Goto bad Spooktober tale: Counting goto in the Linux kernel

[RoGeorge]

Current version of the Linux kernel at https://www.kernel.org/ is 6.5.9, download and unpack:

Code: [Select]

    wget [url]https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.5.9.tar.xz[/url]
    tar -xvf linux-6.5.9.tar.xz

Count all lines

Code: [Select]

    find ./linux-6.5.9 -name '*.c' | xargs cat | wc -l
23174856 

Count the goto lines

Code: [Select]

    find ./linux-6.5.9 -name '*.c' | xargs cat | grep -c 'goto '
193266   

Save them in a file for further inspection

Code: [Select]

    find ./linux-6.5.9 -name '*.c' | xargs cat | grep 'goto ' > goto.txt
Most of them are for treating errors 

Counting again, without goto err/out/fail

Code: [Select]

    find ./linux-6.5.9 -name '*.c' | xargs cat | grep 'goto ' | egrep -vc 'goto err|goto out|goto fail'
73786 

[Siwastaja]

goto is a normal part of C and trying to avoid using it for political reasons leads to less readable spaghetti code. This is well known but some beginners still misunderstand some old tongue-in-cheek articles taken out of context.

Now for C++, amount of goto will be less as there are other ways for error handling (arguably better, arguably worse), but goto has its uses even in C++.

[DiTBho]

What's the point here?

The linux kernel is not a good reference neither about programming style, nor about how a kernel should be written.

Linux is a kernel developped in the 90s that practically "works", and it "works" because there are a lot of people who follow it and are willing to fix it, just look at how many interactions there are every time you go into regression.

Linux v6 stopped correctly booting on PPC-G4 and G5 PowerMacs, and dozens of messages have been raining into the mailing lists for 5 months every single day... and this is precisely the correlation between writing software with lots of gotos and that approach, or writing software with a completely different approach: the first difference you notice is the number of iterations necessary to solve a bug.

Linux is certainly not written well from this point of view as it barely passes the level DO178B level E, which I remind you must be read in terms of "software life cycle" and "resources necessary for development, maintenance and bug fixing". It does not practically matter for the final user, especially for mainstream platforms (x86, amd64, arm, arm64) due to the mechanism with which it is supported by large communities, but things change dramatically when you are alone developing something or solving a problem.

[DiTBho]

goto is a normal part of C and trying to avoid using it for political reasons leads to less readable spaghetti code. This is well known but some beginners still misunderstand some old tongue-in-cheek articles taken out of context.

 

I've never read anything so funny considering that it shows that it's quicker to write just any bullshit (political reasons ? LOL) than to waste time explaining things well: why waste time on a forum when the typical hourly Windirver consulting rate for DO178B/Level A is 100/hr at least? The fewer people know how to do it, the more opportunities you have to bring home wheelbarrows of gold.

[magic]

IMO by far the biggest problem with Linux code is very little documentation (which also suggests the distressing possibility that there may be very little design to it as well ).

It's like those assholes have never heard of comments.

Of course I can read the code and see what it does, but the problem is that usually I'm reading code because it's doing something it shouldn't be doing, and good luck guessing what's the intended operation of every little part and which of those parts is wrong.

I couldn't care less about goto.

[DiTBho]

IMO by far the biggest problem with Linux code is very little documentation (which also suggests the distressing possibility that there may be very little design to it as well ).

It's like those assholes have never heard of comments.

Of course I can read the code and see what it does, but the problem is that usually I'm reading code because it's doing something it shouldn't be doing, and good luck guessing what's the intended operation of every little part and which of those parts is wrong.

Yup, I often see people who don't understand why there are no comments in the code and have to ask and discuss.

It's another aspect of this approach to software.

[Karel]

Based on static analysis defect density, in the 2013 report, we found that open source code outpaced commercial code in quality.
This trend continues in 2014;


Defect density (defects per 1,000 lines of code) of open source code and commercial code has continued to improve since 2013:
When comparing overall defect density numbers between 2013 and 2014, the defect density of both open source code and commercial
code has continued to improve. Open source code defect density improved from 0.66 in 2013 to 0.61 in 2014,
while commercial code defect density improved from 0.77 to 0.76.


