lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 6 Dec 2020 01:13:53 +0100
From:   Luc Van Oostenryck <luc.vanoostenryck@...il.com>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Jakub Kicinski <kuba@...nel.org>,
        Sparse Mailing-list <linux-sparse@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        edwin.peer@...adcom.com,
        Zhang Changzhong <zhangchangzhong@...wei.com>
Subject: Re: sparse annotation for error types?

On Sat, Dec 05, 2020 at 03:10:15PM -0800, Linus Torvalds wrote:
> On Sat, Dec 5, 2020 at 2:34 PM Jakub Kicinski <kuba@...nel.org> wrote:
> >
> > Am I the only one who thinks this would be a good idea?
> 
>         err = third_step(obj, 0);
> 
>    err_undo_2s:
>         second_undo(obj);
>    err_undo_1s:
>         first_undo(obj);
>         return err;
> 
> iow, the "undo" parts are often done even for the success cases. This
> is particularly true when those first steps are locking-related, and
> the code always wants to unlock.
> 
> Sparse also doesn't really do any value analysis, so I suspect it
> wouldn't be trivial to implement in sparse anyway.

Yes but ... (see here under).
 
> Having some kind of smarter compile-time assert could be useful in
> general, but as mentioned, sparse doesn't really do value range
> propagation right now, so..
> 
> Luc, any reactions?

I agree but the code Jakub showed is very constrained:
   * only 2 return points
   * one of them being 0, the other is to be checked.
and I think this should be checkable easily, something like:
   * identify the highest point that can't reach the 'return 0'
   * check that the only way to reach this point is via a zero/non-zero
     test of the 'err' variable/returned value (which is a very
     limited kind of value analysis after all).
But sure, these are rather strict constraints but maybe it's
common for net drivers?

Otherwise, yes, it's probably better to annotate the function itself
or the point of interest (via some kind of assertion) than the
variable.

I've not much idea how much this would be useful, though.

-- Luc

Powered by blists - more mailing lists