1 /*
2 * Copyright (C) 2015 Rasmus Villemoes.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 #define _GNU_SOURCE
19
20 #include <assert.h>
21 #include <ctype.h>
22 #include <string.h>
23 #include "smatch.h"
24 #include "smatch_slist.h"
25
26 #define spam(args...) do { \
27 if (option_spammy) \
28 sm_msg(args); \
29 } while (0)
30
31 static int my_id;
32
33 /*
34 * Much of this is taken directly from the kernel (mostly vsprintf.c),
35 * with a few modifications here and there.
36 */
37
38 #define KERN_SOH_ASCII '\001'
39
40 typedef unsigned char u8;
41 typedef signed short s16;
42
43 #define SIGN 1 /* unsigned/signed, must be 1 */
44 #define LEFT 2 /* left justified */
45 #define PLUS 4 /* show plus */
46 #define SPACE 8 /* space if plus */
47 #define ZEROPAD 16 /* pad with zero, must be 16 == '0' - ' ' */
48 #define SMALL 32 /* use lowercase in hex (must be 32 == 0x20) */
49 #define SPECIAL 64 /* prefix hex with "0x", octal with "0" */
50
51 enum format_type {
52 FORMAT_TYPE_NONE, /* Just a string part */
53 FORMAT_TYPE_WIDTH,
54 FORMAT_TYPE_PRECISION,
55 FORMAT_TYPE_CHAR,
56 FORMAT_TYPE_STR,
57 FORMAT_TYPE_PTR,
58 FORMAT_TYPE_PERCENT_CHAR,
59 FORMAT_TYPE_INVALID,
60 FORMAT_TYPE_LONG_LONG,
61 FORMAT_TYPE_ULONG,
62 FORMAT_TYPE_LONG,
63 FORMAT_TYPE_UBYTE,
64 FORMAT_TYPE_BYTE,
65 FORMAT_TYPE_USHORT,
66 FORMAT_TYPE_SHORT,
67 FORMAT_TYPE_UINT,
68 FORMAT_TYPE_INT,
69 FORMAT_TYPE_SIZE_T,
70 FORMAT_TYPE_PTRDIFF,
71 FORMAT_TYPE_NRCHARS, /* Reintroduced for this checker */
72 FORMAT_TYPE_FLOAT, /* for various floating point formatters */
73 };
74
75 struct printf_spec {
76 unsigned int type:8; /* format_type enum */
77 signed int field_width:24; /* width of output field */
78 unsigned int flags:8; /* flags to number() */
79 unsigned int base:8; /* number base, 8, 10 or 16 only */
80 signed int precision:16; /* # of digits/chars */
81 } __packed;
82 #define FIELD_WIDTH_MAX ((1 << 23) - 1)
83 #define PRECISION_MAX ((1 << 15) - 1)
84 extern char __check_printf_spec[1-2*(sizeof(struct printf_spec) != 8)];
85
86 static int
87 skip_atoi(const char **s)
88 {
89 int i = 0;
90
91 while (isdigit(**s))
92 i = i*10 + *((*s)++) - '0';
93
94 return i;
95 }
96
97 static int
98 format_decode(const char *fmt, struct printf_spec *spec)
99 {
100 const char *start = fmt;
101 char qualifier;
102
103 /* we finished early by reading the field width */
104 if (spec->type == FORMAT_TYPE_WIDTH) {
105 if (spec->field_width < 0) {
106 spec->field_width = -spec->field_width;
107 spec->flags |= LEFT;
108 }
109 spec->type = FORMAT_TYPE_NONE;
110 goto precision;
111 }
112
113 /* we finished early by reading the precision */
114 if (spec->type == FORMAT_TYPE_PRECISION) {
115 if (spec->precision < 0)
116 spec->precision = 0;
117
118 spec->type = FORMAT_TYPE_NONE;
119 goto qualifier;
120 }
121
122 /* By default */
123 spec->type = FORMAT_TYPE_NONE;
124
125 for (; *fmt ; ++fmt) {
126 if (*fmt == '%')
127 break;
128 }
129
130 /* Return the current non-format string */
131 if (fmt != start || !*fmt)
132 return fmt - start;
133
134 /* Process flags */
135 spec->flags = 0;
136
137 while (1) { /* this also skips first '%' */
138 bool found = true;
139
140 ++fmt;
141
142 switch (*fmt) {
143 case '-': spec->flags |= LEFT; break;
144 case '+': spec->flags |= PLUS; break;
145 case ' ': spec->flags |= SPACE; break;
146 case '#': spec->flags |= SPECIAL; break;
147 case '0': spec->flags |= ZEROPAD; break;
148 default: found = false;
149 }
150
151 if (!found)
152 break;
153 }
154
155 /* get field width */
156 spec->field_width = -1;
157
158 if (isdigit(*fmt))
159 spec->field_width = skip_atoi(&fmt);
160 else if (*fmt == '*') {
161 /* it's the next argument */
162 spec->type = FORMAT_TYPE_WIDTH;
163 return ++fmt - start;
164 }
165
166 precision:
167 /* get the precision */
168 spec->precision = -1;
169 if (*fmt == '.') {
170 ++fmt;
171 if (isdigit(*fmt)) {
172 spec->precision = skip_atoi(&fmt);
173 if (spec->precision < 0)
174 spec->precision = 0;
175 } else if (*fmt == '*') {
176 /* it's the next argument */
177 spec->type = FORMAT_TYPE_PRECISION;
178 return ++fmt - start;
179 }
180 }
181
182 qualifier:
183 /* get the conversion qualifier */
184 qualifier = 0;
185 if (*fmt == 'h' || _tolower(*fmt) == 'l' ||
186 _tolower(*fmt) == 'z' || *fmt == 't') {
187 qualifier = *fmt++;
188 if (qualifier == *fmt) {
189 if (qualifier == 'l') {
190 qualifier = 'L';
191 ++fmt;
192 } else if (qualifier == 'h') {
193 qualifier = 'H';
194 ++fmt;
195 } else {
196 sm_warning("invalid repeated qualifier '%c'", *fmt);
197 }
198 }
199 }
200
201 /* default base */
202 spec->base = 10;
203 switch (*fmt) {
204 case 'c':
205 if (qualifier)
206 sm_warning("qualifier '%c' ignored for %%c specifier", qualifier);
207
208 spec->type = FORMAT_TYPE_CHAR;
209 return ++fmt - start;
210
211 case 's':
212 if (qualifier && qualifier != 'l')
213 sm_warning("qualifier '%c' ignored for %%s specifier", qualifier);
214
215 spec->type = FORMAT_TYPE_STR;
216 return ++fmt - start;
217
218 case 'p':
219 spec->type = FORMAT_TYPE_PTR;
220 return ++fmt - start;
221
222 case '%':
223 spec->type = FORMAT_TYPE_PERCENT_CHAR;
224 return ++fmt - start;
225
226 /* integer number formats - set up the flags and "break" */
227 case 'o':
228 spec->base = 8;
229 break;
230
231 case 'x':
232 spec->flags |= SMALL;
233
234 case 'X':
235 spec->base = 16;
236 break;
237
238 case 'd':
239 case 'i':
240 spec->flags |= SIGN;
241 case 'u':
242 break;
243
244 case 'n':
245 spec->type = FORMAT_TYPE_NRCHARS;
246 return ++fmt - start;
247
248 case 'a': case 'A':
249 case 'e': case 'E':
250 case 'f': case 'F':
251 case 'g': case 'G':
252 spec->type = FORMAT_TYPE_FLOAT;
253 return ++fmt - start;
254
255 default:
256 spec->type = FORMAT_TYPE_INVALID;
257 /* Unlike the kernel code, we 'consume' the invalid
258 * character so that it can get included in the
259 * report. After that, we bail out. */
260 return ++fmt - start;
261 }
262
263 if (qualifier == 'L')
264 spec->type = FORMAT_TYPE_LONG_LONG;
265 else if (qualifier == 'l') {
266 if (spec->flags & SIGN)
267 spec->type = FORMAT_TYPE_LONG;
268 else
269 spec->type = FORMAT_TYPE_ULONG;
270 } else if (_tolower(qualifier) == 'z') {
271 spec->type = FORMAT_TYPE_SIZE_T;
272 } else if (qualifier == 't') {
273 spec->type = FORMAT_TYPE_PTRDIFF;
274 } else if (qualifier == 'H') {
275 if (spec->flags & SIGN)
276 spec->type = FORMAT_TYPE_BYTE;
277 else
278 spec->type = FORMAT_TYPE_UBYTE;
279 } else if (qualifier == 'h') {
280 if (spec->flags & SIGN)
281 spec->type = FORMAT_TYPE_SHORT;
282 else
283 spec->type = FORMAT_TYPE_USHORT;
284 } else {
285 if (spec->flags & SIGN)
286 spec->type = FORMAT_TYPE_INT;
287 else
288 spec->type = FORMAT_TYPE_UINT;
289 }
290
291 return ++fmt - start;
292 }
293
294 static int is_struct_tag(struct symbol *type, const char *tag)
295 {
296 return type->type == SYM_STRUCT && type->ident && !strcmp(type->ident->name, tag);
297 }
298
299 static int has_struct_tag(struct symbol *type, const char *tag)
300 {
301 struct symbol *tmp;
302
303 if (type->type == SYM_STRUCT)
304 return is_struct_tag(type, tag);
305 if (type->type == SYM_UNION) {
306 FOR_EACH_PTR(type->symbol_list, tmp) {
307 tmp = get_real_base_type(tmp);
308 if (tmp && is_struct_tag(tmp, tag))
309 return 1;
310 } END_FOR_EACH_PTR(tmp);
311 }
312 return 0;
313 }
314
315 static int is_char_type(struct symbol *type)
316 {
317 return type == &uchar_ctype || type == &char_ctype || type == &schar_ctype;
318 }
319
320 /*
321 * I have absolutely no idea if this is how one is supposed to get the
322 * symbol representing a typedef, but it seems to work.