Linux continues to be a benchmark for open source quality. By leveraging the Scan service,
Linux has reduced the average time to fix a newly detected defect from 122 days to just 6 days.
Since the original Coverity Scan Report in 2008, scanned versions of Linux have consistently achieved
a defect density of less than 1.0. In 2013, Coverity scanned more than 8.5 million lines of Linux code
and found a defect density of .61


https://news.synopsys.com/2014-04-15-Coverity-Scan-Report-Finds-Open-Source-Software-Quality-Outpaces-Proprietary-Code-for-the-First-Time


https://news.synopsys.com/2015-07-29-Coverity-Scan-Open-Source-Report-Shows-Commercial-Code-Is-More-Compliant-to-Security-Standards-than-Open-Source-Code

[DiTBho]

I mysefl seen on IRC a hacker create from scratch all the support for the IP30 platform on his own around the 2.6.17 kernel, then he lost the interest and disappeared from the scene and it took more than 15 years!!! to understand what the hell he had done because his code was not only very cryptic and without any comment, but it was also very low level.

(not only gotos, also asm inlines, strange pointer arithmetic, and really bizarre things, all undocumented  )

It took us all this time because the IP30 is a very complex platform, there was/is little interest in the platform, and let's get back to the topic... Linux works when it is followed by many people.

[magic]

Article summary:

[viral clickbait title]

By regularly scanning Linux source code with our proprietary tool, we have reduced the number of bugs that our tool can find. Also, guys got fast fixing bug reports sent by us.

This is totally not an advertisement.
Click here to buy our tool.

[DiTBho]

Linux continues to be a benchmark for open source quality

What I see, and what this is probably about, is the new approach of automatic 'bots operating in parallel on BiSect to find the one which commit introduced the defect, every time we see a regression.

git| git| git| git| git| git| git| git| git| git| git| ... git
compile| compile| compile| compile| compile| compile| compile| compile| compile| compile| compile| ... compile
test| test| test| test| test| test| test| test| test| test| test| ... test|
report| report| report| report| report| report| report| report| report| report| report| ... report|
(a cluster of nodes, doing this, in parallel, each on a commit between point A and point B of the Git history, moving from A to B)

Yes, this helps. But this is not the point, also because the number of regressions is increasing.
Or do you mean that this "instrumental" approach is better?

[mikeselectricstuff]

I have no knowledge of Linux' internals & how goto is used, but..
The problem with the philosophical argument that "Goto == bad" is that the real world has error conditions. Dealing with scenarios where errors can occur at any stage in a long and convoluted process while trying to be neat and structured can be a nightmare, and make code far less understandable.
However multiple "If (error) go direcly to here because I don't care what happens after that but I do need to deal with it sanely" is reliable and understandable.

 

[Siwastaja]

I have no knowledge of Linux' internals & how goto is used, but..
The problem with the philosophical argument that "Goto == bad" is that the real work has error conditions. Dealing with scenarios where errors can occur at any stage in a long and convoluted process while trying to be neat and structured can be a nightmare, and make code far less understandable.
However multiple "If (error) go direcly to here because I don't care what happens after that but I do need to deal with it sanely" is reliable and understandable.

A quick example for those who are not familiar with the pattern:

Code: [Select]

int do_thing()
{
    turn_relay_on();
    if(!good_to_go)
    {
        turn_relay_off();
        return FAILURE_1;
    }

    if(asdf != 123)
    {
        turn_relay_off();
        return FAILURE_2;
    }

    do_rest_of_stuff();
    turn_relay_off();
    return SUCCESS;
}

vs.

