CPAchecker has won many awards in the International Competition on Software Verification (SV-COMP). The full list can be found here: https://cpachecker.sosy-lab.org/achieve.php
In 2014, the CPAchecker team received a Goedel medal at the Vienna Summer of Logic “for their contributions to the development of efficient verification methods and algorithms, for technology transfer by implementing the techniques in robust software systems, and for the successful participation of their verifiers in the last three years of SV-COMP.”
Note: If you have further bugs in real-world software that were found with CPAchecker, please report them here.
CPAchecker is used to verify Linux kernel drivers by the Linux Driver Verification project and Klever. The following fixes to the Linux kernel were all developed by LDV/Klever for bugs found with CPAchecker:
- 2021-10-02:
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structur... - 2021-10-02:
hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structu... - 2021-10-02:
hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structu... - 2021-09-16:
HID: amd_sfh: Fix potential NULL pointer dereference - 2021-08-26:
usb: musb: musb_dsps: request_irq() after initializing musb - 2021-08-26:
usb: dwc3: imx8mp: request irq after initializing dwc3 - 2021-08-26:
usb: ehci-orion: Handle errors of clk_prepare_enable() in probe - 2021-08-20:
HID: thrustmaster: Fix memory leak in thrustmaster_interrupts() - 2021-08-20:
HID: thrustmaster: Fix memory leak in remove - 2021-08-20:
HID: thrustmaster: Fix memory leaks in probe - 2021-08-18:
usb: gadget: mv_u3d: request_irq() after initializing UDC - 2021-08-17:
mtd: rawnand: intel: Fix error handling in probe - 2021-08-04:
media: tegra-cec: Handle errors of clk_prepare_enable() - 2021-07-22:
media: platform: stm32: unprepare clocks at handling errors in probe - 2021-07-21:
USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable() - 2021-06-17:
media: marvell-ccic: set error code in probe - 2021-06-08:
media: st_rc: Handle errors of clk_prepare_enable() - 2021-06-02:
media: st-hva: Fix potential NULL pointer dereferences - 2021-06-02:
media: v4l: cadence: Handle errors of clk_prepare_enable() - 2021-06-02:
media: v4l: cadence: Handle errors of clk_prepare_enable() - 2021-05-24:
net: appletalk: cops: Fix data race in cops_probe1 - 2021-03-10:
net: pxa168_eth: Fix a potential data race in pxa168_eth_remove - 2020-12-10:
mtd: plat-ram: correctly free memory on error path in platram_probe() - 2020-12-03:
media: s5p-jpeg: handle error condition in s5p_jpeg_probe - 2020-11-16:
media: isif: reset global state - 2020-11-16:
media: zr364xx: propagate errors from zr364xx_start_readpipe() - 2020-10-27:
usb: gadget: goku_udc: fix potential crashes in probe - 2020-10-14:
drivers: watchdog: rdc321x_wdt: Fix race condition bugs - 2020-09-30:
mtd: rawnand: vf610: disable clk on error handling path in probe - 2020-09-27:
media: dvb-frontends: rtl2832_sdr: set error code in probe - 2020-09-08:
fbdev: sm712fb: handle ioremap() errors in probe - 2020-09-07:
mmc: via-sdmmc: Fix data race bug - 2020-08-25:
drivers/dma/dma-jz4780: Fix race condition between probe and irq handler - 2020-08-23:
drm/brige/megachips: Add checking if ge_b850v3_lvds_init() is working correctly - 2020-08-21:
crypto: picoxcell - Fix potential race condition bug - 2020-08-18:
USB: lvtest: return proper error code in probe - 2020-08-06:
media: camss: fix memory leaks on error handling paths in probe - 2020-08-06:
media: davinci: vpif_capture: fix potential double free - 2020-07-24:
usb: gadget: net2280: fix memory leak on probe error handling paths - 2020-07-24:
