Re: Moving smatch to use sparse

["Jörn Engel" <joern@wohnheim.fh-wedel.de>]

On Thu, 5 October 2006 02:49:36 -0700, Dan Carpenter wrote:
> On 10/5/06, Sam Ravnborg <sam@ravnborg.org> wrote:
> >
> >For the mindless - can you please repeat what smatch does?
> 
> It's a static code checker.  Take a look at check_null_deref.c.
> 
> You've got a function called match_assign() that gets called for every
> assignment:
> 
>       name = get_variable_from_expr(expr->left, &sym);
>       name = alloc_string(name);
>       if (is_null(expr->right))
>               set_state(name, my_id, sym, ISNULL);
>       else
>               set_state(name, my_id, sym, NONNULL);
> 
> Say it encounter the code:  a = foo(), then it's going to set the
> state of 'a' to NONNULL;
> 
> Then say it encounters a call to tty_ldisc_deref(), it's going to
> check the state of 'a' and if it's ISNULL or UNDEFINED it's going to
> print a message out.
> 
> More often you have something like:
> a = NULL;
> if (b) {
>       a = foo();
> }
> a->x;  <---Error.  'a' is Undefined.
> 
> The idea is that it's easy to write checks once all the state tracking
> code is in place.
> 
> Use it like this:
> make C=1 CHECK=/path/to/smatch > warns.out 2>&1

One advantage over gcc or plain sparse is that code checking can be
done in two passes.  Pass one collects all sorts of information for
every compilation unit.  Pass two can then combine the information for
all compilation units and do global checking of some sort.

For example, the currently debated "may be used uninitialized" warning
in gcc is simply not able to detect something like:

foo.c:
	int foo;
	do_initialize(&foo);
	do_something(foo);
bar.c:
void do_initialize(int *bar)
{
	*bar = 0;
}

The code is 100% correct, but gcc only looks at foo.c and spits out a
warning.  Smatch can do better than that - if someone writes a
checker.

Jörn

-- 
But this is not to say that the main benefit of Linux and other GPL
software is lower-cost. Control is the main benefit--cost is secondary.
-- Bruce Perens