smatch

---

Timeline

Timeline

2026-05-21

init

This article introduces Smatch, a static analysis tool designed specifically for the Linux kernel, capable of deeply tracing code execution paths to uncover deep-seated defects such as null pointer dereferences, lock usage errors, and resource leaks. The article details Smatch's compilation method, database construction process, and its cross-file vulnerability detection capabilities, and provides script parameters and output file descriptions for running Smatch to check the entire kernel or specified files/folders. It also mentions the analysis approach for out-of-tree modules and the configuration of the smatch_data rules directory.

---

Smatch is a static analysis tool designed specifically for the Linux kernel. It can deeply trace code execution paths and uncover deeply hidden bugs, such as null pointer dereferences, lock usage errors, and resource leaks. Reference documentation:

smatch

https://github.com/error27/smatch/blob/master/Documentation/smatch.rst

Compile smatch

# Install dependencies
sudo apt-get install sqlite3 libsqlite3-dev libdbd-sqlite3-perl
# Compile smatch
cd ~/repository/linux/
wget https://github.com/error27/smatch/archive/refs/tags/1.74.tar.gz -O smatch-1.74.tar.gz
cd smatch-1.74
make -j$(nproc)

kernel

Smatch essentially goes through the kernel build system, so it must be able to correctly find the compiler and header files. Therefore, if cross-compilation is needed, you must set the environment variables first.

export ARCH=arm64
export CROSS_COMPILE=aarch64-none-linux-gnu-

Analyze and build the database

cd ~/repository/linux/linux-5.10.256

# Compile Linux
make defconfig
make -j$(nproc) Image

# Static analysis and build the database
~/repository/linux/smatch-1.74/smatch_scripts/build_kernel_data.sh

build_kernel_data.shwill append--call-tree,--info,--spammy,--data=$DATA_DIRparameter callsmatch_scripts/test_kernel.sh, then invokesmatch_data/db/create_db.shBuild the smatch database

Smatch does not strictly require building a database, but the database makes it more powerful. Once the overall database is built, on the next compilation Smatch can know by looking up tables: ‘how many times the printk function has been called across the entire kernel’, ‘whether a certain structure pointer has been freed in other C files’, thereby achieving epic cross-file vulnerability detection.

Run smatch to perform static analysis on the kernel: run smatch to check the entire kernel

~/repository/linux/smatch-1.74/smatch_scripts/test_kernel.sh --data="$HOME/repository/linux/smatch-1.74/smatch_data"

Script parameters

• --endian: Enable big-endian/little-endian byte order checking.
• --target "bzImage": Specify the build target (default is bzImage modules).
• --log smatch_compile.warns: Specify the build log output file
• --wlog smatch_warns.txt: Customize the output file name for Smatch warnings.

After compilation is complete, two files will be generated in the current directory:

• smatch_compile.warns: Complete kernel build log (including errors and warnings).
• smatch_warns.txt: Pure Smatch static check warning messages.

You can also check only the code under a specific file or folder

~/repository/linux/smatch-1.74/smatch_scripts/kchecker drivers/rpmsg/rpmsg_core.c
~/repository/linux/smatch-1.74/smatch_scripts/kchecker drivers/rpmsg/

The smatch author recommends updating the smatch database frequently, because with each update, cross-function checks become more accurate.

~/repository/linux/smatch-1.74/smatch_data/db/create_db.sh -p=kernel smatch_warns.txt

At runtime, smatch reads some rules set in smatch_data. In~/repository/linux/smatch-1.74/smatch.cinstatic char *get_data_dir(char *arg0)The function has related logic: you can pass--data=/path/to/smatch_datato specify the data directory.

out-of-tree module

For non-kernel projects, use the following method to build the database and analyze

export ARCH=arm64
export CROSS_COMPILE=aarch64-none-linux-gnu-

make -C ~/repository/linux/linux-5.10.256 \
     M=$PWD \
     -j$(nproc) \
     CHECK="$HOME/repository/linux/smatch-1.74/smatch -p=kernel --file-output --succeed --call-tree --info --spammy --data=$HOME/repository/linux/smatch-1.74/smatch_data" \
     C=2

~/repository/linux/smatch-1.74/smatch_data/db/create_db.sh -p=kernel hello_world.c.smatch

make -C ~/repository/linux/linux-5.10.256 \
     M=$PWD \
     -j$(nproc) \
     CHECK="$HOME/repository/linux/smatch-1.74/smatch -p=kernel --succeed --data=$HOME/repository/linux/smatch-1.74/smatch_data" \
     C=2

• --file-outputOutput one result per file
• --succeedIndicates to continue analysis even if errors occur
• --call-treeIndicates enabling cross-function call analysis
• --infoIndicates more detailed analysis logs
• --spammyIndicates more aggressive checks

When the --file-output parameter is used, smatch by default does not print warnings directly to the terminal’s stdout/stderr, but instead generates a bunch of hidden text files in the same directory as your code:

• .hello_world.c.smatch(regular warnings)
• .hello_world.c.smatch.caller_info(if you added parameters like --info)
  Static check analysis

References

[1]

Automatic detection Linux Wrong tool - Static section

[2]

Kernel Testing Guide