Does QEMU's coverity-scan run need to track coverity issues in dtb or slirp ?

Does QEMU's coverity-scan run need to track coverity issues in dtb or slirp ?

[Peter Maydell]

Currently QEMU's Coverity-Scan project has a bunch of unresolved
issues in code in dtc/ and also in slirp/. (I suspect most of them
are actually false-positives that got re-reported when we switched
to Meson and the filenames changed, or some similar event.)

Do dtc and slirp as upstream projects already track Coverity issues
(in which case we can just close the issues in the QEMU tracker as
irrelevant, or do we need to investigate these and potentially
forward them into whatever upstream bug tracker is appropriate?

thanks
-- PMM

Re: Does QEMU's coverity-scan run need to track coverity issues in dtb or slirp ?

[Samuel Thibault]

Hello,

Peter Maydell, le lun. 02 nov. 2020 19:54:14 +0000, a ecrit:
> Do dtc and slirp as upstream projects already track Coverity issues

We started tracking them yes.

Samuel

Re: Does QEMU's coverity-scan run need to track coverity issues in dtb or slirp ?

[Peter Maydell]

On Mon, 2 Nov 2020 at 20:37, Samuel Thibault <samuel.thibault@gnu.org> wrote:
>
> Hello,
>
> Peter Maydell, le lun. 02 nov. 2020 19:54:14 +0000, a ecrit:
> > Do dtc and slirp as upstream projects already track Coverity issues
>
> We started tracking them yes.

OK, so I can just dismiss anything that comes up in slirp/ in QEMU's
scan; that will help to cut down on the recent buildup.

thanks
-- PMM

Re: Does QEMU's coverity-scan run need to track coverity issues in dtb or slirp ?

[David Gibson]

[-- Attachment #1: Type: text/plain, Size: 1085 bytes --]

On Mon, Nov 02, 2020 at 07:54:14PM +0000, Peter Maydell wrote:
> Currently QEMU's Coverity-Scan project has a bunch of unresolved
> issues in code in dtc/ and also in slirp/. (I suspect most of them
> are actually false-positives that got re-reported when we switched
> to Meson and the filenames changed, or some similar event.)
> 
> Do dtc and slirp as upstream projects already track Coverity issues
> (in which case we can just close the issues in the QEMU tracker as
> irrelevant, or do we need to investigate these and potentially
> forward them into whatever upstream bug tracker is appropriate?

dtc is wired up to coverity_scan, and quite a few of the things it
caught were fixed a while back.  I must admit I don't re-examine the
remaining warnings very frequently though.  I *think* what's still
there are false positives, but I'm not super confident about that.

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]