323 */
324 struct typedef_lookup {
325 const char *name;
326 struct symbol *sym;
327 int failed;
328 };
329
330 static struct symbol *_typedef_lookup(const char *name)
331 {
332 struct ident *id;
333 struct symbol *node;
334
335 id = built_in_ident(name);
336 if (!id)
337 return NULL;
338 node = lookup_symbol(id, NS_TYPEDEF);
339 if (!node || node->type != SYM_NODE)
340 return NULL;
341 return get_real_base_type(node);
342 }
343
344 static void typedef_lookup(struct typedef_lookup *tl)
345 {
346 if (tl->sym || tl->failed)
347 return;
348 tl->sym = _typedef_lookup(tl->name);
349 if (!tl->sym) {
350 sm_perror(" could not find typedef '%s'", tl->name);
351 tl->failed = 1;
352 }
353 }
354
355
356 static void ip4(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
357 {
358 enum { ENDIAN_BIG, ENDIAN_LITTLE, ENDIAN_HOST } endian = ENDIAN_BIG;
359
360 assert(fmt[0] == 'i' || fmt[0] == 'I');
361 assert(fmt[1] == '4');
362
363 if (isalnum(fmt[2])) {
364 switch (fmt[2]) {
365 case 'h':
366 endian = ENDIAN_HOST;
367 break;
368 case 'l':
369 endian = ENDIAN_LITTLE;
370 break;
371 case 'n':
372 case 'b':
373 endian = ENDIAN_BIG;
374 break;
375 default:
376 sm_warning("'%%p%c4' can only be followed by one of [hnbl], not '%c'", fmt[0], fmt[2]);
377 }
378 if (isalnum(fmt[3]))
379 sm_warning("'%%p%c4' can only be followed by precisely one of [hnbl]", fmt[0]);
380 }
381
382
383 if (type->ctype.modifiers & MOD_NODEREF)
384 sm_error("passing __user pointer to '%%p%c4'", fmt[0]);
385
386 /*
387 * If we have a pointer to char/u8/s8, we expect the caller to
388 * handle endianness; I don't think there's anything we can
389 * do. I'd like to check that if we're passed a pointer to a
390 * __bitwise u32 (most likely a __be32), we should have endian
391 * == ENDIAN_BIG. But I can't figure out how to get that
392 * information (it also seems to require ensuring certain
393 * macros are defined). But struct in_addr certainly consists
394 * of only a single __be32, so in that case we can do a check.
395 */
396 if (is_char_type(basetype))
397 return;
398
399 if (is_struct_tag(basetype, "in_addr") && endian != ENDIAN_BIG)
400 sm_warning("passing struct in_addr* to '%%p%c4%c', is the endianness ok?", fmt[0], fmt[2]);
401
402 /* ... */
403 }
404
405 static void ip6(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
406 {
407 assert(fmt[0] == 'i' || fmt[0] == 'I');
408 assert(fmt[1] == '6');
409
410 if (isalnum(fmt[2])) {
411 if (fmt[2] != 'c')
412 sm_warning("'%%p%c6' can only be followed by c", fmt[0]);
413 else if (fmt[0] == 'i')
414 sm_warning("'%%pi6' does not allow flag c");
415 if (isalnum(fmt[3]))
416 sm_warning("'%%p%c6%c' cannot be followed by other alphanumerics", fmt[0], fmt[2]);
417 }
418
419 if (type->ctype.modifiers & MOD_NODEREF)
420 sm_error("passing __user pointer to '%%p%c6'", fmt[0]);
421 }
422
423 static void ipS(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
424 {
425 const char *f;
426
427 assert(tolower(fmt[0]) == 'i');
428 assert(fmt[1] == 'S');
429
430 for (f = fmt+2; isalnum(*f); ++f) {
431 /* It's probably too anal checking for duplicate flags. */
432 if (!strchr("pfschnbl", *f))
433 sm_warning("'%%p%cS' cannot be followed by '%c'", fmt[0], *f);
434 }
435
436 /*
437 * XXX: Should we also allow passing a pointer to a union, one
438 * member of which is a struct sockaddr? It may be slightly
439 * cleaner actually passing &u.raw instead of just &u, though
440 * the generated code is of course exactly the same. For now,
441 * we do accept struct sockaddr_in and struct sockaddr_in6,
442 * since those are easy to handle and rather harmless.
443 */
444 if (!has_struct_tag(basetype, "sockaddr") &&
445 !has_struct_tag(basetype, "sockaddr_in") &&
446 !has_struct_tag(basetype, "sockaddr_in6") &&
447 !has_struct_tag(basetype, "__kernel_sockaddr_storage"))
448 sm_error("'%%p%cS' expects argument of type struct sockaddr *, "
449 "argument %d has type '%s'", fmt[0], vaidx, type_to_str(type));
450 }
451
452 static void hex_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
453 {
454 assert(fmt[0] == 'h');
455 if (isalnum(fmt[1])) {
456 if (!strchr("CDN", fmt[1]))
457 sm_warning("'%%ph' cannot be followed by '%c'", fmt[1]);
458 if (isalnum(fmt[2]))
459 sm_warning("'%%ph' can be followed by at most one of [CDN], and no other alphanumerics");
460 }
461 if (type->ctype.modifiers & MOD_NODEREF)
462 sm_error("passing __user pointer to %%ph");
463 }
464
465 static void escaped_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
466 {
467 assert(fmt[0] == 'E');
468 while (isalnum(*++fmt)) {
469 if (!strchr("achnops", *fmt))
470 sm_warning("%%pE can only be followed by a combination of [achnops]");
471 }
472 if (type->ctype.modifiers & MOD_NODEREF)
473 sm_error("passing __user pointer to %%pE");
474 }
475
476 static void resource_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
477 {
478 assert(tolower(fmt[0]) == 'r');
479 if (!is_struct_tag(basetype, "resource")) {
480 sm_error("'%%p%c' expects argument of type struct resource *, "
481 "but argument %d has type '%s'", fmt[0], vaidx, type_to_str(type));
482 }
483 if (isalnum(fmt[1]))
484 sm_warning("'%%p%c' cannot be followed by '%c'", fmt[0], fmt[1]);
485 }
486
487 static void mac_address_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
488 {
489 assert(tolower(fmt[0]) == 'm');
490 if (isalnum(fmt[1])) {
491 if (!(fmt[1] == 'F' || fmt[1] == 'R'))
492 sm_warning("'%%p%c' cannot be followed by '%c'", fmt[0], fmt[1]);
493 if (fmt[0] == 'm' && fmt[1] == 'F')
494 sm_warning("it is pointless to pass flag F to %%pm");
495 if (isalnum(fmt[2]))
496 sm_warning("'%%p%c%c' cannot be followed by other alphanumeric", fmt[0], fmt[1]);
497 }
498 /* Technically, bdaddr_t is a typedef for an anonymous struct, but this still seems to work. */
499 if (!is_char_type(basetype) && !is_struct_tag(basetype, "bdaddr_t") && basetype != &void_ctype) {
500 sm_warning("'%%p%c' expects argument of type u8 * or bdaddr_t *, argument %d has type '%s'",
501 fmt[0], vaidx, type_to_str(type));
502 }
503 if (type->ctype.modifiers & MOD_NODEREF)
504 sm_error("passing __user pointer to '%%p%c'", fmt[0]);
505 }
506
507 static void dentry_file(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
508 {
509 const char *tag;
510
511 assert(tolower(fmt[0]) == 'd');
512 tag = fmt[0] == 'd' ? "dentry" : "file";
513
514 if (isalnum(fmt[1])) {
515 if (!strchr("234", fmt[1]))
516 sm_warning("'%%p%c' can only be followed by one of [234]", fmt[0]);
517 if (isalnum(fmt[2]))
518 sm_warning("'%%p%c%c' cannot be followed by '%c'", fmt[0], fmt[1], fmt[2]);
519 }
520
521 if (!is_struct_tag(basetype, tag))
522 sm_error("'%%p%c' expects argument of type struct '%s*', argument %d has type '%s'",
523 fmt[0], tag, vaidx, type_to_str(type));
524 }
525
