/usr/src/usr.sbin/memconfig/memconfig.c

Bug Summary

File:	src/usr.sbin/memconfig/memconfig.c
Warning:	line 161, column 15 Potential leak of memory pointed to by 'owner'

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name memconfig.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/memconfig/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/memconfig/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/memconfig/memconfig.c

1/* $OpenBSD: memconfig.c,v 1.19 2019/06/28 13:32:48 deraadt Exp $ */

3/*-
* Copyright (c) 1999 Michael Smith <msmith@freebsd.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $FreeBSD: /home/ncvs/src/usr.sbin/memcontrol/memcontrol.c,v 1.8 2002/09/15 15:07:55 dwmalone Exp $
*/

31#include <sys/types.h>
32#include <sys/ioctl.h>
33#include <sys/memrange.h>

35#include <err.h>
36#include <fcntl.h>
37#include <stdio.h>
38#include <stdlib.h>
39#include <string.h>
40#include <unistd.h>

42struct {
const char	*name;
int		val;
int		kind;
46#define MDF_SETTABLE(1<<0)	(1<<0)
47} attrnames[] = {
{"uncacheable",		MDF_UNCACHEABLE(1<<0),	MDF_SETTABLE(1<<0)},
{"write-combine",	MDF_WRITECOMBINE(1<<1),	MDF_SETTABLE(1<<0)},
{"write-through",	MDF_WRITETHROUGH(1<<2),	MDF_SETTABLE(1<<0)},
{"write-back",		MDF_WRITEBACK(1<<3),		MDF_SETTABLE(1<<0)},
{"write-protect",	MDF_WRITEPROTECT(1<<4),	MDF_SETTABLE(1<<0)},
{"force",		MDF_FORCE(1<<31),		MDF_SETTABLE(1<<0)},
{"unknown",		MDF_UNKNOWN(1<<5),		0},
{"fixed-base",		MDF_FIXBASE(1<<24),		0},
{"fixed-length",	MDF_FIXLEN(1<<25),		0},
{"set-by-firmware",	MDF_FIRMWARE(1<<26),		0},
{"active",		MDF_ACTIVE(1<<27),		MDF_SETTABLE(1<<0)},
{"fix-active",		MDF_FIXACTIVE(1<<29),		0},
{"bogus",		MDF_BOGUS(1<<28),		0},
{NULL((void *)0),			0,			0}
62};

64static void	listfunc(int, int, char *[]);
65static void	setfunc(int, int, char *[]);
66static void	clearfunc(int, int, char *[]);
67static void	helpfunc(int, int, char *[]);
68static void	help(const char *);
69static struct mem_range_desc *mrgetall(int, int *);

71struct
72{
const char	*cmd;
const char	*desc;
void	(*func)(int, int, char *[]);
76} functions[] = {
{"list",
"List current memory range attributes\n"
"    list [-a]\n"
"        -a    list all range slots, even those that are inactive",
listfunc},
{"set",
"Set memory range attributes\n"
"    set -b <base> -l <length> -o <owner> <attribute>\n"
"        <base>      memory range base address\n"
"        <length>    length of memory range in bytes, power of 2\n"
"        <owner>     text identifier for this setting (7 char max)\n"
"        <attribute> attribute(s) to be applied to this range:\n"
"                        uncacheable\n"
"                        write-combine\n"
"                        write-through\n"
"                        write-back\n"
"                        write-protect",
setfunc},
{"clear",
"Clear memory range attributes\n"
"    clear -o <owner>\n"
"        <owner>     all ranges with this owner will be cleared\n"
"    clear -b <base> -l <length>\n"
"        <base>      memory range base address\n"
"        <length>    length of memory range in bytes, power of 2\n"
"                    Base and length must exactly match an existing range",
clearfunc},
{NULL((void *)0),	NULL((void *)0),					helpfunc}
105};

107int
108main(int argc, char *argv[])
109{
int	 i, memfd = -1;

if (argc < 2) {
help(NULL((void *)0));
} else {
for (i = 0; functions[i].cmd != NULL((void *)0); i++)
	if (!strcmp(argv[1], functions[i].cmd))
		break;

if ((functions[i].func != helpfunc) &&
    (memfd = open("/dev/mem", O_RDONLY0x0000)) == -1)
	err(1, "can't open /dev/mem");
functions[i].func(memfd, argc - 1, argv + 1);
close(memfd);
}
return(0);
126}

