Michael Vogt
777d9c10ad
The fix in 8f1751a111 made me wonder if we could automatically detect
when pointers are accessed but when this might not be safe. Systemd
is already using a lot of `assert(dst)` and this change now forces
us to use them.
So this commit (ab)uses coccinelle to flag any pointer parameter
dereference not preceded by assert(param), ASSERT_PTR(param), or an
explicit NULL check. It adds integration into meson as a new "coccinelle"
test suite (just like clang-tidy) and is run in CI. The check is not
perfect but seems a reasonable heuristic.
For this RFC commit it is scoped to a subset, it excludes 25 dirs right
now and includes around 100. About 300 warnings left. Busywork that I am
happy to do if there is agreement that it is worth it.
With this in place we would have caught the bug from 8f1751a111 in CI:
```
FAIL: check-pointer-deref.cocci found issues in systemd/src/boot:
diff -u -p systemd/src/boot/measure.c /tmp/nothing/measure.c
--- systemd/src/boot/measure.c
+++ /tmp/nothing/measure.c
@@ -312,7 +312,6 @@ EFI_STATUS tpm_log_tagged_event(
if (err != EFI_SUCCESS)
return err;
- *ret_measured = true;
return EFI_SUCCESS;
}
```
This also adds a new POINTER_MAY_BE_NULL() for the cases when the
called function will do the NULL check (like `iovec_is_set()`).
96 lines
3.5 KiB
YAML
96 lines
3.5 KiB
YAML
---
|
|
# vi: ts=2 sw=2 et:
|
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
# https://github.com/marketplace/actions/super-linter
|
|
name: Lint Code Base
|
|
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
- v[0-9]+-stable
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
name: Lint Code Base
|
|
runs-on: ubuntu-24.04
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
steps:
|
|
- name: Repo checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
|
|
with:
|
|
# We need a full repo clone
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Lint Code Base
|
|
uses: super-linter/super-linter/slim@61abc07d755095a68f4987d1c2c3d1d64408f1f9
|
|
env:
|
|
DEFAULT_BRANCH: main
|
|
MULTI_STATUS: false
|
|
VALIDATE_ALL_CODEBASE: false
|
|
VALIDATE_GITHUB_ACTIONS: true
|
|
LINTER_RULES_PATH: .github/linters
|
|
GITHUB_ACTIONS_CONFIG_FILE: actionlint.yml
|
|
ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT: false
|
|
|
|
- uses: systemd/mkosi@66d51024b7149f40be4702e84275c936373ace97
|
|
|
|
- name: Check that tabs are not used in Python code
|
|
run: sh -c '! git grep -P "\\t" -- src/core/generate-bpf-delegate-configs.py src/boot/generate-hwids-section.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py'
|
|
|
|
- name: Build tools tree
|
|
run: |
|
|
tee mkosi/mkosi.local.conf <<EOF
|
|
[Build]
|
|
ToolsTreeDistribution=fedora
|
|
ToolsTreeRelease=rawhide
|
|
EOF
|
|
|
|
mkosi -f box -- true
|
|
|
|
- name: Run mypy
|
|
run: |
|
|
mkosi box -- mypy --version
|
|
mkosi box -- mypy src/core/generate-bpf-delegate-configs.py src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
|
|
|
|
- name: Run ruff format
|
|
run: |
|
|
mkosi box -- ruff --version
|
|
if ! mkosi box -- ruff format --check src/core/generate-bpf-delegate-configs.py src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
|
|
then
|
|
echo "Please run 'ruff format' on the above files or apply the diffs below manually"
|
|
mkosi box -- ruff format --check --quiet --diff src/core/generate-bpf-delegate-configs.py src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
|
|
fi
|
|
|
|
- name: Run ruff check
|
|
run: |
|
|
mkosi box -- ruff --version
|
|
mkosi box -- ruff check src/core/generate-bpf-delegate-configs.py src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
|
|
|
|
- name: Configure meson
|
|
run: mkosi box -- env CC=clang CXX=clang++ meson setup build
|
|
|
|
- name: Run clang-tidy
|
|
run: mkosi box -- meson test -C build --suite=clang-tidy --print-errorlogs --no-stdsplit --quiet
|
|
|
|
- name: Run coccinelle checks
|
|
run: mkosi box -- meson test -C build --suite=coccinelle --print-errorlogs --no-stdsplit
|
|
|
|
- name: Build with musl
|
|
run: |
|
|
mkosi box -- \
|
|
env \
|
|
CC=musl-gcc \
|
|
CXX=musl-gcc \
|
|
CFLAGS="-idirafter /usr/include" \
|
|
CXXFLAGS="-idirafter /usr/include" \
|
|
meson setup -Dlibc=musl -Ddbus-interfaces-dir=no musl
|
|
mkosi box -- ninja -C musl
|