linux-kernel - Re: [PATCH] Makefile: Globally enable fall-through warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 28 Jul 2019 12:31:18 -0500
From:   "Gustavo A. R. Silva" <gustavo@...eddedor.com>
To:     Guenter Roeck <linux@...ck-us.net>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        linux-kernel@...r.kernel.org, Kees Cook <keescook@...omium.org>
Subject: Re: [PATCH] Makefile: Globally enable fall-through warning



On 7/28/19 12:14 PM, Guenter Roeck wrote:
> Hi Gustavo,
> 
> On Sun, Jul 28, 2019 at 11:42:28AM -0500, Gustavo A. R. Silva wrote:
>> Hi Guenter,
>>
>> On 7/28/19 8:58 AM, Guenter Roeck wrote:
>>> On Thu, Jun 06, 2019 at 07:46:17PM -0500, Gustavo A. R. Silva wrote:
>>>> Now that all the fall-through warnings have been addressed in the
>>>> kernel, enable the fall-through warning globally.
>>>>
>>>
>>> Not really "all".
>>>
>>> powerpc:85xx/sbc8548_defconfig:
>>>
>>> arch/powerpc/kernel/align.c: In function ‘emulate_spe’:
>>> arch/powerpc/kernel/align.c:178:8: error: this statement may fall through
>>>
>>> Plus many more similar errors in the same file.
>>>
>>> All sh builds:
>>>
>>> arch/sh/kernel/disassemble.c: In function 'print_sh_insn':
>>> arch/sh/kernel/disassemble.c:478:8: error: this statement may fall through
>>>
>>> Again, this is seen in several places.
>>>
>>> mips:cavium_octeon_defconfig:
>>>
>>> arch/mips/cavium-octeon/octeon-usb.c: In function 'dwc3_octeon_clocks_start':
>>> include/linux/device.h:1499:2: error: this statement may fall through
>>>
>>> None of those are from recent changes. And this is just from my small
>>> subset of test builds.
>>>
>>
>> Thank you for letting me know about this. I don't have access to build
>> infrastructure like yours.
>>
> 
> I am always happy to run test builds on my infrastructure.
> 

Thank you!

>> My build infrastructure is similar to that of Linus.
>>
>> But if you send me all of those I can create a patch and send it back
>> to you to make sure what you see is addressed. If we can coordinate for
>> this it'd be great for everybody. :)
>>
> 
> Just have a look at the output of https://kerneltests.org/builders/,
> in the 'master' and/or 'next' column. There are many additional warnings
> in 'next'. Only downside is that you won't see the warnings unless there
> are also build errors, but -next tends to have lots of those.
> 

I see.

mm... for some reason I'm not able to establish connection with that site...

> Just wondering ... wouldn't it be possible to run a coccinelle script
> to identify those problems automatically, without depending on compile
> warnings ? Or smatch/sparse, maybe ?
> 

That was a common question from people along the whole process. The short
answer is: no. The reason for that is that Coccinelle is not a sophisticated
enough tool to determine if we are dealing with a false positive or an actual
bug.

That's why a code audit was needed.

Thanks
--
Gustavo