linux-hardening - Re: [cocci] spatch --jobs N missing matches?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 27 Sep 2022 17:06:34 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Julia Lawall <julia.lawall@...ia.fr>
Cc:     cocci@...ia.fr, linux-hardening@...r.kernel.org,
        "Gustavo A. R. Silva" <gustavoars@...nel.org>
Subject: Re: [cocci] spatch --jobs N missing matches?


On Tue, Sep 27, 2022 at 11:09:35PM +0200, Julia Lawall wrote:
> The problem is fixed in github.  Coccinelle was doing some caching of
> header files, that was not desirable in the case where one actually wants
> to match the code, and not just get type information.

Thank you for the fix! I can confirm things appear to be working
correctly now. (And took 124 minutes to run.)

> [...]
> Actually, there are not that many memcpys in the considered code.  Then
> there are not that many that refer to the last element of a structure.  If
> level2 produces nothing, then level 1 should not be applied.
> 
> In the original rule order, all of the pairs of a flexible structure and
> any structure are considered, regardless of whether any memcpys are
> present.

Ah! Yes, I keep forgetting to start with the narrowest part first. :P

I also forget that I can do a "depends" on something that has no other
matches, but if it's built on prior rules that I use in later rules,
then it limits that rule directly. I haven't quite managed to think
sideways hard enough. :)

-- 
Kees Cook