https://coverity.freebsd.org/

When you classified a valid problem, please search in GNATS for corresponding bug reports. Add the PR number to the CoverityID and vice versa.

Stuff which is supposed to help in classifying errors to be added here, e.g. showing an example of stuff Coverity Prevent gets always wrong and how it should be classified.

• It seems that the TAILQ macros confuse Coverity. For example TAILQ_FIRST() seems to trigger an use after free error in <list>.tqh_first when entries are removed in a loop (loop by hand or with FOREACH). In particular it does not recognize that TAILQ_REMOVE puts a new pointer in place an the pointer which previously aliases the tqh_first in not aliasing anymore but it's the only valid pointer. Such cases should be marked as XXX (ATM marked as IGNORE until I know if this should be marked as a FALSE or if this should stay as IGNORE until a custom model is developed for this). Anyone up to write a Coverity Prevent model for our TAILQ macros?

• process userland as well (no owner)
• determine initial list of subsystems which need custom models (= with frequent false positives) and add them below (no owner)
• write custom models for:
  • TAILQ macros (no owner)
  • UMA (no owner)
• find a way to search at least for words in error messages, this would allow to find all instances of frequent false positives much faster

(add here a list of CIDs that you are working on and their status)

If you have a problem with categorizing some CIDs you can ask the people in the following list. If you encounter a CID which is related to a subsystem listed below and you don't want to take care about it yourself, you can use this list and notify the corresponding people.

• sound/linuxulator related CIDs → netchild@FreeBSD.org
• net/netinet related CIDs → bms@FreeBSD.org

To register the access to the Coverity Prevent tool you have to run /usr/coverity/bin/coverity_signup on freefall. You will be asked to agree to a NDA. The NDA basically requires you to not copy&paste Coverity Prevent stuff and to add “Found by: Coverity Prevent” to the commit log, but read and interpret it yourself.