smatch

---

Timeline

Timeline

2026-05-21

init

This article introduces Smatch, a static analysis tool specifically designed for the Linux kernel, detailing its compilation method, database construction process, and its ability to discover hidden bugs through cross-file analysis. Furthermore, this article summarizes the specific steps for running Smatch to perform static analysis on kernel and non-kernel projects, as well as the configuration methods for related script parameters.

---

Smatch is a static analysis tool specifically designed for the Linux kernel. It can deeply track code execution paths and discover deeply hidden bugs, such as null pointer dereferences, lock usage errors, and resource leaks. Reference documentation:

smatch

https://github.com/error27/smatch/blob/master/Documentation/smatch.rst

Compiling smatch

# Installing dependencies
sudo apt-get install sqlite3 libsqlite3-dev libdbd-sqlite3-perl
# Compiling smatch
cd ~/repository/linux/
wget https://github.com/error27/smatch/archive/refs/tags/1.74.tar.gz -O smatch-1.74.tar.gz
cd smatch-1.74
make -j$(nproc)

kernel

Smatch essentially goes through the kernel build system, so it must be able to correctly locate the compiler and header files. Therefore, if cross-compilation is required, environment variables must be set first.

export ARCH=arm64
export CROSS_COMPILE=aarch64-none-linux-gnu-

Analyzing and building the database

cd ~/repository/linux/linux-5.10.256

# Compiling Linux
make defconfig
make -j$(nproc) Image

# Static analysis and database construction
~/repository/linux/smatch-1.74/smatch_scripts/build_kernel_data.sh

build_kernel_data.shwill append--call-tree,--info,--spammy,--data=$DATA_DIRparameter callsmatch_scripts/test_kernel.sh, then callsmatch_data/db/create_db.shbuilding the smatch database

smatch does not strictly require building a database, but its functionality becomes more powerful once a database is built. Once the overall database is established, during the next compilation, Smatch can know by looking up the table: “how many times the printk function has been called throughout the kernel” and “whether a certain struct pointer has been freed in other C files,” thereby achieving epic cross-file vulnerability detection.

Running smatch for static analysis on the kernel: running smatch to check the entire kernel

~/repository/linux/smatch-1.74/smatch_scripts/test_kernel.sh --data="$HOME/repository/linux/smatch-1.74/smatch_data"

Script parameters

• --endian: Enables big-endian/little-endian byte order checking.
• --target "bzImage": Specifies the compilation target (default is bzImage modules).
• --log smatch_compile.warns: Specifies the compilation log output file
• --wlog smatch_warns.txt: Customizes the output filename for Smatch warnings.

After compilation is complete, two files will be generated in the current directory:

• smatch_compile.warns: Complete kernel compilation log (including errors and warnings).
• smatch_warns.txt: Pure Smatch static checking warning information.

You can also check only the code in a specific file or folder

~/repository/linux/smatch-1.74/smatch_scripts/kchecker drivers/rpmsg/rpmsg_core.c
~/repository/linux/smatch-1.74/smatch_scripts/kchecker drivers/rpmsg/

The smatch author recommends frequently updating the smatch database, because cross-function checks become more accurate with each update.

~/repository/linux/smatch-1.74/smatch_data/db/create_db.sh -p=kernel smatch_warns.txt

smatch reads some rules set in smatch_data at runtime. In~/repository/linux/smatch-1.74/smatch.cin thestatic char *get_data_dir(char *arg0)The function has related logic: you can pass--data=/path/to/smatch_datato specify the data directory.

out-of-tree module

For non-kernel projects, use the following method to build the database and analyze

export ARCH=arm64
export CROSS_COMPILE=aarch64-none-linux-gnu-

make -C ~/repository/linux/linux-5.10.256 \
     M=$PWD \
     -j$(nproc) \
     CHECK="$HOME/repository/linux/smatch-1.74/smatch -p=kernel --file-output --succeed --call-tree --info --spammy --data=$HOME/repository/linux/smatch-1.74/smatch_data" \
     C=2

~/repository/linux/smatch-1.74/smatch_data/db/create_db.sh -p=kernel hello_world.c.smatch

make -C ~/repository/linux/linux-5.10.256 \
     M=$PWD \
     -j$(nproc) \
     CHECK="$HOME/repository/linux/smatch-1.74/smatch -p=kernel --succeed --data=$HOME/repository/linux/smatch-1.74/smatch_data" \
     C=2

• --file-outputoutput one result per file
• --succeedmeans continue analysis even if an error occurs
• --call-treemeans enable cross-function call analysis
• --infomeans more detailed analysis logs
• --spammymeans more aggressive checks

When the --file-output parameter is used, smatch will not print warnings directly to the terminal’s stdout/stderr by default, but will generate a bunch of hidden text files in the same directory as your code:

• .hello_world.c.smatch(regular warnings)
• .hello_world.c.smatch.caller_info(if you add parameters like --info)
  Static analysis

References

[1]

Automatic detection Linux Wrong tool - Static section

[2]

Kernel Testing Guide