usb: gadget: net2272: skip BAR1 on error handling paths in probe - 2020-07-19:
media: vpss: clean up resources in init - 2020-07-10:
fbdev: sm712fb: set error code in probe - 2020-07-10:
fbdev: da8xx-fb: go to proper label on error handling paths in probe - 2020-07-10:
video: fbdev: neofb: fix memory leak in neo_scan_monitor() - 2020-07-10:
video: fbdev: savage: fix memory leak on error handling path in probe - 2020-07-09:
usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init() - 2020-07-05:
hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow - 2020-07-04:
media: rc: return proper error code on error handling path in init - 2020-06-25:
staging: rts5208: fix memleaks on error handling paths in probe - 2020-06-25:
staging: kpc2000: kpc_dma: set error code in probe - 2020-06-04:
rapidio: avoid data race between file operation callbacks and mport_cdev_add(). - 2020-04-23:
drivers: char: tlclk.c: Avoid data race between init and interrupt handler - 2020-04-23:
dmaengine: pch_dma.c: Avoid data race between probe and irq handler - 2020-04-16:
usb: host: u132-hcd: Remove u132_static_list and list head u132_list - 2019-04-25:
mwl8k: fix error handling in mwl8k_post_cmd() - 2019-02-17:
net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() - 2019-02-01:
soc: qcom: gsbi: Fix error handling in gsbi_probe() - 2019-01-28:
usb: dwc3: exynos: Fix error handling of clk_prepare_enable - 2019-01-27:
net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup() - 2019-01-16:
media: tw9910: fix failure handling in tw9910_power_on() - 2018-12-20:
video: clps711x-fb: release disp device node in probe() - 2018-12-03:
media: DaVinci-VPBE: fix error handling in vpbe_initialize() - 2018-11-23:
media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm() - 2018-11-09:
mac80211_hwsim: fix module init error paths for netlink - 2018-10-22:
watchdog: ts4800: release syscon device node in ts4800_wdt_probe() - 2018-10-02:
staging: axis-fifo: add error handling of class_create() - 2018-09-22:
iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs() - 2018-09-18:
serial: mxs-auart: Fix potential infinite loop - 2018-09-17:
spi: pic32-sqi: remove unnecessary of_node_get() - 2018-09-07:
spi: pic32: remove unnecessary of_node_get() - 2018-08-31:
media: ov772x: Disable clk on error path - 2018-08-30:
clk: cdce925: release child device nodes - 2018-08-29:
gpio: dwapb: Fix error handling in dwapb_gpio_probe() - 2018-08-29:
usb: gadget: fotg210-udc: Fix memory leak of fotg210-> - 2018-08-10:
pinctrl: axp209: Fix NULL pointer dereference after allocation - 2018-08-10:
drm: qxl: Fix NULL pointer dereference at qxl_alloc_client_monitors_config - 2018-08-10:
drm: qxl: Fix error handling at qxl_device_init - 2018-08-02:
media: davinci: vpif_display: Mix memory leak on probe error path - 2018-08-02:
media: vimc: Remove redundant free - 2018-08-02:
media: dm1105: Limit number of cards to avoid buffer over read - 2018-08-02:
media: dw2102: Fix memleak on sequence of probes - 2018-08-02:
HID: intel_ish-hid: tx_buf memory leak on probe/remove - 2018-08-02:
misc: ti-st: Fix memory leak in the error path of probe() - 2018-08-02:
firmware: vpd: Fix section enabled flag on vpd_section_destroy - 2018-08-02:
tty: rocket: Fix possible buffer overwrite on register_PCI - 2018-07-30:
scsi: 3ware: fix return 0 on the error path of probe - 2018-07-30:
ASoC: tegra_alc5632: fix device_node refcounting - 2018-07-30:
can: ems_usb: Fix memory leak on ems_usb_disconnect() - 2018-07-30:
regulator: tps65217: Fix NULL pointer dereference on probe - 2018-07-29:
gpio: ml-ioh: Fix buffer underwrite on probe error path - 2018-07-28:
net: mdio-mux: bcm-iproc: fix wrong getter and setter pair - 2018-07-24:
video: goldfishfb: fix memory leak on driver remove - 2018-07-11:
sample: vfio-mdev: avoid deadlock in mdev_access() - 2018-07-06:
uwb: hwa-rc: fix memory leak at probe - 2018-07-04:
media: fsl-viu: fix error handling in viu_of_probe() - 2018-06-28:
power: reset: zx-reboot: put device node in zx_reboot_probe() - 2018-06-28:
media: tc358743: release device_node in tc358743_probe_of() - 2018-06-22:
mtd: spi-nor: nxp-spifi: release flash_np in nxp_spifi_probe() - 2018-06-18:
ASoC: tegra: fix device_node refcounting - 2018-06-18:
ASoC: rockchip: put device_node on remove - 2018-06-17:
staging: rts5208: add error handling into rtsx_probe - 2018-05-14:
w1: mxc_w1: Enable clock before calling clk_get_rate() on it - 2018-05-08:
i2c: axxia: enable clock before calling clk_get_rate() - 2018-05-04:
spi: pxa2xx: check clk_prepare_enable() return value - 2018-05-02:
spi: meson-spicc: Fix error handling in meson_spicc_probe() - 2018-04-26:
spi/bcm63xx-hspi: Enable the clock before calling clk_get_rate(). - 2018-04-25:
sc16is7xx: Check for an error when the clock is enabled. - 2018-04-17:
spi: stm32: Fix error handling in stm32_spi_probe() - 2018-03-26:
watchdog: davinci_wdt: fix error handling in davinci_wdt_probe() - 2018-03-18:
spi: jcore: disable ref_clk after getting its rate - 2018-03-16:
phy: lpc18xx-usb-otg: error handling in lpc18xx_usb_otg_phy_power_on() - 2018-03-13:
watchdog: sprd_wdt: Fix error handling in sprd_wdt_enable() - 2018-03-09:
serial: mxs-auart: disable clks of Alphascale ASM9260 - 2018-03-03:
watchdog: asm9260_wdt: fix error handling in asm9260_wdt_probe() - 2018-02-14:
media: rc: ir-hix5hd2: fix error handling of clk_prepare_enable() - 2018-02-12:
mtd: nand: vf610: check mtd_device_register() return code - 2018-01-26:
crypto: picoxcell - Fix error handling in spacc_probe() - 2018-01-13:
thermal: int3400_thermal: fix error handling in int3400_thermal_probe() - 2017-12-21:
clk: si5351: implement remove handler - 2017-12-20:
RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS - 2017-12-18:
rtc: omap: fix unbalanced clk_prepare_enable/clk_disable_unprepare - 2017-12-18:
media: s5p-jpeg: Fix off-by-one problem - 2017-12-18:
net: phy: xgene: disable clk on error paths - 2017-12-18:
media: pxa_camera: disable and unprepare the clock source on error - 2017-12-18:
fpga: socfpga-a10: disable clk on error in socfpga_a10_fpga_probe() - 2017-12-15:
tty: serial: mxs-auart: fix error handling in mxs_auart_probe - 2017-12-15:
serial: 8250_dw: Disable clock on error - 2017-12-15:
dmaengine: fsl-edma: disable clks on all error paths - 2017-12-13:
spi: jcore: disable clock when registering spi conroller failed - 2017-12-13:
net: ethernet: arc: fix error handling in emac_rockchip_probe - 2017-12-11:
usb: dwc3: of-simple: fix missing clk_disable_unprepare - 2017-12-11:
dmaengine: jz4740: disable/unprepare clk if probe fails - 2017-12-08:
media: v4l: mt9v032: Disable clock on error paths - 2017-12-07:
net: ethernet: arc: fix error handling in emac_rockchip_probe - 2017-12-07:
net: mvmdio: disable/unprepare clocks in EPROBE_DEFER case - 2017-12-07:
spi: sun6i: disable/unprepare clocks on remove - 2017-12-07:
spi: sun4i: disable clocks in the remove function - 2017-12-06:
ASoC: rockchip: disable clock on error - 2017-11-29:
rtc: brcmstb-waketimer: fix error handling in brcmstb_waketmr_probe() - 2017-11-08:
w1: keep balance of mutex locks and refcnts - 2017-11-06:
mtd: plat-ram: Replace manual resource management by devm - 2017-10-24:
