linux-kernel - Re: uninitialized variables bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <53237fa6-3d32-4f92-c7ea-9dd8bc12e028@redhat.com>
Date:   Sun, 8 May 2022 05:17:58 -0700
From:   Tom Rix <trix@...hat.com>
To:     Nathan Chancellor <nathan@...nel.org>,
        Dan Carpenter <dan.carpenter@...cle.com>
Cc:     ksummit-discuss@...ts.linuxfoundation.org,
        linux-kernel@...r.kernel.org, kbuild@...ts.01.org, lkp@...el.com,
        llvm@...ts.linux.dev, Nick Desaulniers <ndesaulniers@...gle.com>
Subject: Re: uninitialized variables bugs


On 5/6/22 2:50 PM, Nathan Chancellor wrote:
> Hi Dan,
>
> On Fri, May 06, 2022 at 12:13:38PM +0300, Dan Carpenter wrote:
>> Ever since commit 78a5255ffb6a ("Stop the ad-hoc games with
>> -Wno-maybe-initialized"), GCC's uninitialized variable warnings have
>> been disabled by default.  Now, you have to turn on W=1 or W=2 to see
>> the warnings which nobody except Arnd does.
...
> Clang's static analyzer, which Tom regularly runs, will check variables
> across function boundaries. I am not sure what the false positive rate
> on that check is but it does turn up issues like smatch does.

Clang's static analyzer is pretty go wrt uninitialized variables.

But the issues do not turn up in the report, the show up as errors and 
is why

I post a fix for a build break every couple of weeks.

Tom