--- /dev/null	Fri Dec 21 15:00:05 2018
+++ new/usr/src/tools/smatch/src/check_leaks.c	Fri Dec 21 15:00:05 2018
@@ -0,0 +1,270 @@
+/*
+ * Copyright (C) 2010 Dan Carpenter.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
+ */
+
+/*
+ * The point of this check is to look for leaks.
+ * foo = malloc();  // <- mark it as allocated.
+ * A variable becomes &ok if we:
+ * 1) assign it to another variable.
+ * 2) pass it to a function.
+ *
+ * One complication is dealing with stuff like:
+ * foo->bar = malloc();
+ * foo->baz = malloc();
+ * foo = something();
+ *
+ * The work around is that for now what this check only
+ * checks simple expressions and doesn't check whether
+ * foo->bar is leaked.
+ * 
+ */
+
+#include <fcntl.h>
+#include <unistd.h>
+#include "parse.h"
+#include "smatch.h"
+#include "smatch_slist.h"
+
+static int my_id;
+
+STATE(allocated);
+STATE(ok);
+
+static void set_parent(struct expression *expr, struct smatch_state *state);
+
+static const char *allocation_funcs[] = {
+	"malloc",
+	"kmalloc",
+	"kzalloc",
+	"kmemdup",
+};
+
+static char *alloc_parent_str(struct symbol *sym)
+{
+	static char buf[256];
+
+	if (!sym || !sym->ident)
+		return NULL;
+
+	snprintf(buf, 255, "%s", sym->ident->name);
+	buf[255] = '\0';
+	return alloc_string(buf);
+}
+
+static char *get_parent_from_expr(struct expression *expr, struct symbol **sym)
+{
+	char *name;
+
+	expr = strip_expr(expr);
+
+	name = expr_to_str_sym(expr, sym);
+	free_string(name);
+	if (!name || !*sym || !(*sym)->ident) {
+		*sym = NULL;
+		return NULL;
+	}
+	return alloc_parent_str(*sym);
+}
+
+static int is_local(struct expression *expr)
+{
+	char *name;
+	struct symbol *sym;
+	int ret = 0;
+
+	name = expr_to_str_sym(expr, &sym);
+	if (!name || !sym)
+		goto out;
+	if (sym->ctype.modifiers & (MOD_NONLOCAL | MOD_STATIC | MOD_ADDRESSABLE))
+		goto out;
+	ret = 1;
+out:
+	free_string(name);
+	return ret;
+}
+
+static int is_param(struct expression *expr)
+{
+	char *name;
+	struct symbol *sym;
+	struct symbol *tmp;
+	int ret = 0;
+
+	name = expr_to_str_sym(expr, &sym);
+	if (!name || !sym)
+		goto out;
+	FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, tmp) {
+		if (tmp == sym) {
+			ret = 1;
+			goto out;
+		}
+	} END_FOR_EACH_PTR(tmp);
+out:
+	free_string(name);
+	return ret;
+	
+}
+
+static void match_alloc(const char *fn, struct expression *expr, void *unused)
+{
+	if (!is_local(expr->left))
+		return;
+	if (is_param(expr->left))
+		return;
+	if (expr->left->type != EXPR_SYMBOL)
+		return;
+	set_state_expr(my_id, expr->left, &allocated);
+}
+
+static void match_condition(struct expression *expr)
+{
+	struct sm_state *sm;
+
+	expr = strip_expr(expr);
+
+	switch (expr->type) {
+	case EXPR_PREOP:
+	case EXPR_SYMBOL:
+	case EXPR_DEREF:
+		sm = get_sm_state_expr(my_id, expr);
+		if (sm && slist_has_state(sm->possible, &allocated))
+			set_true_false_states_expr(my_id, expr, NULL, &ok);
+		return;
+	case EXPR_ASSIGNMENT:
+		 /* You have to deal with stuff like if (a = b = c) */
+		match_condition(expr->left);
+		return;
+	default:
+		return;
+	}
+}
+
+static void set_parent(struct expression *expr, struct smatch_state *state)
+{
+	char *name;
+	struct symbol *sym;
+
+	expr = strip_expr(expr);
+	if (!expr)
+		return;
+	if (expr->type == EXPR_CONDITIONAL ||
+	    expr->type == EXPR_SELECT) {
+		set_parent(expr->cond_true, state);
+		set_parent(expr->cond_false, state);
+		return;
+	}
+
+	name = get_parent_from_expr(expr, &sym);
+	if (!name || !sym)
+		goto free;
+	if (state == &ok && !get_state(my_id, name, sym))
+		goto free;
+	set_state(my_id, name, sym, state);
+free:
+	free_string(name);
+}
+
+static void match_function_call(struct expression *expr)
+{
+	struct expression *tmp;
+
+	FOR_EACH_PTR(expr->args, tmp) {
+		set_parent(tmp, &ok);
+	} END_FOR_EACH_PTR(tmp);
+}
+
+static void warn_if_allocated(struct expression *expr)
+{
+	struct sm_state *sm;
+	char *name;
+	sval_t sval;
+
+	if (get_implied_value(expr, &sval) && sval.value == 0)
+		return;
+
+	sm = get_sm_state_expr(my_id, expr);
+	if (!sm)
+		return;
+	if (!slist_has_state(sm->possible, &allocated))
+		return;
+
+	name = expr_to_var(expr);
+	sm_warning("overwrite may leak '%s'", name);
+	free_string(name);
+
+	/* silence further warnings */
+	set_state_expr(my_id, expr, &ok);
+}
+
+static void match_assign(struct expression *expr)
+{
+	struct expression *right;
+
+	right = expr->right;
+
+	while (right->type == EXPR_ASSIGNMENT)
+		right = right->left;
+
+	warn_if_allocated(expr->left);
+	set_parent(right, &ok);
+}
+
+static void check_for_allocated(void)
+{
+	struct stree *stree;
+	struct sm_state *tmp;
+
+	stree = __get_cur_stree();
+	FOR_EACH_MY_SM(my_id, stree, tmp) {
+		if (!slist_has_state(tmp->possible, &allocated))
+			continue;
+		sm_warning("possible memory leak of '%s'", tmp->name);
+	} END_FOR_EACH_SM(tmp);
+}
+
+static void match_return(struct expression *ret_value)
+{
+	if (__inline_fn)
+		return;
+	set_parent(ret_value, &ok);
+	check_for_allocated();
+}
+
+static void match_end_func(struct symbol *sym)
+{
+	if (__inline_fn)
+		return;
+	check_for_allocated();
+}
+
+void check_leaks(int id)
+{
+	int i;
+
+	my_id = id;
+
+	for (i = 0; i < ARRAY_SIZE(allocation_funcs); i++)
+		add_function_assign_hook(allocation_funcs[i], &match_alloc, NULL);
+
+	add_hook(&match_condition, CONDITION_HOOK);
+
+	add_hook(&match_function_call, FUNCTION_CALL_HOOK);
+	add_hook(&match_assign, ASSIGNMENT_HOOK);
+
+	add_hook(&match_return, RETURN_HOOK);
+	add_hook(&match_end_func, END_FUNC_HOOK);
+}
