linux-kernel - Re: [PATCH v5] checkpatch: check for missing Fixes tags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <386af0a6-b15d-4be2-a0e7-0375e822031d@moroto.mountain>
Date: Wed, 12 Jun 2024 13:52:27 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Thorsten Leemhuis <linux@...mhuis.info>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
	Andy Whitcroft <apw@...onical.com>, Joe Perches <joe@...ches.com>,
	Dwaipayan Ray <dwaipayanray1@...il.com>,
	Lukas Bulwahn <lukas.bulwahn@...il.com>,
	linux-kernel@...r.kernel.org,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Arnd Bergmann <arnd@...db.de>, Kees Cook <keescook@...omium.org>,
	Sasha Levin <sashal@...nel.org>, Tom Gall <tom.gall@...aro.org>,
	kernel-janitors@...r.kernel.org
Subject: Re: [PATCH v5] checkpatch: check for missing Fixes tags

On Wed, Jun 12, 2024 at 11:15:45AM +0200, Thorsten Leemhuis wrote:
> I see your point and agree that it would be nice to have. At the same
> time I've seen people on the lists that don't like to use the Fixes: tag
> when nothing is "fixed".

That's correct.  Checkpatch stuff, clean ups, and patches which silence
*harmless* static checker warnings shouldn't get a Fixes tag.  This
checkpatch warning doesn't affect that.  If you look at the patches
which were flagged it's mostly because of CCing stable or syzbot.

> And it would be an additional burden for
> developers to look the commit-id up. So it could contribute to the
> "checkpatch is asking too much here and not worth the trouble" stance
> I've seen a few times (to which I contributed myself... :-/ ).

Someone's got to do it.  It might as well be the person who writes the
patch.

There are times where you're working across function boundaries or even
subsystem boundaries and in those cases finding the correct Fixes tag is
difficult.  The other case where it's annoying is when the code has
moved between files.  But it's generally a worthwhile exercise.  It
helps to look at what the original author was trying to do when they
introduced the bug.  And when you add a Fixes tag then checkpatch will
CC the original author so the review is better as well.

regards,
dan carpenter