[MODERATED] Is: smack, Was:Re: spectrev1+

[Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>]

On Wed, Jun 06, 2018 at 12:48:19PM +0200, speck for Greg KH wrote:
> On Wed, Jun 06, 2018 at 11:50:04AM +0200, speck for Norbert Manthey wrote:
> > Given the static code analysis efforts, I wonder whether we should also
> > make use of Coverity wrt Spectre vulnerabilities. Synopsis announced
> > they somewhat support this [1].
> 
> Yeah, but the results are crap :(
> 
> > Unfortunately, I do not have access to the Linux project on Coverity
> > Scan [2].
> 
> I can give you access, but it's not much there to see.  Apply for the
> project and I'll be sure to add you.  Last round I saw there was only
> about a 10% valid hit rate.  I don't think things have changed since
> those early results.
> 
> > Does anybody on this list have access to that project there
> > and can make sure the new scanner is enabled as well, or at least
> > enabled in some kind of beta phase so that we can judge the usefulness
> > of the reported defects. This way, we could consume the output and
> > compare it to the upgraded version of smatch.
> 
> So far, what we have seen is smatch is much better.  I think this is due
> to some of the people who were originally working on the spectre rules

Since we have a bit of isolation here (Dan is only read on this), could
folks send me the names of folks who are read-in on this.

That is the folks who are going to be working with Dan on improving
smatch so it can do a perfect job?

That way Dan has a whitelist of names and doesn't have to fret about
accidently leaking this data.

Thank you.