Code: [Select]

int do_thing()
{
    int rc = FAILURE_TO_DESCRIBE_FAILURE;
    turn_relay_on();
    if(!good_to_go)
    {
        rc = FAILURE_1;
        goto DONE;
    }

    if(asdf != 123)
    {
        rc = FAILURE_2;
        goto DONE;
    }

    do_rest_of_stuff();
    rc = SUCCESS;

    DONE:
    turn_relay_off();
    return rc;
}

In latter case, one cannot accidentally forget to turn relay off when they add another error check. For this simple case, manual bookkeeping of restoring state is possible, but once you have to undo more than one thing in the opposite order, and how far you initialized (and thus, where to begin uninitializing) depends on error condition, gotos are very handy:

Code: [Select]

    init1();
    if(error) goto DEINIT1;
    init2();
    if(error) goto DEINIT2;
    init3();
    if(error) goto DEINIT3;

    DEINIT3: deinit3();
    DEINIT2: deinit2();
    DEINIT1: deinit1();

In C++, one is supposed to use the exception system for the same result. Building something similar on top of C would likely get into territory of overengineering. Goto is simple and clear, and labels are documentative.

[DiTBho]

the real work has error conditions. Dealing with scenarios where errors can occur at any stage in a long and convoluted process while trying to be neat and structured can be a nightmare, and make code far less understandable.
However multiple "If (error) go direcly to here because I don't care what happens after that but I do need to deal with it sanely" is reliable and understandable.

Yes, this is the only acceptable use with DO178B level from A to C, but if and only if you don't abuse and if you segregate the modules that use goto into in directory or with a prefix/suffix/whatever that at least makes it clear that it is necessary to analyze how any allocated resources are managed in the event of a jump to the point of failure.

All deallocated? partially deallocated can hide resource leackaging on goto error.
All ignored as the firmware is going to invoke panic() or reboot()?

The VxWorks kernel is a good example here, and you can use goto in this case even for your kernel drivers, if your gotos are properly documented for the attention of both the QA team and the testing squads.

Basically: does the module contain goto? If yes, it must also contain the proper documentation, point by point, as it will be properly inspected and tested. Abuses and neglects will be... punished with "code rejected".

Windriver's approach 

[Psi]

This reminds me of that language, what was it, the one that does not have a 'goto' command, and instead has the reverse. a 'come from' command.

That's right, it was C-INTERCAL

[SiliconWizard]

Of course people will keep blabbering about how goto is good while it has been flagged as very bad for decades. Mostly people not actually understanding what is bad about it and why we still use it in C, mostly for error handling, for lack of better constructs. Any other use of it in C *is* generally a very bad idea.

(Quick note: sorry to say that your "egrep -vc 'goto err|goto out|goto fail'" is not really evidence that goto is ever used for anything else than error handling in the Linux kernel code.)

Note that behind this common use case, error handling, the idea is to factor sections of code instead of making them redundant, which is arguably much worse.

There is a well known construct that happens to factor code just fine, and it's called a function. Yes, in many cases you can implement error handling more cleanly writing error handling functions rather than jumping up and down inside a function. With any modern compiler (I mean, younger than 25 years or so), it will even have a very minimal performance impact, if any. Except possibly in very tight loops, for which hand-optimizing further is warranted. You may argue that this approach is not really workable if the error handling part of a given function can have other paths than directly return from said function once the clean-up has been done. In which case, the idea of using goto with not just one code path (error handling/clean-up/return from function) but several is preciselyt what quickly becomes atrocious. The famous spaghetting syndrome.

Now of course, if you resort to a function, that means you'll have to pass some context around, which is not fun. We are lazy.

So with that said, do I still use goto in C on a regular basis for error handling? Yeah. Sure. But I know why I do. I don't do it just because it looks cool to be the programming kiddo that knows better, or to make YT videos with tens/hundreds of thousands of views. And, pointing out that there are other ways to skin the cat, often almost as efficient and much cleaner.

Also, I agree about the fact Linux is not a particularly good example of code style and code quality. But most of it at least looks like C written by people who have a good command of it, so that's already something.
It is, however and IMO, an example of particularly good project management, which is the number 1 reason, again IMO, for its success and longevity.

All in all, that's some kind of false debate that just keeps on going, as again it's used for lack of better constructs in C and similar languages. Not that I take it as an example, but since it's been pretty hyped in the past few years, has anyone heard of using "goto" in Rust? Why keep venting about it?

