Bug Summary

File:build/../torch/csrc/autograd/python_hook.cpp
Warning:line 105, column 22
PyObject ownership leak with reference count of 1

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name python_hook.cpp -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -analyzer-output=html -analyzer-checker=python -analyzer-disable-checker=deadcode -analyzer-config prune-paths=true,suppress-c++-stdlib=true,suppress-inlined-defensive-checks=false,suppress-null-return-paths=false,crosscheck-with-z3=true,model-path=/opt/pyrefcon/lib/pyrefcon/models/models -analyzer-config experimental-enable-naive-ctu-analysis=true,ctu-dir=/tmp/pyrefcon/pytorch/csa-scan,ctu-index-name=/tmp/pyrefcon/pytorch/csa-scan/externalDefMap.txt,ctu-invocation-list=/tmp/pyrefcon/pytorch/csa-scan/invocations.yaml,display-ctu-progress=false -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=none -relaxed-aliasing -fno-rounding-math -ffp-exception-behavior=ignore -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/tmp/pyrefcon/pytorch/build -resource-dir /opt/pyrefcon/lib/clang/13.0.0 -isystem third_party/gloo -isystem ../cmake/../third_party/gloo -isystem ../cmake/../third_party/googletest/googlemock/include -isystem ../cmake/../third_party/googletest/googletest/include -isystem ../third_party/protobuf/src -isystem ../third_party/gemmlowp -isystem ../third_party/neon2sse -isystem ../third_party/XNNPACK/include -isystem ../third_party -isystem ../cmake/../third_party/eigen -isystem /opt/pyrefcon/lib/pyrefcon/models/python3.8 -isystem /usr/lib/python3/dist-packages/numpy/core/include -isystem ../cmake/../third_party/pybind11/include -isystem /usr/lib/x86_64-linux-gnu/openmpi/include/openmpi -isystem /usr/lib/x86_64-linux-gnu/openmpi/include -isystem ../third_party/ideep/mkl-dnn/include -isystem ../third_party/ideep/include -D BUILDING_TESTS -D FMT_HEADER_ONLY=1 -D HAVE_MALLOC_USABLE_SIZE=1 -D HAVE_MMAP=1 -D HAVE_SHM_OPEN=1 -D HAVE_SHM_UNLINK=1 -D MINIZ_DISABLE_ZIP_READER_CRC32_CHECKS -D ONNXIFI_ENABLE_EXT=1 -D ONNX_ML=1 -D ONNX_NAMESPACE=onnx_torch -D THP_BUILD_MAIN_LIB -D USE_C10D -D USE_C10D_GLOO -D USE_C10D_MPI -D USE_DISTRIBUTED -D USE_EXTERNAL_MZCRC -D USE_NUMPY -D USE_RPC -D USE_TENSORPIPE -D USE_VALGRIND -D _FILE_OFFSET_BITS=64 -D torch_python_EXPORTS -I aten/src -I ../aten/src -I . -I ../ -I ../cmake/../third_party/benchmark/include -I caffe2/contrib/aten -I ../third_party/onnx -I third_party/onnx -I ../third_party/foxi -I third_party/foxi -I ../torch/.. -I ../torch/../aten/src -I ../torch/../aten/src/TH -I caffe2/aten/src -I third_party -I ../torch/../third_party/valgrind-headers -I ../torch/../third_party/gloo -I ../torch/../third_party/onnx -I ../torch/csrc -I ../torch/csrc/api/include -I ../torch/lib -I ../torch/lib/libshm -I ../torch/csrc/distributed -I ../torch/csrc/api -I ../c10/.. -I third_party/ideep/mkl-dnn/include -I ../third_party/ideep/mkl-dnn/src/../include -I ../torch/lib/libshm/../../../torch/lib -I ../third_party/fmt/include -D USE_PTHREADPOOL -D NDEBUG -D USE_KINETO -D LIBKINETO_NOCUPTI -D USE_FBGEMM -D USE_QNNPACK -D USE_PYTORCH_QNNPACK -D USE_XNNPACK -D SYMBOLICATE_MOBILE_DEBUG_HANDLE -D HAVE_AVX_CPU_DEFINITION -D HAVE_AVX2_CPU_DEFINITION -D NDEBUG -D NDEBUG -D CAFFE2_USE_GLOO -D HAVE_GCC_GET_CPUID -D USE_AVX -D USE_AVX2 -D TH_HAVE_THREAD -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/x86_64-linux-gnu/c++/10 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/backward -internal-isystem /opt/pyrefcon/lib/clang/13.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -Wno-narrowing -Wall -Wextra -Werror=return-type -Wno-missing-field-initializers -Wno-type-limits -Wno-array-bounds -Wno-unknown-pragmas -Wno-sign-compare -Wno-unused-parameter -Wno-unused-variable -Wno-unused-function -Wno-unused-result -Wno-unused-local-typedefs -Wno-strict-overflow -Wno-strict-aliasing -Wno-error=deprecated-declarations -Wno-stringop-overflow -Wno-psabi -Wno-error=pedantic -Wno-error=redundant-decls -Wno-error=old-style-cast -Wno-unused-but-set-variable -Wno-maybe-uninitialized -Werror=format -Werror=cast-function-type -Wno-stringop-overflow -Wno-write-strings -Wno-strict-aliasing -w -std=gnu++14 -fdeprecated-macro -fdebug-compilation-dir=/tmp/pyrefcon/pytorch/build -ferror-limit 19 -fvisibility-inlines-hidden -fopenmp -fopenmp-cuda-parallel-target-regions -pthread -fgnuc-version=4.2.1 -fcxx-exceptions -fexceptions -faligned-allocation -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/pyrefcon/pytorch/csa-scan/reports -x c++ ../torch/csrc/autograd/python_hook.cpp

