Re: Issue with Setting Up Sparse

[Dan Carpenter <dan.carpenter@linaro.org>]

On Wed, Mar 12, 2025 at 06:04:02PM +0400, Edgar Khachatryan wrote:
> My name is Edgar Khachatryan, and I am a student currently working on a
> project that involves static analysis using Sparse. I have encountered an
> issue where running Sparse with the command "sparse file.c" does not detect
> simple memory issues such as memory leaks, double frees, or use-after-free
> errors in a single file.

Sparse doesn't look for those kinds of bugs.  You're better off using
Smatch for that.

With Smatch, I've never really looked for memory leaks.  It's quite a
hard problem and I've never been able to do it in a useful way without
introducing a lot of false positives.

$ ./smatch test.c
test.c:4:18: warning: non-ANSI function declaration of function 'memory_leak'
test.c:13:18: warning: non-ANSI function declaration of function 'double_free'
test.c:23:21: warning: non-ANSI function declaration of function 'use_after_free'
test.c:33:10: warning: non-ANSI function declaration of function 'main'
test.c:20 double_free() error: double free of 'ptr'
test.c:30 use_after_free() error: dereferencing freed memory 'ptr'
$

But the other problem with Smatch is that it's only ever really used on
the kernel so user space support is proof of concept quality.  I had to
push a quick patch it to make it find the use after free bug.  I use
a different check for check_free_strict.c module for kernel code.
https://github.com/error27/smatch/commit/993d157ab147720b558f0f6293dd4acfeb0d2a18

regards,
dan carpenter