linux-kernel - Re: [BUG REPORT] use of unreachable() masks uninitialized variables warnings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAO6TR8VNy+fUmrgQyg3Y8vAe5jCxZrs1oK-W0z7=pbHbCdqq-A@mail.gmail.com>
Date:	Thu, 11 Feb 2016 21:18:44 -0700
From:	Jeff Merkey <linux.mdb@...il.com>
To:	"Theodore Ts'o" <tytso@....edu>, Jeff Merkey <linux.mdb@...il.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [BUG REPORT] use of unreachable() masks uninitialized variables warnings

On 2/11/16, Theodore Ts'o <tytso@....edu> wrote:
> On Thu, Feb 11, 2016 at 11:12:12AM -0700, Jeff Merkey wrote:
>>
>> That's good to know, they could be false positives, but it was kind of
>> wierd behavior caused by that macro.
>
> If it is true, it sounds more like a compiler bug to me.  Any
> statements a BUG() call are unreachable.  If the compiler assumes that
> in the case of:
>
> 	if (a)
> 	        BUG();
> 	printf("foo bar\n");
> 	
> That the printf is not reachable, that's a compiler bug.  And not a
> problem in the BUG() macro.
>
> It might be that it's worthwhile to use other static code analysis
> tools.  Many people will look at warnings from Coverity and clang to
> find potential problems, since these tend to find more warnings than
> just using gcc.  The problem with some of these, including Coverity,
> is that they can be __too__ noisy, and if 90% of the warnings are
> false positives, most people won't take the time to weed out several
> dozen bogus warnings to find the one good one.
>
> In your case, for example, I looked through several dozen warnings,
> and they were ***all*** bogus.  Keep in mind that this might make me
> less inclined to pay attention to complaints from you in the future.
> The story of the buy who cried wolf too often comes to mind.
>
> Perhaps you could actually take a close look at the warnings, before
> you fire off an e-mail?  If at least one of the warnings were valid
> and pointed at an actual bug, it wouldn't have been a complete waste
> of my time....
>
> Best regards,
>
> 						- Ted
>

Well, it's nice to know I wasn't imagining what I was seeing.  It
wasn't a complete waste of my time or yours since it revealed a
problem with gcc issuing warnings.  Not all of them were bogus BTW,
just inert would be better word.  I noticed it while enabling the
ability of the BUG() macro to emit an int3 instead of a ud2
instruction.

Jeff