../torch/csrc/autograd/python_hook.cpp

→
1#include <torch/csrc/autograd/python_hook.h>
2
3#include <c10/util/irange.h>
4#include <pybind11/pybind11.h>
5#include <torch/csrc/THP.h>
6#include <torch/csrc/autograd/python_variable.h>
7#include <torch/csrc/utils/object_ptr.h>
8#include <torch/csrc/utils/python_strings.h>
9#include <torch/csrc/Exceptions.h>
10
11#include <sstream>
12
13using torch::autograd::variable_list;
14using torch::autograd::Variable;
15
16static PyObject* wrap_variables(const variable_list& c_variables);
17static variable_list unwrap_variables(PyObject* py_variables);
18static std::string hook_name(PyObject* hook);
19static void check_result(PyObject* original, PyObject* result, PyObject* hook);
20static void check_single_result(PyObject* original, PyObject* result, PyObject* hook);
21
22
23namespace torch { namespace autograd {
24
25PyFunctionPreHook::PyFunctionPreHook(PyObject* dict, int value_idx)
26 : dict(dict)
27 , value_idx(value_idx)
28{
29 Py_INCREF(dict)_Py_INCREF(((PyObject*)(dict)));
30}
31
32PyFunctionPreHook::~PyFunctionPreHook() {
33 // If python is already dead, leak the wrapped python objects
34 if (Py_IsInitialized()) {
35 pybind11::gil_scoped_acquire gil;
36 Py_DECREF(dict)_Py_DECREF(((PyObject*)(dict)));
37 }
38}
39
40auto PyFunctionPreHook::operator()(const variable_list& values) -> variable_list
41{
42 pybind11::gil_scoped_acquire gil;
43
44 THPObjectPtr value(THPVariable_Wrap(values.at(value_idx)));
45 if (!value) throw python_error();
46
47 // NOLINTNEXTLINE(cppcoreguidelines-init-variables)
48 PyObject *key, *hook;
49 Py_ssize_t pos = 0;
50 while (PyDict_Next(dict, &pos, &key, &hook)) {
51 THPObjectPtr res(PyObject_CallFunctionObjArgs(hook, value.get(), nullptr));
52 if (!res) throw python_error();
53 if (res == Py_None(&_Py_NoneStruct)) continue;
54 check_single_result(value.get(), res.get(), hook);
55 value = std::move(res);
56 }
57
58 variable_list results(values);
59 if (value != Py_None(&_Py_NoneStruct)) results[value_idx] = THPVariable_Unpack(value.get());
60 return results;
61}
62
63PyFunctionPostHook::PyFunctionPostHook(PyObject* dict) : dict(dict) {
64 Py_INCREF(dict)_Py_INCREF(((PyObject*)(dict)));
65}
66
67PyFunctionPostHook::~PyFunctionPostHook() {
68 // If python is already dead, leak the wrapped python objects
69 if (Py_IsInitialized()) {
70 pybind11::gil_scoped_acquire gil;
71 Py_DECREF(dict)_Py_DECREF(((PyObject*)(dict)));
72 }
73}
74
75auto PyFunctionPostHook::operator()(
76 const variable_list& _outputs, /* grad_inputs */
77 const variable_list& _inputs /* grad_outputs */) -> variable_list
78{
79 pybind11::gil_scoped_acquire gil;
80
81 THPObjectPtr outputs(wrap_variables(_outputs));
1
Calling 'wrap_variables'
→
82 THPObjectPtr inputs(wrap_variables(_inputs));
83
84 // NOLINTNEXTLINE(cppcoreguidelines-init-variables)
85 PyObject *key, *hook;
86 Py_ssize_t pos = 0;
87 while (PyDict_Next(dict, &pos, &key, &hook)) {
88 THPObjectPtr res(PyObject_CallFunctionObjArgs(
89 hook, outputs.get(), inputs.get(), nullptr));
90 if (!res) throw python_error();
91 if (res == Py_None(&_Py_NoneStruct)) continue;
92 check_result(outputs, res, hook);
93 outputs = std::move(res);
94 }
95
96 return unwrap_variables(outputs.get());
97}
98
99}} // namespace torch::autograd
100
101
102static PyObject *wrap_variables(const variable_list& c_variables)
103{
104 size_t num_vars = c_variables.size();
105 THPObjectPtr tuple(PyTuple_New(num_vars));
2
←
Calling 'PyTuple_New'
→
4
←
Returning from 'PyTuple_New'
→
9
←
PyObject ownership leak with reference count of 1
106 if (!tuple) throw python_error();
5
←
Assuming the condition is false
→
6
←
Taking false branch
→
