Differences

This shows you the differences between two versions of the page.

--- coverityprevent [2020/02/05 20:31] – Add a link to the Checker Reference PedroGiffuni
+++ coverityprevent [2020/10/31 01:53] (current) – Remove hyperlink from a broken link. SashaVigole
@@ Line 1: / Line 1: @@
-----
+====== Coverity ======
-|  If in doubt, **do not** classify!  |
+The %%FreeBSD%% Project uses the [[https://www.synopsys.com|Synopsys]] [[https://scan.coverity.com/|Coverity Scan]] service for static analysis of %%FreeBSD%% source code to identity security vulnerabilities and other code quality issues.
-----
+===== Getting Access =====
+  * Browse to [[https://scan.coverity.com/memberships/new?project_id=freebsd|FreeBSD Coverity Project Homepage]]
+  * Click //Sign Up//
+\\
+**Note 1**: At this time, we only provide access to view scan results to %%FreeBSD%% developers.\\
+**Note 2**: If you are a %%FreeBSD%% developer, please register using your %%FreeBSD%%.org email address
+===== Using Coverity Scan =====
+<callout type="danger">
+If in doubt, do **not** classify any issues in the dashboard
+</callout>
+  * When fixing a Coverity issue:
+    - Check [[Bugzilla]] or [[Phabricator]] for existing issues or reports and assign yourself
+      - If an existing issue exists, ensure you include %%%%''%%PR: <issue-id>%%''%%%% in commit log messages
+    - Ensure you include %%%%''%%Coverity ID: <CIDXXXXX>%%''%%%% in commit log message
+    - Ensure all relevent stable/releng branches receive the change (MFC)
+===== Improving Result Quality =====
+Static code analysis has some limitations in its ability to understand certain dynamic operations. This limitation may result in falsely detecting defects. Since most false-positive defects are caused by few functions in your code base, Coverity allows you to tell the analysis engine to treat these functions differently. This is called a Modeling File. By providing a modeling file, most projects reduce their false-positive rate to the ballpark of 10%.
+==== Modeling ====
+  * ''%%https://scan.coverity.com/Coverity Modeling Reference%%'' (This link is broken)
+  * [[https://scan.coverity.com/models|Models and Annotations]]
+  * [[https://community.synopsys.com/s/article/How-to-write-a-function-model-to-eliminate-a-false-positive-in-a-C-applilcation|Synopsys: How to write a function model to eliminate a false positive in a C application]]
+==== Modeling File Examples ====
+  * [[https://github.com/python/cpython/blob/master/Misc/coverity_model.c|Python: Misc/coverity_model.c]]
+  * [[https://github.com/pks-t/libgit2/blob/master/script/user_model.c|libgit2: script/user_model.c]]
+  * [[https://github.com/qemu/qemu/blob/master/scripts/coverity-model.c|qemu: scripts/coverity-model.c]]
+  * [[https://github.com/jpirko/qemu_rocker_bpf/blob/master/scripts/coverity-model.c|qemu_rocker_pbf: scripts/coverity-model.c]]
+  * [[https://github.com/Xilinx/xen/blob/master/misc/coverity/model.c|Xen: misc/coverity/model.c]]
+  * [[https://github.com/FFmpeg/FFmpeg/blob/master/tools/coverity.c|FFmpeg: tools/coverity.c]]
+  * [[https://github.com/apache/trafficserver/blob/master/ci/coverity-model.cpp|Apache Trafficserver: ci/coverity-model.cpp]]
+  * [[https://github.com/neovim/neovim/blob/master/src/coverity-model.c|NeoVim: src/coverity-model.c]]
+  * [[https://github.com/ghc/ghc/blob/master/utils/coverity/model.c|ghc: utils/coverity/model.c]]
+===== TODO =====
+==== TAILQ Macro model ====
-====== Using Coverity Prevent ======
+It seems that the TAILQ macros confuse Coverity. For example TAILQ_FIRST() seems to trigger a use after free error in //%%<%%list>.tqh_first// when entries are removed in a loop (loop by hand or with FOREACH). In particular, it does not recognize that TAILQ_REMOVE puts a new pointer in place and the pointer which previously aliases the tqh_first is not aliasing anymore, but is the only valid pointer.
-https://scan.coverity.com/ -> log in, sign up for the %%FreeBSD%% project
+Such cases should be marked as XXX (at the moment marked as IGNORE until we determine if it should be marked as a FALSE or if this should stay as IGNORE until a custom model is developed for this).
-===== Hints, Tips and Tricks =====
+TODO: Model for TAILQ macros added to Modelling File
-When you classified a valid problem, please search in [[https://bugs.freebsd.org/|Bugzilla]] or [[https://reviews.freebsd.org/|Phabricator]] for corresponding bug reports. Add the PR or DR number to the %%CoverityID%% and vice versa.
+==== UMA Model ====
-Stuff which is supposed to help in classifying errors to be added here, e.g. showing an example of stuff Coverity Prevent gets always wrong and how it should be classified.
+===== References =====
-  * It seems that the TAILQ macros confuse Coverity. For example TAILQ_FIRST() seems to trigger an use after free error in //%%<%%list>.tqh_first// when entries are removed in a loop (loop by hand or with FOREACH). In particular it does not recognize that TAILQ_REMOVE puts a new pointer in place an the pointer which previously aliases the tqh_first in not aliasing anymore but it's the only valid pointer. Such cases should be marked as XXX (ATM marked as IGNORE until I know if this should be marked as a FALSE or if this should stay as IGNORE until a custom model is developed for this). Anyone up to write a Coverity Prevent model for our TAILQ macros?
+  * [[https://devguide.python.org/coverity/|CPython DevGuide: Coverity]]
-===== Checker Reference =====
+===== Contact =====
-Once signed in, there is a [[https://scan6.coverity.com/doc/en/cov_checker_ref.html|Checker Reference]], should you want to give a hand in updating the behavior.
+Coverity Administrators:
-====== TODO ======
+  * KubilayKocak
-  * determine initial list of subsystems which need custom models (= with frequent false positives) and add them below (no owner)
+  * UlrichSpoerlein
-  * write custom models for:
+  * Email: <coverity-admin@FreeBSD.org>
-    * TAILQ macros (no owner)
-    * UMA (no owner)
 ----
-{{tag>Project}}
+{{tag>Services Security}}