usb: phy: tahvo: fix error handling in tahvo_usb_probe() - 2017-10-24:
mfd: mxs-lradc: Fix error handling in mxs_lradc_probe() - 2017-10-12:
misc: ibmasm: Return error on error path - 2017-09-18:
serial: sccnxp: Fix error handling in sccnxp_probe() - 2017-09-11:
Input: ucb1400_ts - fix suspend and resume handling - 2017-08-28:
parport: use release_mem_region instead of release_resource - 2017-08-27:
media: dvb-usb: Add memory free on error path in dw2102_probe() - 2017-08-25:
dmaengine: rcar-dmac: initialize all data before registering IRQ handler - 2017-08-21:
dmaengine: qcom_hidma: avoid freeing an uninitialized pointer - 2017-08-21:
video: fbdev: udlfb: Fix use after free on dlfb_usb_probe error path - 2017-08-18:
USB: Gadget core: fix inconsistency in the interface tousb_add_gadget_udc_release() - 2017-08-15:
loop: fix to a race condition due to the early registration of device - 2017-08-15:
ASoC: samsung: i2s: Null pointer dereference on samsung_i2s_remove - 2017-08-14:
i2c: simtec: use release_mem_region instead of release_resource - 2017-08-13:
hwmon: (stts751) buffer overrun on wrong chip configuration - 2017-08-11:
mISDN: Fix null pointer dereference at mISDN_FsmNew - 2017-08-11:
wan: dscc4: add checks for dma mapping errors - 2017-08-07:
hysdn: fix to a race condition in put_log_buffer - 2017-07-30:
drivers/serial: Do not leave sysfs group in case of error in aspeed_vuart_pro... - 2017-07-30:
serial: 8250: fix error handling in of_platform_serial_probe() - 2017-07-21:
platform/x86: wmi: Fix error handling in acpi_wmi_init() - 2017-07-12:
smsc911x: Add check for ioremap_nocache() return code - 2017-07-04:
vmlfb: Fix error handling in cr_pll_init() - 2017-06-24:
x86/paravirt: Remove unnecessary return from void function - 2017-05-28:
staging: iio: ad7152: Fix deadlock in ad7152_write_raw_samp_freq() - 2017-05-22:
net: atheros: atl2: don't return zero on failure path in atl2_probe() - 2017-05-18:
serial: altera_jtaguart: adding iounmap() - 2017-05-02:
sm501fb: don't return zero on failure path in sm501fb_start() - 2017-04-24:
mmc: sdhci-pxav2: add error handling of clk_prepare_enable() - 2017-04-11:
usb: gadget: mv_u3d: fix error handling in mv_u3d_probe() - 2017-04-10:
[media] m2m-deinterlace: don't return zero on failure paths in deinterlace_pr... - 2017-03-25:
irda: vlsi_ir: fix check for DMA mapping errors - 2017-03-16:
z3fold: fix spinlock unlocking in page reclaim - 2017-03-07:
net/sched: act_skbmod: remove unneeded rcu_read_unlock in tcf_skbmod_dump - 2017-03-07:
mtd: spi-nor: hisi: do not ignore clk_prepare_enable() failure - 2017-02-13:
mmc: wbsd: safer check if dma_addr is valid DMA address - 2017-01-29:
net: adaptec: starfire: add checks for dma mapping errors - 2017-01-04:
backlight: adp5520: Fix error handling in adp5520_bl_probe() - 2017-01-04:
vfio-mdev: fix some error codes in the sample code - 2016-12-14:
IB/isert: do not ignore errors in dma_map_single() - 2016-12-05:
adm80211: add checks for dma mapping errors - 2016-11-29:
uio: pruss: add clk_disable() - 2016-11-29:
mmc: wbsd: implement check for dma mapping error - 2016-11-19:
net: macb: add check for dma mapping error in start_xmit() - 2016-11-08:
usb: gadget: mv_u3d: add check for dma mapping error - 2016-10-26:
SoC: mxs-saif: check validity of ids in mxs_saif_probe() - 2016-10-15:
vmxnet3: avoid assumption about invalid dma_pa in vmxnet3_set_mc() - 2016-10-09:
firewire: nosy: do not ignore errors in ioremap_nocache() - 2016-10-03:
net: mvmdio: do not clk_disable_unprepare() NULL clock - 2016-09-24:
i2c: axxia: disable clks in case of failure in probe - 2016-09-19:
rapidio/rio_cm: avoid GFP_KERNEL in atomic context - 2016-09-16:
IB/rxe: fix GFP_KERNEL in spinlock context - 2016-09-12:
speakup: Add spinlock in synth_direct_store - 2016-09-09:
dwc_eth_qos: do not register semi-initialized device - 2016-09-03:
wl3501_cs: Add spinlock to wl3501_reset - 2016-08-29:
usb: gadget: goku_udc: fix memory leak in goku_probe() - 2016-08-15:
i2c: ocores: add missed clk_disable_unprepare() on failure paths - 2016-07-26:
ide-tape: fix misprint in failure handling in idetape_init() - 2016-07-19:
i2c: efm32: fix a failure path in efm32_i2c_probe() - 2016-07-12:
drm_aux-dev: fix error handling in drm_dp_aux_dev_init() - 2016-07-08:
[media] bt8xx: remove needless module refcounting - 2016-07-05:
rtlwifi: rtl8723ae: Fix potential race condition - 2016-07-05:
rtlwifi: rtl8723be: Fix potential race condition - 2016-07-05:
rtlwifi: rtl8192ee: Fix potential race condition - 2016-07-05:
rtlwifi: rtl8188ee: Fix potential race condition - 2016-07-05:
rtlwifi: rtl8821ae: Fix potential race condition - 2016-06-29:
libertas: Add spinlock to avoid race condition - 2016-06-28:
[media] radio-maxiradio: fix memory leak when device is removed - 2016-06-23:
act_ife: only acquire tcf_lock for existing actions - 2016-04-29:
mptsas: fix checks for dma mapping errors - 2016-04-19:
USB: whci-hcd: add more checks for dma mapping error - 2016-03-18:
mtip32xx: fix checks for dma mapping errors - 2016-03-04:
usb: gadget: bdc_udc: fix race condition in bdc_udc_exit() - 2016-02-23:
be2iscsi: add checks for dma mapping errors - 2016-02-08:
mmc: mmc_spi: add checks for dma mapping error - 2016-02-06:
tty: synclinkmp: do not ignore errors in probe() - 2016-01-07:
ipw2x00: add checks for dma mapping errors - 2015-12-31:
prism54: fix checks for dma mapping errors - 2015-12-19:
natsemi: add checks for dma mapping errors - 2015-12-11:
nfit: acpi_nfit_notify(): Do not leave device locked - 2015-12-01:
USB: whci-hcd: add check for dma mapping error - 2015-12-01:
vmxnet3: fix checks for dma mapping errors - 2015-11-19:
[media] lirc_imon: do not leave imon_probe() with mutex held - 2015-09-14:
usb: gadget: amd5536udc: fix error handling in udc_pci_probe() - 2015-08-18:
mtd: nettel: do not ignore mtd_device_register() failure in nettel_init() - 2015-08-17:
gpio/grgpio: fix deadlock in grgpio_irq_unmap() - 2015-08-12:
bfa: fix leak of bfad_im_port_index on module unload - 2015-05-12:
iio: light: hid-sensor-prox: Fix memory leak in probe() - 2015-05-01:
[media] marvell-ccic: fix memory leak on failure path in cafe_smbus_setup() - 2015-04-17:
dmaengine: pch_dma: fix memory leak on failure path in pch_dma_probe() - 2015-03-02:
[media] sh_vou: fix memory leak on error paths in sh_vou_open() - 2015-02-26:
i40e: Fix memory leak at failure path in i40e_dbg_command_write() - 2014-12-24:
rsi: fix memory leak in rsi_load_ta_instructions() - 2014-11-18:
can: esd_usb2: fix memory leak on disconnect - 2014-11-06:
m501fb: don't return zero on failure path in sm501fb_probe() - 2014-10-05:
dm log userspace: fix memory leak in dm_ulog_tfr_init failure path - 2014-07-29:
isdn/bas_gigaset: fix a leak on failure path in gigaset_probe() - 2014-07-04:
[media] tlg2300: fix leak at failure path in poseidon_probe() - 2014-06-19:
staging: line6: do not return 0 from probe if no initialization done - 2014-04-16:
USB: cdc-acm: fix double usb_autopm_put_interface() in acm_port_activate() - 2013-11-29:
[media] dvb_demux: fix deadlock in dmx_section_feed_release_filter() - 2013-03-28:
drbd: add module_put() on error path in drbd_proc_open() - 2012-03-08:
[media] staging: go7007: fix mismatch in mutex lock-unlock in [read|write]_re...