[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <d9dfab9a24297ce0bb9cbafb3968814d7ebe368d.camel@amazon.de>
Date: Fri, 17 May 2024 06:19:50 +0000
From: "Manthey, Norbert" <nmanthey@...zon.de>
To: "keescook@...omium.org" <keescook@...omium.org>
CC: "Woodhouse, David" <dwmw@...zon.co.uk>, "Stieger, Andreas"
<astieger@...zon.de>, "linux-kernel@...r.kernel.org"
<linux-kernel@...r.kernel.org>, "linux-hardening@...r.kernel.org"
<linux-hardening@...r.kernel.org>, "Hemdan, Hagar Gamal Halim"
<hagarhem@...zon.de>
Subject: Re: Extending Linux' Coverity model and also cover aarch64
On Thu, 2024-05-16 at 12:20 -0700, Kees Cook wrote:
> CAUTION: This email originated from outside of the organization. Do
> not click links or open attachments unless you can confirm the sender
> and know the content is safe.
>
>
>
> On Thu, May 16, 2024 at 03:28:16PM +0000, Manthey, Norbert wrote:
> > we published an extension for the Coverity model that is used by
> > the
> > CoverityScan setup for the Linux kernel [1]. We have been using
> > this
> > extension to analyze the 6.1 kernel branch, and reported some fixes
> > to
> > the upstream code base that are based on this model [2]. Feel free
> > to
> > merge the pull request, and update the model in the CoverityScan
> > setup.
> > We do not have access to that project to perform these updates
> > ourselves.
>
> Thanks for this! I'll get it loaded into the Linux-Next scanner.
Nice, thanks!
>
> > To increase the analysis coverage to aarch64, we analyzed a x86 and
> > a
> > aarch64 configuration. The increased coverage is achieved by using
> > re-
> > configuration and cross-compilation during the analysis build. If
> > you
> > are interested in this setup we can share the Dockerfile and script
> > we
> > used for this process.
>
> We've only got access to the free Coverity scanner, but it would be
> nice
> to see if there was anything specific to arm64.
Yes, I understand. Can you show how that free scanner is used? We
tweaked the command we fed into the "cov-build" tool. This tool should
be part of the scanner (if I remember that correctly).
>
> > To prevent regressions in backports to LTS kernels, we wondered
> > whether
> > the community is interested in setting up CoverityScan projects for
> > older kernel releases. Would such an extension be useful to show
> > new
> > defects in addition to the current release testing?
>
> The only one we (lightly) manage right now is the linux-next scanner.
> If
> other folks want to host scanners for -stable kernels, that would be
> interesting, yes.
Can you share explain or share pointers to how the current setup works?
If I understand that better, we can think about how to process the
other kernels.
Best,
Norbert
>
> -Kees
>
> --
> Kees Cook
Amazon Web Services Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B
Sitz: Berlin
Ust-ID: DE 365 538 597
Powered by blists - more mailing lists