Dear Kees,
some time ago you pointed me at the github copy of the Coverity model
that is used for the Linux kernel analysis [1].
I investigated the effect of using this model, and compared defects
reported with and without the model. Before I deep dive into
modifications, I wanted to understand whether there is a more recent
version (the current one is about 4 years old). I currently have no
access to the public linux dashboard to directly check the effect
there.
In case there is a more recent model file, can you please update the
github repository?
In case I find additions, is the following a good procedure to share
model updates? I would run an analysis on a defined Linux commit with
the current model and the proposed additions, and would report the
effect on the reported defects. Is there anything else I am missing?
Best,
Norbert
[1] https://github.com/kees/coverity-linux
Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879
On Fri, Jun 16, 2023 at 01:44:01PM +0000, Manthey, Norbert wrote:
> some time ago you pointed me at the github copy of the Coverity model
> that is used for the Linux kernel analysis [1].
Hi!
> I investigated the effect of using this model, and compared defects
> reported with and without the model. Before I deep dive into
> modifications, I wanted to understand whether there is a more recent
> version (the current one is about 4 years old). I currently have no
> access to the public linux dashboard to directly check the effect
> there.
>
> In case there is a more recent model file, can you please update the
> github repository?
This model file is current -- we haven't changed it in quite some time.
> In case I find additions, is the following a good procedure to share
> model updates? I would run an analysis on a defined Linux commit with
> the current model and the proposed additions, and would report the
> effect on the reported defects. Is there anything else I am missing?
Yes please! Either send a patch to the [email protected]
mailing list or send a PR to the github repo.
-Kees
> [1] https://github.com/kees/coverity-linux
--
Kees Cook