107 for (const auto i : c10::irange(num_vars)) {
108 THPObjectPtr var(THPVariable_Wrap(c_variables[i]));
109 if (!var) throw python_error();
7
←
Assuming the condition is true
→
8
←
Taking true branch
→
110 PyTuple_SET_ITEM(tuple.get(), i, var.release())PyTuple_SetItem(tuple.get(), i, var.release());
111 }
112 return tuple.release();
113}
114
115static variable_list unwrap_variables(PyObject* py_variables) {
116 variable_list results(PyTuple_GET_SIZE(py_variables)(((PyVarObject*)(((PyTupleObject *)(py_variables))))->ob_size
));
117 for(const auto i : c10::irange(results.size())) {
118 PyObject* item = PyTuple_GET_ITEM(py_variables, i)(((PyTupleObject *)(py_variables))->ob_item[i]);
119 if (item == Py_None(&_Py_NoneStruct)) {
120 continue;
121 } else if (THPVariable_Check(item)) {
122 results[i] = THPVariable_Unpack(item);
123 } else {
124 // this should never happen, but just in case...
125 std::stringstream ss;
126 ss << "expected variable but got " << Py_TYPE(item)(((PyObject*)(item))->ob_type)->tp_name;
127 throw std::runtime_error(ss.str());
128 }
129 }
130 return results;
131}
132
133static void check_result(PyObject* prev, PyObject* result, PyObject* hook) {
134 if (!PyTuple_Check(result)((((((PyObject*)(result))->ob_type))->tp_flags & ((
1UL << 26))) != 0)) {
135 PyErr_Format(PyExc_TypeError, "expected tuple, but hook returned '%s'",
136 THPUtils_typename(result)((((PyObject*)(result))->ob_type)->tp_name));
137 throw python_error();
138 }
139
140 auto prev_size = PyTuple_GET_SIZE(prev)(((PyVarObject*)(((PyTupleObject *)(prev))))->ob_size);
141 auto result_size = PyTuple_GET_SIZE(result)(((PyVarObject*)(((PyTupleObject *)(result))))->ob_size);
142 if (prev_size != result_size) {
143 std::stringstream ss;
144 auto name = hook_name(hook);
145 ss << "hook '" << name << "' has returned an incorrect number ";
146 ss << "of values (got " << result_size << ", but expected ";
147 ss << prev_size << ")";
148 throw std::runtime_error(ss.str());
149 }
150
151 for (const auto i : c10::irange(prev_size)) {
152 check_single_result(PyTuple_GET_ITEM(prev, i)(((PyTupleObject *)(prev))->ob_item[i]), PyTuple_GET_ITEM(result, i)(((PyTupleObject *)(result))->ob_item[i]), hook);
153 }
154}
155
156static void check_single_result(PyObject* _original, PyObject* _result, PyObject* hook) {
157 if (_result == Py_None(&_Py_NoneStruct)) return;
158
159 if (_original == Py_None(&_Py_NoneStruct)) {
160 throw std::runtime_error("can't replace a None gradient with a non-None value");
161 }
162
163 if (!PyObject_IsInstance(_result, THPVariableClass)) {
164 PyErr_Format(PyExc_TypeError, "expected Variable, but hook returned '%s'",
165 THPUtils_typename(_result)((((PyObject*)(_result))->ob_type)->tp_name));
166 throw python_error();
167 }
168
169 const auto& original = THPVariable_Unpack(_original);
170 const auto& result = THPVariable_Unpack(_result);
171
172 torch::autograd::check_variable_result(original, result, hook_name(hook));
173}
174
175static std::string hook_name(PyObject* hook) {
176 if (PyObject_HasAttrString(hook, "__name__")) {
177 THPObjectPtr name(PyObject_GetAttrString(hook, "__name__"));
178 if (!name) throw python_error();
179
180 if (name && THPUtils_checkString(name.get())) {
181 return THPUtils_unpackString(name.get());
182 }
183 }
184 return "<unknown>";
185}
←

/opt/pyrefcon/lib/pyrefcon/models/models/PyTuple_New.model

1#ifndef PyTuple_New
2struct _object;
3typedef struct _object PyObject;
4PyObject* clang_analyzer_PyObject_New_Reference();
5PyObject* PyTuple_New(Py_ssize_t len) {
6 return clang_analyzer_PyObject_New_Reference();
3
←
Setting reference count to 1
→
7}
8#else
9#warning "API PyTuple_New is defined as a macro."
10#endif