linux-kernel - Re: [PATCH] checkpatch: Validate Fixes: tag using 'commit' checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 3 Sep 2019 08:58:22 -0700
From:   Sean Christopherson <sean.j.christopherson@...el.com>
To:     Stephen Rothwell <sfr@...b.auug.org.au>
Cc:     Andy Whitcroft <apw@...onical.com>, Joe Perches <joe@...ches.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] checkpatch: Validate Fixes: tag using 'commit' checks

On Sat, Aug 31, 2019 at 11:39:39AM +1000, Stephen Rothwell wrote:
> Hi Sean,
> 
> On Fri, 30 Aug 2019 09:36:58 -0700 Sean Christopherson <sean.j.christopherson@...el.com> wrote:
> >
> > @@ -2803,10 +2805,15 @@ sub process {
> >  			($id, $description) = git_commit_info($orig_commit,
> >  							      $id, $orig_desc);
> >  
> > -			if (defined($id) &&
> > -			   ($short || $long || $space || $case || ($orig_desc ne $description) || !$hasparens)) {
> > +
> > +			if (!defined($id)) {
> > +				if ($init_tag =~ /fixes:/i) {
> > +					ERROR("GIT_COMMIT_ID",
> > +					      "Target SHA1 '$orig_commit' does not exist\n" . $herecurr);
> > +				}
> 
> Unfortunately, git_commit_info() just returns the passed in $id (which
> is explicitly set earlier) if git is not available or you are not in a
> git repository (and that latter check is not entirely correct anyway).
> 
> Also, what you really need to test is if the specified commit is an
> ancestor of the place in the maintainer's tree where this patch is to
> be applied.  The commit may well exist in the developer's tree, but not
> be in the maintainer's tree :-(

True, but such an error would be caught if the maintainer or a reviewer
runs checkpatch after applying the commit, e.g. I'll run checkpatch as
part of reviewing a patch if I go through the effort of applying it,
which admittedly isn't all that often.
 
> This will, however, catch the cases where the SHA1 has been mistyped,
> but we should encourage people not to type them anyway, instead
> generating them using "git log".

What about adding an example formatting command to the error message, e.g.

  ERROR: Target SHA1 '265381004993' does not exist, use `git show -s
  --pretty='format:%h ("%s")'` or similar to verify and format the commit
  description


The same blurb could be also added to the error message for bad formatting

  ERROR: Please use git commit description style 'Fixes: <12+ chars of sha1>
  ("<title line>")', e.g. `git show -s --pretty='format:%h ("%s")'` -
  ie. 'Fixes: 265381004994 ("Merge tag '5.3-rc6-smb3-fixes' of
  git://git.samba.org/sfrench/cifs-2.6")