Re: [linux-safety] [PATCH] coccinelle: misc: Check for hard-coded constants

On 8/13/20 9:41 AM, Sudip Mukherjee wrote:
> 
> 
> On 13/08/2020 16:33, Lukas Bulwahn wrote:
>> Sorry for top posting.
>>
>>   
>>
>> No, safety is CERTAINLY NOT a category. Security maybe, but even better
>> would be a category like “information leaks” and a subset
>> “kernel-internal information leaks” for your specific coccinelle rule
>> addressing CWE-547.
>>

+1

>>   
>>
>> For me, for now, misc is okay, but if we want to restructure and
>> clean-up, we should come up with a complete picture that fits for all.
> 
> imho, misc is ok for this one, but when you actually make a cocci script
> for CWE-414 ("Missing Lock Check"), that should be going to
> scripts/coccinelle/locks/
> 

+1
Agree with Lukas and Sudip on directory - safety isn't appropriate here.

You can find a suitable place: current coverage areas under
scripts/coccinelle are

api  free  iterators  locks  misc  null  tests

Let's try to map new scripts to these categories or create a new
category when one doesn't exist.

thanks,
-- Shuah