526 static void time_and_date(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
527 {
528 assert(tolower(fmt[0]) == 't');
529
530 if (fmt[1] == 'R' && !is_struct_tag(basetype, "rtc_time"))
531 sm_error("'%%ptR' expects argument of type struct 'rtc_time', argument %d has type '%s'",
532 vaidx, type_to_str(type));
533 }
534
535 static void check_clock(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
536 {
537 assert(fmt[0] == 'C');
538 if (isalnum(fmt[1])) {
539 if (!strchr("nr", fmt[1]))
540 sm_warning("'%%pC' can only be followed by one of [nr]");
541 if (isalnum(fmt[2]))
542 sm_warning("'%%pC%c' cannot be followed by '%c'", fmt[1], fmt[2]);
543 }
544 if (!is_struct_tag(basetype, "clk"))
545 sm_error("'%%pC' expects argument of type 'struct clk*', argument %d has type '%s'",
546 vaidx, type_to_str(type));
547 }
548
549 static void va_format(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
550 {
551 assert(fmt[0] == 'V');
552 if (isalnum(fmt[1]))
553 sm_warning("%%pV cannot be followed by any alphanumerics");
554 if (!is_struct_tag(basetype, "va_format"))
555 sm_error("%%pV expects argument of type struct va_format*, argument %d has type '%s'", vaidx, type_to_str(type));
556 }
557
558 static void netdev_feature(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
559 {
560 static struct typedef_lookup netdev = { .name = "netdev_features_t" };
561
562 assert(fmt[0] == 'N');
563 if (fmt[1] != 'F') {
564 sm_error("%%pN must be followed by 'F'");
565 return;
566 }
567 if (isalnum(fmt[2]))
568 sm_warning("%%pNF cannot be followed by '%c'", fmt[2]);
569
570 typedef_lookup(&netdev);
571 if (!netdev.sym)
572 return;
573 if (basetype != netdev.sym)
574 sm_error("%%pNF expects argument of type netdev_features_t*, argument %d has type '%s'",
575 vaidx, type_to_str(type));
576
577 }
578 static void address_val(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
579 {
580 static struct typedef_lookup dma = { .name = "dma_addr_t" };
581 static struct typedef_lookup phys = { .name = "phys_addr_t" };
582 struct typedef_lookup *which = &phys;
583 const char *suf = "";
584 assert(fmt[0] == 'a');
585
586 if (isalnum(fmt[1])) {
587 switch (fmt[1]) {
588 case 'd':
589 which = &dma;
590 suf = "d";
591 break;
592 case 'p':
593 suf = "p";
594 break;
595 default:
596 sm_error("'%%pa' can only be followed by one of [dp]");
597 }
598 if (isalnum(fmt[2]))
599 sm_error("'%%pa%c' cannot be followed by '%c'", fmt[1], fmt[2]);
600 }
601
602 typedef_lookup(which);
603 if (!which->sym)
604 return;
605 if (basetype != which->sym) {
606 sm_error("'%%pa%s' expects argument of type '%s*', argument %d has type '%s'",
607 suf, which->name, vaidx, type_to_str(type));
608 }
609 }
610
611 static void block_device(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
612 {
613 const char *tag = "block_device";
614
615 assert(fmt[0] == 'g');
616 if (isalnum(fmt[1])) {
617 sm_warning("%%pg cannot be followed by '%c'", fmt[1]);
618 }
619 if (!is_struct_tag(basetype, tag))
620 sm_error("'%%p%c' expects argument of type struct '%s*', argument %d has type '%s'",
621 fmt[0], tag, vaidx, type_to_str(type));
622 }
623
624 static void flag_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
625 {
626 static struct typedef_lookup gfp = { .name = "gfp_t" };
627
628 assert(fmt[0] == 'G');
629 if (!isalnum(fmt[1])) {
630 sm_error("%%pG must be followed by one of [gpv]");
631 return;
632 }
633 switch (fmt[1]) {
634 case 'p':
635 case 'v':
636 if (basetype != &ulong_ctype)
637 sm_error("'%%pG%c' expects argument of type 'unsigned long *', argument %d has type '%s'",
638 fmt[1], vaidx, type_to_str(type));
639 break;
640 case 'g':
641 typedef_lookup(&gfp);
642 if (basetype != gfp.sym)
643 sm_error("'%%pGg' expects argument of type 'gfp_t *', argument %d has type '%s'",
644 vaidx, type_to_str(type));
645 break;
646 default:
647 sm_error("'%%pG' must be followed by one of [gpv]");
648 }
649 }
650
651 static void device_node_string(const char *fmt, struct symbol *type, struct symbol *basetype, int vaidx)
652 {
653 if (fmt[1] != 'F') {
654 sm_error("%%pO can only be followed by 'F'");
655 return;
656 }
657 if (!is_struct_tag(basetype, "device_node"))
658 sm_error("'%%pOF' expects argument of type 'struct device_node*', argument %d has type '%s'",
659 vaidx, type_to_str(type));
660 }
661
662 static void
663 pointer(const char *fmt, struct expression *arg, int vaidx)
664 {
665 struct symbol *type, *basetype;
666
667 type = get_type(arg);
668 if (!type) {
669 sm_warning("could not determine type of argument %d", vaidx);
670 return;
671 }
672 if (!is_ptr_type(type)) {
673 sm_error("%%p expects pointer argument, but argument %d has type '%s'",
674 vaidx, type_to_str(type));
675 return;
676 }
677
678 /* error pointers */
679 if (*fmt == 'e')
680 fmt++;
681
682
683 /* Just plain %p, nothing to check. */
684 if (!isalnum(*fmt))
685 return;
686
687 basetype = get_real_base_type(type);
688 if (is_void_type(basetype))
689 return;
690 /*
691 * Passing a pointer-to-array is harmless, but most likely one
692 * meant to pass pointer-to-first-element. If basetype is
693 * array type, we issue a notice and "dereference" the types
694 * once more.
695 */
696 if (basetype->type == SYM_ARRAY) {
697 spam("note: passing pointer-to-array; is the address-of redundant?");
698 type = basetype;
699 basetype = get_real_base_type(type);
700 }
701
702 /*
703 * We pass both the type and the basetype to the helpers. If,
704 * for example, the pointer is really a decayed array which is
705 * passed to %pI4, we might want to check that it is in fact
706 * an array of four bytes. But most are probably only
707 * interested in whether the basetype makes sense. Also, the
708 * pointer may carry some annotation such as __user which
709 * might be worth checking in the handlers which actually
710 * dereference the pointer.
711 */
712
713 switch (*fmt) {
714 case 'b':
715 case 'F':
716 case 'f':
717 case 'S':
718 case 's':
719 case 'B':
720 /* Can we do anything sensible? Check that the arg is a function pointer, for example? */
721 break;
722
723 case 'R':
724 case 'r':
725 resource_string(fmt, type, basetype, vaidx);
726 break;
727 case 'M':
728 case 'm':
729 mac_address_string(fmt, type, basetype, vaidx);
730 break;
731 case 'I':
732 case 'i':
733 switch (fmt[1]) {
734 case '4':
735 ip4(fmt, type, basetype, vaidx);
736 break;
737 case '6':
738 ip6(fmt, type, basetype, vaidx);
739 break;
740 case 'S':
741 ipS(fmt, type, basetype, vaidx);
742 break;
743 default:
744 sm_warning("'%%p%c' must be followed by one of [46S]", fmt[0]);
745 break;
746 }
747 break;
748 /*
749 * %pE and %ph can handle any valid pointer. We still check
750 * whether all the subsequent alphanumerics are valid for the
751 * particular %pX conversion.
