linux-kernel - Re: [PATCH] checkpatch: Validate Fixes: tag using 'commit' checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 31 Aug 2019 11:39:39 +1000
From:   Stephen Rothwell <sfr@...b.auug.org.au>
To:     Sean Christopherson <sean.j.christopherson@...el.com>
Cc:     Andy Whitcroft <apw@...onical.com>, Joe Perches <joe@...ches.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] checkpatch: Validate Fixes: tag using 'commit' checks

Hi Sean,

On Fri, 30 Aug 2019 09:36:58 -0700 Sean Christopherson <sean.j.christopherson@...el.com> wrote:
>
> @@ -2803,10 +2805,15 @@ sub process {
>  			($id, $description) = git_commit_info($orig_commit,
>  							      $id, $orig_desc);
>  
> -			if (defined($id) &&
> -			   ($short || $long || $space || $case || ($orig_desc ne $description) || !$hasparens)) {
> +
> +			if (!defined($id)) {
> +				if ($init_tag =~ /fixes:/i) {
> +					ERROR("GIT_COMMIT_ID",
> +					      "Target SHA1 '$orig_commit' does not exist\n" . $herecurr);
> +				}

Unfortunately, git_commit_info() just returns the passed in $id (which
is explicitly set earlier) if git is not available or you are not in a
git repository (and that latter check is not entirely correct anyway).

Also, what you really need to test is if the specified commit is an
ancestor of the place in the maintainer's tree where this patch is to
be applied.  The commit may well exist in the developer's tree, but not
be in the maintainer's tree :-(

This will, however, catch the cases where the SHA1 has been mistyped,
but we should encourage people not to type them anyway, instead
generating them using "git log".

-- 
Cheers,
Stephen Rothwell

Content of type "application/pgp-signature" skipped