Smatch tracks information about every function call. When a function pointer is called it maybe looks something like this: kernel/module.c | SYSC_delete_module | (struct module)->exit | INTERNAL | -1 | | void(*)() So then we just have to know what functions are assigned to module->exit. I also filter based on the function signature "void(*)()" because there are a couple places where we cut and pasted so the structs can have the same name and function pointer name as a member but take different arguments. regards, dan carpenter