752 */
753 case 'E':
754 escaped_string(fmt, type, basetype, vaidx);
755 break;
756 case 'h':
757 hex_string(fmt, type, basetype, vaidx);
758 break;
759 case 'U': /* TODO */
760 break;
761 case 'V':
762 va_format(fmt, type, basetype, vaidx);
763 break;
764 case 'K': /* TODO */
765 break;
766 case 'N':
767 netdev_feature(fmt, type, basetype, vaidx);
768 break;
769 case 'a':
770 address_val(fmt, type, basetype, vaidx);
771 break;
772 case 'D':
773 case 'd':
774 dentry_file(fmt, type, basetype, vaidx);
775 break;
776 case 't':
777 time_and_date(fmt, type, basetype, vaidx);
778 break;
779 case 'C':
780 check_clock(fmt, type, basetype, vaidx);
781 break;
782 case 'g':
783 block_device(fmt, type, basetype, vaidx);
784 break;
785 case 'G':
786 flag_string(fmt, type, basetype, vaidx);
787 break;
788 case 'O':
789 device_node_string(fmt, type, basetype, vaidx);
790 break;
791 case 'x':
792 /* 'x' is for an unhashed pointer */
793 break;
794 default:
795 sm_error("unrecognized %%p extension '%c', treated as normal %%p", *fmt);
796 }
797 }
798
799 /*
800 * A common error is to pass a "char" or "signed char" to %02x (or
801 * %.2X or some other variant). This can actually be a security
802 * problem, because a lot of code expects this to produce exactly two
803 * characters of output. Unfortunately this also produces false
804 * positives, since we're sometimes in arch-specific code on an arch
805 * where char is always unsigned.
806 */
807 static void
808 hexbyte(const char *fmt, int fmt_len, struct expression *arg, int vaidx, struct printf_spec spec)
809 {
810 struct symbol *type;
811
812 /*
813 * For now, just check the most common and obvious, which is
814 * roughly %[.0]2[xX].
815 */
816 if (spec.field_width != 2 && spec.precision != 2)
817 return;
818 if (spec.base != 16)
819 return;
820
821 type = get_type(arg);
822 if (!type) {
823 sm_warning("could not determine type of argument %d", vaidx);
824 return;
825 }
826 if (type == &char_ctype || type == &schar_ctype)
827 sm_warning("argument %d to %.*s specifier has type '%s'",
828 vaidx, fmt_len, fmt, type_to_str(type));
829 }
830
831 static int
832 check_format_string(const char *fmt, const char *caller)
833 {
834 const char *f;
835
836 for (f = fmt; *f; ++f) {
837 unsigned char c = *f;
838 switch (c) {
839 case KERN_SOH_ASCII:
840 /*
841 * This typically arises from bad conversion
842 * to pr_*, e.g. pr_warn(KERN_WARNING "something").
843 */
844 if (f != fmt)
845 sm_warning("KERN_* level not at start of string");
846 /*
847 * In a very few cases, the level is actually
848 * computed and passed via %c, as in KERN_SOH
849 * "%c...". printk explicitly supports
850 * this.
851 */
852 if (!(('0' <= f[1] && f[1] <= '7') ||
853 f[1] == 'd' || /* KERN_DEFAULT */
854 f[1] == 'c' || /* KERN_CONT */
855 (f[1] == '%' && f[2] == 'c')))
856 sm_warning("invalid KERN_* level: KERN_SOH_ASCII followed by '\\x%02x'", (unsigned char)f[1]);
857 break;
858 case '\t':
859 case '\n':
860 case '\r':
861 case 0x20 ... 0x7e:
862 break;
863 case 0x80 ... 0xff:
864 sm_warning("format string contains non-ascii character '\\x%02x'", c);
865 break;
866 case 0x08:
867 if (f == fmt)
868 break;
869 /* fall through */
870 default:
871 sm_warning("format string contains unusual character '\\x%02x'", c);
872 break;
873 }
874 }
875
876 f = strstr(fmt, caller);
877 if (f && strstr(f+1, caller))
878 sm_warning("format string contains name of enclosing function '%s' twice", caller);
879
880 return f != NULL;
881 }
882
883 static int arg_is___func__(struct expression *arg)
884 {
885 if (arg->type != EXPR_SYMBOL)
886 return 0;
887 return !strcmp(arg->symbol_name->name, "__func__") ||
888 !strcmp(arg->symbol_name->name, "__FUNCTION__") ||
889 !strcmp(arg->symbol_name->name, "__PRETTY_FUNCTION__");
890 }
891 static int arg_contains_caller(struct expression *arg, const char *caller)
892 {
893 if (arg->type != EXPR_STRING)
894 return 0;
895 return strstr(arg->string->data, caller) != NULL;
896 }
897
898 static int is_array_of_const_char(struct symbol *sym)
899 {
900 struct symbol *base = sym->ctype.base_type;
901 if (base->type != SYM_ARRAY)
902 return 0;
903 if (!(base->ctype.modifiers & MOD_CONST))
904 return 0;
905 if (!is_char_type(base->ctype.base_type)) {
906 spam("weird: format argument is array of const '%s'", type_to_str(base->ctype.base_type));
907 return 0;
908 }
909 return 1;
910 }
911
912 static int is_const_pointer_to_const_char(struct symbol *sym)
913 {
914 struct symbol *base = sym->ctype.base_type;
915 if (!(sym->ctype.modifiers & MOD_CONST))
916 return 0;
917 if (base->type != SYM_PTR)
918 return 0;
919 if (!(base->ctype.modifiers & MOD_CONST))
920 return 0;
921 if (!is_char_type(base->ctype.base_type)) {
922 spam("weird: format argument is pointer to const '%s'", type_to_str(base->ctype.base_type));
923 return 0;
924 }
925 return 1;
926 }
927
928 static int unknown_format(struct expression *expr)
929 {
930 struct state_list *slist;
931
932 slist = get_strings(expr);
933 if (!slist)
934 return 1;
935 if (slist_has_state(slist, &undefined))
936 return 1;
937 free_slist(&slist);
938 return 0;
939 }
940
941 static bool has_hex_prefix(const char *orig_fmt, const char *old_fmt)
942 {
943 return old_fmt >= orig_fmt + 2 &&
944 old_fmt[-2] == '0' && _tolower(old_fmt[-1]) == 'x';
945 }
946
947 static bool is_integer_specifier(int type)
948 {
949 switch (type) {
950 case FORMAT_TYPE_LONG_LONG:
951 case FORMAT_TYPE_ULONG:
952 case FORMAT_TYPE_LONG:
953 case FORMAT_TYPE_UBYTE:
954 case FORMAT_TYPE_BYTE:
955 case FORMAT_TYPE_USHORT:
956 case FORMAT_TYPE_SHORT:
957 case FORMAT_TYPE_UINT:
958 case FORMAT_TYPE_INT:
959 case FORMAT_TYPE_SIZE_T:
960 case FORMAT_TYPE_PTRDIFF:
961 return true;
962 default:
963 return false;
964 }
965 }
966
967 static int
968 is_cast_expr(struct expression *expr)
969 {
970 if (!expr)
971 return 0;
972
973 switch (expr->type) {
974 case EXPR_CAST:
975 case EXPR_FORCE_CAST:
976 /* not EXPR_IMPLIED_CAST for our purposes */
977 return 1;
978 default:
979 return 0;
980 }
981 }
982
983 static void
984 check_cast_from_pointer(const char *fmt, int len, struct expression *arg, int va_idx)
985 {
986 /*
987 * This can easily be fooled by passing 0+(long)ptr or doing
988 * "long local_var = (long)ptr" and passing local_var to
989 * %lx. Tough.
990 */
991 if (!is_cast_expr(arg))
992 return;
993 while (is_cast_expr(arg))
994 arg = arg->cast_expression;
995 if (is_ptr_type(get_final_type(arg)))
996 sm_warning("argument %d to %.*s specifier is cast from pointer",
997 va_idx, len, fmt);
998 }
999
1000 static void
1001 do_check_printf_call(const char *caller, const char *name, struct expression *callexpr, struct expression *fmtexpr, int vaidx)
1002 {
1003 struct printf_spec spec = {0};
1004 const char *fmt, *orig_fmt;
1005 int caller_in_fmt;
1006
1007 fmtexpr = strip_parens(fmtexpr);
1008 if (fmtexpr->type == EXPR_CONDITIONAL) {
1009 do_check_printf_call(caller, name, callexpr, fmtexpr->cond_true ? : fmtexpr->conditional, vaidx);
1010 do_check_printf_call(caller, name, callexpr, fmtexpr->cond_false, vaidx);
1011 return;
1012 }
1013 if (fmtexpr->type == EXPR_SYMBOL) {
1014 /*
1015 * If the symbol has an initializer, we can handle
1016 *
1017 * const char foo[] = "abc"; and
1018 * const char * const foo = "abc";
1019 *
1020 * We simply replace fmtexpr with the initializer
1021 * expression. If foo is not one of the above, or if
1022 * the initializer expression is somehow not a string
1023 * literal, fmtexpr->type != EXPR_STRING will trigger
1024 * below and we'll spam+return.