[floobydust]

In a computing science course assignment, used GOTO to bust out of a few nested levels of loops. I think was a Dykstra's shortest path algo.
Asked the prof and he said "no prob" GOTO is sometimes necessary and required, so it exists. So does BRA in assembler.
Like anything it can get abused but I haven't seen that since the days of BASIC, when people did not learn structured programming and could drift towards spaghetti using it. Anybody quickly learns how to code better after getting boxed in, creating a dog's breakfast.

Instead of demonizing necessary programming constructs, what about that old 1970 programming language that still is shit for buffer overruns and array indexes into lala land...

[Siwastaja]

So with that said, do I still use goto in C on a regular basis for error handling? Yeah. Sure. But I know why I do. I don't do it just because it looks cool

So does this imply you use other constructs, for example for loop, because it looks cool? If not, how does it make any sense to mention that goto is used for... a specific technical purpose, and possibly harmful for others? I mean, isn't that true for nearly every construct in nearly any language?

Same can be asked from DiTBho:

Basically: does the module contain goto? If yes, it must also contain the proper documentation, point by point, as it will be properly inspected and tested. Abuses and neglects will be... punished with "code rejected".

Wat? So if you do not use goto, but instead, for example, create a messed up if-else spaghetti, then there is no need for documentation, no inspections and no tests? Is this what you mean? If yes, I'm horrified. If no, and if documentation, tests and rationale for choices are needed in all cases, what do you mean by the above, it makes no sense to me.

"goto considered harmful" mindset seems to stick hard in some of us, to the point of requiring weird mental acrobatics and "oh I know how to use it, BUT..." type rationalizations. I find it hilarious. It's just one feature of the language amongst others, and specifically C is full of much more dangerous features than that. I mean, integer promotion related bugs is actually a "thing". No one knows a concept of "goto bugs".

[magic]

Wat? So if you do not use goto, but instead, for example, create a messed up if-else spaghetti, then there is no need for documentation, no inspections and no tests? Is this what you mean?

This is how government works, so I would expect some of this attitude to leak into government regulated industries too

[Siwastaja]

Wat? So if you do not use goto, but instead, for example, create a messed up if-else spaghetti, then there is no need for documentation, no inspections and no tests? Is this what you mean?

This is how government works, so I would expect some of this attitude to leak into government regulated industries too

It never stops amazing me how supposedly safety-critical fields (like aviation) are governed by practices like "using goto is forbidden, now your code passes as it does not use goto" (for example, about half of MISRA actually reduces code quality and increases risk of bugs, while another half might have a slight positive effect which hopefully compensates, for net zero end result). I'm so glad I don't have to work in such setting where using safety-increasing common sense (and known good practices from "standard commercial" software development) on the other hand has to be used so that I could sleep well, but on the other hand is made very difficult to use due to the red tape requiring more dangerous practices, so it's a fine balancing act between the regulations and actual safety.

[DiTBho]

GOTO to bust out of a few nested levels of loops.

oh sht

[DiTBho]

Wat? So if you do not use goto, but instead, for example, create a messed up if-else spaghetti, then there is no need for documentation, no inspections and no tests? Is this what you mean?

This is how government works, so I would expect some of this attitude to leak into government regulated industries too

It never stops amazing me how supposedly safety-critical fields (like aviation) is governed by practices like "using goto is forbidden, now your code passes as it does not use goto" (for example, about half of MISRA actually reduces code quality and increases risk of bugs, while another half might have a slight positive effect which hopefully compensates, for net zero end result). I'm so glad I don't have to work in such setting where using safety-increasing common sense (and known good practices from "standard commercial" software development) on the other hand has to be used so that I could sleep well, but on the other hand is made very difficult to use due to the red tape requiring more dangerous practices, so it's a fine balancing act between the regulations and actual safety.

yes, why don't you go and play with arduino? Do yourself a favor

[DiTBho]

Wat? So if you do not use goto, but instead, for example, create a messed up if-else spaghetti

then there is no need for documentation, no inspections and no tests?

cognitive problems?

