[PATCH 0/4] fix build warnings on gcc-16 and glibc-2.43

[PATCH 0/4] fix build warnings on gcc-16 and glibc-2.43

[Arka Mondal]

Smatch builds with 14 warnings on gcc-16 and glibc-2.43.  This fixes 12.
Only the last patch changes behavior: it returns instead of storing a
truncated name.

Six of these are new. glibc-2.43 returns const from strchr() and strstr()
on const strings, and gcc-15 defaults to -std=gnu23 which enables it.

Two are left.  assume_indexes_are_valid() is unused because its add_hook()
call is commented out.

The other is in smatch_kernel_user_data.c:

      if (param_data_treat_untagged(value) || sym->ctype.as == 5)

ctype.as is a struct ident pointer, so this is never true.  It has never
worked: ctype.as became an ident in 69fce9f7 (Dec 2018), this code in 5f2fcd8a (Oct
2019).  Revive the check or delete the condition?

Arka Mondal (4):
  smatch: use const pointers for strchr() and strstr() results
  smatch: delete unused variables
  untracked_param: fix a -Wwrite-strings warning
  comparison: silence a -Wformat-truncation warning

 check_implicit_dependencies.c |  6 +++---
 check_unwind.c                |  2 +-
 smatch_comparison.c           |  6 ++++--
 smatch_db.c                   |  2 +-
 smatch_fn_arg_link.c          |  3 ---
 smatch_function_hooks.c       | 17 +++++++++--------
 smatch_kernel.c               |  2 +-
 smatch_math.c                 |  2 --
 smatch_param_key.c            |  2 +-
 smatch_untracked_param.c      |  2 +-
 10 files changed, 21 insertions(+), 23 deletions(-)

-- 
2.55.0

[PATCH 1/4] smatch: use const pointers for strchr() and strstr() results

[Arka Mondal]

glibc-2.43 returns a const pointer from strchr() and strstr() when the
string is const.  Nothing writes through these so declare them const.
In get_arg_from_ret_string() it needed a second variable.

Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com>
---
 check_unwind.c          |  2 +-
 smatch_db.c             |  2 +-
 smatch_function_hooks.c | 17 +++++++++--------
 smatch_kernel.c         |  2 +-
 smatch_param_key.c      |  2 +-
 5 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/check_unwind.c b/check_unwind.c
index dcede91f..ef6f8897 100644
--- a/check_unwind.c
+++ b/check_unwind.c
@@ -170,7 +170,7 @@ static void mark_partial_matches_as_undefined(const char *key)
 {
 	struct sm_state *sm;
 	int start_pos, state_len, key_len;
-	char *p;
+	const char *p;
 
 	while ((p = strchr(key, '-'))) {
 		if (p[1] != '>')
diff --git a/smatch_db.c b/smatch_db.c
index 2d6989c7..b3ba25be 100644
--- a/smatch_db.c
+++ b/smatch_db.c
@@ -1854,7 +1854,7 @@ static bool handle_forced_split(const char *return_ranges, struct expression *ex
 	struct range_list *rl;
 	static bool recurse;
 	char buf[64];
-	char *math;
+	const char *math;
 	sval_t sval;
 	bool undo;
 	int i;
diff --git a/smatch_function_hooks.c b/smatch_function_hooks.c
index 9782015f..7299eac4 100644
--- a/smatch_function_hooks.c
+++ b/smatch_function_hooks.c
@@ -855,20 +855,21 @@ static struct expression *get_arg_from_ret_string(struct expression *call, const
 {
 	struct expression *arg, *tmp;
 	char *str;
+	const char *p;
 	char buf[64];
 	int param;
 
-	str = strchr(ret_string, '[');
-	if (!str)
+	p = strchr(ret_string, '[');
+	if (!p)
 		return NULL;
-	str++;
-	if (strncmp(str, "== ", 3) == 0)
-		str += 3;
+	p++;
+	if (strncmp(p, "== ", 3) == 0)
+		p += 3;
 
-	if (str[0] != '$' || !isdigit(str[1]))
+	if (p[0] != '$' || !isdigit(p[1]))
 		return NULL;
 
