Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-21 Thread Siteshwar Vashisht
On Tue, Nov 19, 2024 at 6:08 PM David Malcolm wrote: > > On Tue, 2024-11-19 at 17:25 +0100, František Šumšal wrote: > > On 11/19/24 10:22, František Šumšal wrote: > > > On 11/19/24 09:07, Kamil Dudka wrote: > > > > On Monday, November 18, 2024 6:57:03 PM GMT+1 František Šumšal > > > > wrote: > > >

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-20 Thread František Šumšal
Just to add some positive news after my previous (and somewhat negative emails) - I rebuilt polkit with GCC analyzer and LTO which yielded four warnings and all of them were real issues (well, the last one was a potential one, but I understand why GCC analyzer reported it). So it seems to work

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-20 Thread Zbigniew Jędrzejewski-Szmek
On Fri, Nov 15, 2024 at 06:53:59AM +0100, Siteshwar Vashisht wrote: > - The issue of false positives is one of the most important, but hard > to solve. I started a discussion[2] on GitHub, but we do not have a > good answer to it yet. If you have ideas, please share on GitHub. Hi, This was alread

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-20 Thread František Šumšal
On 11/19/24 18:07, David Malcolm wrote: On Tue, 2024-11-19 at 17:25 +0100, František Šumšal wrote: On 11/19/24 10:22, František Šumšal wrote: On 11/19/24 09:07, Kamil Dudka wrote: On Monday, November 18, 2024 6:57:03 PM GMT+1 František Šumšal wrote: Right after I sent this I got a response

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-19 Thread David Malcolm
On Tue, 2024-11-19 at 17:25 +0100, František Šumšal wrote: > On 11/19/24 10:22, František Šumšal wrote: > > On 11/19/24 09:07, Kamil Dudka wrote: > > > On Monday, November 18, 2024 6:57:03 PM GMT+1 František Šumšal > > > wrote: > > > > Right after I sent this I got a response [0] to the gcc bug and

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-19 Thread František Šumšal
On 11/19/24 10:22, František Šumšal wrote: On 11/19/24 09:07, Kamil Dudka wrote: On Monday, November 18, 2024 6:57:03 PM GMT+1 František Šumšal wrote: Right after I sent this I got a response [0] to the gcc bug and turns out that the culprit is disabled LTO. And indeed, if I build systemd with

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-19 Thread František Šumšal
On 11/19/24 09:07, Kamil Dudka wrote: On Monday, November 18, 2024 6:57:03 PM GMT+1 František Šumšal wrote: Right after I sent this I got a response [0] to the gcc bug and turns out that the culprit is disabled LTO. And indeed, if I build systemd with `-fanalyzer -flto=auto`, (almost) all repo

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-19 Thread Kamil Dudka
On Monday, November 18, 2024 6:57:03 PM GMT+1 František Šumšal wrote: > Right after I sent this I got a response [0] to the gcc bug and turns out > that the culprit is disabled LTO. And indeed, if I build systemd with > `-fanalyzer -flto=auto`, (almost) all reports disappear: > > With just -fana

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-18 Thread František Šumšal
Right after I sent this I got a response [0] to the gcc bug and turns out that the culprit is disabled LTO. And indeed, if I build systemd with `-fanalyzer -flto=auto`, (almost) all reports disappear: With just -fanalyzer (meson setup build -Dc_args="-fanalyzer"): $ grep warning: log-fanalyzer.

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-18 Thread František Šumšal
Hey, Thank you for doing this! I started taking apart systemd findings and reported a first issue against gcc [0], so we can hopefully squash the false positives from the results (at least the ones repored by gcc's -fanalyzer) and make them more useful. One thing that comes to mind (especiall

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-15 Thread Kevin Fenzi
On Fri, Nov 15, 2024 at 06:36:14AM +0100, Siteshwar Vashisht wrote: > On Thu, Nov 14, 2024 at 10:47 PM Kevin Fenzi wrote: > > > > What does it mean when the table lists the package version as 'el8'? > > I was trying to reuse some scripts that are used to generate reports > for RHEL and they did n

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-15 Thread Carlos Rodriguez-Fernandez
That went on the wrong thread, sorry, lol. -- ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduc

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-15 Thread Carlos Rodriguez-Fernandez
Just out of curiosity, in the fclose(..) case, my original thought was that the exit(1) call would close the file descriptor. Is it still necessary because of a possibility of some atexit hanging the process and holding the fd longer than expected, hence the possible resource leak? Or is it bec

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-15 Thread Carlos Rodriguez-Fernandez
A few were actually good, and they were fixed right away upstream. Thanks again for the report! Carlos R.F. On 11/14/24 10:14 PM, Carlos Rodriguez-Fernandez wrote: Thanks for sharing the report. I looked into the libcap ones and they all appear to be false positives, but I can see why gcc stru

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-14 Thread Siteshwar Vashisht
On Thu, Nov 14, 2024 at 10:23 PM Richard W.M. Jones wrote: > > On Thu, Nov 14, 2024 at 08:47:36AM +0100, Siteshwar Vashisht wrote: > > Hello, > > > > I am writing this message to get feedback from the community on new > > findings by static analyzers in Critical Path Packages that have > > changed

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-14 Thread Siteshwar Vashisht
On Thu, Nov 14, 2024 at 10:47 PM Kevin Fenzi wrote: > > What does it mean when the table lists the package version as 'el8'? I was trying to reuse some scripts that are used to generate reports for RHEL and they did not work as expected. I have fixed it now. Please take a look at the report again

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-14 Thread Carlos Rodriguez-Fernandez
Thanks for sharing the report. I looked into the libcap ones and they all appear to be false positives, but I can see why gcc struggles to figure it out. I forwarded them to the upstream developer for confirmation. Thank you, Carlos R.F. On 11/14/24 12:47 AM, Siteshwar Vashisht wrote: Hello,

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-14 Thread Kevin Fenzi
What does it mean when the table lists the package version as 'el8'? kevin signature.asc Description: PGP signature -- ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora C

Re: Findings by static analyzers in Fedora 42 Critical Path Packages

2024-11-14 Thread Richard W.M. Jones
On Thu, Nov 14, 2024 at 08:47:36AM +0100, Siteshwar Vashisht wrote: > Hello, > > I am writing this message to get feedback from the community on new > findings by static analyzers in Critical Path Packages that have > changed in Fedora 42. > > TLDR: This report[1] contains 37330 findings. Please