Today I put up a page on the smatch.sf.net site to record bugs found by the smatch source checker. It's a pretty decent start. There are quite a few bugs listed so far.

The most fun script is the one that checks for UnreachedCode. These bugs are mostly harmless things like not printing out debug messages. This check shows that no matter how smart people are, the little things can still trip everyone up.

One thing that I expected to cause bugs was confusing "=" with "==". There are quite a few places where kernel hackers use "if (variable = variable){ ..." or "if (variable = constant) {..." (because of macros), but I didn't find any bugs.

I've already moderated most of the check results except SpinlockUndefined. Unfortunately because of a bug in smatch.pm, I couldn't print a start line for each bug so reading it is more difficult. The basic premise is that you should always know whether a lock is held or not.

spin_lock(&foo);
if (bar) {
        spin_unlock(&foo);
}
<--- Error because you don't know whether &foo is 
     held or not

From glancing through the results it looks like there are a lot of false positives. My guess is that there are probably only 10 real bugs out of the list of 100.