-	param = atoi(str + 1);
+	param = atoi(p + 1);
 	arg = get_argument_from_call_expr(call->args, param);
 	if (!arg)
 		return NULL;
@@ -881,7 +882,7 @@ static struct expression *get_arg_from_ret_string(struct expression *call, const
 		arg = tmp;
 	}
 
-	snprintf(buf, sizeof(buf), "$%s", str + 2);
+	snprintf(buf, sizeof(buf), "$%s", p + 2);
 	str = strchr(buf, ']');
 	if (!str)
 		return NULL;
diff --git a/smatch_kernel.c b/smatch_kernel.c
index c78ef440..b5d169a1 100644
--- a/smatch_kernel.c
+++ b/smatch_kernel.c
@@ -573,7 +573,7 @@ static void match_kernel_param(struct symbol *sym)
 
 bool is_ignored_kernel_data(const char *name)
 {
-	char *p;
+	const char *p;
 
 	if (option_project != PROJ_KERNEL)
 		return false;
diff --git a/smatch_param_key.c b/smatch_param_key.c
index bafd499b..d1356e6e 100644
--- a/smatch_param_key.c
+++ b/smatch_param_key.c
@@ -273,7 +273,7 @@ struct expression *map_netdev_priv_to_simpler_expr_key(struct expression *expr,
 	struct expression *priv;
 	char buf[64];
 	int diff;
-	char *p;
+	const char *p;
 
 	priv = get_netdev_priv(expr);
 	if (!priv)
-- 
2.55.0

[PATCH 2/4] smatch: delete unused variables

[Arka Mondal]

These are left over from earlier changes.

Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com>
---
 check_implicit_dependencies.c | 6 +++---
 smatch_fn_arg_link.c          | 3 ---
 smatch_math.c                 | 2 --
 3 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/check_implicit_dependencies.c b/check_implicit_dependencies.c
index 70bec2de..c7213dc6 100644
--- a/check_implicit_dependencies.c
+++ b/check_implicit_dependencies.c
@@ -247,21 +247,21 @@ static void match_condition(struct expression *expr)
 static void match_call_info(struct expression *expr)
 {
 	struct expression *arg;
-	int i;
+	// int i;
 
 	if (!__inline_fn || !cur_syscall)
 		return;
 
 	// prefix(); printf("fn: %s\n", expr->fn->symbol->ident->name);
 
-	i = 0;
+	// i = 0;
 	FOR_EACH_PTR(expr->args, arg) {
 		/*
 		   if (arg->type == EXPR_DEREF)
 		   printf("arg %d is deref\n", i);
 		 */
 		print_read_member_type(arg);
-		i++;
+		// i++;
 	} END_FOR_EACH_PTR(arg);
 }
 
diff --git a/smatch_fn_arg_link.c b/smatch_fn_arg_link.c
index daff38c4..41f69153 100644
--- a/smatch_fn_arg_link.c
+++ b/smatch_fn_arg_link.c
@@ -102,7 +102,6 @@ static int print_call_is_linked(struct expression *call)
 	struct expression *arg;
 	struct symbol *fn_sym;
 	struct symbol *arg_sym = NULL;
-	int i;
 
 	fn = strip_expr(call->fn);
 	tmp = get_assigned_expr(fn);
@@ -115,9 +114,7 @@ static int print_call_is_linked(struct expression *call)
 	if (!fn_sym)
 		return 0;
 
-	i = -1;
 	FOR_EACH_PTR(call->args, arg) {
-		i++;
 		tmp = get_assigned_expr(arg);
 		if (tmp)
 			arg = tmp;
diff --git a/smatch_math.c b/smatch_math.c
index 4dce8f87..e39d481a 100644
--- a/smatch_math.c
+++ b/smatch_math.c
@@ -172,7 +172,6 @@ static bool handle_array_address(struct expression *expr, int implied, int *recu
 
 static bool handle_address_member_offset(struct expression *expr, struct symbol *type, int implied, int *recurse_cnt, struct range_list **res, sval_t *res_sval)
 {
-	struct expression *orig = expr;
 	struct range_list *outer_rl;
 	sval_t offset = { .type = &ulong_ctype, .value = 0};
 	mtag_t tag;
@@ -230,7 +229,6 @@ static bool handle_address_member_offset(struct expression *expr, struct symbol
 
 static bool handle_ampersand_address(struct expression *expr, int implied, int *recurse_cnt, struct range_list **res, sval_t *res_sval)
 {
-	struct expression *orig = expr;
 	struct symbol *type;
 
 	/*
-- 
2.55.0

[PATCH 3/4] untracked_param: fix a -Wwrite-strings warning

[Arka Mondal]

mark_untracked() is used as a callback so the prototype can't change.
Cast it instead.

Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com>
---
 smatch_untracked_param.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/smatch_untracked_param.c b/smatch_untracked_param.c
index a84889ca..ed32f149 100644
--- a/smatch_untracked_param.c
+++ b/smatch_untracked_param.c
@@ -136,7 +136,7 @@ void mark_call_params_untracked(struct expression *call)
 	int i = 0;
 
 	FOR_EACH_PTR(call->args, arg) {
-		mark_untracked(call, i++, "$", NULL);
+		mark_untracked(call, i++, (char *)"$", NULL);
 	} END_FOR_EACH_PTR(arg);
 }
 
-- 
2.55.0

[PATCH 4/4] comparison: silence a -Wformat-truncation warning

[Arka Mondal]

The names can be up to 128 characters each so they don't always fit.
Check for truncation instead of storing a truncated name.

Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com>
---
 smatch_comparison.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/smatch_comparison.c b/smatch_comparison.c
index c1af79f0..1a408fb8 100644
--- a/smatch_comparison.c
+++ b/smatch_comparison.c
@@ -2638,7 +2638,7 @@ void select_caller_info(const char *name, struct symbol *sym, char *value)
 	struct symbol *right_sym;
 	char comparison_name[128];
 	char right_buf[128];
-	int op, right_param;
+	int op, right_param, cnt;
 
 	if (!split_op_param_key(value, &op, &right_param, &right_key))
 		return;
@@ -2669,7 +2669,9 @@ void select_caller_info(const char *name, struct symbol *sym, char *value)
 	add_var_sym(&left_vsl, name, sym);
 	add_var_sym(&right_vsl, right_name, right_sym);
 
-	snprintf(comparison_name, sizeof(comparison_name), "%s vs %s", name, right_name);
+	cnt = snprintf(comparison_name, sizeof(comparison_name), "%s vs %s", name, right_name);
+	if (cnt >= sizeof(comparison_name))
+		return;
 
 	set_state(comparison_id, comparison_name, NULL,
 		  alloc_compare_state(NULL, name, left_vsl,
-- 
2.55.0

Re: [PATCH 0/4] fix build warnings on gcc-16 and glibc-2.43

[Dan Carpenter]

Thanks,  I applied this to the devel branch of Smatch.

https://github.com/error27/smatch/tree/devel

On Fri, Aug 14, 2026 at 04:09:50PM +0900, Arka Mondal wrote:
> Smatch builds with 14 warnings on gcc-16 and glibc-2.43.  This fixes 12.
> Only the last patch changes behavior: it returns instead of storing a
> truncated name.
> 
> Six of these are new. glibc-2.43 returns const from strchr() and strstr()
> on const strings, and gcc-15 defaults to -std=gnu23 which enables it.
> 
> Two are left.  assume_indexes_are_valid() is unused because its add_hook()
> call is commented out.
> 
> The other is in smatch_kernel_user_data.c:
> 
>       if (param_data_treat_untagged(value) || sym->ctype.as == 5)
> 
> ctype.as is a struct ident pointer, so this is never true.  It has never
> worked: ctype.as became an ident in 69fce9f7 (Dec 2018), this code in 5f2fcd8a (Oct
> 2019).  Revive the check or delete the condition?

I didn't write that code and I did ask about it but I'm not sure what
was intended really...  I've deleted it, since it hopefully can't
possibly be true...  I'll push that later.

(I worry that there is an reason for that weird condition.  Perhaps it
was a hack around for memory corruption or something. :P  But surely all
those ancient bugs have been replaced with new bugs by now).

regards,
dan carpenter