1025 */
1026 struct symbol *sym = fmtexpr->symbol;
1027 if (sym && sym->initializer &&
1028 (is_array_of_const_char(sym) ||
1029 is_const_pointer_to_const_char(sym))) {
1030 fmtexpr = strip_parens(sym->initializer);
1031 }
1032 }
1033
1034 if (fmtexpr->type != EXPR_STRING) {
1035 if (!unknown_format(fmtexpr))
1036 return;
1037 /*
1038 * Since we're now handling both ?: and static const
1039 * char[] arguments, we don't get as much noise. It's
1040 * still spammy, though.
1041 */
1042 spam("warn: call of '%s' with non-constant format argument", name);
1043 return;
1044 }
1045
1046 orig_fmt = fmt = fmtexpr->string->data;
1047 caller_in_fmt = check_format_string(fmt, caller);
1048
1049 while (*fmt) {
1050 const char *old_fmt = fmt;
1051 int read = format_decode(fmt, &spec);
1052 struct expression *arg;
1053
1054 fmt += read;
1055 if (spec.type == FORMAT_TYPE_NONE ||
1056 spec.type == FORMAT_TYPE_PERCENT_CHAR)
1057 continue;
1058
1059 /*
1060 * vaidx is currently the correct 0-based index for
1061 * get_argument_from_call_expr. We post-increment it
1062 * here so that it is the correct 1-based index for
1063 * all the handlers below. This of course requires
1064 * that we handle all FORMAT_TYPE_* things not taking
1065 * an argument above.
1066 */
1067 arg = get_argument_from_call_expr(callexpr->args, vaidx++);
1068
1069 if (spec.flags & SPECIAL && has_hex_prefix(orig_fmt, old_fmt))
1070 sm_warning("'%.2s' prefix is redundant when # flag is used", old_fmt-2);
1071 if (is_integer_specifier(spec.type)) {
1072 if (spec.base != 16 && has_hex_prefix(orig_fmt, old_fmt))
1073 sm_warning("'%.2s' prefix is confusing together with '%.*s' specifier",
1074 old_fmt-2, (int)(fmt-old_fmt), old_fmt);
1075
1076 check_cast_from_pointer(old_fmt, read, arg, vaidx);
1077 }
1078
1079 switch (spec.type) {
1080 /* case FORMAT_TYPE_NONE: */
1081 /* case FORMAT_TYPE_PERCENT_CHAR: */
1082 /* break; */
1083
1084 case FORMAT_TYPE_INVALID:
1085 sm_error("format specifier '%.*s' invalid", read, old_fmt);
1086 return;
1087
1088 case FORMAT_TYPE_FLOAT:
1089 sm_error("no floats in the kernel; invalid format specifier '%.*s'", read, old_fmt);
1090 return;
1091
1092 case FORMAT_TYPE_NRCHARS:
1093 sm_error("%%n not supported in kernel");
1094 return;
1095
1096 case FORMAT_TYPE_WIDTH:
1097 case FORMAT_TYPE_PRECISION:
1098 /* check int argument */
1099 break;
1100
1101 case FORMAT_TYPE_STR:
1102 /*
1103 * If the format string already contains the
1104 * function name, it probably doesn't make
1105 * sense to pass __func__ as well (or rather
1106 * vice versa: If pr_fmt(fmt) has been defined
1107 * to '"%s: " fmt, __func__', it doesn't make
1108 * sense to use a format string containing the
1109 * function name).
1110 *
1111 * This produces a lot of hits. They are not
1112 * false positives, but it is easier to handle
1113 * the things which don't occur that often
1114 * first, so we use spam().
1115 */
1116 if (caller_in_fmt) {
1117 if (arg_is___func__(arg))
1118 spam("warn: passing __func__ while the format string already contains the name of the function '%s'",
1119 caller);
1120 else if (arg_contains_caller(arg, caller))
1121 sm_warning("passing string constant '%s' containing '%s' which is already part of the format string",
1122 arg->string->data, caller);
1123 }
1124 break;
1125
1126 case FORMAT_TYPE_PTR:
1127 /* This is the most important part: Checking %p extensions. */
1128 pointer(fmt, arg, vaidx);
1129 while (isalnum(*fmt))
1130 fmt++;
1131 break;
1132
1133 case FORMAT_TYPE_CHAR:
1134
1135 case FORMAT_TYPE_UBYTE:
1136 case FORMAT_TYPE_BYTE:
1137 case FORMAT_TYPE_USHORT:
1138 case FORMAT_TYPE_SHORT:
1139 case FORMAT_TYPE_INT:
1140 /* argument should have integer type of width <= sizeof(int) */
1141 break;
1142
1143 case FORMAT_TYPE_UINT:
1144 hexbyte(old_fmt, fmt-old_fmt, arg, vaidx, spec);
1145 case FORMAT_TYPE_LONG:
1146 case FORMAT_TYPE_ULONG:
1147 case FORMAT_TYPE_LONG_LONG:
1148 case FORMAT_TYPE_PTRDIFF:
1149 case FORMAT_TYPE_SIZE_T:
1150 break;
1151 }
1152
1153
1154 }
1155
1156 if (get_argument_from_call_expr(callexpr->args, vaidx))
1157 sm_warning("excess argument passed to '%s'", name);
1158
1159
1160 }
1161
1162 static void
1163 check_printf_call(const char *name, struct expression *callexpr, void *_info)
1164 {
1165 /*
1166 * Note: attribute(printf) uses 1-based indexing, but
1167 * get_argument_from_call_expr() uses 0-based indexing.
1168 */
1169 int info = PTR_INT(_info);
1170 int fmtidx = (info & 0xff) - 1;
1171 int vaidx = ((info >> 8) & 0xff) - 1;
1172 struct expression *fmtexpr;
1173 const char *caller = get_function();
1174
1175 if (!caller)
1176 return;
1177
1178 /*
1179 * Calling a v*printf function with a literal format arg is
1180 * extremely rare, so we don't bother doing the only checking
1181 * we could do, namely checking that the format string is
1182 * valid.
1183 */
1184 if (vaidx < 0)
1185 return;
1186
1187 /*
1188 * For the things we use the name of the calling function for,
1189 * it is more appropriate to skip a potential SyS_ prefix; the
1190 * same goes for leading underscores.
