linux-kernel - Re: [3/3] Coccinelle: pci_free_consistent: Extend when constraints for two SmPL ellipses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 15 May 2019 08:48:13 +0200
From:   Markus Elfring <Markus.Elfring@....de>
To:     Wen Yang <wen.yang99@....com.cn>,
        Julia Lawall <julia.lawall@...6.fr>
Cc:     Gilles Muller <Gilles.Muller@...6.fr>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>,
        Michal Marek <michal.lkml@...kovi.net>,
        Nicolas Palix <nicolas.palix@...g.fr>,
        Yi Wang <wang.yi59@....com.cn>,
        Cheng Shengyu <cheng.shengyu@....com.cn>,
        Ma Jiang <ma.jiang@....com.cn>,
        Coccinelle <cocci@...teme.lip6.fr>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [3/3] Coccinelle: pci_free_consistent: Extend when constraints
 for two SmPL ellipses

> 1, "id = (T2)(e)" is rare.

I can follow this view for such a filter.

> It may be a minor detail that will have no impact in practice.

I suggest to reconsider this view once more.

Should such exclusion specifications take also “unexpected” source code
into account so that analysis results will be presented with a low
false positive rate?

> We've tested it, and this SmPL may only need to fix the following two false positives:

Thanks for your acknowledgement that my proposal can give us
another useful effect.

> 2,  If you really plan to add the two restrictions above,
> you may need to consider this further than simply adding a "when != id = (T2)(e)" statement.
> I constructed the flollowing code snippet as a test case:
…
> Using the original SmPL, we can find a bug.

I observe on my system that I do not get a desired warning
by the software combination “Coccinelle 1.0.7-00186-g99e081e9 (OCaml 4.07.1)”
(even from the unmodified SmPL script) for your test example.

Which version are you using for the spatch program?

> But with your modified SmPL, we can't find the bug.

I do not see a difference here. - I wonder also about this situation then.

But this gives us the opportunity to clarify the really desired
software behaviour in more detail.
How many developers would like to help with additional insights?

Regards,
Markus