linux-kernel - Smatch 1.74 released

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <aXHh6Mu2HT8NpKjb@stanley.mountain>
Date: Thu, 22 Jan 2026 11:38:00 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: smatch@...r.kernel.org
Cc: linux-kernel@...r.kernel.org, Philip Li <philip.li@...el.com>,
	lkp@...el.com
Subject: Smatch 1.74 released

A lot of people have been asking for a new release of Smatch because the
v1.73 release was from 2022 and it complicates creating distro packages.

There have been quite a few of improvements, but the main thing recently
is that I've been turning off warnings by default so that the zero day
bot can send emails without my filtering them.

I haven't been sending Spectre v1 warnings for some time.  These are
places where we should add array_index_nospec().  It still an issue but
I've never felt like I've understood the issue well enough to triage
these.  If anyone would like to help triage these warnigns I could
probably improve the warning a lot.  (Does anyone have contacts at
Intel or AMD?)

The other warning that I disabled was about uninitialized variables.  This
check is pretty good, but it requires cross function analysis and the zero
day bot doesn't do that.  For example, we often have loops:

	for (i = 0; i < parameter_limit; i++) {

Without cross function analysis we have to consider that parameter_limit
could be zero or even negative.  The other things about uninitialized
variables is that Clang does a pretty good job warning about these.

The zero day bot has a false positive with regards to "iterator not
incremented" warnings, but I've never been able to reproduce that despite
trying really hard so I disabled that as well.

I think most people use Smatch from git but if you're using a package
then there are lots of improvements in here.

$ git log --oneline 1.73..1.74 | wc -l
874

All good things.  :)

regards,
dan carpenter