Re: [linux-safety] [PATCH] coccinelle: misc: Check for hard-coded constants

On 8/13/20 11:02 AM, Shuah Khan via lists.elisa.tech wrote:
> On 8/13/20 9:41 AM, Sudip Mukherjee wrote:
>>
>>
>> On 13/08/2020 16:33, Lukas Bulwahn wrote:
>>> Sorry for top posting.
>>>
>>>
>>> No, safety is CERTAINLY NOT a category. Security maybe, but even better
>>> would be a category like “information leaks” and a subset
>>> “kernel-internal information leaks” for your specific coccinelle rule
>>> addressing CWE-547.
>>>
> 
> +1
> 
>>>
>>> For me, for now, misc is okay, but if we want to restructure and
>>> clean-up, we should come up with a complete picture that fits for all.
>>
>> imho, misc is ok for this one, but when you actually make a cocci script
>> for CWE-414 ("Missing Lock Check"), that should be going to
>> scripts/coccinelle/locks/
>>
> 
> +1
> Agree with Lukas and Sudip on directory - safety isn't appropriate here.
> 
> You can find a suitable place: current coverage areas under
> scripts/coccinelle are
> 
> api  free  iterators  locks  misc  null  tests
> 
> Let's try to map new scripts to these categories or create a new
> category when one doesn't exist.
> 

One more thing. Also look into if these issues can be found by compiler.
If so, is there a need to come up with coccinelle script.

Somehow this sounds like a basic error compiler should be able to flag
and might already have a method in the kernel.

thanks,
-- Shuah