128static struct mem_range_desc *
129mrgetall(int memfd, int *nmr)
130{
struct mem_range_desc	*mrd;
struct mem_range_op	mro;

mro.mo_arg[0] = 0;
if (ioctl(memfd, MEMRANGE_GET(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct mem_range_op) & 0x1fff) << 16) | ((('m')) <<
 8) | ((50))), &mro) == -1)
err(1, "can't size range descriptor array");

*nmr = mro.mo_arg[0];
mrd = calloc(*nmr, sizeof(struct mem_range_desc));
if (mrd == NULL((void *)0))
errx(1, "can't allocate %zu bytes for %d range descriptors",
     *nmr * sizeof(struct mem_range_desc), *nmr);

mro.mo_arg[0] = *nmr;
mro.mo_desc = mrd;
if (ioctl(memfd, MEMRANGE_GET(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct mem_range_op) & 0x1fff) << 16) | ((('m')) <<
 8) | ((50))), &mro) == -1)
err(1, "can't fetch range descriptor array");

return(mrd);
150}


153static void
154listfunc(int memfd, int argc, char *argv[])
155{
int	nd, i, j, k, ch, showall = 0;
struct mem_range_desc	*mrd;
char	*owner;

owner = NULL((void *)0);
while ((ch = getopt(argc, argv, "ao:")) != -1)
1
Assuming the condition is true→
2
←
Loop condition is true.  Entering loop body→
8
←
Assuming the condition is true→
9
←
Loop condition is true.  Entering loop body→
14
←
Potential leak of memory pointed to by 'owner'
switch(ch) {
3
←
Control jumps to 'case 111:'  at line 166→
10
←
Control jumps to 'case 111:'  at line 166→
case 'a':
	showall = 1;
	break;
case 'o':
	if (!(owner = strdup(optarg)))
4
←
Memory is allocated→
5
←
Assuming 'owner' is non-null→
6
←
Taking false branch→
11
←
Assuming 'owner' is non-null→
12
←
Taking false branch→
		errx(1, "out of memory");
	break;
7
←
 Execution continues on line 161→
13
←
 Execution continues on line 161→
default:
	help("list");
}

mrd = mrgetall(memfd, &nd);

for (i = 0; i < nd; i++) {
if (!showall && !(mrd[i].mr_flags & MDF_ACTIVE(1<<27)))
	continue;
if (owner && strcmp(mrd[i].mr_owner, owner))
	continue;
printf("%llx/%llx %.8s ", mrd[i].mr_base, mrd[i].mr_len,
       mrd[i].mr_owner[0] ? mrd[i].mr_owner : "-");
for (j = 0; j < 32; j++) {
	if ( ((1<<j) & mrd[i].mr_flags) == 0)
		continue;
	for (k = 0; attrnames[k].name != NULL((void *)0); k++)
		if (((1<<j) & mrd[i].mr_flags) & attrnames[k].val) {
			printf("%s ", attrnames[k].name);
			break;
		}
	if (attrnames[k].name == NULL((void *)0))
		printf("0x%x", (1<<j) & mrd[i].mr_flags);
}
printf("\n");
}
free(mrd);
free(owner);
198}

200static void
201setfunc(int memfd, int argc, char *argv[])
202{
struct mem_range_desc	 mrd;
struct mem_range_op	 mro;
int	 i, ch;
char	*ep;

mrd.mr_base = 0;
mrd.mr_len = 0;
mrd.mr_flags = 0;
strlcpy(mrd.mr_owner, "user", sizeof mrd.mr_owner);

while ((ch = getopt(argc, argv, "b:l:o:")) != -1)
switch(ch) {
case 'b':
	mrd.mr_base = strtoull(optarg, &ep, 0);
	if ((ep == optarg) || (*ep != 0))
		help("set");
	break;
case 'l':
	mrd.mr_len = strtoull(optarg, &ep, 0);
	if ((ep == optarg) || (*ep != 0))
		help("set");
	break;
case 'o':
	if (*optarg == 0 ||
	    strlen(optarg) > sizeof(mrd.mr_owner)-1)
		help("set");
	strlcpy(mrd.mr_owner, optarg, sizeof mrd.mr_owner);
	break;
default:
	help("set");
}

