linux-kernel - Re: [Ksummit-2013-discuss] [ARM ATTEND] catching up on exploit mitigations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 1 Aug 2013 21:26:24 +0200 (CEST)
From:	Julia Lawall <julia.lawall@...6.fr>
To:	Dan Carpenter <dan.carpenter@...cle.com>
cc:	Dave Jones <davej@...hat.com>, Kees Cook <keescook@...omium.org>,
	ksummit-2013-discuss@...ts.linuxfoundation.org,
	LKML <linux-kernel@...r.kernel.org>,
	"linux-arm-kernel@...ts.infradead.org" 
	<linux-arm-kernel@...ts.infradead.org>,
	Julia Lawall <julia.lawall@...6.fr>,
	Gilles Muller <Gilles.Muller@...6.fr>, npalix@...u.dk
Subject: Re: [Ksummit-2013-discuss] [ARM ATTEND] catching up on exploit
 mitigations

On Thu, 1 Aug 2013, Dan Carpenter wrote:

> On Thu, Aug 01, 2013 at 03:05:56PM -0400, Dave Jones wrote:
> > On Thu, Aug 01, 2013 at 12:13:22PM +0300, Dan Carpenter wrote:
> >  > I was just reading http://faultlinux.lip6.fr/ which says that in
> >  > 2011 the static checker fault rate in arch/ and fs/ was worse than
> >  > in drivers/
> > 
> > I've been working on getting more regular builds in coverity, so we can
> > get more meaningful statistics on things like "what area is getting worse".
> > 
> > Of the current bugs I've categorised so far, here's the breakdown for 3.11-rc3
> > in terms of highest bug counts.
> > 
> > Drivers/net/wireless: 659 
> > Drivers/ [1] : 600
> > Drivers/staging: 449
> > Drivers/scsi: 409
> > Drivers/net: 350
> > Net/[2] : 297
> > Drivers/media: 286
> > Sound: 220
> > Drivers/GPU: 217
> > 
> > That's the top categories for the whole kernel.
> > 
> > That wireless was top of the list was the least shocking thing to me,
> > based on what we get reported to Fedora bugzilla.  That it found more
> > bugs there than in staging was amusing though. The good news is that
> > wireless also takes the top slot for 'resolved' issues.
> > 
> > The paper above talks about 'arch' but doesn't indicate if it's counting
> > all arches, or just the one they run the tests on. (Coverity only covers x86,
> > so arch/ shows up in 10th place there).
> 
> It's Coccinelle, so my guess is they ran it on all the .c files.

Coccinelle runs on all C files.  The rates in the paper are relative to 
what are referred to as notes, ie the number of potential bug sites.  
For example, code that does not use kmalloc is not likely to contain 
missing kfrees.

julia
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/