linux-kernel - Re: smatch 1.53 released

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a63d67fe0906160754ub38679ag9493d5090a9ca0c0@mail.gmail.com>
Date:	Tue, 16 Jun 2009 16:54:15 +0200
From:	Dan Carpenter <error27@...il.com>
To:	Christian Kujau <lists@...dbynature.de>
Cc:	Andi Kleen <andi@...stfloor.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: smatch 1.53 released

On 6/9/09, Christian Kujau <lists@...dbynature.de> wrote:
> On Thu, 4 Jun 2009, Dan Carpenter wrote:
>>> Smatch is a source code checker for C.  Right now the focus is on
>>> checking
>>> for kernel bugs.
>
> Hm, smatch is pretty noisy. I'm getting hundreds of warnings and errors on
> a randconfig build: http://nerdbynature.de/bits/smatch/
>
> False positives or real issues?
>

If it´s not in drivers/ it´s a false positive.  Otherwise there is a
95% chance it is a false positive.  In an ideal world there would be
no bugs and no false positives.  But it´s easier to fix the bugs
smatch reports than to fix smatch so probably eventually it will be
100% false positives.

Quite a lot of the time, I don´t know the code well enough to say
whether a bug is a false positive or not.  Check the bits that you
care about.  The smatch output format is designed for vim.  "vim
filename.c +lineno"

If there was some way to get rid of the "field" messages that would
reduce the false positive count by 20.
kernel/trace/trace_functions_graph.c +808 print_graph_function(14)
error: dereferencing undefined:  'field'
I don´t see a heuristic to do that.

The rest are smatch bugs.  Code like:
foo->bar = NULL;
foo = frob();
foo->bar->baz = x;  // smatch thinks this is a bug since foo->bar was
set to NULL.

Sometimes running smatch with the --debug option can help to find
where smatch gets it wrong.  kchecker also takes the --debug option.

regards,
dan carpenter

> Thanks,
> Christian.
> --
> BOFH excuse #182:
>
> endothermal recalibration
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/