1191 */
1192 if (!strncmp(caller, "SyS_", 4))
1193 caller += 4;
1194 while (*caller == '_')
1195 ++caller;
1196
1197 /* Lack of format argument is a bug. */
1198 fmtexpr = get_argument_from_call_expr(callexpr->args, fmtidx);
1199 if (!fmtexpr) {
1200 sm_error("call of '%s' with no format argument", name);
1201 return;
1202 }
1203
1204 do_check_printf_call(caller, name, callexpr, fmtexpr, vaidx);
1205 }
1206
1207
1208 void check_kernel_printf(int id)
1209 {
1210 if (option_project != PROJ_KERNEL)
1211 return;
1212
1213 my_id = id;
1214
1215 #define printf_hook(func, fmt, first_to_check) \
1216 add_function_hook(#func, check_printf_call, INT_PTR(fmt + (first_to_check << 8)))
1217
1218 /* Extracted using stupid perl script. */
1219
1220 #if 0
1221 printf_hook(srm_printk, 1, 2); /* arch/alpha/include/asm/console.h */
1222 printf_hook(die_if_kernel, 1, 2); /* arch/frv/include/asm/bug.h */
1223 printf_hook(ia64_mca_printk, 1, 2); /* arch/ia64/include/asm/mca.h */
1224 printf_hook(nfprint, 1, 2); /* arch/m68k/include/asm/natfeat.h */
1225 printf_hook(gdbstub_printk, 1, 2); /* arch/mn10300/include/asm/gdb-stub.h */
1226 printf_hook(DBG, 1, 2); /* arch/powerpc/boot/ps3.c */
1227 printf_hook(printf, 1, 2); /* arch/powerpc/boot/stdio.h */
1228 printf_hook(udbg_printf, 1, 2); /* arch/powerpc/include/asm/udbg.h */
1229 printf_hook(__debug_sprintf_event, 3, 4); /* arch/s390/include/asm/debug.h */
1230 printf_hook(__debug_sprintf_exception, 3, 4); /* arch/s390/include/asm/debug.h */
1231 printf_hook(prom_printf, 1, 2); /* arch/sparc/include/asm/oplib_32.h */
1232
1233 printf_hook(fail, 1, 2); /* arch/x86/vdso/vdso2c.c */
1234 #endif
1235
1236 printf_hook(_ldm_printk, 3, 4); /* block/partitions/ldm.c */
1237 printf_hook(rbd_warn, 2, 3); /* drivers/block/rbd.c */
1238 printf_hook(fw_err, 2, 3); /* drivers/firewire/core.h */
1239 printf_hook(fw_notice, 2, 3); /* drivers/firewire/core.h */
1240 printf_hook(i915_error_printf, 2, 3); /* drivers/gpu/drm/i915/i915_drv.h */
1241 printf_hook(i915_handle_error, 3, 4); /* drivers/gpu/drm/i915/i915_drv.h */
1242 printf_hook(nv_printk_, 3, 4); /* drivers/gpu/drm/nouveau/core/include/core/printk.h */
1243 printf_hook(host1x_debug_output, 2, 3); /* drivers/gpu/host1x/debug.h */
1244 printf_hook(callc_debug, 2, 3); /* drivers/isdn/hisax/callc.c */
1245 printf_hook(link_debug, 3, 4); /* drivers/isdn/hisax/callc.c */
1246 printf_hook(HiSax_putstatus, 3, 4); /* drivers/isdn/hisax/hisax.h */
1247 printf_hook(VHiSax_putstatus, 3, 0); /* drivers/isdn/hisax/hisax.h */
1248 printf_hook(debugl1, 2, 3); /* drivers/isdn/hisax/isdnl1.h */
1249 printf_hook(l3m_debug, 2, 3); /* drivers/isdn/hisax/isdnl3.c */
1250 printf_hook(dout_debug, 2, 3); /* drivers/isdn/hisax/st5481_d.c */
1251 printf_hook(l1m_debug, 2, 3); /* drivers/isdn/hisax/st5481_d.c */
1252 printf_hook(bch_cache_set_error, 2, 3); /* drivers/md/bcache/bcache.h */
1253 printf_hook(_tda_printk, 4, 5); /* drivers/media/tuners/tda18271-priv.h */
1254 printf_hook(i40evf_debug_d, 3, 4); /* drivers/net/ethernet/intel/i40evf/i40e_osdep.h */
1255 printf_hook(en_print, 3, 4); /* drivers/net/ethernet/mellanox/mlx4/mlx4_en.h */
1256 printf_hook(_ath_dbg, 3, 4); /* drivers/net/wireless/ath/ath.h */
1257 printf_hook(ath_printk, 3, 4); /* drivers/net/wireless/ath/ath.h */
1258 printf_hook(ath10k_dbg, 3, 4); /* drivers/net/wireless/ath/ath10k/debug.h */
1259 printf_hook(ath10k_err, 2, 3); /* drivers/net/wireless/ath/ath10k/debug.h */
1260 printf_hook(ath10k_info, 2, 3); /* drivers/net/wireless/ath/ath10k/debug.h */
1261 printf_hook(ath10k_warn, 2, 3); /* drivers/net/wireless/ath/ath10k/debug.h */
1262 printf_hook(_ath5k_printk, 3, 4); /* drivers/net/wireless/ath/ath5k/ath5k.h */
1263 printf_hook(ATH5K_DBG, 3, 4); /* drivers/net/wireless/ath/ath5k/debug.h */
1264 printf_hook(ATH5K_DBG_UNLIMIT, 3, 4); /* drivers/net/wireless/ath/ath5k/debug.h */
1265 printf_hook(ath6kl_printk, 2, 3); /* drivers/net/wireless/ath/ath6kl/common.h */
1266 printf_hook(ath6kl_err, 1, 2); /* drivers/net/wireless/ath/ath6kl/debug.h */
1267 printf_hook(ath6kl_info, 1, 2); /* drivers/net/wireless/ath/ath6kl/debug.h */
1268 printf_hook(ath6kl_warn, 1, 2); /* drivers/net/wireless/ath/ath6kl/debug.h */
1269 printf_hook(wil_dbg_trace, 2, 3); /* drivers/net/wireless/ath/wil6210/wil6210.h */
1270 printf_hook(wil_err, 2, 3); /* drivers/net/wireless/ath/wil6210/wil6210.h */
1271 printf_hook(wil_err_ratelimited, 2, 3); /* drivers/net/wireless/ath/wil6210/wil6210.h */
1272 printf_hook(wil_info, 2, 3); /* drivers/net/wireless/ath/wil6210/wil6210.h */
1273 printf_hook(b43dbg, 2, 3); /* drivers/net/wireless/b43/b43.h */
1274 printf_hook(b43err, 2, 3); /* drivers/net/wireless/b43/b43.h */
1275 printf_hook(b43info, 2, 3); /* drivers/net/wireless/b43/b43.h */
1276 printf_hook(b43warn, 2, 3); /* drivers/net/wireless/b43/b43.h */
1277 printf_hook(b43legacydbg, 2, 3); /* drivers/net/wireless/b43legacy/b43legacy.h */
1278 printf_hook(b43legacyerr, 2, 3); /* drivers/net/wireless/b43legacy/b43legacy.h */
1279 printf_hook(b43legacyinfo, 2, 3); /* drivers/net/wireless/b43legacy/b43legacy.h */
1280 printf_hook(b43legacywarn, 2, 3); /* drivers/net/wireless/b43legacy/b43legacy.h */
1281 printf_hook(__brcmf_dbg, 3, 4); /* drivers/net/wireless/brcm80211/brcmfmac/debug.h */
1282 printf_hook(__brcmf_err, 2, 3); /* drivers/net/wireless/brcm80211/brcmfmac/debug.h */
1283 printf_hook(__brcms_crit, 2, 3); /* drivers/net/wireless/brcm80211/brcmsmac/debug.h */
1284 printf_hook(__brcms_dbg, 4, 5); /* drivers/net/wireless/brcm80211/brcmsmac/debug.h */
1285 printf_hook(__brcms_err, 2, 3); /* drivers/net/wireless/brcm80211/brcmsmac/debug.h */
1286 printf_hook(__brcms_info, 2, 3); /* drivers/net/wireless/brcm80211/brcmsmac/debug.h */
1287 printf_hook(__brcms_warn, 2, 3); /* drivers/net/wireless/brcm80211/brcmsmac/debug.h */
1288 printf_hook(brcmu_dbg_hex_dump, 3, 4); /* drivers/net/wireless/brcm80211/include/brcmu_utils.h */
1289 printf_hook(__iwl_crit, 2, 3); /* drivers/net/wireless/iwlwifi/iwl-debug.h */
1290 printf_hook(__iwl_dbg, 5, 6); /* drivers/net/wireless/iwlwifi/iwl-debug.h */
1291 printf_hook(__iwl_err, 4, 5); /* drivers/net/wireless/iwlwifi/iwl-debug.h */
1292 printf_hook(__iwl_info, 2, 3); /* drivers/net/wireless/iwlwifi/iwl-debug.h */
1293 printf_hook(__iwl_warn, 2, 3); /* drivers/net/wireless/iwlwifi/iwl-debug.h */
1294 printf_hook(rsi_dbg, 2, 3); /* drivers/net/wireless/rsi/rsi_main.h */
1295 printf_hook(RTPRINT, 4, 5); /* drivers/net/wireless/rtlwifi/debug.h */