if (mrd.mr_len == 0)
help("set");

argc -= optind;
argv += optind;

while(argc--) {
for (i = 0; attrnames[i].name != NULL((void *)0); i++) {
	if (!strcmp(attrnames[i].name, argv[0])) {
		if (!(attrnames[i].kind & MDF_SETTABLE(1<<0)))
			help("flags");
		mrd.mr_flags |= attrnames[i].val;
		break;
	}
}
if (attrnames[i].name == NULL((void *)0))
	help("flags");
argv++;
}

mro.mo_desc = &mrd;
mro.mo_arg[0] = 0;
if (ioctl(memfd, MEMRANGE_SET((unsigned long)0x80000000 | ((sizeof(struct mem_range_op) &
 0x1fff) << 16) | ((('m')) << 8) | ((51))), &mro) == -1)
err(1, "can't set range");
259}

261static void
262clearfunc(int memfd, int argc, char *argv[])
263{
struct mem_range_desc	 mrd, *mrdp;
struct mem_range_op      mro;
int	i, nd, ch, got_base = 0;
char	*ep, *owner;

mrd.mr_base = 0;
mrd.mr_len = 0;
owner = NULL((void *)0);
while ((ch = getopt(argc, argv, "b:l:o:")) != -1)
switch(ch) {
case 'b':
	mrd.mr_base = strtoull(optarg, &ep, 0);
	if ((ep == optarg) || (*ep != 0))
		help("clear");
	else
		got_base = 1;
	break;
case 'l':
	mrd.mr_len = strtoull(optarg, &ep, 0);
	if ((ep == optarg) || (*ep != 0))
		help("clear");
	break;
case 'o':
	if ((*optarg == 0) || (strlen(optarg) > 7))
		help("clear");
	if (!(owner = strdup(optarg)))
		errx(1, "out of memory");
	break;

default:
	help("clear");
}

if (owner != NULL((void *)0)) {
/* clear-by-owner */
if (got_base || mrd.mr_len != 0)
	help("clear");

mrdp = mrgetall(memfd, &nd);
mro.mo_arg[0] = MEMRANGE_SET_REMOVE1;
for (i = 0; i < nd; i++) {
	if (!strcmp(owner, mrdp[i].mr_owner) &&
	    (mrdp[i].mr_flags & MDF_ACTIVE(1<<27)) &&
	    !(mrdp[i].mr_flags & MDF_FIXACTIVE(1<<29))) {

		mro.mo_desc = mrdp + i;
		if (ioctl(memfd, MEMRANGE_SET((unsigned long)0x80000000 | ((sizeof(struct mem_range_op) &
 0x1fff) << 16) | ((('m')) << 8) | ((51))), &mro) == -1)
			warn("couldn't clear range owned by '%s'",
			    owner);
	}
}
} else if (got_base && mrd.mr_len != 0) {
/* clear-by-base/len */
mro.mo_arg[0] = MEMRANGE_SET_REMOVE1;
mro.mo_desc = &mrd;
if (ioctl(memfd, MEMRANGE_SET((unsigned long)0x80000000 | ((sizeof(struct mem_range_op) &
 0x1fff) << 16) | ((('m')) << 8) | ((51))), &mro) == -1)
	err(1, "couldn't clear range");
} else {
help("clear");
}
324}

326static void
327helpfunc(int memfd, int argc, char *argv[])
328{
help(argv[1]);
330}

332static void
333help(const char *what)
334{
int	 i;

if (what != NULL((void *)0)) {
/* find a function that matches */
for (i = 0; functions[i].cmd != NULL((void *)0); i++)
	if (!strcmp(what, functions[i].cmd)) {
		fprintf(stderr(&__sF[2]), "%s\n", functions[i].desc);
		return;
	}
fprintf(stderr(&__sF[2]), "Unknown command '%s'\n", what);
}

/* print general help */
fprintf(stderr(&__sF[2]), "Valid commands are :\n");
for (i = 0; functions[i].cmd != NULL((void *)0); i++)
fprintf(stderr(&__sF[2]), "    %s\n", functions[i].cmd);
fprintf(stderr(&__sF[2]), "Use help <command> for command-specific help\n");
352}