Re: [linux-safety] [PATCH] coccinelle: misc: Check for hard-coded constants

To your questions, here is my opinion...

1. Is the header format in the semantic patch acceptable (i.e. referencing the CWE that this particular semantic patch aims to address)?

Actually, I think we should that for the existing rules as well.

I was thinking of the following format:

# Addresses: CWE-414 ("Missing Lock Check")

or

# Contributes-to: Missing Lock Check [CWE-414]

I think it is good discussion to have with Julia Lawall, Dan Carpenter, Luc Van Oostenryck, Joe Perches, etc. to see how they would want to maintain such information within their tools.


2. Should we create a separate directory for ELISA within coccinelle?

No, we do not structure according to the contributor, then the kernel architecture would be "linus directory", "andrew directory", "shuah directory", etc.

I would suggest that we could roughly structure according the existing structure for coccinelle and the CWE structure.


Lukas

P.S.: We need to set groups.io not to generate HTML emails on responses etc. when we want to engage with the kernel community. Let us check if we get that set up.