1296 printf_hook(RT_ASSERT, 2, 3); /* drivers/net/wireless/rtlwifi/debug.h */
1297 printf_hook(RT_TRACE, 4, 5); /* drivers/net/wireless/rtlwifi/debug.h */
1298 printf_hook(__of_node_dup, 2, 3); /* drivers/of/of_private.h */
1299 printf_hook(BNX2FC_HBA_DBG, 2, 3); /* drivers/scsi/bnx2fc/bnx2fc_debug.h */
1300 printf_hook(BNX2FC_IO_DBG, 2, 3); /* drivers/scsi/bnx2fc/bnx2fc_debug.h */
1301 printf_hook(BNX2FC_TGT_DBG, 2, 3); /* drivers/scsi/bnx2fc/bnx2fc_debug.h */
1302 printf_hook(ql_dbg, 4, 5); /* drivers/scsi/qla2xxx/qla_dbg.h */
1303 printf_hook(ql_dbg_pci, 4, 5); /* drivers/scsi/qla2xxx/qla_dbg.h */
1304 printf_hook(ql_log, 4, 5); /* drivers/scsi/qla2xxx/qla_dbg.h */
1305 printf_hook(ql_log_pci, 4, 5); /* drivers/scsi/qla2xxx/qla_dbg.h */
1306 printf_hook(libcfs_debug_msg, 2, 3); /* drivers/staging/lustre/include/linux/libcfs/libcfs_debug.h */
1307 printf_hook(libcfs_debug_vmsg2, 4, 5); /* drivers/staging/lustre/include/linux/libcfs/libcfs_debug.h */
1308 printf_hook(_ldlm_lock_debug, 3, 4); /* drivers/staging/lustre/lustre/include/lustre_dlm.h */
1309 printf_hook(_debug_req, 3, 4); /* drivers/staging/lustre/lustre/include/lustre_net.h */
1310 printf_hook(iscsi_change_param_sprintf, 2, 3); /* drivers/target/iscsi/iscsi_target_login.c */
1311 printf_hook(dbg, 1, 2); /* drivers/tty/serial/samsung.c */
1312 printf_hook(_usb_stor_dbg, 2, 3); /* drivers/usb/storage/debug.h */
1313 printf_hook(usb_stor_dbg, 2, 3); /* drivers/usb/storage/debug.h */
1314 printf_hook(vringh_bad, 1, 2); /* drivers/vhost/vringh.c */
1315 printf_hook(__adfs_error, 3, 4); /* fs/adfs/adfs.h */
1316 printf_hook(affs_error, 3, 4); /* fs/affs/affs.h */
1317 printf_hook(affs_warning, 3, 4); /* fs/affs/affs.h */
1318 printf_hook(befs_debug, 2, 3); /* fs/befs/befs.h */
1319 printf_hook(befs_error, 2, 3); /* fs/befs/befs.h */
1320 printf_hook(befs_warning, 2, 3); /* fs/befs/befs.h */
1321 printf_hook(__btrfs_panic, 5, 6); /* fs/btrfs/ctree.h */
1322 printf_hook(__btrfs_std_error, 5, 6); /* fs/btrfs/ctree.h */
1323 printf_hook(btrfs_printk, 2, 3); /* fs/btrfs/ctree.h */
1324 printf_hook(cifs_vfs_err, 1, 2); /* fs/cifs/cifs_debug.h */
1325 printf_hook(__ecryptfs_printk, 1, 2); /* fs/ecryptfs/ecryptfs_kernel.h */
1326 printf_hook(ext2_error, 3, 4); /* fs/ext2/ext2.h */
1327 printf_hook(ext2_msg, 3, 4); /* fs/ext2/ext2.h */
1328 printf_hook(ext3_abort, 3, 4); /* fs/ext3/ext3.h */
1329 printf_hook(ext3_error, 3, 4); /* fs/ext3/ext3.h */
1330 printf_hook(ext3_msg, 3, 4); /* fs/ext3/ext3.h */
1331 printf_hook(ext3_warning, 3, 4); /* fs/ext3/ext3.h */
1332 printf_hook(__ext4_abort, 4, 5); /* fs/ext4/ext4.h */
1333 printf_hook(__ext4_error, 4, 5); /* fs/ext4/ext4.h */
1334 printf_hook(__ext4_error_file, 5, 6); /* fs/ext4/ext4.h */
1335 printf_hook(__ext4_error_inode, 5, 6); /* fs/ext4/ext4.h */
1336 printf_hook(__ext4_grp_locked_error, 7, 8); /* fs/ext4/ext4.h */
1337 printf_hook(__ext4_msg, 3, 4); /* fs/ext4/ext4.h */
1338 printf_hook(__ext4_warning, 4, 5); /* fs/ext4/ext4.h */
1339 printf_hook(f2fs_msg, 3, 4); /* fs/f2fs/f2fs.h */
1340 printf_hook(__fat_fs_error, 3, 4); /* fs/fat/fat.h */
1341 printf_hook(fat_msg, 3, 4); /* fs/fat/fat.h */
1342 printf_hook(gfs2_print_dbg, 2, 3); /* fs/gfs2/glock.h */
1343 printf_hook(gfs2_lm_withdraw, 2, 3); /* fs/gfs2/util.h */
1344 printf_hook(hpfs_error, 2, 3); /* fs/hpfs/hpfs_fn.h */
1345 printf_hook(jfs_error, 2, 3); /* fs/jfs/jfs_superblock.h */
1346 printf_hook(nilfs_error, 3, 4); /* fs/nilfs2/nilfs.h */
1347 printf_hook(nilfs_warning, 3, 4); /* fs/nilfs2/nilfs.h */
1348 printf_hook(__ntfs_debug, 4, 5); /* fs/ntfs/debug.h */
1349 printf_hook(__ntfs_error, 3, 4); /* fs/ntfs/debug.h */
1350 printf_hook(__ntfs_warning, 3, 4); /* fs/ntfs/debug.h */
1351 printf_hook(__ocfs2_abort, 3, 4); /* fs/ocfs2/super.h */
1352 printf_hook(__ocfs2_error, 3, 4); /* fs/ocfs2/super.h */
1353 printf_hook(_udf_err, 3, 4); /* fs/udf/udfdecl.h */
1354 printf_hook(_udf_warn, 3, 4); /* fs/udf/udfdecl.h */
1355 printf_hook(ufs_error, 3, 4); /* fs/ufs/ufs.h */
1356 printf_hook(ufs_panic, 3, 4); /* fs/ufs/ufs.h */
1357 printf_hook(ufs_warning, 3, 4); /* fs/ufs/ufs.h */
1358 printf_hook(xfs_alert, 2, 3); /* fs/xfs/xfs_message.h */
1359 printf_hook(xfs_alert_tag, 3, 4); /* fs/xfs/xfs_message.h */
1360 printf_hook(xfs_crit, 2, 3); /* fs/xfs/xfs_message.h */
1361 printf_hook(xfs_debug, 2, 3); /* fs/xfs/xfs_message.h */
1362 printf_hook(xfs_emerg, 2, 3); /* fs/xfs/xfs_message.h */
1363 printf_hook(xfs_err, 2, 3); /* fs/xfs/xfs_message.h */
1364 printf_hook(xfs_info, 2, 3); /* fs/xfs/xfs_message.h */
1365 printf_hook(xfs_notice, 2, 3); /* fs/xfs/xfs_message.h */
1366 printf_hook(xfs_warn, 2, 3); /* fs/xfs/xfs_message.h */
1367 printf_hook(warn_slowpath_fmt, 3, 4); /* include/asm-generic/bug.h */
1368 printf_hook(warn_slowpath_fmt_taint, 4, 5); /* include/asm-generic/bug.h */
1369 printf_hook(drm_err, 1, 2); /* include/drm/drmP.h */
1370 printf_hook(drm_ut_debug_printk, 2, 3); /* include/drm/drmP.h */
1371 printf_hook(__acpi_handle_debug, 3, 4); /* include/linux/acpi.h */
1372 printf_hook(acpi_handle_printk, 3, 4); /* include/linux/acpi.h */
1373 printf_hook(audit_log, 4, 5); /* include/linux/audit.h */
1374 printf_hook(audit_log_format, 2, 3); /* include/linux/audit.h */
1375 printf_hook(bdi_register, 3, 4); /* include/linux/backing-dev.h */
1376 printf_hook(__trace_note_message, 2, 3); /* include/linux/blktrace_api.h */
1377 printf_hook(_dev_info, 2, 3); /* include/linux/device.h */
1378 printf_hook(dev_alert, 2, 3); /* include/linux/device.h */
1379 printf_hook(dev_crit, 2, 3); /* include/linux/device.h */
1380 printf_hook(dev_emerg, 2, 3); /* include/linux/device.h */
1381 printf_hook(dev_err, 2, 3); /* include/linux/device.h */
1382 printf_hook(dev_notice, 2, 3); /* include/linux/device.h */
1383 printf_hook(dev_printk, 3, 4); /* include/linux/device.h */
1384 printf_hook(dev_printk_emit, 3, 4); /* include/linux/device.h */
1385 printf_hook(dev_set_name, 2, 3); /* include/linux/device.h */
1386 printf_hook(dev_vprintk_emit, 3, 0); /* include/linux/device.h */
1387 printf_hook(dev_warn, 2, 3); /* include/linux/device.h */
1388 printf_hook(device_create, 5, 6); /* include/linux/device.h */
1389 printf_hook(device_create_with_groups, 6, 7); /* include/linux/device.h */
1390 printf_hook(devm_kasprintf, 3, 4); /* include/linux/device.h */
1391 printf_hook(__dynamic_dev_dbg, 3, 4); /* include/linux/dynamic_debug.h */
1392 printf_hook(__dynamic_netdev_dbg, 3, 4); /* include/linux/dynamic_debug.h */
