Clang-Tidy is a linter from the LLVM ecosystem. I wanted to try to run it on the Linux kernel to see what kind of bugs it would find. The false positive rate seems pretty high (a persistent bane to static analysis), but some patching in both the tooling and the source can likely help bring this rate down.
The most straightforward way to invoke Clang-Tidy is with a compilation database, which is a json based file that for each translation unit records
- The source file of the translation unit.
- The top level directory of the source.
- The exact arguments passed to the compiler.
The exact arguments are required because
-I flags are necessary to
reproduce the exact Abstract Syntax Tree (AST) used to compile your code. Given
a compilation database, it’s trivial to parse and recreate a build. For the
kernel’s KBuild, it’s a lot like encoding the output of
With BEAR installed, we can invoke the kernel’s build with
bear make -j. When
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Now with Clang-Tidy (probably worthwhile to build from source, but it’s also
apt), we want to grab
this helper script, run-clang-tidy.py
to help analyze all this code.
Then we can run it from the same directory as compile_commands.json:
1 2 3
This took about 1hr12min on my box. Let’s see what the damage is:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
Looking through the output, there’s seems to be almost nothing but false positives, but who knows, maybe there’s an actual bug or two in there. Likely possible patches to LLVM, its checkers, or the Linux kernel could lower the false positive ratio.
If you’re interested in seeing the kinds of warnings/outputs, I’ve uploaded my
results run on a 4.12-rc3 based kernel that may or may not have been compiled
with Clang to
my clang_tidy branch of the kernel on GitHub.
As in my sorted output, I find it handy to
warning:. Maybe you can
find yourself a good first bug to
contribute a fix to the kernel?
There’s likely also some checks that make sense to disable or enable. Clang-Tidy also allows you to write and use your own checkers. Who knows, someone may just end up writing static analyses tailored to the Linux kernel.