Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Sun, 6 Dec 2020 01:13:53 +0100
From:   Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
To:     Linus Torvalds <torvalds@linux-foundation.org>
Cc:     Jakub Kicinski <kuba@kernel.org>,
        Sparse Mailing-list <linux-sparse@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        edwin.peer@broadcom.com,
        Zhang Changzhong <zhangchangzhong@huawei.com>
Subject: Re: sparse annotation for error types?
Message-ID: <20201206001353.fhfu6wzn7nfg7fmv@ltop.local>
References: <20201205143250.2378b9f9@kicinski-fedora-pc1c0hjn.DHCP.thefacebook.com>
 <CAHk-=wjQYjRusiGfXTywSg5xC8knhP6uesDfO3J=bgu5uevtyA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAHk-=wjQYjRusiGfXTywSg5xC8knhP6uesDfO3J=bgu5uevtyA@mail.gmail.com>
Precedence: bulk

On Sat, Dec 05, 2020 at 03:10:15PM -0800, Linus Torvalds wrote:
> On Sat, Dec 5, 2020 at 2:34 PM Jakub Kicinski <kuba@kernel.org> wrote:
> >
> > Am I the only one who thinks this would be a good idea?
> 
>         err = third_step(obj, 0);
> 
>    err_undo_2s:
>         second_undo(obj);
>    err_undo_1s:
>         first_undo(obj);
>         return err;
> 
> iow, the "undo" parts are often done even for the success cases. This
> is particularly true when those first steps are locking-related, and
> the code always wants to unlock.
> 
> Sparse also doesn't really do any value analysis, so I suspect it
> wouldn't be trivial to implement in sparse anyway.

Yes but ... (see here under).
 
> Having some kind of smarter compile-time assert could be useful in
> general, but as mentioned, sparse doesn't really do value range
> propagation right now, so..
> 
> Luc, any reactions?

I agree but the code Jakub showed is very constrained:
   * only 2 return points
   * one of them being 0, the other is to be checked.
and I think this should be checkable easily, something like:
   * identify the highest point that can't reach the 'return 0'
   * check that the only way to reach this point is via a zero/non-zero
     test of the 'err' variable/returned value (which is a very
     limited kind of value analysis after all).
But sure, these are rather strict constraints but maybe it's
common for net drivers?

Otherwise, yes, it's probably better to annotate the function itself
or the point of interest (via some kind of assertion) than the
variable.

I've not much idea how much this would be useful, though.

-- Luc