1393 printf_hook(__dynamic_pr_debug, 2, 3); /* include/linux/dynamic_debug.h */
1394 printf_hook(__simple_attr_check_format, 1, 2); /* include/linux/fs.h */
1395 printf_hook(fscache_init_cache, 3, 4); /* include/linux/fscache-cache.h */
1396 printf_hook(gameport_set_phys, 2, 3); /* include/linux/gameport.h */
1397 printf_hook(iio_trigger_alloc, 1, 2); /* include/linux/iio/trigger.h */
1398 printf_hook(__check_printsym_format, 1, 2); /* include/linux/kallsyms.h */
1399 printf_hook(kdb_printf, 1, 2); /* include/linux/kdb.h */
1400 printf_hook(vkdb_printf, 1, 0); /* include/linux/kdb.h */
1401 printf_hook(____trace_printk_check_format, 1, 2); /* include/linux/kernel.h */
1402 printf_hook(__trace_bprintk, 2, 3); /* include/linux/kernel.h */
1403 printf_hook(__trace_printk, 2, 3); /* include/linux/kernel.h */
1404 printf_hook(kasprintf, 2, 3); /* include/linux/kernel.h */
1405 printf_hook(panic, 1, 2); /* include/linux/kernel.h */
1406 printf_hook(scnprintf, 3, 4); /* include/linux/kernel.h */
1407 printf_hook(snprintf, 3, 4); /* include/linux/kernel.h */
1408 printf_hook(sprintf, 2, 3); /* include/linux/kernel.h */
1409 printf_hook(trace_printk, 1, 2); /* include/linux/kernel.h */
1410 printf_hook(vscnprintf, 3, 0); /* include/linux/kernel.h */
1411 printf_hook(vsnprintf, 3, 0); /* include/linux/kernel.h */
1412 printf_hook(vsprintf, 2, 0); /* include/linux/kernel.h */
1413 printf_hook(vmcoreinfo_append_str, 1, 2); /* include/linux/kexec.h */
1414 printf_hook(__request_module, 2, 3); /* include/linux/kmod.h */
1415 printf_hook(add_uevent_var, 2, 3); /* include/linux/kobject.h */
1416 printf_hook(kobject_add, 3, 4); /* include/linux/kobject.h */
1417 printf_hook(kobject_init_and_add, 4, 5); /* include/linux/kobject.h */
1418 printf_hook(kobject_set_name, 2, 3); /* include/linux/kobject.h */
1419 printf_hook(kthread_create_on_node, 4, 5); /* include/linux/kthread.h */
1420 printf_hook(__ata_ehi_push_desc, 2, 3); /* include/linux/libata.h */
1421 printf_hook(ata_dev_printk, 3, 4); /* include/linux/libata.h */
1422 printf_hook(ata_ehi_push_desc, 2, 3); /* include/linux/libata.h */
1423 printf_hook(ata_link_printk, 3, 4); /* include/linux/libata.h */
1424 printf_hook(ata_port_desc, 2, 3); /* include/linux/libata.h */
1425 printf_hook(ata_port_printk, 3, 4); /* include/linux/libata.h */
1426 printf_hook(warn_alloc_failed, 3, 4); /* include/linux/mm.h */
1427 printf_hook(mmiotrace_printk, 1, 2); /* include/linux/mmiotrace.h */
1428 printf_hook(netdev_alert, 2, 3); /* include/linux/netdevice.h */
1429 printf_hook(netdev_crit, 2, 3); /* include/linux/netdevice.h */
1430 printf_hook(netdev_emerg, 2, 3); /* include/linux/netdevice.h */
1431 printf_hook(netdev_err, 2, 3); /* include/linux/netdevice.h */
1432 printf_hook(netdev_info, 2, 3); /* include/linux/netdevice.h */
1433 printf_hook(netdev_notice, 2, 3); /* include/linux/netdevice.h */
1434 printf_hook(netdev_printk, 3, 4); /* include/linux/netdevice.h */
1435 printf_hook(netdev_warn, 2, 3); /* include/linux/netdevice.h */
1436 printf_hook(early_printk, 1, 2); /* include/linux/printk.h */
1437 printf_hook(no_printk, 1, 2); /* include/linux/printk.h */
1438 printf_hook(printk, 1, 2); /* include/linux/printk.h */
1439 printf_hook(printk_deferred, 1, 2); /* include/linux/printk.h */
1440 printf_hook(printk_emit, 5, 6); /* include/linux/printk.h */
1441 printf_hook(vprintk, 1, 0); /* include/linux/printk.h */
1442 printf_hook(vprintk_emit, 5, 0); /* include/linux/printk.h */
1443 printf_hook(__quota_error, 3, 4); /* include/linux/quotaops.h */
1444 printf_hook(seq_buf_printf, 2, 3); /* include/linux/seq_buf.h */
1445 printf_hook(seq_buf_vprintf, 2, 0); /* include/linux/seq_buf.h */
1446 printf_hook(seq_printf, 2, 3); /* include/linux/seq_file.h */
1447 printf_hook(seq_vprintf, 2, 0); /* include/linux/seq_file.h */
1448 printf_hook(bprintf, 3, 4); /* include/linux/string.h */
1449 printf_hook(trace_seq_printf, 2, 3); /* include/linux/trace_seq.h */
1450 printf_hook(trace_seq_vprintf, 2, 0); /* include/linux/trace_seq.h */
1451 printf_hook(__alloc_workqueue_key, 1, 6); /* include/linux/workqueue.h */
1452 printf_hook(set_worker_desc, 1, 2); /* include/linux/workqueue.h */
1453 printf_hook(_p9_debug, 3, 4); /* include/net/9p/9p.h */
1454 printf_hook(bt_err, 1, 2); /* include/net/bluetooth/bluetooth.h */
1455 printf_hook(bt_info, 1, 2); /* include/net/bluetooth/bluetooth.h */
1456 printf_hook(nf_ct_helper_log, 3, 4); /* include/net/netfilter/nf_conntrack_helper.h */
1457 printf_hook(nf_log_buf_add, 2, 3); /* include/net/netfilter/nf_log.h */
1458 printf_hook(nf_log_packet, 8, 9); /* include/net/netfilter/nf_log.h */
1459 printf_hook(SOCK_DEBUG, 2, 3); /* include/net/sock.h */
1460 printf_hook(__snd_printk, 4, 5); /* include/sound/core.h */
1461 printf_hook(_snd_printd, 2, 3); /* include/sound/core.h */
1462 printf_hook(snd_printd, 1, 2); /* include/sound/core.h */
1463 printf_hook(snd_printdd, 1, 2); /* include/sound/core.h */
1464 printf_hook(snd_iprintf, 2, 3); /* include/sound/info.h */
1465 printf_hook(snd_seq_create_kernel_client, 3, 4); /* include/sound/seq_kernel.h */
1466 printf_hook(xen_raw_printk, 1, 2); /* include/xen/hvc-console.h */
1467 printf_hook(xenbus_dev_error, 3, 4); /* include/xen/xenbus.h */
1468 printf_hook(xenbus_dev_fatal, 3, 4); /* include/xen/xenbus.h */
1469 printf_hook(xenbus_printf, 4, 5); /* include/xen/xenbus.h */
1470 printf_hook(xenbus_watch_pathfmt, 4, 5); /* include/xen/xenbus.h */
1471 printf_hook(batadv_fdebug_log, 2, 3); /* net/batman-adv/debugfs.c */
1472 printf_hook(_batadv_dbg, 4, 5); /* net/batman-adv/main.h */
1473 printf_hook(batadv_debug_log, 2, 3); /* net/batman-adv/main.h */
1474 printf_hook(__sdata_dbg, 2, 3); /* net/mac80211/debug.h */
1475 printf_hook(__sdata_err, 1, 2); /* net/mac80211/debug.h */
1476 printf_hook(__sdata_info, 1, 2); /* net/mac80211/debug.h */
1477 printf_hook(__wiphy_dbg, 3, 4); /* net/mac80211/debug.h */
1478 printf_hook(mac80211_format_buffer, 4, 5); /* net/mac80211/debugfs.h */
1479 printf_hook(__rds_conn_error, 2, 3); /* net/rds/rds.h */
1480 printf_hook(rdsdebug, 1, 2); /* net/rds/rds.h */
1481 printf_hook(printl, 1, 2); /* net/sctp/probe.c */
1482 printf_hook(svc_printk, 2, 3); /* net/sunrpc/svc.c */
1483 printf_hook(tomoyo_io_printf, 2, 3); /* security/tomoyo/common.c */
1484 printf_hook(tomoyo_supervisor, 2, 3); /* security/tomoyo/common.h */
1485 printf_hook(tomoyo_write_log, 2, 3); /* security/tomoyo/common.h */
1486 printf_hook(cmp_error, 2, 3); /* sound/firewire/cmp.c */
1487 }