_SIZE_PTR;131 kfree(ptr); // no warning about freeing this value132}133 134void test_kfree_other_constant_value(void) {135 void *ptr = (void *)1;136 kfree(ptr); // expected-warning{{Argument to 'kfree()' is a constant address (1)}}137}138