[analyzer][MallocChecker] Fix that kfree only takes a single argument

[Szelethus]

Summary

Exactly what it says on the tin!

https://www.kernel.org/doc/htmldocs/kernel-api/API-kfree.html

[balazske]

And the test file is corrected.

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

struct MemFunctionInfoTy {
   CallDescription CD_alloca{{"alloca"}, 1}, CD_win_alloca{{"_alloca"}, 1},
       CD_malloc{{"malloc"}, 1}, CD_BSD_malloc{{"malloc"}, 3},
       CD_free{{"free"}, 1}, CD_realloc{{"realloc"}, 2},
       CD_calloc{{"calloc"}, 2}, CD_valloc{{"valloc"}, 1},
       CD_reallocf{{"reallocf"}, 2}, CD_strndup{{"strndup"}, 2},
       CD_strdup{{"strdup"}, 1}, CD_win_strdup{{"_strdup"}, 1},
       CD_kmalloc{{"kmalloc"}, 2}, CD_if_nameindex{{"if_nameindex"}, 1},
       CD_if_freenameindex{{"if_freenameindex"}, 1}, CD_wcsdup{{"wcsdup"}, 1},
-      CD_win_wcsdup{{"_wcsdup"}, 1}, CD_kfree{{"kfree"}, 2},
+      CD_win_wcsdup{{"_wcsdup"}, 1}, CD_kfree{{"kfree"}, 1},
       CD_g_malloc{{"g_malloc"}, 1}, CD_g_malloc0{{"g_malloc0"}, 1},
       CD_g_realloc{{"g_realloc"}, 2}, CD_g_try_malloc{{"g_try_malloc"}, 1},
       CD_g_try_malloc0{{"g_try_malloc0"}, 1},
       CD_g_try_realloc{{"g_try_realloc"}, 2}, CD_g_free{{"g_free"}, 1},
       CD_g_memdup{{"g_memdup"}, 2}, CD_g_malloc_n{{"g_malloc_n"}, 2},
       CD_g_malloc0_n{{"g_malloc0_n"}, 2}, CD_g_realloc_n{{"g_realloc_n"}, 3},
       CD_g_try_malloc_n{{"g_try_malloc_n"}, 2},
       CD_g_try_malloc0_n{{"g_try_malloc0_n"}, 2},

clang/test/Analysis/kmalloc-linux.c

-// RUN: %clang_analyze_cc1 -triple x86_64-unknown-linux %s
+// RUN: %clang_analyze_cc1 -triple x86_64-unknown-linux %s -verify \
+// RUN:   -Wno-incompatible-library-redeclaration \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-checker=unix.Malloc
 
 #define __GFP_ZERO 0x8000
 #define NULL ((void *)0)
 
 typedef __typeof(sizeof(int)) size_t;
 
 void *kmalloc(size_t, int);
+void kfree(void *);
 
 struct test {
 };
 
 void foo(struct test *);
 
 void test_zeroed() {
   struct test **list, *t;
void test_indeterminate(int flags) {
   }
   kfree(list);
 }
 
 typedef unsigned long long uint64_t;
 
 struct malloc_type;
 
+// 3 parameter malloc:
+// https://www.freebsd.org/cgi/man.cgi?query=malloc&sektion=9
 void *malloc(unsigned long size, struct malloc_type *mtp, int flags);
 
 void test_3arg_malloc(struct malloc_type *mtp) {
   struct test **list, *t;
   int i;
 
   list = malloc(sizeof(*list) * 10, mtp, __GFP_ZERO);
   if (list == NULL)
void test_3arg_malloc_nonzero(struct malloc_type *mtp) {
   }
   kfree(list);
 }
 
 void test_3arg_malloc_indeterminate(struct malloc_type *mtp, int flags) {
   struct test **list, *t;
   int i;
 
-  list = alloc(sizeof(*list) * 10, mtp, flags);
+  list = malloc(sizeof(*list) * 10, mtp, flags);
   if (list == NULL)
     return;
 
   for (i = 0; i < 10; i++) {
     t = list[i]; // expected-warning{{undefined}}
     foo(t);
   }
   kfree(list);
 }
+
+void test_3arg_malloc_leak(struct malloc_type *mtp, int flags) {
+  struct test **list;
+
+  list = malloc(sizeof(*list) * 10, mtp, flags);
+  if (list == NULL)
+    return;
+} // expected-warning{{Potential leak of memory pointed to by 'list'}}