linux-kernel - Re: Look Ma, da kernel is b0rken

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 5 Dec 2012 22:12:45 +0100
From:	Borislav Petkov <bp@...en8.de>
To:	Stephen Rothwell <sfr@...b.auug.org.au>
Cc:	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Andreas Mohr <andi@...as.de>, linux-kernel@...r.kernel.org,
	Li Shaohua <shaohua.li@...el.com>, linux-acpi@...r.kernel.org
Subject: Re: Look Ma, da kernel is b0rken

On Thu, Dec 06, 2012 at 07:57:21AM +1100, Stephen Rothwell wrote:
> On Wed, 5 Dec 2012 15:47:49 +0000 Alan Cox <alan@...rguk.ukuu.org.uk> wrote:
> > And yes btw we should turn this option on in -next, and get these sort of
> > things out of the tree for good. More importantly it'll mean anyone
> > adding another one gets a whine on the spot.
> 
> While I appreciate your confidence, I don't notice quite a few new
> warnings (because there are so many of them already :-().  Is there some
> reason to not turn this on in our "normal" builds?  Does it produce many
> false positives?

Yes, it produces a huge number of warnings which need weeding out (some
of them are false positives and some of them are simply unfixable due to
design decisions in the kernel, etc, etc):

$ make W=123 drivers/pnp/pnpacpi/core.o 2> w.log
make[1]: Nothing to be done for `all'.
  CHK     include/generated/uapi/linux/version.h
  CHK     include/generated/utsrelease.h
make[1]: Nothing to be done for `relocs'.
  CALL    scripts/checksyscalls.sh
  CC      drivers/pnp/pnpacpi/core.o
$ wc w.log
  2305  11202 168011 w.log

This is 2305 lines only for one compilation unit.

So if one enables all additional warning levels (this is what "W=123"
does) your build logs will be huge.

> What compiler version is required?

Works on all compilers by checking for supported -W options - see
scripts/Makefile.build.

> I also currently don't carry patches that only ever appear in
> linux-next (well, not intentionally anyway). I assume it would require
> a patch to the Makefile(s) to turn this on.

See above.

So ideally it would be if someone would build with "W=123" and track all
new warnings appearing with each new patch in linux-next and nag the
patch author to fix it before it hits mainline. This would require a
moderate level of scripting and experimenting though. The advantage is
that with something like that we'll be able to use all -W code checking
methods implemented gcc on our code and let the compiler possibly catch
more stuff.

We simply need someone not lazy enough to write that tracking and
nagging bit :).

Thanks.

-- 
Regards/Gruss,
    Boris.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/