Re: [kernel-hardening] Re: [RFC v4 PATCH 00/13] HARDENED_ATOMIC

[Julia Lawall <julia.lawall@lip6.fr>]

On Thu, 17 Nov 2016, Mark Rutland wrote:

> On Thu, Nov 17, 2016 at 11:16:42AM +0100, Peter Zijlstra wrote:
> > On Thu, Nov 17, 2016 at 10:36:47AM +0100, Julia Lawall wrote:
> > > On Thu, 17 Nov 2016, Peter Zijlstra wrote:
>
> > > > Also, we should really have a "make spatch" target so that we can run
> > > > the thing concurrently with -j80 or somesuch, because as is coccinelle
> > > > is unbearably slow.
> > >
> > > In the kernel, there is already the make coccicheck infrastructure.  It
> > > suffices to add the semantic patch to a subdirectory of
> > > scripts/coccinelle.
> >
> > Shiny.. however:
> >
> > $ make coccicheck COCCI=kref.cocci MODE=patch V=1
> > /bin/bash ./scripts/coccicheck
> >
> > Please check for false positives in the output before submitting a patch.
> > When using "patch" mode, carefully review the patch before submitting it.
> >
> > Processing kref.cocci
> > with option(s) ""
> >
> > Message example to submit a patch:
> >  The semantic patch that makes this change is available
> >  in kref.cocci.
> >
> >  More information about semantic patching is available at
> >  http://coccinelle.lip6.fr/
> >
> > Running (8 in parallel): /usr/bin/spatch -D patch --very-quiet --cocci-file kref.cocci --dir . -I ./arch/x86/include -I ./arch/x86/include/generated/uapi -I ./arch/x86/include/generated -I ./include -I ./arch/x86/include/uapi -I ./include/uapi -I ./include/generated/uapi --include ./include/linux/kconfig.h --jobs 8 --chunksize 1
> > coccicheck failed
>
> How odd. I took your patch, added a "virtual patch" line, and ran:

The virtual patch line solves the coccicheck failed problem.

> $ make coccicheck COCCI=/home/mark/kref.cocci MODE=patch > kref.patch
>
> ... and after ~30 seconds I had a valid looking patch on stdout.

You're not doing the --recursive-includes with all the include paths
available.  I've been doing some experiments to see whether there are some
options that will give reasonble results in a reasonable amount of time.
Unfortunately on the one hand refcount is a common field name and on the
ther hand --recursive-includes requires procssing a huge amount of code
for each file.

julia

> [mark@leverpostej:~/src/linux]% spatch --version
> spatch version 1.0.0-rc19 with Python support and with PCRE support
>
> I'm using a v4.9-rc4 tree.
>
> Thanks,
> Mark.
>