Re: [Ksummit-discuss] coverity, static checking etc.

[Dave Jones <davej@redhat.com>]

On Fri, May 09, 2014 at 01:33:46PM -0700, Roland Dreier wrote:
 > On Fri, May 9, 2014 at 10:07 AM, Dave Jones <davej@redhat.com> wrote:
 > > Last year I had been doing the coverity scans on an almost daily basis
 > > for 2-3 months.  Now that we're a year in, I'd like to share some
 > > results, and show some of the more common trends and bug patterns that
 > > seem to pop up.
 > 
 > This probably doesn't add too much to the discussion, but as a
 > subsystem maintainer, I like having easy-to-run analysis tools (or
 > easily available scan results like coverity).  It seems to lead to
 > interesting patches from people who aren't really interested in the
 > subsystem but just trawl through scan results.
 > 
 > It's pretty cool getting fixes for subtle (but in retrospect obvious)
 > bugs from people who say "compile tested only because I have no
 > hardware."

I've been apprehensive about approving some of the people signing up
for coverity. There's been a large influx of people over the last few
months whose only prior kernel commits have been things like checkpatch
fixes. On one hand, it's great to see people wanting to progress beyond
that, but I know some maintainers have had a less than positive reaction
with getting crap patches based on coverity results. It's a tricky
balance, but I think for the most part my judgment is erring on the
right side of the approve/deny fence.

The one thing I can't wait for Coverity to implement is the ability
to say "bugs for this subsystem go to this mailing list".  At that point
the mails it sends out should be a lot more useful, and maintainers
themselves will be able to take action. (I know some people hate the
web UI, so this will hopefully appease them).

Most people have got a lot better at jumping on things as they get
introduced, which is great.  The stuff that sucks is the old reports
that have been in their database forever.  I've (along with several
other people) been periodically going through these trying to weed
out the real bugs from the false positive/intentionals.

I'll need to come up with some way to periodically send a bunch of
those to lists too.

	Dave