linux-kernel - Re: [PATCH 0/3 RFC] Coccinelle: completion API checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.10.1501021241550.2558@hadrien>
Date:	Fri, 2 Jan 2015 12:46:15 +0100 (CET)
From:	Julia Lawall <julia.lawall@...6.fr>
To:	Nicholas Mc Guire <der.herr@...r.at>
cc:	Gilles Muller <Gilles.Muller@...6.fr>,
	Nicolas Palix <nicolas.palix@...g.fr>,
	Michal Marek <mmarek@...e.cz>,
	Andreas Platschek <platschek@....tuwien.ac.at>,
	cocci@...teme.lip6.fr, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 0/3 RFC] Coccinelle: completion API checking

On Fri, 2 Jan 2015, Nicholas Mc Guire wrote:

>
> This little set of semantic patches is for partially checking the
> completion API. It seems to be working correctly and has not yet
> produced any false-positive.
>
> The cases being detected are:
>
> 1/3 - duplicate init_completions.
> 2/3 - incorrect static initialization of completion on stack.
> 3/3 - re-initialization of completion with init_completion() rather
>       than reinit_completion().
>
> semantic patch                  findings   files  confirmed
> duplicate_init_completion.cocci    2         2        2
> false_declare_completion.cocci     6         5        3
> false_init_compltion.cocci         9         6        5
>
> Note: false_declare_completion.cocci runs extremely slow on my system
>       roughly a factor 10 slower than the other two - not clear why.

The problem is the use of <... ...>.  That is good because it allows
DECLARE_COMPLETION not to appear on some execution paths, but it is not so
good because it allows DECLARE_COMPLETION to appear on no execution paths
at all.  So the semantic patch is considered to be relevant to every file,
and every file has to be parsed, which takes a lot of time.

To fix the problem, you can first check whether the call actually exists
in each function:

@pre_e exists@
identifier f;
declarer name DECLARE_COMPLETION;
@@

f(...) {
  <+...
  DECLARE_COMPLETION(...);
  ...+>
}

Then only run the second rules on functions for which pre_e is satisfied.
That is, in the rule e, instead of putting identifier f, you can put
identifier pre_e.f.  You can do the same in the rule ep.  Ep is already
looking for the existence of an execution path, so for ep you could also
just replace the <... ...> by <+... ...+> instead of relying on pre_e.

julia
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/