Static analysis of return code propagation
UD2.208 (Decroly) | Day 2 | 15:50 - 16:10 | Speakers: Asbjørn Sloth Tønnesen
Abstract
A journey of using sparse to statically analyze and detect cases where return codes are returned, and overruled within a driver before they are able to reach a generic subsystem API or user-space.
In 2024, while working on some flower patches for the Linux kernel, I stumbled upon a few bugs[1][2][3] in the qede driver.
As an example: A static int helper function could return a number of return codes, but the only caller just used it for a non-zero check, and if so always returns -EINVAL, regardless of the error code returned by the callee.
This class of errors seemed like a good candidate for static analysis. As these bugs had been around and undetected for a long time, I decided to take a stab at it.
Attachments
Speakers
Links
External Links
Notice: The placeholder video image is licensed under CC BY-SA 4.0. The original image can be found hereChanges made to the image are: Cropped the image to a new ratio, part of the image was cut off.