Nobody said that! It's always under DO178B, therefore normal procedures are applied; I only underlined that is Windriver's approach to add an extra layer as the modules containing "goto" must be reported for further inspections, and there must be documented, otherwise the code won't pass.

edit: to be more clear. necessary condition, not sufficient!

This does not mean that there will not be the normal testreport vectors, on the contrary, it means that the testing team will have the opportunity to better understand how to test the various error cases, a typical situation in which gotos are used.

It also means that this type of test report cannot be assisted by A.I., as the comments are written in human language.

So, this approach also helps plan activities.

Note, that's very different from trying to ridicule what I wrote, as I said "goto" is accepted, and explained when it's accepted, and how it is managed.

I'm horrified

Perplexed. Like giving pearls to pigs.

[Siwastaja]

Nobody said that! It's always under DO178B, therefore normal procedures are applied; I only underlined that is Windriver's approach to add an extra layer as the modules containing "goto" must be reported for further inspections, and there must be documentation, otherwise the code won't pass.

Sounds like typical regulatory BS, the usual mischief that if you do X then you get extra chores so that practically you won't be doing X, even when doing X would be the best option, and then you do bullshit like add weird and complex temporary variables and their conditions in the loop termination definition just to avoid goto (and maybe break, too) and the related extra chores.

Maybe I'm too simple-minded, but I think best would be that all safety-critical code must go through the same level of scrutiny with the goal of proving the correctness as far as humanly possible. I fail to see what is so special in goto that it requires a complete separate extra process.

It also means that this type of test report cannot be assisted by A.I., as the comments are written in human language.

Quite sadly, ChatGPT is well capable of generating human language reasoning which sounds very convincing to managers. Probably the only way is to know your staff and only hire responsible, competent people who are proud of what they are doing. Having a system where usage of "goto" triggers another layer of red tape drives the culture to the opposite direction.

yes, why don't you go and play with arduino? Do yourself a favor

"go play with Arduino" - embedded engineers' way of saying "fuck you". I hear you

Quite typical - I'm discussing my concerns regarding safety regulations and their effectiveness, and what I get is an ad hominem attack. Fair enough, but don't forget - reality is on my side - arrogance and safety DON'T PLAY ALONG, this is the key finding during aircraft accident investigations in 1970's and 1980's that triggered design of cockpit resource management. We need similar thought patterns (allowing questions and disagreements, reasoning instead of name-calling) in safety critical engineering*, instead of calling those who disagree to fuck off.

*) which I have done, just on a field that was so new that it didn't have regulatory standardization at the time (and still probably does not) so went under much more generic set of regulations, prompting for own thinking.

[DiTBho]

"go play with Arduino" - embedded engineers' way of saying "fuck you". I hear you

If we have to be assholes, then what are your skills? last time you said that you deal with "home automation", yet up here you deliberately allowed yourself to distort what I wrote in order to insult, once again, an entire category of workers.

Quite sadly, ChatGPT is well capable of generating human language reasoning which sounds very convincing to managers. Probably the only way is to know your staff and only hire responsible, competent people who are proud of what they are doing. Having a system where usage of "goto" triggers another layer of red tape drives the culture to the opposite direction.

Oh SHT, again 

Do you even have the qualifications to shit in our shoes? ChatGPT is well capable ... I do not think so, and I don't even care, I'd sooner ignore you than waste any more time.

Quite typical - I'm discussing my concerns regarding safety regulations and their effectiveness

Ok, Quite typical, enjoy my ignore list, this time is permanent.

[Siwastaja]

Interesting how emotional some people can get over a simple language feature 

In any case, I don't recall insulting any workers, and despite re-reading my posts a few times, can't find anything that even remotely resembles that. Maybe some mental mixup between threads or something?

edit: oh shit, he meant I insulted the regulators. Being an engineering forum where we are usually not the ones to write the regulations, but to obey them, that perspective didn't pop to my mind, but maybe I was a bit harsh for those who make the rules. After all, rules are like words of God; they can't be disagreed with.